ISO 13485 Sec 7.4 - Supplier Selection, Evaluation and Re-evaluation

Haisoj Lesleh · May 6, 2011

Hello all,

Although I have spent many hours on these forums, this is my first time posting. So let me start by saying that it is truly amazing to have access to such great material from brilliant minds across the world!

And speaking of brilliant, I hope someone out there has the brain power to help me out with an ISO problem. My company is ISO 13485 certified. We just completed an audit, and the auditor found several minor nonconformities. In particular, he noted that "It was observed that the procedure for supplier qualification does not clearly define the criteria for supplier selection, evaluation and re-evaluation as well as what records are maintained to demonstrate conformance." He verbally explained to me that the root of our problem was that we were not qualifying companies who supply basic office materials, including our toilet paper (yes, I specifically asked) which, no doubt, can have a dramatic effect on quality throughout an organization and should be monitored accordingly :sarcasm:

.

Based on what I have seen in other posts, many experts would tell this auditor to go back to auditor school and take better notes this time. I would love tell him that, but I need to be able to back up my disagreement with substance based on the ISO 13485 standard itself. And the standard does require our company to evaluate and select suppliers (see section 7.4 of the ISO 13485:2003 text) - granted, the type and extent of control may vary, but there is no clause saying that SOME suppliers require essentially no control.

Even more problematic is the requirement to keep records of supplier evaluations (again, ALL suppliers as far as I can tell) and re-evaluations and any necessary actions. So if I buy toilet paper from Costco, then must I must maintain a record somewhere showing that I evaluated Costco and this supplier met our stringent toilet paper standards? And periodic re-evaluations of the ongoing toilet paper quality? Believe me, I really don't want to write up the product requirements in this case and evaluate them!

Any wisdom or insight experts can offer would be welcome. I would prefer to keep our quality requirements simple so that people will implement them in the places where it really matters. It seems like putting petty items like toilet paper onto the same plane as medical equipment is just begging for the employees to stop taking the quality requirements seriously.

harry · May 6, 2011

Welcome to the Cove.

I have 2 views on this:

1. The auditor was being sarcastic
My guess is that he expects to see some form of risk analysis being applied to the purchasing process. You justify why toilet paper suppliers do not need to be evaluated from a risk point of view (this is where sarcasm comes in). A simple ISO 9001 approach to purchasing seems to me to be inappropriate (too simple) for a medical related set-up.

2. Call their Certification Manager.
If you are sure of yourself, talk to their certification manager but I don't think an ISO 13485 auditor can be that shallow.

Haisoj Lesleh · May 6, 2011

Hi harry, many thanks for your speedy reply!

I would tend to agree with you, except that we discussed this at some length with the auditor. The toilet paper example was our attempt to show how absurd this could become, but the auditor stoically maintained we should evaluate Costco for supplying our TP. He even gave us a form for evaluating suppliers of office supplies, general services, and other products/services which would have a minimal (if any) impact on the final product. If he was being sarcastic, then he has an amazing poker face.

As I have thought about our company's response to the auditor over the past few days, I have considered a solution like the one you propose - namely, perform a risk analysis for several common office supplies/services to demonstrate that they will not pose a risk to the final product for the patients using our products. I like that concept very much and it would be feasible. However, I still wonder how to properly implement the ISO 13485 requirement to maintain records of supplier selection, evaluation and re-evaluations for suppliers like Costco and the donut shop down the street. It seems to me that the standard would still require a record of these things even if we have demonstrated that toilet paper and donuts pose a a low/zero risk to the final product.

But believe me, I would love to be wrong! In fact, I really hope you or someone else here in the forum can show me a simple way to get around this situation. Unfortunately, I am definitely not confident enough to call the auditor's supervisor until I can make good case for my view from the ISO 13485 standard itself. I still don't think he is right to insist on this requirement - but at the same time, I don't have a way to prove he is asking for something beyond the ISO 13485 standard.

harry · May 6, 2011

This is a good thread on the same subject - Evaluation of Medical Device Suppliers - Categories when Initially Evaluated

Sidney Vianna · May 6, 2011

Haisoj Lesleh said:
Any wisdom or insight experts can offer would be welcome.

The key issue is the term product. ISO 13485:2003 requires

The type and extent of control applied to the supplier and the purchased product shall be dependent upon the effect of the purchased product on subsequent product realization or the final product.

Product, in the context of the standard is INTENTED product.

ISO 9001:2008 said:
NOTE 1 In this International Standard, the term “product” only applies to
a) product intended for, or required by, a customer,
b) any intended output resulting from the product realization processes.

