New ISO 13485 Expands On QSR Supplier Requirements

What has always been implicit in the FDA’s Quality System Regulation is spelled out in detail in the 2016 version of international standard ISO 13485.

The International Organization for Standardization’s revision of its purchasing controls requirements, the first in 13 years, closes gaps in supplier management practices left by the less detailed U.S. rule. Consultant Dan O’Leary, president of Ombu Enterprises, noted five key differences between ISO 13485:2016 and the QSR.

First, the QSR states that manufacturers must establish supplier selection requirements. By contrast, ISO 13485:2016 is more specific, providing that they must establish criteria based on a supplier’s performance and its impact on the finished medical device.

Second, while the QSR says that manufacturers must evaluate potential suppliers, ISO 13485:2016 emphasizes monitoring and re-evaluation of accepted suppliers.

Third, the QSR requires manufacturers to practice document control in setting supplier specifications, while ISO 13485 says only that they must ensure that purchasing requirements are adequate before communicating them to the supplier.

Even though the ISO standard does not mention document control, O’Leary recommended that manufacturers do it anyway because it is required under the QSR and “is a way for the appropriate people to review and approve these purchasing requirements.”

Fourth, the QSR says that, where possible, a change notification agreement should be obtained. ISO 13485:2016 states that purchasing information must include, as applicable, a written agreement that the supplier will notify the manufacturer of changes prior to implementation.

“I suspect that many suppliers are not going to sign up” for the ISO change notification standard, O’Leary said.

Finally, the ISO standard says manufacturers must determine whether changes affect the production process or the finished device. There is no corresponding requirement in the QSR.

After dozens of years of the same old, same old, manufacturers will need to make adjustments. Will the requirements really be consistent with current cGMP and quality system requirements? What is the bottom line impact on CAPA, supply chain, adverse event reporting, environmental controls and complaint handling? We compiled the most comprehensive presentations on the subject. Register today for one day webinar on Dec. 20 to gain the most comprehensive understanding of the new ISO 13485 standard.