Notified Body (NB) Audits of Sub-Contractors and Critical Suppliers

[yodon]

Re: NB Audits of Sub-Contractors and Critical Suppliers

It's been my experience that the component providers aren't considered. The Contract Manufacturer is expected to have proper purchasing controls in place to ensure they're getting what they ordered / is required and have in-process and final acceptance testing is conducted to ensure the assembly meets spec. To me, that's why the CM is the 'critical' supplier (and target for audit).

 

[Pads38]

Re: NB Audits of Sub-Contractors and Critical Suppliers

Perhaps I need to clarify my previous post.

The front page of our Technical Files is a sheet of "Administrative Details". That lists:
a) Our name and address
b) The name and address of any other facilities involved in the design and manufacture of the device
c) Name and address of the NB
d) Regulations applied
e) Device classification and classification rule
f) Conformity assessment procedure followed

When it comes to Notified Body Unannounced Audit, it is only those suppliers/contract manufacturers listed in bullet b above that this applies to. It is this listing that identifies the "critical suppliers" to your Notified Body.

Of course some parts are critical, be that fuse, transformer or populated PCB. Transformers and PCBs are purchased from suppliers who have been vetted and placed on our "Approved Suppliers" list. We also have signed agreements in place with those suppliers, that specifies acceptable quality of delivered goods (See IPC A-610F Acceptability of electronic assemblies).

Other critical parts, such as fuses, mains wiring, etc are identified as part of the type test process. We will ensure that the manufacturers of such parts are ISO9001 certified and that such parts are approved by a recognised test house, to the appropriate standard.

Our NB certainly has full access to our supplier records and parts lists. This formed part of our own unannounced audit last month, where we were asked to show component traceability.

We have many critical components, from a variety of vendors.
But, for the purposes of NB unannounced audits, we do not have "critical suppliers".

 

[Ronen E]

Re: NB Audits of Sub-Contractors and Critical Suppliers

When it comes to Notified Body Unannounced Audit, it is only those suppliers/contract manufacturers listed in bullet b above that this applies to. It is this listing that identifies the "critical suppliers" to your Notified Body.

(...)

But, for the purposes of NB unannounced audits, we do not have "critical suppliers".

This might well be the case for your company, and may be acceptable by your NB, but again - what is the regulatory basis? Where does it say so in the regulations?

Besides, as far as I understood the OP asked about audits in general; not necessarily unannounced audits in specific. Regardless, I was under the impression that there is no real difference when auditing scope is concerned - wherever a NB can audit (announced) it also can (and should) audit unannounced, occasionally. So if critical suppliers should expect announced audits they should also expect unannounced ones, and vice versa.

 

[Pads38]

Re: NB Audits of Sub-Contractors and Critical Suppliers

Auditing of suppliers/sub-contractors is covered by MEDDEV 2.5/3, SUBCONTRACTING – QUALITY SYSTEMS RELATED

https://ec.europa.eu/DocsRoom/documents/10289/attachments/1/translations/en/renditions/pdf

From that document:

The two main issues a Notified Body should address when reviewing subcontractors are:
a) Whether the subcontractor has a substantial involvement with the design and/or production of the device.
b) Whether the subcontractor is undertaking the supply of a part, material or service, which may affect the compliance of the device with the essential requirements.
If the answer to both a) and b) above is NO, no further action is required. If the answer to a) or b) above is YES, then the Notified Body must evaluate whether there is sufficient evidence provided of the competence of the subcontractor to undertake supply of the part, material or service in relation to the medical device(s) in question.

As Ronen points out, there is no distinction made between planned audits and unannounced audits. The MEDDEV uses the term 'subcontractor' to cover all forms of suppliers or subcontractors.

In the question of the purchase of populated PCBs, which Mark originally mentioned, it might be said that such a supplier does have a 'substantial involvement...in the production of the device'. However, in our situation, every board forms part of our finished device and is subject to full production tests and safety tests. This means that we 'verify' every board.

Also from the MEDDEV:

...the Notified Body must be allowed to review the relevance or criticality of the subcontractor to the medical device and, if not satisfied by the evidence available from the manufacturer, undertake an audit/assessment of the subcontractor...

Although this MEDDEV is rather old (1998) it does remain valid. Also, the same concepts of supplier audits are shown in the relevant GHTF document:-

https://www.imdrf.org/docs/ghtf/fin...ng-qms-part-5-control-of-suppliers-100827.pdf

 

[Laughing Pierre]

Re: NB Audits of Sub-Contractors and Critical Suppliers

I understand exactly where Pads38 is coming from.

