Supplier controls are a fundamental aspect of every quality management system (QMS) and one of the most frequently discussed topics during audits or inspections. Many recalls, warning letters, and even the 2012 breast implant scandal, which led to changes in EU legislation, stemmed from inadequate supplier qualification and insufficient supplier controls. In this context, what does a global supply chain mean in terms of business risks?

Medical device manufacturers must ensure that all aspects of their supply chain are compliant. The connection between supplier controls and business risks is becoming increasingly evident, especially as the criticality of supplied parts or materials grows and supply chains become more global. In my work as a regulatory consultant and auditor, I frequently encounter supply chain management issues, particularly when companies are preparing for audits or inspections in various countries. Many express concerns about potential severe disruptions due to inadequate control of supply chain risks. A common question from companies operating within a global supply chain is how to manage oversight in specific countries, particularly regarding supply chain controls and border regulations for delivering parts, components, or pre-finished devices. They also inquire about labeling requirements to avoid legal violations that could result in shipments being held at the border. Addressing these questions is crucial for medical manufacturers before engaging suppliers or shipping parts and materials.

A business perspective on a global supply chain

Today’s medical supply chains are complex and global, often involving numerous suppliers. The perceived simplicity of a medical device may mask a complicated supply chain. Manufacturers source individual components, parts, or raw materials from various suppliers, who in turn may obtain certain components from other suppliers, and so forth. Depending on the component or material, specific delivery conditions may be required, or substances may necessitate particular safety labeling (e.g., compliance with European Union directives such as WEEE, RoHS, or REACH). 

Subcontractors may also be involved, for example, when products require sterilization. As a result, the number of direct and subtier suppliers and subcontractors in a supply chain can be extensive. In some cases, specific components or raw materials are unique to a particular medical device, which can limit the number of available suppliers. Furthermore, these suppliers may not always be well-qualified or fully aware of the necessary documentation (objective evidence) required to meet regulatory supply chain standards.

The regulatory view on a global supply chain

Regulatory oversight and safety standards for medical device components, parts, and raw materials can vary significantly based on the level of risk they pose and the jurisdiction involved. However, they all share a common focus: safety. A medical device is only as safe as its parts. Regulators are trained to identify violations and take action to protect public safety. As a result, low-quality or poorly documented parts, components, or materials can lead to a classification of a medical device as “low-safe,” resulting in significant repercussions and costs.

This is why supplier control and supplier management are mandated in QMS regulations worldwide. Auditors consistently examine the criticality and associated risks of suppliers within the medical device supply chain, expecting robust controls for high-risk suppliers (e.g., US 21 CFR Part 820.50, ISO 13485 sections 4.1 and 7.4).

Such high-risk suppliers are often referred to as “crucial suppliers” or “critical subcontractors.” The expectation is that these high-risk suppliers maintain an adequate QMS, are subject to audits, and have established sufficient controls (including incoming inspections and final release testing) to ensure consistent quality. Most require written agreements that include product change notifications and supplier audits as part of the documentation needed to demonstrate that supply chain risks are effectively managed and that high-risk parts, components, or materials conform to defined specifications.

Balancing global supply chain with strategic supplier audits 

Overall, the decision-making process for selecting a supplier from a business perspective is always a balancing act between cost, quality, and risk for medical device manufacturers. Inadequate supply chain controls can trigger a domino effect of negative consequences, such as a halt in sales or even legal fines. This potential business risk increases as more global supply chain players and regulators become involved. Regulatory agencies worldwide are increasingly scrutinizing critical components provided by suppliers and can track and search their established databases for potential candidates to audit or inspect.

While you cannot change this increasing scrutiny from agencies, you can prepare for such events and reduce the risk of supply chain disruptions through focused supplier audits for high-risk parts, components, or materials. These supplier audits should be well-documented and conducted by a trained auditor experienced in understanding the regulatory nuances of supply chain requirements and interpretations. This expertise is particularly important when specific country legislation in global supply chains must be considered. If you lack this global expertise, consider hiring a qualified external auditor. Many regulatory consultancies have local in-country auditors who are familiar with the specific pitfalls of country legislation and case scenarios, which can be significantly beneficial. Language issues may also play a crucial role in conducting effective supplier audits.

Independent and realistic feedback on supplier risks and associated business risks can provide valuable insights for companies, helping them avoid major non-conformities during QMS audits. In several client scenarios, I encountered strong resistance regarding expected outcomes (non-conformities) from supplier audits, which subsequently required documentation as corrective and preventive actions (CAPAs) and could directly impact the company's operations. A potential solution is conducting a gap analysis, which offers more flexibility compared to a formal audit. This approach allows for documentation of potential gaps and encourages open discussions with auditees about improvement opportunities. In business terms, this can also be seen as a “maturity assessment.”

Regardless of whether you conduct an internal or external audit, or a gap analysis, it is significantly beneficial for both the medical device manufacturer and the supplier to understand areas for improvement and act on these insights before regulatory agencies intervene. The regulatory knowledge and independent perspective of qualified external auditors can lead to substantial improvements and a deeper understanding of risks, helping to avoid foreseeable critical scenarios.

At Pure Global, we have qualified auditors who conduct systematic and independent supplier audits around the globe. By leveraging these strategies, you can reduce business risks and associated costs in a global supply chain when suppliers are involved. In simpler terms, “Let the supplier be aware” and “Let the regulatory experts do their jobs.”

Visit our website or contact us to discuss your challenges and how Pure Global’s regulatory consulting services can help.

‍