MDSAP · Medium · 14 min lesson
Chapter 7 Purchasing - twelve tasks: supplier evaluation, purchasing data, critical suppliers and verification
MDSAP AU P0002.009 Audit Approach, Chapter 7 (12 tasks); ISO 13485:2016 clauses 4.1.5, 7.4.1, 7.4.2, 7.4.3 and 8.4
What you will learn
- Audit the 12 purchasing tasks in order and say what evidence each needs.
- Classify critical suppliers and apply controls in proportion to risk.
- Review quality agreements, purchasing data and verification of purchased product.
Key takeaways
- Chapter 7 has 12 tasks, from planning (task 1) to top management commitment (task 12).
- Critical suppliers include suppliers of finished devices, of products affecting essential design outputs, and of products or services requiring process validation.
- Controls are proportionate to risk and the manufacturer stays responsible for outsourced processes (clauses 4.1.5, 7.4.1).
- Purchasing information must include a written agreement to notify changes before implementation (clause 7.4.2).
- Verification is risk based and recorded (clause 7.4.3); supplier data must reach analysis and management review (clause 8.4).
Free practice question
A manufacturer applies the same annual questionnaire to its coating house, its contract sterilizer and its stationery vendor.
What is the main weakness?
Controls are not proportionate to the risk of the purchased product, which clause 7.4.1 requires.
Correct. ISO 13485 clause 7.4.1 and MDSAP task 4 require the extent of control to depend on the effect of the purchase on the device.
Questionnaires are forbidden under clause 7.4.1.
Not quite. Clause 7.4.1 does not forbid questionnaires; it requires criteria and proportionate control, as MDSAP task 4 explains.
The stationery vendor must be audited on site every year.
Not quite. Over controlling a trivial supplier contradicts the risk proportionate approach of clause 7.4.1 and MDSAP task 4.
There is no weakness because treating all suppliers equally is fair.
Not quite. Equal treatment ignores risk; clause 7.4.1 asks that controls be proportionate to the risk of the purchased product.
Key terms
- critical supplier: A supplier of finished devices, of products or services affecting essential design outputs, or of products or services requiring process validation (MDSAP audit approach terminology).
- outsourced process: A process of the quality system performed by an outside party; the manufacturer keeps responsibility (ISO 13485 clause 4.1.5).
- quality agreement: A written agreement setting quality duties, including notification of changes before implementation (clause 7.4.2).
- purchasing information: The description of the product and requirements sent to the supplier (clause 7.4.2; MDSAP Chapter 7 task 9).
- reevaluation: Repeat assessment of a supplier using performance data at defined intervals (clause 7.4.1; task 4).
- verification of purchased product: Inspection or other activity ensuring purchased product meets purchasing information (clause 7.4.3; task 10).
Official sources
- MDSAP AU P0002.009 MDSAP Audit Approach (FDA)
- MDSAP AU P0037.001 Guidelines on the use of the nonconformity grading system for MDSAP purposes (FDA)
- Medical Device Single Audit Program (MDSAP) Frequently Asked Questions (FDA)
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.