Supplier control is one of the chapters of ISO 13485 that generates the most nonconformities in audits, particularly in SMEs. Clause 7.4 is demanding on method. Having a contract with a supplier is not enough to demonstrate control.
What clause 7.4 requires
Clause 7.4 breaks down into three parts. Addressing the first one alone is the most common scoping error.
7.4.1 Purchasing process. Evaluation and selection of suppliers based on their ability to supply products that conform to specified requirements, on their performance, on the effect of the purchased product on the quality of the device, and proportionately to risk. Selection criteria are documented, results recorded. Re-evaluation is planned, carried out, and its results retained, together with the actions triggered in the event of a nonconformity.
7.4.2 Purchasing information. The purchasing information describes the product ordered: specifications, acceptance criteria, requirements for the qualification of the supplier’s personnel, QMS requirements where applicable. A point often missing in SMEs: the change notification agreement. The supplier must contractually commit to reporting any change of process, material or subcontractor before implementing it. Without this agreement, control rests on the chance discovery of a change.
7.4.3 Verification of purchased product. The extent of incoming inspection is not uniform. It depends on the results of the supplier evaluation and on the associated risk. A newly qualified critical supplier justifies enhanced inspection; a standard, stable supplier, a lighter one.
Classification by criticality: the operational translation of risk
The standard requires control proportionate to risk. Classification by criticality is the concrete way to implement it. It is built before choosing the qualification methods.
Critical suppliers. Their products or services enter into the composition of the device or affect its safety and performance: biocompatible raw materials, sterilisation provider, subcontractor for a key component. Rigorous qualification mandatory.
Important suppliers. Their failure may affect quality without a direct impact on safety: logistics provider, primary packaging supplier. Intermediate level of control.
Standard suppliers. Office supplies, general services with no impact on product quality. Minimal control is sufficient.
Acceptable qualification methods
The choice of method follows from the level of criticality.
Supplier audit, on-site or remote. The most robust method for critical suppliers. Planned, conducted according to a defined programme, concluded by a report.
Self-assessment questionnaire. Acceptable for important suppliers. Insufficient on its own for a critical supplier.
Documentation review. ISO 13485 or ISO 9001 certificates, reports of audits carried out by other customers, inspection reports. An ISO 13485 certificate facilitates qualification but does not replace it. It attests to the supplier’s QMS, not to its ability to meet your specific requirements. Depending on the purchased product, ISO 9001 remains acceptable, provided it covers the expected technical capability.
Enhanced incoming inspection. Additional measures for new suppliers or suppliers whose qualification is in progress, in direct application of 7.4.3.
The three most frequent pitfalls
Pitfall 1: qualify once, never re-evaluate. Periodic re-evaluation is mandatory. It is planned in the supplier audit programme and carried out, even when the supplier has caused no problem. Its absence is a systematic nonconformity.
Pitfall 2: basing qualification on the ISO certificate alone. A supplier certified to ISO 13485 has a conforming QMS. It does not necessarily have the ability to meet your particular technical specifications. Qualification must cover this specific ability.
Pitfall 3: failing to link supplier changes to change management. A change of process, material or subcontractor, or a certificate that has expired, must trigger a re-evaluation. This is precisely the purpose of the notification agreement provided for in 7.4.2. Without this contractual link, the list of qualified suppliers goes out of date without anyone seeing it.