An important part of FDA's quality system regulation (QSR), which went into effect last year, is the inclusion of a new section on purchasing controls. This section requires regulated device manufacturers to undertake activities to ensure that the goods and services they purchase conform to specified requirements.¹

In compiling the rule on purchasing controls, FDA intentionally avoided prescriptive formulas or specific requirements wherever possible. The rule therefore allows manufacturers a great deal of flexibility in the way they go about ensuring the acceptability of the products and services they purchase. For the purposes of regulatory inspection, the rule instead emphasizes the need for manufacturers to document the processes they use as purchasing controls.² This article reviews the key points of the QSR's purchasing control requirements—areas that FDA field officers will review during their inspections of regulated manufacturers.

Evolution of QSR Purchasing Controls

One of the primary motives for FDA's inclusion of purchasing controls in the QSR is the agency's recognition that a significant number of product recalls have occurred because device manufacturers did not have adequate means of controlling the quality of the products and services they purchased. In the preface to the QSR, the agency says that "about 15 percent of the recalls each year are due to unacceptable purchased products. Many of these products are unacceptable because the finished device manufacturer did not properly describe the product."³ Although the preface does not provide enough information to determine what percentage of diagnostics recalls have been caused by this failing, there is certainly no reason to believe that IVD manufacturers are immune from the potential for such errors.⁴ To make certain that such errors do not occur, the QSR requires manufacturers to implement the basic mechanisms needed to ensure that only acceptable products and services are used in the manufacturing of their products.

Harmonization. Another motive for the inclusion of purchasing controls is to bring FDA's regulation into conformity with ISO 9001, the fullest of the quality system standards compiled by the International Organization for Standardization and the basis for worldwide efforts to harmonize quality standards.⁵ Although the purchasing controls section of the QSR is modeled closely after the equivalent sections of ISO 9001, FDA discourages manufacturers from relying on the requirements for ISO certification as the sole basis for their purchasing controls. In its preface to the QSR, FDA cautions manufacturers against relying solely on certification by third parties as evidence that suppliers have the capability to provide quality products or services. FDA has found during inspections that some manufacturers who have been certified to the ISO standards have not had acceptable problem identification and corrective action programs. Therefore, the initial assessment or evaluation, depending on the type and potential effect on device quality of the product or service, should be a combination of assessment methods, to possibly include third party or product certification. However, third party certification should not be relied on exclusively in initially evaluating a supplier.⁶

In short, knowing that a supplier is certified to one of the ISO 9000 family of standards may be a useful way of characterizing the sophistication of its quality system, but it does not guarantee that the company's practices will satisfy the requirements of the QSR. Particularly if the manufacturer has no previous experience with the supplier, it may be appropriate to conduct an on-site audit that will verify the truth of any claims the latter has made about its ability to comply with the QSR, the European Union's medical device directives, or other regulations and standards applicable to the manufacturer's products.⁷ If the manufacturer intends to export those products to the European Union (EU), it would be especially appropriate to assess vendor compliance with the terms of European norm (EN) 46000, which applies the quality requirements of ISO 9001 specifically to the production of medical devices.^8—11

A Changing Industry. Industry also has strong reasons to find the inclusion of purchasing controls in the QSR both useful and desirable. The strong impetus toward consolidation throughout the medical device industry—and, over the past year, particularly in the diagnostics sector—can result in oversubscription of a company's resources, making it reliant on the use of outside suppliers. Similarly, pressure to contain costs can often lead manufacturers to outsource portions of their operations, leading to greater reliance on an emerging base of subcontractors and consultants. One survey of manufacturers indicated that 59% of respondents intended to increase their use of subcontracted services.¹²

Such growth in the importance of outside suppliers places increased significance on the contractual relationships between manufacturers and their vendors, and highlights the need for purchasing control systems that will help all parties comply with essential quality standards. Following the QSR's purchasing control rule will benefit both suppliers and manufacturers. Although component suppliers are not required to comply with the rule, they can still derive benefit by using it as a guide for their operations and as a way to better understand the expectations of their customers in the device industry. Meanwhile, manufacturers can use the rule as a means to develop a more educated supplier base. Bob Kanuga, director of procurement for chemical manufacturing at Merck and Co. (Whitehouse Station, NJ), sums it up: "It may be necessary to define for suppliers what a strategic position they hold for the manufacturer. . . . In small companies or start-ups, who have not had an FDA 'experience' . . . often they do not understand why [FDA-registered manufacturers] have requirements often higher than basic industry standards."¹³

Purchasing Control Requirements

The purchasing controls that are now a part of the QSR were not present in its predecessor, the good manufacturing practices (GMP) regulation.¹⁴ FDA's new additions include sections to govern the compilation of purchasing specifications and the evaluation of a suppli-er's ability to consistently meet those requirements. The rules apply to contract services performed for the manufacturer as well as to components that it receives or purchases. Notably, FDA defines a component as "any raw material, substance, piece, part, software, firmware, labeling, or assembly which is intended to be included as part of the finished, packaged, and labeled device" (21 CFR 820.3(c)). Although labels and package inserts are considered components, and are therefore subject to the purchasing control requirements, they are also governed under separate regulations. Before dealing with issues involving these components, manufacturers should review the requirements under general device labeling and in vitro diagnostic labeling (21 CFR 801 and 21 CFR 809, respectively).

