Taking Responsibility for Supplier Purchasing Controls

Sept. 13, 2010
How to establish clear guidelines, and stay out of trouble, courtesy of compliance consultants, a finished goods manufacturer, and a supplier.

Manufacturers bear responsibility for every step of their global supply chain, FDA Commissioner Margaret Hamburg has stated recently; and the Agency is taking strict enforcement action. In 2009, 12% of 483 Observations and 16 Warning Letters were issued citing inadequate supplier qualification [1]. Concerned not only with the failure of some U.S. manufacturers and suppliers to comply with the U.S. Code of Federal Regulations, the Agency recently hired over 700 inspectors to ensure that the FDA performs overseas inspections on a timely basis [2]. For manufacturers, the responsibility may seem overwhelming as it impacts more than 330,000 suppliers in over 150 countries worldwide [3]. How, one may wonder, did we get here?

Traditionally, critical components like Active Pharmaceutical Ingredients (APIs) or printed circuit boards (device) were manufactured internally by Finished Goods Manufacturers (FGMs). In an effort to reduce costs and/or reduce-regulatory scrutiny, many pharmaceutical and medical device FGMs began outsourcing to suppliers nationally and globally. Increased failures of these critical components led to recalls, patient safety issues and caught the attention of the FDA and Congress, and generated tremendous public outcry. Some of these incidents have resulted in hundreds of serious adverse reactions and scores of deaths, as was the case in 2008, when a contaminant was found in lots of heparin from an outsourced supplier in China.

These incidents need not reach a critical stage as there are cost-effective, compliant solutions available. This article presents the perspectives of three sets of experts—regulatory compliance consultants; a finished goods manufacturer and a supplier. While the FGM and supplier co-authors hail from the device industry, their insights apply to pharmaceutical FGMs and their suppliers.

I. Regulatory Compliance Expectations—Consultant Perspective

Regulations and Guidance Documents
Manufacturers are wise to remember that the purpose of assessing the capability of suppliers is to ensure that supplier components meet FGM requirements [4]. FGMs need to provide a greater degree of assurance beyond that provided by receiving inspection and test. An appropriate component supplier and services quality assurance (QA) program should include a combination of assessment techniques.

One such technique and regulatory enforcement trend is supplier process validation. FGMs need to ensure that validation processes employed by their suppliers not only meet the supplier’s own processes, but meet the validation processes requirements of the FGM as part of either: a) the qualification of the supplier by the FGM, and/or b) through the review of validation protocols conducted by the supplier for the manufacturer. This would include all aspects of the validation process, including process output performance levels (i.e., acceptance criteria), statistical requirements, review/resolution of deviations, etc.

For pharmaceuticals, the expectation of an Active Pharmaceutical Ingredient supplier, the equivalent of a critical component supplier for medical devices, is much more clearly defined in ICH Q7A, and closely mirrors the same GMP regulations applied for Finished Goods Manufacturers—i.e., CFR 21 Part 211.  Additionally, the requirements for API supplier validation are comprehensive, from equipment and facilities qualification, to analytical test methods, cleaning, and process validation.

The “gray” area is that the application of the guidance and cGMP requirements depends on the type of manufacturing, (e.g., chemical vs. API derived from animal or plant sources vs. biotechnology), cell culture and degree of manufacturing, (e.g., cutting, mixing, and/or initial processing vs. isolation and purification), where more complex and final processing of material has a higher degree of applicability.

The quality systems approach also calls for periodic auditing of suppliers based on risk assessment. According to the FDA’s “Guidance for Industry Quality Systems Approach to Pharmaceutical cGMP Regulations,” the audit should include an examination of the supplier’s quality system to ensure that reliability is maintained and quality is built-in throughout its component manufacturing. Although this is only a guidance, it is up to the FGM to provide rationale, through a risk assessment, as to why such an approach was not used; or risk being cited for inadequate establishment of the reliability of the supplier’s analyses (§ 211.84 d(2)).

In addition, the guidance recommends that changes to materials (e.g., specification, supplier, or materials handling) be implemented through a change control system with certain changes requiring review and approval by the Quality Unit per § 211.100(a). It is also important to have a system in place to respond to changes in materials from suppliers so that necessary adjustments to the FGM’s process can be made and validated if appropriate; helping to avoid unintended consequences.

Theoretical application
So where do we draw the Quality Systems Regulation (QSR) applicability line? It is clear that critical components that affect product function and patient safety plays an important role as described by the regulations and guidances cited above. However, even a non-critical component, such as a pharmaceutical excipient, can have a contamination issue through supplier processing and shipping that could lead to patient injury or deaths.