We specify any number of safety critical devices such as fuses, opto-couplers, transformers, mains rated cable, etc.. All of these components are standard catalogue items and can be purchased from any number of distributors. So point one is that the distributor is our supplier, the original manufacturer is not. We fully specify the component to our supplier (the distributor) who is on our approved supplier list, they supply and we check at goods-in that the correct parts have been supplied. Through this very simple process we have full and demonstrable control of the supply of critical components without the need for any NB intervention. The specification of the parts has to be precise.

During the design process hazards are identified and, where appropriate, are mitigated by employing components which can be considered as safety critical. The efficacy of those components is verified and validated through in-house bench testing and type testing to the 60601 series of standards by an independent, accredited test house. Through that process the specifications of all components, including safety critical, are determined and detailed on the BoM. We can clearly demonstrate that if component part number 'A' with specification 'B' from manufacturer 'C' is fitted in position 'D' all the relevant safety criteria will be met irrespective of who the actual supplier is.

There's more...

We also sub-contract out the assembly of our surface mount PCBs. Contrary to some of the comments made earlier in this thread, our PCB sub-contractors are not classed as critical suppliers by our NB and are not in line for an unannounced audit. This is because of the way we manage them. They have been through our supplier approval process, so we are happy with the way they translate and transfer our BoM into their production control system, we are happy with their processes for managing engineering changes, we are happy with their manufacturing process controls and they supply us with a full traceability report for all of the components used in a manufacturing batch. We have a supply agreement in place with them which describes the regulatory requirements associated with the manufacture of the PCBs and assigns each one to either or both of our companies as appropriate. The crucial part of the process is that when the PCBs arrive we carry out 100% testing. This effectively transfers all of the risks away from the sub-contractor and onto us and for that reason our NB regards the sub-contractor as a significant supplier, but not a critical one.

We have consulted with our NB along the way and have no critical suppliers as a result.

MEDDEV 2.5/3 Rev 2, Subcontracting - Quality systems related, is now quite an old document, but it is still current and effective. The guidance indicates that the NB should take into account the control exercised by the manufacturer over the sub-contractor when determining the requirements for auditing the latter. It would appear that our NB has noted the guidance and is acting accordingly.

 

[bjohnsonrli]

Re: NB Audits of Sub-Contractors and Critical Suppliers

I would also tend to agree with Pads38 and Pierre.

Section 5 of NBOG 2010-1 pretty much explains how the NB will determine the need to perform a supplier audit. To answer Marks original question, the likelihood of having suppliers undergo an unannounced audit, it seems, would be based on what controls a manufacturer has in place. If you have robust procedures in place for purchasing, supplier selection and supplier monitoring the risk of an unannounced audit seems low. I would also point out that the NBOG makes a note in that the NB may decide to visit suppliers that were deemed to be non-critical. My take is that notified bodies do not want to limit themselves. Any thoughts on that theory?

Our experience from this years re-certification to ISO 13485 was that the NB was focused on who we have identified as critical suppliers and what agreements we have in place. They wanted a specific agreement from our supplier which stated that they agree to any unannounced audits.

On a side note, I do enjoy the discussions here at the Cove. I don't claim to be an expert by no means, but I will share my relevant experiences. Very thankful for all the wealth of information in this forum. It think it helps tremendously in this highly regulated industry.

Regards,

Bryan

 

[Laughing Pierre]

Re: NB Audits of Sub-Contractors and Critical Suppliers

I would also point out that the NBOG makes a note in that the NB may decide to visit suppliers that were deemed to be non-critical. My take is that notified bodies do not want to limit themselves. Any thoughts on that theory?Bryan

I agree totally and we have included a clause to allow unannounced audits in the supply agreements with all suppliers who form a significant part of our supply chain, even though the NB has said they are not critical. I know that it is not necessarily the right way of thinking about these things, but all of the NBs are so under resourced at the moment they are struggling to fulfill their required unannounced audits before the end of this 3 year cycle. I therefore think it unlikely that they will be surprising non-critical suppliers for a few years yet. In forming this opinion I have factored in the massive changes being made to the requirements being placed on Own Brand Labellers (and yet another consequential increase in the workload of the NBs) which have to be implemented by April 2017.

 

[Ronen E]

Re: NB Audits of Sub-Contractors and Critical Suppliers

Auditing of suppliers/sub-contractors is covered by MEDDEV 2.5/3, SUBCONTRACTING – QUALITY SYSTEMS RELATED

https://ec.europa.eu/DocsRoom/documents/10289/attachments/1/translations/en/renditions/pdf

From that document:

The two main issues a Notified Body should address when reviewing subcontractors are:
a) Whether the subcontractor has a substantial involvement with the design and/or production of the device.
b) Whether the subcontractor is undertaking the supply of a part, material or service, which may affect the compliance of the device with the essential requirements.
If the answer to both a) and b) above is NO, no further action is required. If the answer to a) or b) above is YES, then the Notified Body must evaluate whether there is sufficient evidence provided of the competence of the subcontractor to undertake supply of the part, material or service in relation to the medical device(s) in question.

