When it comes to Medical Device companies’ purchasing processes, supplier management takes the bulk of the attention. This makes sense, as having a great supplier management system will make the other parts of the system run much smoother.
That being said, Medical Device companies that want to conform to standards and regulations should still record their process for purchasing goods and services. This article will break down the processes Medical Device companies need to conform with ISO 13485 clause 7.4.2 when purchasing materials.
Table of Contents
Approved Supplier List
Having an up-to-date Approved Supplier List (ASL) makes it simple for companies to know which vendors can provide different materials and services. To learn more about supplier management and setting up an ASL, check out our guide, Effective Supplier Management for Medical Devices.
If you are purchasing any materials or services related to finished medical devices, the supplier must be on the ASL. If you need to purchase something that is not provided by a vendor on your ASL or if the approved supplier is not able to provide the material, Purchasing should work with Quality to get the vendor added as quickly as possible.
For this reason and to minimize supply issues, it can be beneficial to have multiple suppliers of the same material on your ASL. However, this must be weighed with the business risk of qualifying extra suppliers who will not be providing anything immediately, as well as the benefits of working with a single supplier.
Purchase Orders
Companies almost always use Purchase Orders (PO) to purchase from other companies. ISO 13485 lists four items required to be included or referenced in purchasing requirements:
- Purchase specifications
- Requirements for product acceptance
- Requirements for qualification of supplier personnel
- Quality Management System Requirements.
The last two requirements are best left to the Supplier Management system so that a company does not create them from scratch every time they have to purchase materials.
Purchase Orders typically focus on the first and second requirements, purchase specifications, and conditions for product acceptance. For low-risk off-the-shelf products, this could be as simple as a PO documenting the part/catalog number and quantity.
For POs of complex, higher-risk, or custom products more information should be included such as:
- Revision levels
- Packaging and shipping requirements
- Certificates of Analysis
- Inclusions of product verification data
- Labeling
- National or International standards (a commonly used example is RoHS compliance)
- And more depending on your organization
Engineering should be involved with communicating the specifications, part drawings, and product requirements to Purchasing. These documents can be sent alongside the PO to give the supplier as much information as possible.
Requirements for acceptance can be included in a PO, a Quality Agreement, or a combination of both. These might state that the supplier sends a Certificate of Conformance or other testing information with the materials. It could also reference an inspection plan and Acceptable Quality Limit (AQL) agreed upon by the company and supplier.
Do Purchase Orders Need to be Approved?
ISO 13485 suggests that POs be checked for adequacy before being sent to suppliers.
The first part of this check is done during device design and development. Companies must ensure they have approved all of the requirements regarding their products before anything is requested from suppliers.
The second part comes when it is time to send out the PO. One option is to have Quality or a defined member of Purchasing physically approve each PO. I would caution against this approach, as it will add unnecessary paperwork burden and slow down the purchasing process.
The better option is to make sure that the entire Purchasing team is well-trained on the organization’s supplier management and purchasing processes. That way, everyone involved with purchasing can understand which suppliers are on the ASL and the correct revision levels of materials to purchase.
Change Notification Agreements
Quality agreements are essential to purchasing for Medical Device companies, however, the area that is highlighted in ISO 13485 is the Change Notification Agreement.
The Change Notification Agreement dictates that a vendor must notify the purchasing organization before changing any aspect of the process or product.
For medium and high-risk products this is usually done through formal Quality Agreements. If you want to learn more about what is included in a Quality Agreement, please review our guide on Supplier Management.
For low-risk products and materials, the Change Notification Agreement can be as simple as a statement on the PO or in terms and conditions associated with the PO. Either way, this information needs to be communicated and agreed upon with the supplier.
Traceability and Records
Traceability is another important aspect of producing Medical Devices, however, the criticality varies based on the nature and risk level of the specific device.
For purchasing, companies should at a minimum maintain records of their POs. The PO number is a common point of reference for the organization and the supplier and can be used for communications if there are any product defects found during incoming inspection.
Organizations should also try to tie the PO number and supplier lot/batch number to their internal lot/batch numbers of products. This is a requirement for higher risk Medical Device companies, especially those producing implantable devices, but it is the best practice for all Medical Device organizations.
This level of traceability is important if there are defects found in stages of the production processes outside of incoming inspection, or in products that have been sent to customers. This information facilitates investigations and can be used as a starting point during supplier audits.
Other records of traceability that may need to be maintained depending on the specific requirements of the organization include Certificates of Analysis or Conformance, purchased material revision number, and supplier-provided verification information.
Should Purchasing be its own SOP?
Whether an organization should have a specific SOP on the purchasing process is completely up to that organization’s needs.
It is common and perfectly acceptable to fold the purchasing process into a supplier management or similar procedure. The advantage is that it gives the company fewer SOPs to review and control as part of document management. It also means fewer documents must be accessed during audits and similar activities.
Personally, I like having a QMS with a greater number of SOPs that are shorter. The advantage is that if some part of the purchasing process changes, you don’t need to do a change order on the entire supplier management SOP. It also means that you can be more specific and only push out training for documents that are specific to an employee’s role.
The key is that an organization has to document a Purchasing process, however, it is free to make that its own SOP or include the processes as part of a larger SOP.
Wrapping Up
Medical device companies spend so much time focused on managing suppliers, that they often overlook the act of buying the materials. However, as part of having a well-running QMS, organizations also need a process to ensure they purchase the correct parts and services from the right suppliers. By following this guide, you can set up your organization for success and conformance with ISO 13485 requirements.
If you liked this post, be sure to check out the other articles on the site and sign up for our newsletter below.