Vendor Vetting Helps Improve Compliance, Operations
Skilled vendors can do a lot for an FDA-regulated life sciences firm -- but if there are problems with their work, the agency will place the burden of responsibility on you and make it tough to shake, an industry expert said.
"You are liable for the vendor's conduct the FDA will [usually] deal with the sponsor and not the vendor," Jonathan Andrus, vice president for Phoenix Data Systems, told attendees at a Drug Information Association conference Feb. 8.
In addition, the FDA's regulatory authority means it can demand to see how you evaluate vendors. The agency mandates that you control any outsourced operations, and a good vendor assessment plan can help demonstrate your efforts in that direction, Andrus said.
Beyond that, vetting vendors just "makes good business sense," he said. For starters, it helps you to get a better handle on your own system and goals. Evaluating a vendor also helps you understand their strengths and limitations up front. You are then in a better position to protect your firm by implementing a validation plan that emphasizes controls in areas where the vendor might not be as strong.
A veteran of dozens of vendor audits, Andrus offered his tips for vetting vendors. To begin with, firms need to understand what the FDA will look for in a vendor management program, he said. Successful vendor management procedures will clearly outline:
How often you conduct vendor audits; Who in your shop conducts them; How you signal vendor acceptance or conditional approval; and How you handle correcting or otherwise addressing problem areas raised by an audit.
Determining who should be on the internal committee is the key to a good vendor management program, Andrus stressed. In most cases, it's a good idea to involve representatives from quality assurance, purchasing, information technology, clinical research and document management, he advised.
Once you have your group in place, you need to agree on how to define issues and terms such as scope of work, vendor responsibilities, frequency of follow-up audits and other related metrics, he said.
Vendor assessment requires a flexible approach that is matched to a vendor's capabilities and the tasks they are helping you with. The rigorousness of your assessment should depend, in part, on your knowledge of a vendor's track record and on how critical the tasks are with regard to patient safety and risk, Andrus said.
With an established vendor, or one handling relatively low-risk projects, assessment may only require a questionnaire. But in other cases, be sure to conduct the vendor assessment on-site, he said. With many vendors, consider a due diligence audit, meaning a full audit is conducted before any contract is signed.
Ask the vendor to provide basic background information before the vendor audit, but you should also be prepared to do some digging. Resources such as the FDA's website will contain information about warning letters or other red flags that may be attached to your prospective vendor.
Your team should also put together a checklist that clearly defines the vendor's roles and responsibilities. Making this an addendum to the contract makes it easier to avoid "legalese" jargon in formal contracts and allows you to focus on very specific situations you're likely to encounter with the vendor on the project. Part of that agreement should include a clause regarding a "for cause" audit. Under this clause, you reserve the right to conduct an audit at any time with advance notification.
Strong Quality Agreement
A good quality agreement with a vendor will clearly lay out what the quality measurements are for the project. It should also define critical compliance responsibilities. "The quality agreement is an effective tool to enforce your firm's quality requirements with each vendor and understand the scope of validation," Andrus said.
Your team should also include provisions for decertifying a vendor. "If a vendor is consistently not keeping up their end of the bargain, you need a process in place" to stop working with that vendor, he said.
Consider adding in an escalation procedure, too, he suggested. If you aren't getting anywhere with a particular vendor rep, have your agreement spell out who you can go to if you need an alternate rep, Andrus said.
Finally, remember to share your vendor audit results with your vendor. "It helps them learn, too," Andrus said, noting that he only gets vendor audit results about 20 percent of the time. -- Michael Causey