SBS - The best value in QMS software

ISO 13485 Sec 7.4 - Supplier Selection, Evaluation and Re-evaluation

H

Haisoj Lesleh

#1
Hello all,

Although I have spent many hours on these forums, this is my first time posting. So let me start by saying that it is truly amazing to have access to such great material from brilliant minds across the world!

And speaking of brilliant, I hope someone out there has the brain power to help me out with an ISO problem. My company is ISO 13485 certified. We just completed an audit, and the auditor found several minor nonconformities. In particular, he noted that "It was observed that the procedure for supplier qualification does not clearly define the criteria for supplier selection, evaluation and re-evaluation as well as what records are maintained to demonstrate conformance." He verbally explained to me that the root of our problem was that we were not qualifying companies who supply basic office materials, including our toilet paper (yes, I specifically asked) which, no doubt, can have a dramatic effect on quality throughout an organization and should be monitored accordingly :sarcasm:.

Based on what I have seen in other posts, many experts would tell this auditor to go back to auditor school and take better notes this time. I would love tell him that, but I need to be able to back up my disagreement with substance based on the ISO 13485 standard itself. And the standard does require our company to evaluate and select suppliers (see section 7.4 of the ISO 13485:2003 text) - granted, the type and extent of control may vary, but there is no clause saying that SOME suppliers require essentially no control.

Even more problematic is the requirement to keep records of supplier evaluations (again, ALL suppliers as far as I can tell) and re-evaluations and any necessary actions. So if I buy toilet paper from Costco, then must I must maintain a record somewhere showing that I evaluated Costco and this supplier met our stringent toilet paper standards? And periodic re-evaluations of the ongoing toilet paper quality? Believe me, I really don't want to write up the product requirements in this case and evaluate them!

Any wisdom or insight experts can offer would be welcome. I would prefer to keep our quality requirements simple so that people will implement them in the places where it really matters. It seems like putting petty items like toilet paper onto the same plane as medical equipment is just begging for the employees to stop taking the quality requirements seriously.
 
Elsmar Forum Sponsor

harry

Super Moderator
#2
Welcome to the Cove.

I have 2 views on this:

1. The auditor was being sarcastic
My guess is that he expects to see some form of risk analysis being applied to the purchasing process. You justify why toilet paper suppliers do not need to be evaluated from a risk point of view (this is where sarcasm comes in). A simple ISO 9001 approach to purchasing seems to me to be inappropriate (too simple) for a medical related set-up.

2. Call their Certification Manager.
If you are sure of yourself, talk to their certification manager but I don't think an ISO 13485 auditor can be that shallow.
 
H

Haisoj Lesleh

#3
Hi harry, many thanks for your speedy reply!

I would tend to agree with you, except that we discussed this at some length with the auditor. The toilet paper example was our attempt to show how absurd this could become, but the auditor stoically maintained we should evaluate Costco for supplying our TP. He even gave us a form for evaluating suppliers of office supplies, general services, and other products/services which would have a minimal (if any) impact on the final product. If he was being sarcastic, then he has an amazing poker face.

As I have thought about our company's response to the auditor over the past few days, I have considered a solution like the one you propose - namely, perform a risk analysis for several common office supplies/services to demonstrate that they will not pose a risk to the final product for the patients using our products. I like that concept very much and it would be feasible. However, I still wonder how to properly implement the ISO 13485 requirement to maintain records of supplier selection, evaluation and re-evaluations for suppliers like Costco and the donut shop down the street. It seems to me that the standard would still require a record of these things even if we have demonstrated that toilet paper and donuts pose a a low/zero risk to the final product.

But believe me, I would love to be wrong! In fact, I really hope you or someone else here in the forum can show me a simple way to get around this situation. Unfortunately, I am definitely not confident enough to call the auditor's supervisor until I can make good case for my view from the ISO 13485 standard itself. I still don't think he is right to insist on this requirement - but at the same time, I don't have a way to prove he is asking for something beyond the ISO 13485 standard.
 