Evaluation of Suppliers, Contractors, and Consultants. The QSR makes it the responsibility of device manufacturers to establish the requirements that must be met by their suppliers (21 CFR 820.50 (a)). As used by FDA, the term establish has a very specific meaning: to "define, document (in writing or electronically), and implement" (21 CFR 820.3(k)). Consequently, this single section of the rule means that device manufacturers must define their requirements for suppliers, document those requirements, and ensure that they are implemented—all in all, a fair amount of work.

To comply with this general requirement, manufacturers should define what criteria they will apply and what methods they will use to assess whether the supplier meets those criteria. The QSR gives manufacturers a great deal of flexibility in meeting this requirement; the criteria and evaluation tools that a manufacturer chooses to use may vary widely according to the nature of the product or the supplier under consideration. FDA expresses this intention in the preface to the QSR.

Thus, a finished device manufacturer may choose to provide greater in-house controls to ensure that products and services meet requirements, or may require the supplier to adopt measures necessary to ensure acceptability, as appropriate. FDA generally believes that an appropriate mix of supplier and manufacturer quality controls are necessary. However, finished device manufacturers who conduct product quality control solely in-house must also assess the capability of suppliers to provide acceptable product. Where audits are not practical, this may be done through, among other means, reviewing historical data, monitoring and trending, and inspection and testing.¹⁵

Beyond this general requirement, the purchasing control rules specify three additional activities that manufacturers must perform. First, they must evaluate and select suppliers on the basis of their ability to meet the specified requirements, and then they must document their evaluations (21 CFR 820.50(a)(1)). When deciding on the type of evaluation method to employ, manufacturers should take into consideration the reasons for conducting the evaluation. The depth and type of assessment may differ depending upon whether the supplier is new, a provider of a vital part or process, a sole-source supplier, a supplier of off-the-shelf components, or a known supplier whose quality has recently begun to deteriorate.¹⁶ Whatever method the manufacturer decides to use, its requirements must be defined, documented, implemented, and maintained. According to the terms of the QSR, the results of the evaluation are to provide the sole basis for the selection of suppliers.

Second, based on their evaluations, manufacturers must define the type and extent of quality control to be put in place for each purchased product and its supplier. The regulation permits manufacturers to determine what proportions of in-house and supplier quality controls are appropriate for each product and supplier (21 CFR 820.50(a)(2)). These may vary widely, depending upon the nature of the material or type of component being purchased, its intended use in the finished device, the experience and historical performance of the supplier, the amount of control the manufacturer chooses to exert on its own, and any number of other factors. The manufacturer may also define dynamic controls that may be increased or decreased according to the performance of the supplier (e.g., an increasing rate of unacceptable parts would trigger more frequent vendor audits, while a reduced failure rate would lessen the frequency of such audits). Once again, the manufacturer must ensure that whatever system it decides to use is documented and implemented consistently.

And third, manufacturers must establish and maintain records about the assessment, selection, and treatment of the suppliers they have accepted as vendors (21 CFR 820.50(a)(3)). These records should include actions that were taken to change the status of a supplier or to remove a supplier from approved status. For example, a supplier's status might be changed because of deterioration in the quality of its products, because the product no longer meets specified requirements, or because attempts to achieve corrective action have failed. All such facts should be documented.

In addition to satisfying FDA's requirements, manufacturers should take advantage of their purchasing control system to establish their own requirements and procedures. Some of these may help to meet international quality systems requirements, or they may simply help the manufacturer improve its bottom line. Some simple procedures that a manufacturer could implement might include the following.

• Defined intervals for the review of products and services to ensure that suppliers can regularly demonstrate conformity with the specified requirements.

• Procedures for maintaining a list of approved suppliers, consultants, and subcontractors that meet the company's specified quality requirements.

Purchasing Data. The QSR also requires manufacturers to establish and maintain "data that clearly describe or reference the specified requirements, including quality requirements, for purchased or otherwise received products or services" (21 CFR 820.50(b)). These product specifications are the essential bases for the relationships between manufacturers and their suppliers, consultants, and contractors. They should be clear, succinct, and fully descriptive of the material or service to be provided.

