Notified Body (NB) Audits of Sub-Contractors and Critical Suppliers

#1
Wondering if anyone can share experiences with respect to the likelihood that critical suppliers/sub-contractors may be audited by Notified Bodies.

I'm looking at an article from LNE-GMED, which raises some concerns...

The article states:
"Per the NBOG’s Best Practice Guide 2010-1; a critical supplier is one that is delivering materials, components, or services that may influence the safety and performance of the device. "

With respect to electrical components populating PCBs, by this definition, this could be quite a lengthy list...

It further goes on to say:
"Auditing the Legal manufacturers’ critical subcontractor is becoming the new normal and it is no secret that the level of scrutiny is on the rise. "

Given that, following an assessment, NBs may deem on-site audits of critical suppliers necessary, my concerns are:
  1. Given a complicated PCB, with many components (capacitors, integrated-circuits, LEDs, fuses...etc.), many influencing safety, and arguably all influencing performance, is it commonplace for such manufacturers to have dozens of identified critical suppliers?
  2. How often to NBs deem on-site audits necessary for such suppliers? (hopefully not often...)
  3. Are these on-site audits at the expense of the manufacturer? (presumably yes...)

My concern, obviously, is to avoid unexpected costs of having NBs conduct on-site audits of critical suppliers...

Any input much appreciated!
MM
 

yodon

Staff member
Moderator
#2
Re: NB Audits of Sub-Contractors and Critical Suppliers

My experience is that the NB wouldn't (routinely) audit a (critical) supplier if that supplier is registered to 13485 through an accredited NB themselves. If they establish a "for cause" audit need, though, all bets are off.

Should on-site audits of critical suppliers be necessary, I believe they would conduct them annually PLUS an unannounced audit once in the 3-year window.

And unless you could get your CM to pay for it, it would absolutely be on you.
 

Ronen E

Just a person
Super Moderator
#3
Re: NB Audits of Sub-Contractors and Critical Suppliers

I suspect that NBs will decide to audit a supplier (any supplier) only if they conclude that there is a serious threat on the consistency or adequacy of the quality of what they supply. If you select and manage your suppliers properly, I believe you already handled the bulk of the risk. I've never heard of a manufacturer that had more than 2-3 of their suppliers audited strictly on their account.

:topic:If you have dozens of different suppliers for PCB components then apparently you have significant potential for operation efficiency improvement.
 
#4
Re: NB Audits of Sub-Contractors and Critical Suppliers

:topic:If you have dozens of different suppliers for PCB components then apparently you have significant potential for operation efficiency improvement.
With respect to PCB components, I don't know that there's any getting around the specialization of manufacturers.

We purchase 90% of our PCB components through a single distributor (DigiKey), but the individual manufacturers of the components are highly specialized...

I'd love to reduce our list of manufacturers! Perhaps you could suggest a one-stop-shop manufacturer of a wide range of specialized PCB components that we can look into? We try, but it seems that many of these manufacturers remain highly specialized...
 
#5
Re: NB Audits of Sub-Contractors and Critical Suppliers

My experience is that the NB wouldn't (routinely) audit a (critical) supplier if that supplier is registered to 13485 through an accredited NB themselves.
This would be a pretty tough standard to meet...especially when it comes to electrical components. Very few have ISO 13485...

We require a quality system of some sort (in most cases ISO 9001), and RoHS documentation. With respect to PCB electrical components, any more stringent requirements would make sourcing the necessary suppliers nearly impossible...

To Everyone: I'm curious, what are your requirements with respect to PCB components? Do your suppliers of PCB components all have ISO 13485 through accredited NBs? If not, are you confident that this will not be an issue?
 

Ronen E

Just a person
Super Moderator
#6
Re: NB Audits of Sub-Contractors and Critical Suppliers

We purchase 90% of our PCB components through a single distributor (DigiKey), but the individual manufacturers of the components are highly specialized...
Do you mean that the actual manufacturers are suppliers to your supplier? In that case I think it's quite unlikely that the NB will see them as critical suppliers of yours or audit them on your account. Your supplier's quality management system is supposed to ensure that their suppliers' supply quality is adequate and consistent for your needs; therefore, that system is the one to be scrutinised (and fixed if necessary). I believe that auditing is not an endless-recursive process.