Sidney Vianna

Post Responsibly
Staff member
Admin
#5
Any wisdom or insight experts can offer would be welcome.
The key issue is the term product. ISO 13485:2003 requires
The type and extent of control applied to the supplier and the purchased product shall be dependent upon the effect of the purchased product on subsequent product realization or the final product.
Product, in the context of the standard is INTENTED product.
ISO 9001:2008 said:
NOTE 1 In this International Standard, the term “product” only applies to
a) product intended for, or required by, a customer,
b) any intended output resulting from the product realization processes.
If you were a provider of janitorial services, the toilet paper would be part of the intended product. But you are a medical device manufacturer.
 

sagai

Quite Involved in Discussions
#6
So if I buy toilet paper from Costco, then must I must maintain a record somewhere showing that I evaluated Costco and this supplier met our stringent toilet paper standards? And periodic re-evaluations of the ongoing toilet paper quality? Believe me, I really don't want to write up the product requirements in this case and evaluate them!
You do not have to.
I would recommend to have ISO/TR 14969:2004(E) and you will have a bit more insight what the words of the standards consider to.
in that case there are several guidances, one of them
7.4.3 3rd paragraph from ISO/TR 14969:2004(E)
This subclause does not imply that incoming product has to be inspected and tested by the organization.
Incoming inspection might not be required if the necessary confidence in the product can be obtained by other defined processes or procedures, particularly if the information given by a supplier is considered sufficient.
br
Sz.
 

somashekar

Staff member
Super Moderator
#7
"It was observed that the procedure for supplier qualification does not clearly define the criteria for supplier selection, evaluation and re-evaluation as well as what records are maintained to demonstrate conformance."
Hi Haisoj, welcome here.
Now why did the auditor say the above .... ?
Was your procedure not having clarity ?
If that is the case then you, as user are not clear who what and when to evaulate and re-evaluate and what records can establish this activity. So get the procedure clear.
How ....
Have you catagorized supplier and the purchased products based on your product requirement and other requirement and established type and extent of control ... ?
See this:
Purchased products could be
Direct materials
Indirect materials
Direct consumables
Indirect consumables
Direct services
(all above apply to product realization and final product requirement. Keep them in your procedure and map the evaulation and re-evaluation responsibility, criteria and records)
Indirect services
Stationary and housekeeping materials ...
... and many more
(above do not apply to product realization and final product requirement. Keep them directly in the control of the buyer)

Where does the TP come ? Stationary and housekeeping materials OR Indirect consumables ?
Please note that TP can also be used in some places as an absorbent and use of TP can detriment any cleanroom conditions if used there. So how do you classify your TP as used ?
When your grouping gets clear and necessary controls established as in procedure, then you can demonstrate to yourself the evaluation; re-evaluation and controls and then to the auditor.

Records can be one or a combination of the following as applicable to your situation:
Supplier information database
Supplier visit and audit report
Supplier first parts inspection and acceptance report
Customer's recommendation.
Third party test and assessment of QMS and purchased product
Authorized representative of the OEM
Design department recommendation after part approval
User recommendation (typical for maintenance spares and services)
QMS certification ....
and many more

Re-evaluation criteria can be one or a combination of the following as applicable to your situation:
Long "no supply" period
Change in supplier management
Relocation of supplier to a new place
New processes introduced by the supplier
Periodic audit and report
Current and valid QMS certification
Alarming incoming and process rejections concerning to supplied parts
Supplier rating and decision on the rating for re-evaluation ...
... and many more

(Note that none are an annual affair and it is wrong to generally bind oneself with an annual re-evaluation procedure and fail in its implementation)
 
Last edited:
H

Haisoj Lesleh

#8
Wow! Many thanks to all of you who posted above. All of you have brought to light very important facts. The definition of "product" is more precise than I had known, which clarifies the main point. And today I purchased ISO 14969 as per the recommendation above and it has already illuminated many points for me. :thanx:

Thank you in particular, somashekar, for your helpful analysis. You are quite right to ask why the minor nonconformity was raised in the first place. As some background, I am not actually the quality manager at our company. That position belongs to an engineer in our company who has not implemented ISO 13485 particularly well. I was roped in to fix a few (out of ten total) minor nonconformities arising from our audit because I am more familiar with the process than the quality guy. So all that to say, I am no expert but learning fast!

