You didn't provide much context of the situation, but if you are a medical device manufacturer and have a Notified Body working with you for the CE-marking of your products, some NB's may require (their) auditing and/or certification of critical suppliers.
As for having a critical supplier without a quality system, that would violate any basic risk management concept; so don't confuse a quality system with a quality system STANDARD.