How Device Makers Can Improve Supplier Agreements For Better Product Safety
September 20, 2022 Law
Purchasing controls, part of the US Food and Drug Administration's Quality System Regulation, are critical to maintaining product quality and service and, ultimately, to patient safety. Supplier agreements are one aspect of purchasing controls.
Finished device manufacturers must comply with the QSR’s purchasing control requirements. However, the purchasing controls subsection includes little that’s specific to supplier agreements. The agreement-specific language is: “Purchasing documents shall include, where possible, an agreement that the suppliers, contractors, and consultants agree to notify the manufacturer of changes in the product or service so that manufacturers may determine whether the changes may affect the quality of a finished device.”
This sentence is preceded by the broader requirement that manufacturers must establish and maintain data clearly describing or referencing specified requirements, including quality requirements, for purchased or otherwise received product and services.
Some General Things to Think About When Drafting Supplier Agreements
As noted above, manufacturers must “establish” (meaning define, document and implement) and maintain data regarding requirements for product and services. Further, purchasing controls require manufacturers to have procedures to ensure that all purchased and “otherwise received” product and services conform to specified requirements. Manufacturers must also evaluate and select potential suppliers, including contractors and consultants, based on their ability to meet requirements and define controls they will exercise over received goods and services based on that evaluation.
Good regulatory, legal, business and practical acumen are clearly needed in drafting supplier agreements.
Supplier-related issues have resulted in adverse events (including deaths), recalls and customer concerns. In addition to compliance, keep broader quality and safety perspectives in mind when drafting supplier agreements.
There are many kinds of agreements with many different considerations. Templates can help, but must be customized. For example, an agreement with a consultant who is responsible for product submissions will be very different from an agreement with a component supplier.
Agreements need to clearly describe the parties’ roles and responsibilities. It’s key to have descriptions of, and specific requirements for, all applicable QSR responsibilities. Where there are shared responsibilities, it’s important to differentiate each party’s duties. Contract language can impact the FDA’s view of which entity has primary responsibility for what, as well as agency thinking about possible regulatory actions.
Manufacturers must define the type and extent of control they exercise over their suppliers based on the evaluation that’s been performed. What controls are documented and in how much detail reflect many different things including: the complexity and criticality of the product or service; risks associated with the product or service; whether the product is off-the-shelf or custom-made; the other party’s quality history and its technical and regulatory sophistication; and both parties’ resources. For example, a supplier’s lack of regulatory savvy may warrant additional manufacturer controls. And documentation that an off-the-shelf product meets applicable standards may be sufficient, while more detail may be needed for other products.
Device makers must comply with the Quality System Regulation. But because it’s short on relevant detail, it can be helpful to look at other sources.
Manufacturer and supplier staff responsible for carrying out the various activities should collaborate on contract provisions; company lawyers and senior personnel should not be the only ones involved in contract discussions. Collaboration is also important to ensure that requirements in a supplier agreement don’t conflict with other documented requirements for the same vendor.
Statutory and regulatory responsibilities of one party cannot be delegated to the other party. For example, the manufacturer cannot delegate its Medical Device Reporting (MDR) submission responsibility to its component supplier.
If a procedure requires an agreement, or particular agreement provisions, ensure that the procedure is followed. Failure to do so is low-hanging fruit that can be easily identified during an FDA inspection.
Be prepared to justify any questionable aspects of your supplier agreements. For example, if an agreement doesn’t include change-notification language, it may be wise to document the specific circumstances and what additional controls are in place.
Some Specifics To Think About When Drafting Supplier Agreements
Content regarding all applicable QSR requirements is essential. This includes detail regarding product or service specifications that must be met, complaint handling and MDR reporting as well as change notification “where possible.”
Agreements often include provisions regarding: product recalls; notification of corrections and removals; personnel responsibilities; communication; use of third-party suppliers; resolution of disagreements; product application responsibilities; audits, inspections and testing; government inspection; and, as needed, compliance with other regulatory requirements such as environmental and data protection issues.
The following explores a few of these topics further:
Change Notification: Change notification language may involve changes to product, process, procedure, suppliers, or facility. It’s important to think through this language carefully. Broad terms like “significant changes” or “changes that could affect the finished device” can pose problems. Consider language requiring suppliers to notify the manufacturer about changes before implementing them, giving the manufacturer sole discretion to refuse to agree to changes for any reason, and addressing which party is responsible for obtaining product clearances and approvals relating to changes. Other specifics include identifying who is responsible for signing off on changes and the process for doing so. It’s also important to consider language about changes made by subcontractors.
Complaint Handling and MDRs: Complaint handling and MDRs, while sometimes given short shrift, are important aspects that may involve shared responsibilities. For example, both parties may be required to maintain complaint files and procedures, and agreements may further detail what this means. Other considerations include: how parties provide complaints to each other; how complaints are investigated; and what happens if the supplier cannot resolve a complaint.
MDR-related language may, for example: provide that the parties exchange all reports that could result in an MDR; address how these reports are investigated; note that both parties cooperate in drafting MDRs; and make clear who is responsible for submitting MDRs to the FDA and similar reports to other regulatory bodies. Other topics include the timing of all these activities, and how the parties communicate relevant information to customers.
Product Recalls and Notifications of Corrections and Removals: It can help to detail which party is responsible for what in recall situations. This includes whether and how the parties collaborate on recall decisions, which party makes the ultimate recall decision, and how the parties develop safety communications. Another consideration is how recall-related information is communicated to customers. Timing is important, as is the practical issue of who bears recall-related costs.