If possible, I would like to explore some aspects of this a little further to help me write a concise and useful procedure to comply with section 7.4.

Hi Haisoj, welcome here.
How ....
Have you catagorized supplier and the purchased products based on your product requirement and other requirement and established type and extent of control ... ?
See this:
Purchased products could be
Direct materials
Indirect materials
Direct consumables
Indirect consumables
Direct services
(all above apply to product realization and final product requirement. Keep them in your procedure and map the evaulation and re-evaluation responsibility, criteria and records)
Indirect services
Stationary and housekeeping materials ...
... and many more
(above do not apply to product realization and final product requirement. Keep them directly in the control of the buyer)
That makes good sense, but could you clarify what you mean by "direct consumables" and "indirect consumables"? I think I understand direct materials (for an automobile, tires, steering wheels, etc?) and indirect materials (again, for an automobile, a calibration machine or some line equipment which allows the company to make cars). However, direct consumables and indirect consumables are not as clear to me.

Do you use these categories to establish the necessary type and extent of control to the product? And if so, do you define a specific procedure for each category or grouping? Or do you just list out specific requirements for each level, such as "Direct materials shall require at minimum ISO 9001 certification, an acceptable sample, and a physical audit" whereas "Indirect consumables shall require at minimum only one of the following: third-party certificate, acceptable sample, or customer requirement."

In other words, would each category of product purchased from suppliers have different criteria to use in selecting, evaluating, and re-evaluating suppliers?

Where does the TP come ? Stationary and housekeeping materials OR Indirect consumables ?
Please note that TP can also be used in some places as an absorbent and use of TP can detriment any cleanroom conditions if used there. So how do you classify your TP as used ?
When your grouping gets clear and necessary controls established as in procedure, then you can demonstrate to yourself the evaluation; re-evaluation and controls and then to the auditor.
Your point is well taken. IF we were to use the TP for some purpose that could affect the safety of the final product (i.e. in a cleanroom), then we need to apply an appropriate measure of control documented in a procedure.

Finally, am I correct to think that engineering/R&D would typically establish the necessary controls for a product? Since they define the technical requirements and are in the best position to know how a failure would affect the final product, it seems like they should define the necessary controls, but I am curious to know how an experience quality guru would interact with that question.
 

somashekar

Staff member
Super Moderator
#9
Wow! Many thanks to all of you who posted above. All of you have brought to light very important facts. The definition of "product" is more precise than I had known, which clarifies the main point. And today I purchased ISO 14969 as per the recommendation above and it has already illuminated many points for me. :thanx:

Thank you in particular, somashekar, for your helpful analysis. You are quite right to ask why the minor nonconformity was raised in the first place. As some background, I am not actually the quality manager at our company. That position belongs to an engineer in our company who has not implemented ISO 13485 particularly well. I was roped in to fix a few (out of ten total) minor nonconformities arising from our audit because I am more familiar with the process than the quality guy. So all that to say, I am no expert but learning fast!

If possible, I would like to explore some aspects of this a little further to help me write a concise and useful procedure to comply with section 7.4.



That makes good sense, but could you clarify what you mean by "direct consumables" and "indirect consumables"? I think I understand direct materials (for an automobile, tires, steering wheels, etc?) and indirect materials (again, for an automobile, a calibration machine or some line equipment which allows the company to make cars). However, direct consumables and indirect consumables are not as clear to me.

Do you use these categories to establish the necessary type and extent of control to the product? And if so, do you define a specific procedure for each category or grouping? Or do you just list out specific requirements for each level, such as "Direct materials shall require at minimum ISO 9001 certification, an acceptable sample, and a physical audit" whereas "Indirect consumables shall require at minimum only one of the following: third-party certificate, acceptable sample, or customer requirement."