The simplest way to satisfy this requirement is to plainly describe the needed product or service by reference to a standard source. For example, a diagnostic manufacturer could identify a particular biochemical simply by referring to its catalog number, purity, description, or recognized grade or standard (e.g., sodium chloride USP, CAS number, or vendor catalog number). However, such standard sources are not always available for materials and components that are being used in conjunction with products that are still in the R&D phase of their life cycle. In this case, as early as possible in the development phase, manufacturers should establish measurable ranges that describe acceptable materials or components, with allowance for some variation. Manufacturers, in short, should define the range of acceptable materials or components based on the requirements of their products—not on what they hope the supplier can provide. Where possible, they should review the historical lot-to-lot consistency of potential suppliers to determine what should be considered an acceptable range of variations.

Once established, specifications for materials and components should be considered locked. However, the contractual relationships between a manufacturer and its suppliers should establish a basis for discussing changes to material and component specifications. Wherever possible, manufacturers and their suppliers should agree on procedures for planning and executing changes to established specifications. This will provide the manufacturer with the flexibility needed to keep up with advancing diagnostics technologies, allowing for changes to improve the overall accuracy of its diagnostic assays.

Similarly, the contract between a manufacturer and its suppliers should specify that the manufacturer must be notified of changes to a purchased product or service, so that it can determine whether the change may affect the quality of its finished device. Such an agreement should also require notification about changes to any raw material or processing parameter that might affect the quality of the purchased product or service. When a supplier declines to accept such a condition, the manufacturer must take appropriate action to ensure the continued quality of its purchased products—for example, by increasing the frequency of vendor audits or carrying out more in-house inspection of incoming products.

Changes that are accepted should be documented and placed into the manufacturer's document controls system, as specified elsewhere in the QSR (21 CFR 820.40). This step must be taken before the change is implemented.

Coordination with Other QSR Rules

As suggested above, FDA has been critical of manufacturers whose quality systems do not include appropriate methods for identifying problems and undertaking corrective actions. To prevent such situations, the QSR includes a number of additional regulations that manufacturers should observe in conjunction with the purchasing control requirements.

The QSR rule related to acceptance activities requires that manufacturers establish and maintain procedures for the acceptance of incoming, in-process, and finished products (21 CFR 820.80). Typical procedures might include inspection of sample products from delivered lots, testing of batches of delivered chemicals, or other means of verifying product quality. When viewed as an adjunct to purchasing controls, such activities can often provide advance warning of problems that a supplier is experiencing. Manufacturers should ensure that they have established a feedback loop that uses information about incoming products as part of their ongoing assessment of suppliers.

The QSR section on nonconforming product requires manufacturers to establish procedures to control finished devices that do not meet specifications (21 CFR 820.90). Part of this rule requires manufacturers to determine "the need for an investigation and notification of the persons or organizations responsible for the nonconformance." Since the responsible organization may turn out to be an outside supplier, contractor, or consultant, manufacturers should guarantee that all relevant information about nonconforming product is made a part of its purchasing control documentation.

Finally, the QSR section on corrective and preventive action requires manufacturers to investigate the cause of nonconforming product and to implement changes necessary to prevent its recurrence (21 CFR 820.100). Such corrective and preventive actions may need to involve suppliers, and should therefore be made a part of the company's purchasing control records.

Conclusion

In order for a finished device to meet its specifications, the individual components must first have met theirs. The most cost-effective way a manufacturer can minimize the risks associated with using faulty components to build faulty devices is to prevent such unacceptable components from entering the plant in the first place. But accomplishing this task means having detailed control of both the components and the companies that manufacture them.

It is for this reason that one of the key issues debated during the five years that FDA spent creating the new QSR was whether it would apply to component manufacturers. For a variety of reasons explained in the preface to the QSR, the agency eventually decided against such a policy.¹⁷ Instead, it decided to control the quality of products and services used in medical device manufacturing by relying on the purchasing control systems of regulated manufacturers. In short, according to the QSR, overall responsibility for the quality of purchased products and services lies with the regulated manufacturer.

As specified in the QSR, the primary means of controlling the quality of purchased products and services is to assess the capabilities of the suppliers, contractors, and consultants that create them. Manufacturers have a great deal of flexibility in determining how to carry out such assessments. Methods they may use include testing, supplier audits, statistical analyses, and review of a supplier's quality history. Although the results of supplier audits are not reviewed during routine FDA inspections, the agency may request a member of company management to certify that such audits have been performed. The manufacturer's audit procedures, schedules, and supplier evaluation criteria are subject to review (21 CFR 820.180(c)).