If you were a provider of janitorial services, the toilet paper would be part of the intended product. But you are a medical device manufacturer.

sagai · May 7, 2011

So if I buy toilet paper from Costco, then must I must maintain a record somewhere showing that I evaluated Costco and this supplier met our stringent toilet paper standards? And periodic re-evaluations of the ongoing toilet paper quality? Believe me, I really don't want to write up the product requirements in this case and evaluate them!

You do not have to.
I would recommend to have ISO/TR 14969:2004(E) and you will have a bit more insight what the words of the standards consider to.
in that case there are several guidances, one of them

7.4.3 3rd paragraph from ISO/TR 14969:2004(E)
This subclause does not imply that incoming product has to be inspected and tested by the organization.
Incoming inspection might not be required if the necessary confidence in the product can be obtained by other defined processes or procedures, particularly if the information given by a supplier is considered sufficient.

br
Sz.

somashekar · May 7, 2011

"It was observed that the procedure for supplier qualification does not clearly define the criteria for supplier selection, evaluation and re-evaluation as well as what records are maintained to demonstrate conformance."

Hi Haisoj, welcome here.
Now why did the auditor say the above .... ?
Was your procedure not having clarity ?
If that is the case then you, as user are not clear who what and when to evaulate and re-evaluate and what records can establish this activity. So get the procedure clear.
How ....
Have you catagorized supplier and the purchased products based on your product requirement and other requirement and established type and extent of control ... ?
See this:
Purchased products could be
Direct materials
Indirect materials
Direct consumables
Indirect consumables
Direct services
(all above apply to product realization and final product requirement. Keep them in your procedure and map the evaulation and re-evaluation responsibility, criteria and records)
Indirect services
Stationary and housekeeping materials ...
... and many more
(above do not apply to product realization and final product requirement. Keep them directly in the control of the buyer)

Where does the TP come ? Stationary and housekeeping materials OR Indirect consumables ?
Please note that TP can also be used in some places as an absorbent and use of TP can detriment any cleanroom conditions if used there. So how do you classify your TP as used ?
When your grouping gets clear and necessary controls established as in procedure, then you can demonstrate to yourself the evaluation; re-evaluation and controls and then to the auditor.

Records can be one or a combination of the following as applicable to your situation:
Supplier information database
Supplier visit and audit report
Supplier first parts inspection and acceptance report
Customer's recommendation.
Third party test and assessment of QMS and purchased product
Authorized representative of the OEM
Design department recommendation after part approval
User recommendation (typical for maintenance spares and services)
QMS certification ....
and many more

Re-evaluation criteria can be one or a combination of the following as applicable to your situation:
Long "no supply" period
Change in supplier management
Relocation of supplier to a new place
New processes introduced by the supplier
Periodic audit and report
Current and valid QMS certification
Alarming incoming and process rejections concerning to supplied parts
Supplier rating and decision on the rating for re-evaluation ...
... and many more

(Note that none are an annual affair and it is wrong to generally bind oneself with an annual re-evaluation procedure and fail in its implementation)

Haisoj Lesleh · May 9, 2011

Wow! Many thanks to all of you who posted above. All of you have brought to light very important facts. The definition of "product" is more precise than I had known, which clarifies the main point. And today I purchased ISO 14969 as per the recommendation above and it has already illuminated many points for me. :thanx:

Thank you in particular, somashekar, for your helpful analysis. You are quite right to ask why the minor nonconformity was raised in the first place. As some background, I am not actually the quality manager at our company. That position belongs to an engineer in our company who has not implemented ISO 13485 particularly well. I was roped in to fix a few (out of ten total) minor nonconformities arising from our audit because I am more familiar with the process than the quality guy. So all that to say, I am no expert but learning fast!

If possible, I would like to explore some aspects of this a little further to help me write a concise and useful procedure to comply with section 7.4.

somashekar said:
Hi Haisoj, welcome here.
How ....
Have you catagorized supplier and the purchased products based on your product requirement and other requirement and established type and extent of control ... ?
See this:
Purchased products could be
Direct materials
Indirect materials
Direct consumables
Indirect consumables
Direct services
(all above apply to product realization and final product requirement. Keep them in your procedure and map the evaulation and re-evaluation responsibility, criteria and records)
Indirect services
Stationary and housekeeping materials ...
... and many more
(above do not apply to product realization and final product requirement. Keep them directly in the control of the buyer)

That makes good sense, but could you clarify what you mean by "direct consumables" and "indirect consumables"? I think I understand direct materials (for an automobile, tires, steering wheels, etc?) and indirect materials (again, for an automobile, a calibration machine or some line equipment which allows the company to make cars). However, direct consumables and indirect consumables are not as clear to me.