In other words, would each category of product purchased from suppliers have different criteria to use in selecting, evaluating, and re-evaluating suppliers?



Your point is well taken. IF we were to use the TP for some purpose that could affect the safety of the final product (i.e. in a cleanroom), then we need to apply an appropriate measure of control documented in a procedure.

Finally, am I correct to think that engineering/R&D would typically establish the necessary controls for a product? Since they define the technical requirements and are in the best position to know how a failure would affect the final product, it seems like they should define the necessary controls, but I am curious to know how an experience quality guru would interact with that question.
"direct consumables" = I use a small drop of medical grade loctite in my assembly of medical device sensor. I have no measure of this but it is controlled in my dispensing process with a specific needle size, which is validated. It goes into the product
"indirect consumables" = I use a specific hydraulic oil in the press which is used to mould my optic devices used in the medical sensor. It does not go into the product.
As I said before the controls can be one or a combination of few. For an actual part, I can demonstrate what controls are exercised in my QMS.
Yes, R&D have a great level of inputs into it, and more so because some of the parts are also governed by the approved safety report from the 3rd party test house which captures the various make and type of components used. This gets reflected into the bill of material.
Ex; R&D control for a MOSFET : xyz make and type abc123
Purchase control : Authorized distributor or representative of the xyz make
 