In addition, component quality can be maintained through the establishment of accurate component and service specifications, procurement methods, incoming acceptance activities, and change control. Manufacturers have definite expectations for the products and services they order, but those expectations can only be met when suppliers are provided clearly defined, precise, and explicit specifications. Where deviations from component specifications could result in a device's being unfit for its intended use, the QSR requires that manufacturers inspect, sample, and test components to ensure conformance to specification.

The QSR was designed to apply to various types of devices—including IVDs—and it requires manufacturers to develop procedures appropriate to their application. Such procedures not only ensure compliance and create manufacturing efficiencies, they can also have a positive effect on the relationships between manufacturers and their suppliers by providing a firm foundation for productive communication.

What the QSR requires

Here's the short version. The following requirements are specified in the purchasing controls section of FDA's quality system regulation (21 CFR 820.50).

• Selection of suppliers and consultants based on their ability to meet the manufacturer's requirements.

• A defined level of supplier control according to predetermined criteria.

• Reviews and inspections to confirm that the program is effective.

• Specifications that clearly state requirements for products and
  services.

• Change control of purchasing data according to the QSR section on document controls (21 CFR 820.40).

Purchasing controls for regulated manufacturers

Based on the purchasing controls section of FDA's quality system regulation, here are some key points that IVD manufacturers should consider as part of their system. Paying attention to these items will not only help manufacturers comply with the QSR, but will also ensure that suppliers, contractors, and consultants have a clear understanding of what the manufacturer expects of them.

1. Establish, maintain, and follow procedures to ensure that purchased products and services conform to specified requirements.

2. Establish and maintain requirements—including quality requirements—that suppliers, contractors, and consultants must meet.

3. Establish procedures that describe how suppliers, contractors, and consultants are evaluated and selected.

4. Define criteria and methods for changing the status of a supplier or removing a supplier from approved status.

5. Document supplier evaluations.

6. Maintain a record describing the type and extent of control over products and services provided by suppliers, contractors, and consultants based on the results of supplier evaluations.

7. Maintain a list of acceptable suppliers, contractors, and consultants.

8. Maintain documentation whose purpose is to demonstrate that purchasing documents are reviewed and approved by suppliers before purchase orders are issued.

9. Include in all purchasing documents a stipulation that the suppliers, contractors, and consultants agree to notify the manufacturer of changes in their products or services, whenever possible.

References

1. "Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation (Subpart E—Purchasing Controls)," 21 Code of Federal Regulations, part 820.50, in Federal Register 61(195):52602— 52662, October 7, 1996.

2. Trautman K, "Purchasing Controls," in The FDA and Worldwide Quality Systems Requirements for Medical Devices, Milwaukee, ASQC Press, pp 87—94, 1997.

3. FR 61(195):52626, October 7, 1996.

4. "Quality Systems: Changes in the Medical Device Good Manufacturing Practice Regulations," Art to Science in Tissue Culture, 13(1):3—10, 1994.

5. "Quality Systems—Model for Quality Assurance in Design, Development, Production, Installation, and Servicing," ANSI/ASQC/ISO 9001:1994, Geneva, International Organization for Standardization (ISO), 1994.

6. FR 61(195):52625, October 7, 1996.

7. Freiberg GP, "Optimizing Regulated-Vendor Audits," Med Dev Diag Indust, 18(3):40—48, 1996.

8. "Quality Systems—Medical Devices—Particular Requirements for the Application of EN 29001," European norm 46001, Brussels, European Committee for Standardization, 1996.

9. Gillespie H, "New GMPs for Medical Devices Usher in Many Key Changes," Today's Chemist at Work, 5(7):43—57, 1996.

10. Hooten F, "FDA Makes Quality the Rule; Part 2," Med Dev Diag Indust, 19(2):83—99, 1997.

11. Donawa M, "Purchasing Raw Materials," Med Dev Tech, 17(7):12—16, 1996.

12. "Contracting Out for Services," Med Dev Tech, 17(10):32—34, 1996.

13. Genna A, "How Merck Leverages Supply for Profit," Purchasing, pp 34C11—34C16, September 4, 1997.

14. "Good Manufacturing Practice for Medical Devices: General," 21 CFR 820, in FR 43(141):31508, July 21, 1978.

15. FR 61(195):52624, October 7, 1996.

16. "Purchasing and Acceptance Activities," in Medical Device Quality Systems Manual: A Small Entity Compliance Guide, HHS Publication FDA 97-4179, Rockville, MD, FDA, Center for Devices and Radiological Health, Division of Small Manufacturers Assistance, 1996, rpt. Santa Monica, CA, Canon Communications, pp 10-1—10-37, 1997.

17. FR 61(195):52606, October 7, 1996.

Russ Hangos is a senior quality engineer at Abbott Diagnostics (Abbott Park, IL).

Illustration by John Berry