ISO 13485 · Basic · 13 min lesson
Supplier selection and evaluation - clause 7.4.1 and the approved supplier list
ISO 13485:2016 clauses 7.4.1, 4.1.5 and 4.2.5: criteria, tiers, monitoring and re-evaluation
What you will learn
- Explain what clause 7.4.1 requires of the purchasing process and why the manufacturer stays responsible for purchased product.
- Build supplier selection and evaluation criteria that are proportionate to device risk and to the effect of the purchased item.
- Maintain an approved supplier list with monitoring, re-evaluation and records that stand up to audit.
Key takeaways
- Clause 7.4.1: document the purchasing process, set criteria for selection and evaluation, plan monitoring and re-evaluation, and keep records.
- Control must be proportionate to the effect of the item on the final device and to the risk of the device.
- A certificate supports an evaluation but does not prove the supplier can make your specific part.
- The approved supplier list must show scope, tier, status, approval date and next re-evaluation date, under document control.
- Monitoring results feed re-evaluation, and nonfulfilment is handled in proportion to risk with the action recorded.
Free practice question
Lumora's approved supplier list shows Norvale Sterilisation Services, approved in 2019. The quality manager finds no questionnaire, audit, risk assessment or signed approval. Norvale sterilises every lot of infusion sets. An auditor asks how Norvale was chosen.
What is the most accurate assessment?
A critical supplier was approved with no evaluation record, so clause 7.4.1 and clause 4.2.5 are not met.
Correct. Clause 7.4.1 requires evaluation criteria and records of results, and clause 4.2.5 controls those records for sterilisation.
Acceptable: a long relationship shows the supplier is good.
Not quite. History can be evidence, but clause 7.4.1 requires it to be recorded and evaluated against criteria.
Acceptable, because services are outside clause 7.4.1.
Not quite. Outsourced services that affect conformity fall under clause 7.4.1 and clause 4.1.5, so sterilisation is in scope.
Only a minor note, as the list itself exists.
Not quite. A list without evaluation evidence for a critical supplier is a significant gap under clause 7.4.1.
Key terms
- approved supplier list: A controlled list of suppliers the organisation has evaluated and approved, with scope, status and review dates.
- proportionate control: Control whose depth matches the effect of the purchased item on the device and the device risk.
- re-evaluation: Periodic reassessment of a supplier using monitoring results to confirm it should remain approved.
- outsourced process: A process affecting product conformity that is performed by an external party but remains the organisation's responsibility under clause 4.1.5.
- supplier tier: A risk-based category, for example critical, important or general, that sets how deep the evaluation and monitoring are.
- nonfulfilment: Failure of a supplier to meet purchasing requirements, which must be addressed in proportion to risk.
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- Advisera: How can ISO 13485 clause 7.4 Purchasing enhance procurement
- Hardcore QMS: Verifying purchased product according to ISO 13485 7.4.3
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.