Thread starter Similar threads Forum Replies Date
D ISO: 13485:2016 Sec. 7.5.2 (C) - Requirements for cleanliness of product or contamination control ISO 13485:2016 - Medical Device Quality Management Systems 2
Q What is the difference between MDD Annex II, Sec 3 and ISO 13485 ? ISO 13485:2016 - Medical Device Quality Management Systems 5
D ISO 14971 applicability in ISO 13485 ISO 13485:2016 - Medical Device Quality Management Systems 7
E ISO 13485 in Clinical Trial conduct: Applicable or No ISO 13485:2016 - Medical Device Quality Management Systems 2
G ISO 13485 Certification - Can we get the ISO 13485 certification prior to shipment of the device? ISO 13485:2016 - Medical Device Quality Management Systems 6
N Does anyone use SGS for ISO 13485 / CE certification Registrars and Notified Bodies 0
Ed Panek ISO 13485:2016 Section 5.5.3 ISO 13485:2016 - Medical Device Quality Management Systems 3
ebrahim QMS as per ISO 13485, Clause 4.2 Requirements for regulatory purposes for Medical Devices Authorized Representatives. ISO 13485:2016 - Medical Device Quality Management Systems 3
D ISO 13485 scope (implantable) - Polymers for dental application EU Medical Device Regulations 9
N ISO 13485 7.3.9 Change control in medical device software ISO 13485:2016 - Medical Device Quality Management Systems 6
A ISO 13485 procedure change and reflect to legacy manufacture items ISO 13485:2016 - Medical Device Quality Management Systems 2
D ISO 13485 & CE Certification for Surgical Gloves CE Marking (Conformité Européene) / CB Scheme 0
S Inventory Listing and ISO 13485:2016 ISO 13485:2016 - Medical Device Quality Management Systems 3
M ISO 13485:2016 Certification Scope ISO 13485:2016 - Medical Device Quality Management Systems 3
D Reports under change management | ISO 13485:2016 & ISO 9001:2015 ISO 13485:2016 - Medical Device Quality Management Systems 3
M Scope for ISO 13485 Certification of a Translation Service Provider ISO 13485:2016 - Medical Device Quality Management Systems 17
Q ISO 13485 7.5.6 Validation - Off the shelf Software ISO 13485:2016 - Medical Device Quality Management Systems 3
A ISO 13485 Certification for Resin Manufacturer ISO 13485:2016 - Medical Device Quality Management Systems 4
A ISO 13485 Sterilization Clause Applicability ISO 13485:2016 - Medical Device Quality Management Systems 7
K ISO 13485 and compliance of electronic signature ISO 13485:2016 - Medical Device Quality Management Systems 5
T ISO 13485 - Assembly instructions written vs. online ISO 13485:2016 - Medical Device Quality Management Systems 5
M ISO 13485:2016 internal audit checklist Medical Device and FDA Regulations and Standards News 5
N 93/42/EEC certification without ISO 13485 EU Medical Device Regulations 3
M How Specific in an ISO 13485:2016 Scope for a Contract Manufacturer ISO 13485:2016 - Medical Device Quality Management Systems 9
A ISO 13485 for Class 1 Medical Device ISO 13485:2016 - Medical Device Quality Management Systems 7
0 ISO 13485:2016 Chapter 8 Integration of the subsections ISO 13485:2016 - Medical Device Quality Management Systems 3
M Change in Constitution / Ownership of firm -------ISO 13485 ISO 13485:2016 - Medical Device Quality Management Systems 1
E ISO 13485 QMS certification as a Supplier ISO 13485:2016 - Medical Device Quality Management Systems 8
T ISO 13485:2016 Clauses related to process matrix ISO 13485:2016 - Medical Device Quality Management Systems 3
J Can signed agreements over-ride review of every "contract" under ISO 13485:2016? ISO 13485:2016 - Medical Device Quality Management Systems 2
J Implementing an ISO 13485 QMS Software ISO 13485:2016 - Medical Device Quality Management Systems 6
Q EN ISO 13485:2016/AC:2018 - AC:2018 being stated in the applicable harmonized standard listing Other ISO and International Standards and European Regulations 1
J Leveraging another company's ISO 13485:2016 ISO 13485:2016 - Medical Device Quality Management Systems 5
J New Job Position - Achieving ISO 13485 Certification ISO 13485:2016 - Medical Device Quality Management Systems 5
A Scope of ISO 13485 certificate ISO 13485:2016 - Medical Device Quality Management Systems 1
A ASL requirement when the supplier is certified for ISO 13485 ISO 13485:2016 - Medical Device Quality Management Systems 6
M ISO 13485-2016 online certification ISO 13485:2016 - Medical Device Quality Management Systems 3
S Thoughts on managing ISO 9001, 13485, IATF 16949 and 17025 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 33
S Supplier Management ISO 13485: 2016- Which supplier needs to fill in a self assessment form? ISO 13485:2016 - Medical Device Quality Management Systems 6
J Possible to get ISO 13485 certified with only OEM Product? ISO 13485:2016 - Medical Device Quality Management Systems 4
D Definition of equipment for ISO 13485:2016 ISO 13485:2016 - Medical Device Quality Management Systems 1
M ISO 13485:2016 Complaint Definition Clarity Customer Complaints 2
D Rules for Paper Forms outside of an eQMS - 3 Questions (ISO 13485) Document Control Systems, Procedures, Forms and Templates 9
S Qualification question - ISO 13485 - Setting up a small lab Reliability Analysis - Predictions, Testing and Standards 2
K ISO 13485 clause 8.5.2 'Any necessary CA shall be taken without undue delay' ISO 13485:2016 - Medical Device Quality Management Systems 11
J How much to charge for helping a startup company with initial ISO 13485 certification? Consultants and Consulting 3
J ISO 13485 System 'soft start' - How to best reflect this in initial audits, management review minutes and other records? ISO 13485:2016 - Medical Device Quality Management Systems 3
D ISO 13485 - 7.3.6 Design and development verification - Do most folks create a separate SOP? ISO 13485:2016 - Medical Device Quality Management Systems 6
C ISO 13485 :2016 - CAPA - Does every CAPA need to be checked by regulations? ISO 13485:2016 - Medical Device Quality Management Systems 9
D ISO 13485 8.2.1 and 8.2.2 - Customer Feedback and Customer Complaints ISO 13485:2016 - Medical Device Quality Management Systems 5

Similar threads

Top Bottom