Devicemakers Can Use Seven Steps to Qualify Virtual, or All, Suppliers
While devicemakers often can’t tell which of their suppliers are virtual companies, a set of seven steps has proven effective for qualifying suppliers — including those that are, or could be, virtual, an expert says.
“At least 10 to 11 percent of your suppliers are virtual companies,” John Avellanet, founder of Cerulean Associates, told attendees of a recent FDAnews webinar. “So for at least 10 percent of your suppliers, you’ve got to be doing extra things to control them because you’re never going to be able to go on site.”
Traditional qualification involves remote prep work for an audit, the onsite audit and then contractual control negotiations. But for a company that may be virtual, or can’t be physically audited because of distance or other factors, the devicemaker must put much more work into remote preparation, Avellanet said. Manufacturers should keep the results of this information gathering in a vendor dossier to show regulators.
Avellanet recommends a seven-step qualification procedure, including:
Step 1: Rapid red-flag review. This should be a 20-minute activity that involves looking at the supplier’s website for consistency, misspellings (particularly regulatory acronyms like HIPAA), whether information is current, whether email addresses match the website URL and whether physical addresses fit expectations.
A Google Earth revelation of an address mismatch is the No. 1 way devicemakers discover a company is virtual, Avellanet said. “You must have your people be familiar with Google Earth. It is absolutely critical.”
Devicemakers should also check debarment lists, including the State Department Terrorist Exclusion list.
Step 2: Basic criteria verification. This involves checking whether a company is incorporated with liability insurance, looking at financial history, assessing experience with whatever the devicemaker wants to purchase, experience dealing with regulated customers and experience dealing with customers in the devicemaker’s region. It is key that the supplier has an employee fluent in the devicemaker’s language, or vice versa, Avellanet said.
Step 3: Reputational due diligence. Devicemakers should check for industry accreditations or certifications, association memberships, awards, independent third-party assessment reports, periodical publications and regulatory compliance history.
During the webinar, Avellanet pointed to a May warning letter on supplier control that cites legal cases that raised the bar for corporate responsibility. This indicates “the agency is getting very frustrated regarding supplier oversight and they’re really looking to hammer home this concept of ultimate accountability,” he told attendees.
You may believe that your people are on top of the GMP requirements — but what about the suppliers and contractors coming in and out of your facility? Do they understand your rules and standards of procedure? If you’re not sure how to go about broaching the subject, then GMP Training for Contractors and Visitors is for you. Order your copy of the DVD now.