Teresa Jimenez
Regulatory Expert Consultants, Inc.
Oct. 4, 2012

• QS regulatory requirements for Purchasing controls (21 CFR 820.50)
• GHTF Guidance on the Control of Products and
Services Obtained from Suppliers
• Link between purchasing controls and other QS regulation requirements
• W/L for Purchasing Control
2

Sub-Part 820.1 (a) Applicability
• QSR purports the basic requirements applicable to manufacturers of finished medical devices . In other words, QSR clearly exposes
– What to do; but it doesn’t portray HOW to do it
• It does not apply to manufacturers of components.
3

The QS Regulation is intended to ensure that finished devices will be
– SAFE
– EFFECTIVE , and
– WITHIN COMPLIANCE with the Federal Food
Drug and Cosmetic Act (the Act)
4

• Finished Device: Any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.
• Component: Any raw material, substance, piece, part, software, firmware, labeling, or assembly which is intended to be included as part of the finished, packaged, and labeled device.
5

• Service means parts of the manufacturing or quality system that are contracted to others, for example, plating of metals, testing, and sterilizing, among others.
Preamble to the 1996 QS Regulation, Comment #102
• Manufacturing Material: Any material or substance used in or used to facilitate the manufacturing process, a concomitant constituent, or a byproduct constituent produced during the manufacturing process, which is present in or on the finished device as a residue or impurity not by design or intent of the manufacturer.

The failure to comply with any applicable provision of CFR 21 part 820 renders a device adulterated under section 501(h) of the act.
Such device , as well as any person responsible for the failure to comply is subjected to regulatory actions
7

820.5 Quality System
Each manufacturer shall establish and maintain a Quality System that is appropriate for the specific medical devices designed or manufactured , and that meets the requirements of part 820.
8

Inadequate Purchasing Controls
Significant Number of Recalls
9

FDA decided not to regulate component manufacturers under the Quality System regulation in light of the new Purchasing
Controls Requirements in 820.5 and the requirements for Receiving Acceptance
Activities in 820.80(b).
10

PURCHASING
CONTROLS OVERVIEW
•
Establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements
•
Evaluate suppliers, contractors and consultants
•
Establish and maintain purchasing data/documents that describe or reference specified requirements (including notification of change agreements)
•
Approve purchasing data/documents
11

21 CFR 820.50
Each manufacturer shall establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements.
Product includes components, manufacturing materials, inprocess devices, finished devices, and returned devices. [21
CFR 820.3(r)]
12

... the requirements apply to all product and service received from outside of the finished device manufacturer, whether payment occurs or not. Thus, a manufacturer must comply with these provisions when it receives product or services from its “sister facility” or some other corporate or financial affiliate.
Preamble to the 1996 QS Regulation, Comment #100
★
In general, entities not covered by a firm’s internal audits should be treated as suppliers.
13

21 CFR 820.50(a) Evaluation of suppliers, contractors, and consultants.
Each manufacturer shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants.
Each manufacturer shall:
14

21 CFR 820.50(a)(1)
Evaluate and select potential suppliers, contractors, and consultants on the basis of their ability to meet specified requirements, including quality requirements . The evaluation shall be documented.
``quality requirements'' means the quality control and quality assurance procedures, standards, and other requirements necessary to assure that the product or service is adequate for its intended use.
Preamble to the 1996 QS Regulation, Comment #109
15

21 CFR 820.50(a)(2)
Define the type and extent of control to be exercised over the product, services, suppliers, contractors, and consultants, based on the evaluation results.
★ higher risk components
★ higher risk processes (e.g., those that may require validation)
★ sub-tier supplier controls
16

Risk Based Decisions
The extent of the specification detail necessary to ensure that the product or service purchased meets requirements will be related to the nature of the product or service purchased, taking into account the effect the product or service may have on the safety or effectiveness of the finished device , among other factors.
Preamble to the 1996 QS Regulation, Comment #115
17