Current enforcement trends indicate that the minimum quality systems for all suppliers should include:

  • Change Control (Design and Process)
  • Process Control, including Process Validation where the product quality attributes including stability cannot be fully verified
  • Supplier QA, for critical raw material suppliers 
  • Other aspects of FGMs’ quality assurance may also apply, e.g., Complaint Handling, Statistical Requirements, etc.

Ultimately, manufacturers need to view all suppliers as if suppliers were part of the FGMs’ in-house production facility.  After all, while the supplier may own the process; the manufacturer owns the product.  

Pragmatic realism
The FDA and global regulatory bodies have raised the bar on expectations for supplier controls through recent enforcement actions and issuances of guidances. The reality is that it will continue to take the industry years to come up to speed on the latest cGMP requirements.

Manufacturers must identify high-risk component suppliers through a documented risk management process, typically, design and process Failure Mode Effects Analysis that call out the function and effects of failure of the component design or process output and detection controls.  Methodologies can be utilized such as component category risk grid methodologies that prioritize remediation efforts based on degree of customization and impact to function and/or safety.

In the end, Manufacturers will need to balance risk, cost, and quality while maintaining regulatory compliance.

II. FGM Perspective

By Jim Dabbs, VP of Quality Assurance, Physio-Control, Inc. 

The challenges presented by the stricter interpretation and enforcement of the supplier control regulations are increasingly dynamic for established firms with long-standing supplier relationships and historical paradigms and practices to overcome. These challenges include ensuring that the established quality system elements continue to evolve to meet the stricter interpretation of the regulations around supplier controls.

The suppliers that produce the parts that present the highest risk to the operation of the finished product should be prioritized for first consideration and, when necessary, updated to current standards.

As an interim mitigating control, a review of the supplier’s process monitoring data gathered during production can be performed by the manufacturer as part of Incoming Quality Assurance (IQA) Inspection activities to ensure that the processes are maintained in their pre-established state of control before using the supplied parts. Alternatively, the FGM may choose to increase IQA internal test sampling using a tightened inspection plan. The interim control(s) can be discontinued once the revalidation work has been successfully completed.

Partnering with each supplier ensures that the process validations are successful. The development of the plans and protocols is a joint activity and approvals from both firms are required prior to execution. The burden of cost associated with these revalidations should be shared between the firm and the suppliers as the benefit is mutual and the requirement common to both the pharmaceutical and medical device industries.

The benefits of institutionalizing increasingly rigorous supplier controls goes well beyond sustained regulatory compliance and extends into tangible business outcomes by improving customer satisfaction through fewer supply chain interruptions of commitments and increasing operational leverage by lowering the overall cost of quality.

III. Supplier Perspective

By Peter Stein, Director of QA, Admedes Schuessler.

Manufacturers increased quality system purchasing controls requirements are creating unique challenges for suppliers. Key challenges include:

  • Balancing the role of being both a customer and a supplier. In many cases, as suppliers we may also receive critical components and/or supplies from what would be considered sub-tier suppliers.
  • As FGMs react to the expectations from the FDA, many are hastily putting into place new controls—which may vary significantly in requirements from one device manufacturer to another. These variations in requirements can, in some cases, manifest themselves into significantly different internal requirements for us; which at a minimum, can add costs to our internal processes and can also create confusion for staff.
  • Finally, significant new control requirements must come at a cost—and the pressure frequently comes to us as suppliers to absorb these costs. Although the increased controls will ultimately benefit both the suppliers and the FGMs, the implementation costs need to be shared.        

One very practical way to resolve the challenges outlined above is the development, approval, and implementation of a common Supply Quality Agreement (SQA). These Supply Quality Agreements initiate from a common template for all customers that meet the applicable international and U.S. regulatory (QSR) requirements. The common template is then customized to take into account each of our unique customer requirements—including reference to the manufacturer’s quality system requirements.

Once completed, the SQA establishes clear definitions of responsibilities for us, the supplier, and for our customer, the finished goods manufacturer. Key topics included in the SQA are:

  • Ownership of Product Specifications
  • Inspection Plans
  • Audit Functions
  • Complaint Handling 
  • Change Control
  • Process Validation
  • Process Controls
  • Design Controls
  • Control of Sub-Tier Suppliers
  • Legal Aspects
  • Key Personnel Responsibilities

While all the above elements are critical to the success of the FGM/supplier relationship, one of the most challenging elements is Change Control. The challenge frequently comes from poorly worded agreements, which often times include language such as “significant changes” or “changes that could impact the finished product”. The supplier is often asked to make decisions for changes that originate in our processes, but in many cases we may not be fully qualified to make these decisions. To ensure effective change control processes are fully implemented requires:

  • Clear language within the SQA agreements
  • Effective supplier quality system change control processes
  • Consistent provision of change control information to the FGM
  • Oversight by both the supplier’s and manufacturer’s audit processes 

As a supplier, design transfer is always a critical phase for us because once our customer receives FDA clearance to market their product, there is always a significant push to move from a pre-production/development environment to full production.