QSR, Other Sources Offer Guidance
Device makers must comply with the QSR. But because it’s short on relevant detail, it can be helpful to look at other sources.
The 1996 preamble to the Quality System Regulation provides the FDA’s responses to comments regarding the proposed rule. It’s worth reading the entire preamble for the full breadth of the agency’s thinking.
Responsibility: When initially proposed, the QSR applied to component manufacturers. Industry argued that this would increase product cost – with questionable impact on device safety and effectiveness – and that many component suppliers would refuse to supply components or services to the industry. By “balancing the many concerns of the medical device industry and the agency’s public health and safety concerns,” the FDA removed the provision making the QSR applicable to component manufacturers. Accordingly, the finished device manufacturer is ultimately responsible for all products and services and addition of the purchasing controls of ISO 9001:1994, in conjunction with the QSR’s acceptance requirements, were necessary to ensure that only acceptable components are used and that purchased or otherwise received product or services conform to specifications.
Application of Purchasing Controls to All Suppliers: The preamble reinforced that purchasing controls have broad application. The FDA clarified that the term “service” means the parts of the manufacturing or quality system that are contracted to others, such as plating of metals, testing and sterilizing. “Suppliers of such services must be assessed and evaluated, just like a supplier of a product,” it says. Responding to comments arguing that application of the regulation to consultants would unreasonably interfere with manufacturers’ business activities, the FDA noted that use of unqualified consultants could impact device safety and effectiveness and had led to regulatory action in the past. Consultants are suppliers of services and purchasing controls ensure that their capability for specific tasks are assessed and documented.
Documentation: The FDA made clear that the extent of detail necessary to ensure that a product or service meets requirements is related to the nature of what is obtained, taking into account the impact it may have on the safety and effectiveness of the finished device and other issues. The FDA also noted that adequate controls include “clear and unambiguous” specification of requirements.
The term “specification” means “any requirement with which a product, process, service or other activity must conform.” While one comment argued that the phrase “other activity” is too broad, it remained in the definition because there can be a specification for anything the manufacturer chooses.
Degree of Control: The FDA made clear that the degree of supplier control needed can vary with the type and significance of the product or service purchased and the impact the product or service can have on the quality of the finished device. The agency also confirmed that manufacturers have flexibility to establish procedures to meet their needs and ensure that a product conforms to specified requirements. For example, per the FDA, a finished device manufacturer can choose to provide greater in-house controls to ensure that products and services meet requirements, or can require that the supplier adopt measures necessary to ensure acceptability.
Notification of Change in Product or Service: Comments contended that change notification language is feasible only for custom-made components, and that suppliers are not willing to supply such information. In response, the FDA revised the regulation to state that change notification must be obtained “where possible.”
However, the FDA said that manufacturers should obtain information regarding changes to products or services and that a supplier may be unacceptable by refusing to provide such notification. Where product is in short supply and must be purchased, manufacturers should heighten controls in other ways. In response to concerns about a requirement making suppliers notify manufacturers of any change in their products or services, the FDA deleted the word “any” to give manufacturers flexibility to define, in agreements, the types of changes that would require notification.
Warning Letters Provide Further Insights
Warning letters provide added insights. For example, a 2019 warning letter identified various documentation problems, including the manufacturer’s failure to have a procedure to evaluate suppliers for the contract manufacture or sterilization of jejunostomy and intestinal tubes labeled as sterile. It noted, “[p]art of the regulations covering purchasing includes a potential agreement where suppliers, such as your contract manufacturer, must make you aware of changes prior to implementing them. Such an agreement might have been of benefit in this situation.”
Carefully crafted supplier agreements foster smooth operations and help prevent problems down the road.
At least two recent warning letters mentioned that change notifications were not in supplier agreements. One of those letters also criticized the firm for failure to review supplier agreements to collect information on changes made without a notification, and evaluate how those changes could have impacted product quality.
A warning letter to a contract manufacturer of a blood glucose strips was more specific. The FDA observed that the company had not established a supplier agreement to define quality system responsibilities, such as finished device packaging and shipping, and to address temperature and humidity control during transit and storage.
Various warning letters noted that purchasing controls apply to consultants. Failure to follow procedures was also significant. One 2019 warning letter says that the company’s procedure required a quality agreement for high-risk suppliers – but the agreements were only completed after the suppliers were approved. Another warning letter observed that the company did not implement its procedure identifying sterilizers as a “critical vendor” and require critical vendors to have a quality agreement. Yet another warning letter noted that the company did not consider test labs and consultants as suppliers, although the company’s procedure required this.
Other sources that may be helpful include:
- FDA’s Compliance Program Guidance Manual 7382.845, See “Regulatory/Administrative Follow-Up” section;
- FDA’s 2016 Guidance “Contract Manufacturing Arrangements for Drugs: Quality Agreements Guidance for Industry” See footnote 4; and
- Global Harmonization Task Force (GHTF) document “Medical Devices - Guidance on Control of Products and Services Obtained from Suppliers.” See Section 3.4 (Finalization of Controls).
To conclude, carefully crafted supplier agreements foster smooth operations and help prevent problems down the road. Given the FDA’s efforts to harmonize and modernize the QSR to mesh with ISO 13485:2016, it will be important to understand and evaluate any proposed changes to purchasing controls – including any specifics about written agreements.
*Disclaimer: This article does not, and is not intended to, constitute legal or regulatory advice; it is for general information only. It does not create an attorney-client relationship with you or any other reader. Consult with a qualified legal or regulatory professional for advice regarding your specific circumstances