... certification may play a role in evaluating suppliers, but cautions manufacturers against relying solely on certification by third parties as evidence that suppliers have the capability to provide quality products or services.
...third party certification should not be relied on exclusively in initially evaluating a supplier. If a device manufacturer has established confidence in the supplier's ability to provide acceptable products or services, certification with test data may be acceptable.
Preamble to the 1996 QS Regulation, Comment #103
18

• Each manufacturer must establish an appropriate mix of assessment and receiving acceptance to ensure products and services are acceptable for their intended uses. The specifications for the finished device cannot be met unless the individual parts of the finished device meet specifications. The most efficient and least costly approach is to ensure that only acceptable products and services are received. This means that only suppliers, contractors, and consultants that meet specifications should be used.
• Preamble to the 1996 QS Regulation, Comment #99
19

...a finished device manufacturer may choose to provide greater in-house controls to ensure that products and services meet requirements, or may require the supplier to adopt measures necessary to ensure acceptability, as appropriate. FDA generally believes that an appropriate mix of supplier and manufacturer quality controls are necessary . However, finished device manufacturers who conduct product quality control solely in-house must also assess the capability of suppliers to provide acceptable product.
Where audits are not practical, this may be done through, among other means, reviewing historical data, monitoring and trending, and inspection and testing .
Preamble to the 1996 QS Regulation, Comment #99
★
Link to Acceptance Activities – 21 CFR 820.80(a)
★
Be cautious of using prior supplier audits as sole basis for decisions; verify the scope of previous audits.
20

Suppliers, contractors, and consultants selected by manufacturers of medical devices should have a demonstrated capability of providing products and services that meet the requirements established by the finished device manufacturer.
The capability of the product or service suppliers should be reviewed at intervals consistent with the significance of the product or service provided and the review should demonstrate conformance to specified requirements.
Preamble to the 1996 QS Regulation, Comment #105
21

21 CFR 820.50(a)(3)
Establish and maintain records of acceptable suppliers, contractors, and consultants.
22

21 CFR 820.50(b)
Each manufacturer shall establish and maintain data that clearly describe or reference the specified requirements, including quality requirements, for purchased or otherwise received product and services.
23

21 CFR 820.50(b) Cont.
Purchasing documents shall include, where possible, an agreement that the suppliers, contractors, and consultants agree to notify the manufacturer of changes in the product or service so that manufacturers may determine whether the changes may affect the quality of a finished device.
Purchasing data shall be approved in accordance with § 820.40.
§ 820.40 Document controls.
24

Key topics covered by the Suppler Quality Agreement are:
■ Ownership of product specifications
■ Inspection plans
■ Audit functions
■ Complaint handling processes and responsibilities
■ Change control
■ Process validation
■ Process controls
■ Design controls
■ Control of subtier suppliers
■ Legal aspects
■ Key personnel responsibilities and contact information http://www.mddionline.com/article/fda-focus-managing-supplier-purchasing-controls
25

Ensuring that effective change control processes are fully implemented requires:
■ Clear language within the supplier Quality
Agreement .
■ Effective supplier quality system change control processes.
■ Consistent provision of change control information to the manufacturer.
■ Oversight by the supplier’s and manufacturer’s audit processes.
http://www.mddionline.com/article/fda-focus-managing-supplier-purchasing-controls
26

Quality management system – Medical devices - Guidance on the control of products and services obtained from suppliers.
GHTF/SG3/N17:2008
27

• Manufacturers are not required to comply with guidance documents.
• Guidance is voluntary and is a way of doing something that FDA generally recognizes as acceptable.
• Manufacturers are required to comply with the Quality System Regulation.
28

Notice
May 31, 2010
Our file number: 10-109706-625
Subject: Adoption of Global Harmonization Task Force (GHTF) Guidance: Quality Management
System - Medical Devices - Guidance on the Control of Products and Services Obtained from
Suppliers
Health Canada is pleased to announce the adoption of the GHTF Guidance Quality
Management System - Medical Devices - Guidance on the Control of Products and Services
Obtained from Suppliers.
This guidance has been developed by the appropriate GHTF Expert Study Group (Study Group 3) and has been subject to consultation by the regulatory parties, in accordance with the GHTF Process.
The GHTF Steering Committee has endorsed the final document.
In adopting this GHTF guidance, Health Canada endorses the principles and practices described therein. This document should be read in conjunction with this covering letter and with the relevant sections of other applicable Health Canada guidances.
This and other guidance documents are currently available on the Health Canada website.
REF: http://www.hc-sc.gc.ca/dhp-mps/md-im/applic-demande/guideld/md_gd_suppliers_im_ld_fournisseurs-ghtf-eng.php
29