Process controls have to be implemented and demonstrated to the customers as required by QSR. Clearly, the initial cost of validating a process can be significant, but inevitably adds value by ensuring a stable process that consistently achieves desired results with a high degree of assurance. Once a validated state is achieved, process controls then need to be established to ensure processes remain in a state of control.

Remediation is also important. The above outlined practices are challenging enough to implement on a go-forward basis, but the retrospective application of these requirements can be daunting. Although there is not a one-size-fits-all solution here, some key considerations should include:

1.    Under whose quality system requirements will the work be performed? To become an approved supplier, it is important to demonstrate that quality system processes meet all applicable international quality systems, and U.S. regulatory requirements. As such, all work should be performed under the requirements of the supplier’s quality system requirements. The extent of the oversight (review and approval) by our customer should be defined by the SQA.

2.    When resources are provided by the FGM, who is responsible for managing the overall resource effort? Since the work is being performed under the requirements of the supplier’s quality system, and in most cases, the work is being performed at the supplier’s site, it is recommended that the effort be managed by the supplier. As with most resources, the cost of managing the project should be shared. 

3.    Who will fund the retrospective review and implementation activities? There is no simple answer here, but since there is a shared benefit to bringing older processes into current requirements, these costs should also be shared. There are also other ways to resolve cost situations, such as negotiating additional product volumes.


With the FDA’s focus on purchasing controls, the following is clear:

  • The bar is being raised quickly—FDA does not see this as a new requirement and expects FGMs to conduct remediation, (where required), within aggressive timelines. 
  • Finished good manufacturers that do not take the issue seriously are likely to face regulatory action.
  • Where remediation is required, utilize a risk management approach to prioritize work, but not to eliminate work. Manufacturers cannot “risk-manage” away the regulatory requirements.
  • Develop a detailed SQA that accounts for the FGM’s quality system requirements and clearly defines the FGM’s and supplier’s area of responsibility.
  • Suppliers should not necessarily wait for direction from their FGM customers in this area. 
  • There is no simple answer. Collaboration between manufacturers and suppliers is critical to success; ideally costs should also be shared.

The effort required to come into full compliance can be significant depending upon the number of products a manufacturer has on the market, the complexity of the processes that are outsourced, and the depth of the supply chain. The time to act is now.  Manufacturers and suppliers who heed to regulatory compliance requirements avoid regulatory action, improve business outcomes, and most important, decrease patient safety issues.

About the Authors

Braulio Ortiz is co-founder and project manager at BioTeknica (Miami, Florida). He has extensive experience in regulatory compliance, quality systems, engineering, process validation, and manufacturing for the biomedical, pharmaceutical and medical device industries. Additionally, he has been instrumental in successfully leading third-party consulting efforts for companies that received FDA Warning Letters or Consent Decrees.
Michael Neaves is Senior Quality consultant at BioTeknica. Mike has specific experience in design, installation, and continuous improvement of 21 CFR Part 820 and ISO 9001 compliant quality systems as well as dealing with FDA and third-party inspections, Consent Decree and Warning Letter responses.

Jim Dabbs is Vice President of Quality Assurance for Physio-Control (Redmond, Washington), a manufacturer of external automated defibrillators and a division of Medtronic, Inc. Jim was formerly with Abbott Laboratories.

Peter Stein is Director of Quality Assurance for Admedes Schuessler GmbH (Pforzheim, Germany), a contract manufacturer and supplier of stent components to the Class III Device industry.  Admedes is in the process of establishing a manufacturing site in northern California.


1.    Avellanet, John. FDA Drug Enforcement: An Analysis of Warning Letter Trends. FDANews, March 2010.
2.    Seventh Annual Medical Device Quality Congress, June 2-4, 2010, Bethesda, Maryland.
3.    FDAnews [[email protected]], June 26, 2010.
4.    Medical Devices; Current Good Manufacturing Practice (cGMP) Final Rule; Quality System Regulation [Federal Register: October 7, 1996 (Volume 61, Number 195), Supplementary Information, Section V.  Response to Comments and Rationale for Changes, comment no. 107.]

About the Author

Braulio Ortiz and Michael Neaves | BioTeknica Consulting