FDA Requirements for Supplier Management: A Primer from EduQuest

Supplier Management: A Primer for Meeting

FDA Requirements

Managing Relationships with

Your Third-Party Vendors, Suppliers

and AuditorsBy: Martin Browning, President & Co-Founder, EduQuest, Inc.

www.EduQuest.net or email [email protected], DC

http://www.eduquest.net/



mailto:[email protected]

2

EduQuestEDUcation: QUality Engineering, Science

and Technology

Global team of FDA compliance experts based near Washington, DC, with staff located in U.S. and Europe

Founded by former senior officials and expert investigators from FDA’s Office of Regulatory Affairs (ORA) Headquarters

Advisors to medical device, pharmaceutical, biologics, tobacco and food companies since 1995 – Fortune 500s and Start-Ups

Authorities on audits & training for Quality Systems, Supplier Control, Risk Management, Part 11, Validation, and Inspection Readiness

© 2014 EduQuest, Inc.

Martin Browning

President & Founder, EduQuest

22 years with U.S. FDA as expert investigator and rule-maker

Special Assistant to Associate Commissioner of Regulatory Affairs

Co-Author of 21 CFR Part 11 for Electronic Records & Electronic Signatures

Former chair of U.S. ISO 9000 committee; served as FDA liaison to the Global Harmonisation Task Force (GHTF)

Helped to develop the Quality System Regulation (QSR) for Medical Devices

Chair of EduQuest’s classroom training courses (www.EduQuest.net)

, & Technology

http://www.EduQuest.net/



Managing Relationships with Third-Party Vendors, Suppliers and Auditors

Overview• What’s Behind the Drive to Outsource

– A growing problem• FDA Requirements and Expectations

– Who’s responsible for what?– Selecting partners– Notifying FDA

• What NOT to Outsource• Common Pitfalls & Advice for Avoiding Them• Looking Ahead at the Trends

© 2014 EduQuest, Inc. 4


What’s Behind the Drive to Outsource

“What can be outsourced?

Everything, except responsibility.”



Why outsource?• Cost reduction• Better focus on “core” business• Reduce or control personnel “overhead”• Improve organizational performance



Outsourcing IT, for example• Reduce the cost of supporting an IT

infrastructure• Improve the organization’s efficiency and

performance• Comply with the company’s strategic direction



Outsourcing Manufacturing, for example• Reduce the cost of supporting a manufacturing facility

(or unique line, or special product)• Improve the organization’s efficiency and performance• Comply with the company’s strategic direction and

core expertise (development, marketing, etc.)


FDA Requirements and Expectations

• You, the regulated entity, are responsible for compliance with all of the applicable regulatory requirements.

• If you outsource, you are responsible for the performance of your outsourcing partners.



• If you outsource IT, you are still responsible for assuring that all required activities are performed and documented.

• Monitoring is critical, so typically a more robust quality organization is needed for audit, oversight, etc. (note that this also can be outsourced)



• If you outsource manufacturing, you are still responsible for assuring that all specifications are met, required activities are performed, data is maintained, and regulatory requirements are met.

• Monitoring is critical, so typically a more robust quality organization is needed for audit, oversight, etc. (note that this also can be outsourced)


Select Partners Compatible with Your Standards and Integrity

• Those who outsource must have established:– Company moral and integrity standards clearly stated

in policy documents– Mission statement– Quality policy– Management responsibilities– Quality responsibilities



• Management (not Quality) must have processes for evaluating potential partners (suppliers, sub-contractors, etc.)– Survey, audit, selection process– CAPA processes– Clearly defined risk analysis– Clearly defined regulatory compliance processes



• Potential partners should have already defined their own moral standards and integrity and these must be a good “fit”

• Potential partners must understand and be willing to fully comply with regulatory requirements

• Potential partners must understand and be willing to accept regulatory risks


Notify FDA About Your Partners

• Disclosure (in advance) is required for some submissions

• Disclosure is made during inspections, discussions, meetings, formally and informally

• Some outsourcing partners are required to register with the FDA


Notify FDA About Your Partners

• FDA has authority to inspect most (if not all) outsourcing partners

• A corporation can outsource to itself but…• Changes of suppliers may require Agency

notification• Document everything!