As Ronen points out, there is no distinction made between planned audits and unannounced audits. The MEDDEV uses the term 'subcontractor' to cover all forms of suppliers or subcontractors.

In the question of the purchase of populated PCBs, which Mark originally mentioned, it might be said that such a supplier does have a 'substantial involvement...in the production of the device'. However, in our situation, every board forms part of our finished device and is subject to full production tests and safety tests. This means that we 'verify' every board.

Also from the MEDDEV:

...the Notified Body must be allowed to review the relevance or criticality of the subcontractor to the medical device and, if not satisfied by the evidence available from the manufacturer, undertake an audit/assessment of the subcontractor...

Although this MEDDEV is rather old (1998) it does remain valid. Also, the same concepts of supplier audits are shown in the relevant GHTF document:-

https://www.imdrf.org/docs/ghtf/fin...ng-qms-part-5-control-of-suppliers-100827.pdf

Thanks for that response. I think that there are some important points to take away from it.

The first is the essential difference between the QA state-of-mind and the QC one. QC focuses on checking and verifying after-the-case. QA focuses on taking measures that would make QC redundant, thus increasing efficiency and preventing potential scrap.

Another issue is regulation vs. guidance. It's true that MEDDEV is the official guidance, and often it's applied by NBs as de-facto regulation, but it's not the regulation. As such it's open to interpretation, which may differ from one NB to another. It can also be challenged by manufacturers with alternative interpretation. The regulation can't be challenged as easily. NBOG is even less authoritative than MEDDEV, and GHTF guidance is mostly voluntary in nature.

Never mind, for discussion sake let's treat MEDDEV as de-facto regulation.

In the first MEDDEV quote above, I think item b is the one that deserves most of the attention. In my understanding it practically means that every component that affects either the safety or the performance of the device invites supplier scrutiny, whether the supplier's involvement is "substantial" or not. Quite far-reaching, but I'm assuming that we've agreed to treat MEDDEV as regulation and that specific MEDDEV as effective and applicable.

Coming back to the populated PCBs,

However, in our situation, every board forms part of our finished device and is subject to full production tests and safety tests. This means that we 'verify' every board.

This is QC in essence. While it might satisfy the NB and downgrade the supplier to "non-critical" (?), it is in theory a waste of resources. Let's assume you receive a faulty PCB lot - you potentially will discover it only in final inspection and will have to scrap or rework the finished devices (or provide a concessional pass, which might bear on your overall quality, reputation etc). The essence of selecting and qualifying good suppliers (and monitoring them, including auditing) is to make QC as redundant as reasonably possible.

Cheers,
Ronen.

 

[Mark Meer]

Re: NB Audits of Sub-Contractors and Critical Suppliers

Thank you Pads, Pierre and Bryan for sharing your experiences, and Ronen for your input!

I have to admit, I'm still surprised that you can get by with no critical suppliers for medical electrical equipment.

Perhaps I'll need to make some caveats in our supplier evaluation process. Presently, it is just a blanket assessment: "Does the item(s)/service(s) supplied affect the safety or performance of finished device(s)?"
...to which the answer is "Yes" for many of our suppliers...

But, as you are suggesting, we can also factor in supplier agreements, the level of control/traceability we maintain, and in-process testing conducted during final assembly, this might be a basis to justify that these are NOT critical suppliers despite supplying critical components? If so, that'd be great!

From a rational, risk perspective this makes sense. Nevertheless, a Ronen points out, this depends on some degree of interpretation, so I'm still a bit wary...

I'm sure there are a lot of hard-lined auditors out there who wouldn't consider:

"They have been through our supplier approval process, so we are happy with the way they translate and transfer our BoM into their production control system, we are happy with their processes for managing engineering changes, we are happy with their manufacturing process controls and they supply us with a full traceability report for all of the components used in a manufacturing batch."

sufficient rationale to justify that a supplier of a critical component/process is not a critical supplier...

 

[Ronen E]

Re: NB Audits of Sub-Contractors and Critical Suppliers

But, as you are suggesting, we can also factor in supplier agreements, the level of control/traceability we maintain, and in-process testing conducted during final assembly, this might be a basis to justify that these are NOT critical suppliers despite supplying critical components? If so, that'd be great!

Mark, I think you place a little too much importance on the word "critical".

In terms of the MEDDEV -
It makes a difference if a component affects the safety or performance of the finished device;
It makes a difference whether or not the NB can/should review a given supplier's quality record; and
It makes a difference whether, upon such review, the NB concludes that an on-site audit of that supplier is necessary (whether planned or unannounced).

It makes much less difference how you tag such components and suppliers ("critical" or not).