Purchasing Controls
Purchasing controls ensure that purchased products and services conform to specified requirements. They are one of the most commonly cited areas in FDA 483 observations.
Regulatory basis — § 820.50
Under 21 CFR § 820.50 (QMSR), manufacturers must:
- Establish and maintain procedures to ensure that purchased products and services meet specified requirements
- Evaluate and select potential suppliers and contractors based on their ability to meet requirements
- Define the type and extent of control over suppliers based on the effect of the purchased product or service on device quality
- Establish and maintain records of acceptable suppliers
Supplier qualification
Risk-based approach
The level of control applied to a supplier must be commensurate with the risk to device quality posed by the supplied product or service:
| Supplier risk level | Examples | Qualification approach |
|---|---|---|
| Critical | Contract manufacturers, sterilisation contractors, critical components | Full audit, approved supplier list, incoming inspection or skip lot |
| Significant | Non-critical components, calibration services | Documented qualification, certificate review, periodic re-qualification |
| Standard | Raw materials, consumables | Supplier questionnaire, certificate of compliance |
Qualification methods
- Supplier audit — on-site or remote assessment of the supplier's quality system
- Supplier questionnaire — documented responses to quality capability questions
- First article inspection / qualification testing — testing of initial product lot
- Certificate of conformance — supplier provides documented certification of conformance
- ISO 13485 or equivalent certification — third-party certification accepted as part of qualification
Approved Supplier List (ASL)
The Approved Supplier List (or Approved Vendor List, AVL) is the documented record of qualified suppliers. Purchasing from a supplier not on the ASL is a QMSR violation.
Purchasing data — § 820.50(b)
Purchasing documents must clearly describe or reference:
- Product or service requirements (specifications, drawings, standards)
- Quality requirements (inspection requirements, certificates required)
- Approved supplier identification
Receiving acceptance activities — § 820.80
Incoming products must be inspected to verify conformance to specified requirements before being used in production. The extent of incoming inspection may be reduced for qualified critical suppliers with strong performance history.