Common Pitfalls of Outsourcing

• A partner changes processes, personnel, locations, ownership, etc. without notifying you

• If it’s not in the contract…• The service, system, software, product, etc.

doesn’t really exist…yet• A partner has your data…now what?


How to Avoid the Pitfalls

• Diligent audits• More diligent monitoring• Review the data• Make sure everything is in writing• Train them on your requirements, regulatory

requirements -- and retrain as necessary• Constantly measure compliance


What Should NOT be Outsourced

• Activities where a company holds the technical expertise and does not want to give away control

• Activities that cannot be monitored• Activities involving specific commitments to

FDA or other government Agencies


How to Protect Your Company

• Contracts and Service Level Agreements (SLAs)– Responsibility and processes must be established for

handling non-conformances– Responsibility for initial investigation, root cause

analysis, follow-up, correction, corrective action, etc. must be established

– Issue closure must be clearly defined and assured


Keys to Supplier Oversight and Monitoring

• Monitor and Trend– Monitor based upon defined processes and defined

risk– Collect key process data on performance (control

points)– Trend past, current, and future performance relative

to expectations and quality goals


Keys to Supplier Oversight and Monitoring

• Continuous Improvement– Actions based upon defined risks

• Reevaluate risks• Reevaluate processes

– Predefined mitigations• Measure effectiveness• Refine mitigations


Looking Ahead at Trends

• FDA currently inspects outsourced activities based upon submissions (GLP, GCP), upon risk (contract sterilizers, etc.), or upon complaint– Inefficient– Costly– Too late– Embarrassing



• FDA’s movement toward Quality Systems and risk-based approaches for Agency activity logically leads toward a QS approach in the GLP and GCP areas (periodic quality systems inspections rather than submission specific inspections)

• Preventive rather than reactive oversight is far more efficient



• Increased use of standards and international harmonization efforts

• More regulation of research and development (standards, regulation, guidance)

• Continued growth of outsourcing• New data risks• More regulatory oversight


Need Help with Your Supplier Management?

Contact:

EduQuest, Inc.1896 Urbana Pike, Suite 14

Hyattstown, MD 20871 USA (near Washington, DC)+1 (301) 874-6031

[email protected]

To subscribe to free monthly EduQuest-ions & Answers e-newsletter:

http://bit.ly/EduQuestQAsignup









For continued news & updates:Subscribe to free monthly EduQuest-ions & Answers

e-newsletter:http://bit.ly/EduQuestQAsignup


EduQuestEDUcation: QUality Engineering, Science

and Technology

FDA Compliance Training Classes available from EduQuest:

Managing and Auditing Supplier Quality(Learn to measure and monitor supplier quality systems, processes and documentation)

FDA Auditing of Computerized Systems and Part 11/Annex 11

(FDA’s expectations for data integrity. Includes 3 mock FDA audits of real-world computer systems.)

Quality Risk Management for FDA/ICH Q9 Compliance

(How to identify, assess, and mitigate GxP risks while meeting FDA rules and international guidance)

The CAPA Clinic: Effective CAPA Systems, Failure Investigations and Complaint Management

(Improving your CAPA system through better data collection, management reporting, trending, and root cause analysis)

QSR Compliance Basics: Complying with FDA’s 21 CFR 820 Quality System Regulation

(Fully understand your company’s obligations for Quality Systems under 21 CFR 820)

Design Control for Medical Devices(How FDA expects you to develop, implement, and manage design controls)

All offered publicly or as on-site, on-demand classes -- when and where you need them.

Details at www.EduQuest.net , or Email: [email protected]




Health & Medicine

FDA Requirements for Supplier Management: A Primer from EduQuest