Do you use these categories to establish the necessary type and extent of control to the product? And if so, do you define a specific procedure for each category or grouping? Or do you just list out specific requirements for each level, such as "Direct materials shall require at minimum ISO 9001 certification, an acceptable sample, and a physical audit" whereas "Indirect consumables shall require at minimum only one of the following: third-party certificate, acceptable sample, or customer requirement."

In other words, would each category of product purchased from suppliers have different criteria to use in selecting, evaluating, and re-evaluating suppliers?

somashekar said:
Where does the TP come ? Stationary and housekeeping materials OR Indirect consumables ?
Please note that TP can also be used in some places as an absorbent and use of TP can detriment any cleanroom conditions if used there. So how do you classify your TP as used ?
When your grouping gets clear and necessary controls established as in procedure, then you can demonstrate to yourself the evaluation; re-evaluation and controls and then to the auditor.

Your point is well taken. IF we were to use the TP for some purpose that could affect the safety of the final product (i.e. in a cleanroom), then we need to apply an appropriate measure of control documented in a procedure.

Finally, am I correct to think that engineering/R&D would typically establish the necessary controls for a product? Since they define the technical requirements and are in the best position to know how a failure would affect the final product, it seems like they should define the necessary controls, but I am curious to know how an experience quality guru would interact with that question.

somashekar · May 10, 2011

Haisoj Lesleh said:
Wow! Many thanks to all of you who posted above. All of you have brought to light very important facts. The definition of "product" is more precise than I had known, which clarifies the main point. And today I purchased ISO 14969 as per the recommendation above and it has already illuminated many points for me.

Thank you in particular, somashekar, for your helpful analysis. You are quite right to ask why the minor nonconformity was raised in the first place. As some background, I am not actually the quality manager at our company. That position belongs to an engineer in our company who has not implemented ISO 13485 particularly well. I was roped in to fix a few (out of ten total) minor nonconformities arising from our audit because I am more familiar with the process than the quality guy. So all that to say, I am no expert but learning fast!

If possible, I would like to explore some aspects of this a little further to help me write a concise and useful procedure to comply with section 7.4.

That makes good sense, but could you clarify what you mean by "direct consumables" and "indirect consumables"? I think I understand direct materials (for an automobile, tires, steering wheels, etc?) and indirect materials (again, for an automobile, a calibration machine or some line equipment which allows the company to make cars). However, direct consumables and indirect consumables are not as clear to me.

Do you use these categories to establish the necessary type and extent of control to the product? And if so, do you define a specific procedure for each category or grouping? Or do you just list out specific requirements for each level, such as "Direct materials shall require at minimum ISO 9001 certification, an acceptable sample, and a physical audit" whereas "Indirect consumables shall require at minimum only one of the following: third-party certificate, acceptable sample, or customer requirement."

In other words, would each category of product purchased from suppliers have different criteria to use in selecting, evaluating, and re-evaluating suppliers?

Your point is well taken. IF we were to use the TP for some purpose that could affect the safety of the final product (i.e. in a cleanroom), then we need to apply an appropriate measure of control documented in a procedure.

Finally, am I correct to think that engineering/R&D would typically establish the necessary controls for a product? Since they define the technical requirements and are in the best position to know how a failure would affect the final product, it seems like they should define the necessary controls, but I am curious to know how an experience quality guru would interact with that question.

"direct consumables" = I use a small drop of medical grade loctite in my assembly of medical device sensor. I have no measure of this but it is controlled in my dispensing process with a specific needle size, which is validated. It goes into the product
"indirect consumables" = I use a specific hydraulic oil in the press which is used to mould my optic devices used in the medical sensor. It does not go into the product.
As I said before the controls can be one or a combination of few. For an actual part, I can demonstrate what controls are exercised in my QMS.
Yes, R&D have a great level of inputs into it, and more so because some of the parts are also governed by the approved safety report from the 3rd party test house which captures the various make and type of components used. This gets reflected into the bill of material.
Ex; R&D control for a MOSFET : xyz make and type abc123
Purchase control : Authorized distributor or representative of the xyz make

PE-2011 · May 10, 2011

Excellent answer Mr.Somashekar. :agree:

ISO 13485 Sec 7.4 - Supplier Selection, Evaluation and Re-evaluation

Haisoj Lesleh

harry

Haisoj Lesleh

harry

Sidney Vianna

Post Responsibly

sagai

Quite Involved in Discussions

somashekar

Haisoj Lesleh

somashekar

PE-2011

Similar threads