Medical device manufacturers saw an increase in 2013 in the number FDA-483 observations that cite inadequate supplier controls. Poor supplier control is one of the top five most common 483 citations for devicemakers, and is an issue that has been gaining steam with FDA investigators and EMA inspectors for years.
In 2010, 84 FDA-483 citations for poor supplier controls were issued; this increased to 98 citations in 2011, then 110 in 2012, and then 2013 saw 126 FDA-483 observations of supplier control deficiencies. Part of this reflects the growing outsourcing trend among devicemakers, and part of this reflects FDA’s growing realization of how poorly purchasing controls are understood and followed.
With the FDA continuing to increase scrutiny on the issue, devicemakers need to sharpen their focus on supplier controls and on their documentation of supplier management activities, said John Avellanet, Managing Director and Principal Consultant of Cerulean Associates LLC. Mr. Avellanet was speaking at an FDAnews supplier control event in February 2014.
In developing supplier oversight plans, companies can choose to either draw up separate plans for each supplier or an overall framework plan with additional elements – such as more specific contractual terms, quality agreements, and specific quality thresholds – that allow the tailoring of supplier controls to different suppliers based on risk and criticality.
Companies should define and list specific metrics and parameters, preferably within the quality agreement. One place to start might be with some of the metrics proposed by the ISPE (even though those metrics are intended for pharmaceutical firms).
“If we think in terms of an overall program, one example metric that might apply to nearly all suppliers is the timing of delivery to our dock. Does it show up on time? For service suppliers such as consultants, is the project on time and on budget?” Avellanet said. For more critical vendors, a devicemaker might want to track the percentage of delivered material showing up on their dock as still sterile or within a proper temperature range.
Have a Supplier Qualification Plan
Medical device firms also need a plan for qualifying their suppliers, and not just the critical vendors. “Always remember, consultants are suppliers,” said Avellanet. “FDA loves to find that people haven’t gone off and qualified their consultants.” Mr. Avellanet then provided a step-by-step example of how to qualify a consultant as a supplier.
A written procedure is also needed to disqualify suppliers, said Avellanet. “The procedure should be based on your qualifying process, but just in reverse, and should updating the approved vendor list, creating a disqualified vendor list, and making sure any CAPA investigation references this shift into disqualification status.”
While FDA investigators will assess the supplier controls of devicemakers by asking directly about purchasing controls and their supplier control SOPs, FDA will also check the effectiveness of supplier controls through three indirect pathways:
- CAPA reviews, in which FDA looks for CAPAs associated with suppliers
- Recall and MDR record reviews, in which FDA investigators want to know how suppliers were involved
- Production controls, in which FDA reviews 10 or less production-related SOPs to find what activities are outsourced (such as warehousing, contract sterilization, and so on).
Any supplier-associated item will then lead the FDA investigator to review a firm’s supplier control SOPs and the records showing proof of effective oversight and monitoring. “Be aware,” said Avellanet, “that a red flag for both FDA and EMA inspectors are supplier control SOPs that are not cross-functional. It’s simply not possible in this day and age to have one group and one group only handle all the aspects of supplier control, from selection to qualification, onsite auditing, ongoing monitoring and re-evaluation.”
Using an Inspection Proof Binder
Cerulean’s Mr. Avellanet advises devicemakers to add their list of approved vendors, their list of conditional vendors, their list of disqualified vendors (if any), and a supplier control program overview document to their inspection proof binder.
Ideally, the supplier control overview document would include a one page flowchart tracing the flow of supplier controls, from the moment when the company decided it needed a supplier all the way through to the time when the company no longer uses the supplier, said Avellanet.
“You’d have five or six boxes connected by flow arrows on the sheet of paper, where each box would represent an individual SOP that generates a particular form or report,” he explained. The flowchart would be very high level. “It’s just intended to give anyone a quick, 30-second overview of your controls,” he added.
As an easy first step in preparing for an FDA or ISO or EMA inspection, medical device firms should compile a list of all their high-risk, critical suppliers and then create a vendor dossier for each.
“Obviously, in an ideal world, you’d have vendor dossiers for every supplier, but you’ve got to start somewhere,” Avellanet said, noting that companies should also have an SOP for creating and maintaining vendor dossiers. Firms can then conduct internal audits against the records within those dossiers to ensure consistency and compliance.
Adapted for the web from the original April 2014 publication in FDAnews’ Devices & Diagnostics Letter.