I'd love to reduce our list of manufacturers! Perhaps you could suggest a one-stop-shop manufacturer of a wide range of specialized PCB components that we can look into?
No, I can't pull such a supplier out of my hat... If you have such an issue that you want to improve, and you've exhausted your internal abilities, I would recommend engaging a specialist from that specific field (I'm not one) that will study your current BOMs and purchasing arrangements and suggest ways to improve efficiency. Hang on, I know the answer...: you don't have a budget for a specialist... :sarcasm:

We require a quality system of some sort (in most cases ISO 9001), and RoHS documentation.
I'd venture say that in most cases that will satisfy the NB as well, provided that the ISO 9001 certificate is from an accredited registrar (and the accreditation body is from a respectable scheme). Since PCB components are not finished medical devices, the added value of ISO 13485 over ISO 9001 would not have been overwhelming (especially if we're talking about ISO 13485:2003).
 
Last edited:

somashekar

Staff member
Super Moderator
#7
Re: NB Audits of Sub-Contractors and Critical Suppliers

To Everyone: I'm curious, what are your requirements with respect to PCB components? Do your suppliers of PCB components all have ISO 13485 through accredited NBs? If not, are you confident that this will not be an issue?
The BoM is the governing factor and we have prioritized alternatives mentioned in the BoM. Parts that are considered safety critical are considered in testing and evaluation with alternatives, to maximize the advantage. Also is the fact that the CM we engage has box build capabilities and certainly has the ISO 13485 through accredited CB, as he builds the device and not just the PCA. It then is our call just to buy the PCA or the box build. We have both types of purchase aligned with our CM.
We have in the CM quality agreement included third party audit on our behalf at the CM location, and off course the change control agreement established separately (FDA)
 
#8
Re: NB Audits of Sub-Contractors and Critical Suppliers

I believe that it is worth reiterating what is here meant as being a "critical supplier".

Here it is only referring to those suppliers that you have to list on your CE certification - these are the only suppliers that your NB has knowledge of.

We buy in our PCBs (almost) fully populated. Neither the PCB builder, nor any of the component manufacturers, nor DigiKey/Element14/Mouser etc. are "critical" suppliers. Not even the manufacturers of the transformers, which form an important part of the safety measures, are critical suppliers.

Examples of suppliers that would be "critical"
- sterilisation services
- design services
- OBM suppliers (Own Brand Manufacturer)


EDIT:
I have just checked our NB certification.
We supply some sterile and some OBM devices but not even those suppliers are listed.
Therefore - we do not have ANY critical suppliers.
 
Last edited:

Ronen E

Just a person
Super Moderator
#9
Re: NB Audits of Sub-Contractors and Critical Suppliers

I believe that it is worth reiterating what is here meant as being a "critical supplier".

Here it is only referring to those suppliers that you have to list on your CE certification - these are the only suppliers that your NB has knowledge of.

We buy in our PCBs (almost) fully populated. Neither the PCB builder, nor any of the component manufacturers, nor DigiKey/Element14/Mouser etc. are "critical" suppliers. Not even the manufacturers of the transformers, which form an important part of the safety measures, are critical suppliers.

Examples of suppliers that would be "critical"
- sterilisation services
- design services
- OBM suppliers (Own Brand Manufacturer)


EDIT:
I have just checked our NB certification.
We supply some sterile and some OBM devices but not even those suppliers are listed.
Therefore - we do not have ANY critical suppliers.
Sounds like a somewhat extreme interpretation; I'd have thought that this is how that specific NB sees it, so if you could refresh my memory as to the regulatory basis of that stance I'd be grateful.
 
#10
Re: NB Audits of Sub-Contractors and Critical Suppliers

Here it is only referring to those suppliers that you have to list on your CE certification - these are the only suppliers that your NB has knowledge of.

We buy in our PCBs (almost) fully populated. Neither the PCB builder, nor any of the component manufacturers, nor DigiKey/Element14/Mouser etc. are "critical" suppliers. Not even the manufacturers of the transformers, which form an important part of the safety measures, are critical suppliers.
With all due respect, this seems like a bit of an obfuscation on your part. "These are the only suppliers that your NB has knowledge of...", seems to read like you're deliberately not identifying certain suppliers.

Our PCBs also come fully populated (by a supplier deemed critical), but we also send them a BoM of components to populate the PCBs with. So if there is a change to, say, a transformer, the PCB supplier doesn't change, but it is still important that we document the change to the transformer supplier.

Question: if your risk management identifies, for example, "use fuse with X spec" as a risk-mitigating measure, how do you in turn document the sourcing and implementation of such a fuse without listing the fuse manufacturer as a critical supplier?

How do you justify this when the typical definition of critical supplier is "one that is delivering materials, components, or services that may influence the safety and performance of the device"? Surely the PCB components fit this definition, no?
 

Top