Scope
• For the purposes of this document, a product or service is one which is purchased or otherwise obtained by the manufacturer.
• In addition, a supplier is anyone that is independent from the manufacturer’s quality management system . This includes a supplier that may be part of the manufacturer’s organization but operates under a separate quality management system.
30

• If the supplier is not a part of the manufacturer’s internal audit (quality audit) scope , then the supplier is under a separate quality management system and is considered an internal supplier
• Corporations that have corporate quality policies and procedures do not necessarily place all divisions or groups under the same quality management system
• Internal suppliers are to be controlled under a similar way as external suppliers are controlled .
31

The “manufacturer” or entity has the ultimate responsibility for its quality management system, cannot relinquish (contractually or otherwise) its obligation and responsibility over any or all functions within the quality management system...
the responsibility for complying with the quality management system requirements cannot be delegated to any supplier (internal or external) of products and services.
32

Some suppliers may undergo some form of oversight either by a regulatory authority, or a third- party operating on behalf of a regulatory authority.
This oversight does not relinquish the responsibility of a manufacturer to establish controls and provide evidence for products and services obtained from suppliers.
33

The process of establishing controls for products and services obtained from suppliers typically comprises six phases, which include:
– 3.1 Planning
– 3.2 Selection of potential suppliers
– 3.3 Supplier evaluation and acceptance
– 3.4 Finalization of controls and responsibilities
– 3.5 Delivery, measurement and monitoring
– 3.6 Feedback and communication, including
Corrective and Preventive Action process
34

• Inspections
– Quality System Inspections Technique (QSIT)
- Production and Process Controls
– Compliance Program (7382.845) – Inspection of Medical Device Manufacturers
• Premarket Approval Applications(PMAs)
36

COMPLIANCE PROGRAM 7382.845
Selection of manufacturing processes for inspectional coverage should include the following considerations:
– CAPA indicators of process problems
– Processes used to manufacture high risk products
– Processes that have a high risk of causing product failure
– Processes that require process validation
37

COMPLIANCE PROGRAM 7382.845
Selection of manufacturing processes... Cont.
– Processes that are new to the manufacturer
– Processes that cover a variety of process technologies and profile classes
– Common processes used in multiple products
– Processes not covered during previous inspections
– It is important to thoroughly cover Purchasing
Controls, to include outsourced processes, as a QSIT linkage under P&PC
38

Sub-Part
A
B
C
D
Title
General Provisions
Quality System
Requirements
Design Controls
Document Controls
Sub-Part
I
Title
Non-Conforming Product
J
K
Corrective & Preventive
Action
Labeling & Packaging
Controls
L
Handling, Storage,
Distribution, Installation
E
F
Purchasing Controls M
N
Records
Identification & Traceability Servicing
G
H
Production & Process
Controls
Acceptance
Activities
O Statistical Techniques
39

Quality System Linkages
– Design Controls
– Risk Management
– Acceptance Activities
– Production & Process Controls
• Change Control
• Validation
– CAPA (Nonconforming Product, Complaints)
– Management Controls: Auditing, Quality Planning,
Quality Policy
– Document control and records

FDA-483 Quality Policy
“Although the company's quality policy states that its intent is "to provide the medical profession with quality products that meet all regulatory requirements," management did not notify customers of potentially non-conforming products that remained on the market.
”
41

