What a Notified Body expects to see in a Supplier/Quality Agreement

Good Afternoon, is anyone aware of a guidance document that specifies the types of things (minimum requirements) a Notified Body expects to see in a Supplier Quality Agreement. We will be subcontracting our manufacturing processes to a newly started company who is not yet ISO13485 certified. We will receive/inspect all raw materials and kit the work order to them, they will manufacture and we will send out for EO sterilization and do final inspection and distribution. Our registrar wants to audit their operations and I want to make sure our SQA with them is robust. I am covering all aspects of the QMS in the SQA but wanted to know if their are any published guidance docs? Thank you.

Re: Supplier/Quality Agreement

I do not believe there are specific requirements. It should have appropriate approvals, periodic review and updates specifically stated in the agreement. In other words, who needs to approve the agreement, when will it be reviweed and when should it be updated (change in process for example). The closest you will get is the following statement:

"Manufacturer must establish an appropriate mix of assessment and receiving acceptance to ensure products and services are acceptable for their intended uses."

Hope that helps.

BostonQP said:

Good Afternoon, is anyone aware of a guidance document that specifies the types of things (minimum requirements) a Notified Body expects to see in a Supplier Quality Agreement. We will be subcontracting our manufacturing processes to a newly started company who is not yet ISO13485 certified. We will receive/inspect all raw materials and kit the work order to them, they will manufacture and we will send out for EO sterilization and do final inspection and distribution. Our registrar wants to audit their operations and I want to make sure our SQA with them is robust. I am covering all aspects of the QMS in the SQA but wanted to know if their are any published guidance docs? Thank you.

Click to expand...

I know I'm not going to answer your query, but for what it's worth:

I think that subcontracting to a newly established company (is it also a newly established operation, or just a new business entity?), not certified to ISO 13485 (are they compliant with any equivalent, e.g. part 820?), could be quite risky; especially when to-be-sterile products are concerned. You should be extra cautious. As a minimum, include in the agreement a clause that discusses in detail the ability and the ways for your CB to audit the subcontractor's QMS, premises and operations.

Cheers,
Ronen.

BostonQP said:

Good Afternoon, is anyone aware of a guidance document that specifies the types of things (minimum requirements) a Notified Body expects to see in a Supplier Quality Agreement. We will be subcontracting our manufacturing processes to a newly started company who is not yet ISO13485 certified. We will receive/inspect all raw materials and kit the work order to them, they will manufacture and we will send out for EO sterilization and do final inspection and distribution. Our registrar wants to audit their operations and I want to make sure our SQA with them is robust. I am covering all aspects of the QMS in the SQA but wanted to know if their are any published guidance docs? Thank you.

Click to expand...

As this is in the medical devices QMS sub forum, I read your subject line replacing NB with CB as it must be the ISO13485 CB (Certification body) and not NB (Notified body) which concerns to EU CE mark regulations. Correct me if wrong.
This is more about controls exercised over the outsourced process, and typically in your case as the complete manufacturing is going to given there, a good QMS in operation itself is one big control, preferably the ISO13485.
This must be stated in your SQA. Also explore the possibility if your CB can audit the newly started company to ISO13485, along the same time as your's. Same CB reduces a lot of varience in your business association.
Also note to include in the SQA, the newly started company's willingness to be audited by you or your CB, or any other third party as decided by you during your business term.

Thank you everyone for your comments. Yes Somashekar you are correct, it is our certified body (who also happens to be our notified body) that is requiring that they audit the new company. I have language in the SQA about us and the CB auditing them twice per year if requested.

Meddev 2.5/3 will offer a little guidance http://www.meddev.info/_documents/2_5-3____06-1998.pdf
ZLG in Germany has published a guidance document, that takes into account different set ups for outsourcing, section 5 contains recommendation for what is expected in the quality agreement. http://www.tuvps.co.uk/uploads/images/1281516789545136220477/ZLG%20EKmed_309_0607_B16EN%20Certification%20of%20OEM%20Devices.pdf

Thank you...this was very helpful!

Rocke's post is interesting and certainly relevent, although I would caution you with the http://www.tuvps.co.uk/uploads/imag...9_0607_B16EN Certification of OEM Devices.pdf as it relates specifically to OEM devices which isn't applicable to you.

The reason for your NB requiring an audit of your sub contractor is because it does not hold 13485 certification or (I'm guessing) 9001. They therefore have concerns about the quality of the product you receive.


Your supply agreement must be robust enough to control the quality of the product. It should contain all the requirements you would expect to be carried out by the supplier. At the very least it should cover

• validation and verification of processes and machinery
• training/competence requirements for staff
• traceability and record control of all appropriate activities, including training, batches etc.
• Calibration requirements
• handling of non-conforming product

That's even before you go down the actual requirements for the product!

It may be worth going through ISO 13485 and covering each requirement, ask yourself...Is this something the supplier should be doing to ensure the quality of my product? if it is, include a requirement for it in your agreement.

If you were working with a company with ISO 13485 and probably 9001, you could assume a lot of this and just require the continual renewal of QMS certification, your NB wouldn't have to audit them either!


One question....you say that you arrange the sterilisation, do you or the customer do the packaging prior to sterilisation? If they package the devices for you, they are still part of the sterilisation process.

I would recommend taking a look at NBOG 2010-1 Appendix 2. The guidance document is available at http://www.nbog.eu/2.html

I can't say for certain that every notified body is following this, but I think it is still good guidance. German notified bodies are contractually bound by their designating authority (ZLG) to comply to this document.