42

Warning Letter 37-12
• Failure to establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements, as required by 21 CFR 820.50. For example, your firm does not have a quality agreement between (b)(4)(supplier of
Synatron 2000 components) and your firm . Also, there was no documentation that any evaluations or qualifications of suppliers of components used for the Synatron 2000 have been performed.
• Failure to establish and maintain procedures for acceptance of incoming product, as required by 21 CFR 820.80(b). For example, your firm does not have procedures for inspections, tests, or other verification activities to control receiving of components used for the Synatron
2000.
43

Warning Letter SEA 12-31
Failure to adequately establish and maintain procedures for finished device acceptance to ensure that each production run, lot, or batch of finished devices meets acceptance criteria, as required by 21 CFR 820.80(d).
For example, your firm’s procedure, Generation, Review and Approval of
Quality Agreements (SOP-0019, Rev. A) states that a fully approved
Quality Agreement shall be in place prior to release of product for distribution.
However, your firm’s Quality Agreement (QA-0001, Rev. B) with its sleeve supplier, (b)(4), effective from August 10, 2009, to December
13, 2011, did not cover the manufacturing of the GMD 1011 and GMD 1012 sling.
Your firm began to distribute GMD 1011 sling in May 2010 and
GMD 1012 sling in June 2010. However, a Quality Agreement for the manufacturing of GMD 1011 and GMD 1012 slings was not established until December 13, 2011.

Warning Letter SEA 12-31
Failure to adequately establish and maintain procedures for acceptance of incoming product; inspect, test, or otherwise verify as conforming to specified requirements; and document acceptance or rejection, as required by 21 CFR
820.80(b). For example, your firm determined that the (b)(4) process was the root cause of the sleeve breakage/malfunction complaints . Nine lots
… were manufactured using the(b)(4) method.
The acceptance activities receipt provided by your firm’s sleeve supplier, (b)(4), did not include test results demonstrating that the products from the identified lots met their specified requirements. Your firm also did not perform any testing of the finished device received from (b)(4) to determine if the products met their specified requirements. However, these lots were released for distribution.
We reviewed your firm’s response and conclude that it is not adequate. ...The
response did not address what methods are in place, other than the
Certification of Compliance, to demonstrate that products received by
(b)(4) are conformed to their specified requirements.
45

Warning Letter SEA 12-31
Failure to adequately investigate the cause of nonconformities related to product, processes and the quality system, as required by 21 CFR 820.100(a)(2). For example, your firm’s sleeve supplier , (b)(4), never notified your firm per its
Quality Agreement (QA-0001, Rev. B), that its contract manufacturer, (b)(4), has changed a manufacturing process , which involved switching from (b)(4) method to (b)(4) method.
Your firm was notified about this change by (b)(4) on
December 15, 2010, approximately seven months after the implementation of the change .
(b)(4) additionally informed your firm that the (b)(4) method improved the tensile strength of the sleeve. After the implementation of this manufacturing change/fix, your firm received 20 complaints (6 of which were
MDRs) for the ...sling ... and 16 complaints (7 of which were MDRs) for the GMD
1011 sling ... However, your firm failed to identify and report the previous manufacturing process ((b)(4) method) as a potential cause of sleeve breakage issues to the CAPA leader per its Standard Operative Procedure,
Corrective and Preventive Action Management (SOP 0060 Rev. E).
46

Warning Letter NYK-2012-24
Failure to establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements, as required by 21 CFR 820.50. For example, your firm does not have an agreement with its supplier,
(b)(4), which defines responsibility for device attributes and quality requirements. Specifications for the device are not defined between
(b)(4) and... Further, although (b)(4) is listed on your firm’s
Approved Supplier List, IHR-603, Revision 4, as a critical supplier, your firm failed to follow its own procedure in requiring critical suppliers to have a Change Notification Contract. Your firm’s procedure, QAP-601, Rev. 18, Supplier Assessment, requires a file for each supplier that includes product specifications and supplier assessments; however, upon request, no supplier file for (b)(4) was provided to the investigator .
47

A cross-functional Group / Quality Review
Board is essential for assuring the effective establishment and maintenance of the purchasing control subsystem.
48

49

E-mail: teresa.jimenez@regulatoryexperts.com
Cell phone: 787 550-1226
50