Supplier Controls and Purchasing for Medical Devices: A Risk-Based ISO 13485 Programme

A medical device is only as good as the components, materials and services that go into it. Contract manufacturers, sterilisers, software vendors, testing labs and raw material suppliers all affect safety, and regulators hold the manufacturer responsible for all of them. Supplier controls are among the most frequent sources of audit findings, warning letters and recalls. This guide explains what ISO 13485 and FDA expect and how to build a risk-based supplier programme.

The regulatory basis

ISO 13485:2016, clause 7.4 covers purchasing: the purchasing process (7.4.1), purchasing information (7.4.2) and verification of purchased product (7.4.3). Clause 8.4 on analysis of data includes supplier performance. In the United States, the Quality Management System Regulation (QMSR) took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference, so purchasing controls now sit within that framework. EU MDR Annex IX and the general obligations of manufacturers also make you responsible for outsourced processes and for ensuring that suppliers allow notified body access where needed. See our overviews of ISO 13485 and MDSAP audit readiness and US FDA regulations.

The core principle: you can outsource work but not responsibility. The controls must be proportionate to the effect the supplier has on product quality and on the risk to patients.

Step 1: classify suppliers by risk

Not every supplier needs an audit. Classify suppliers by the impact of their product or service on safety and performance. A simple three-level scheme works well:

Level	Examples	Typical controls
Critical	Contract manufacturers, sterilisers, suppliers of implant materials or safety-critical components, software tools that affect quality records	Initial audit, quality agreement, change notification, periodic re-audit, performance monitoring
Major	Standard components with defined specifications, calibration and test labs	Questionnaire, certificate review (such as ISO 13485 or ISO 17025), incoming inspection, monitoring
Minor	Office supplies, general commercial items	Basic approval, no specific monitoring

Write the rule for classification into your procedure and record the rationale for each supplier. Linking classification to the risk management file shows the connection between a component and patient risk.

Step 2: evaluate and approve

Before using a supplier, collect evidence suited to the risk: a quality questionnaire, certificates, sample parts, an on-site or remote audit, a review of their regulatory history, and financial and capacity checks for critical suppliers. Record the decision and add approved suppliers to the approved supplier list (ASL), with the scope of what they are approved to supply. An approval for one part does not cover another.

Step 3: write clear purchasing information and a quality agreement

Purchasing information should describe the product or service precisely: specification, drawing revision, acceptance criteria, applicable standards, and requirements for qualification of personnel and processes. For critical suppliers, a quality agreement states responsibilities. A good one covers:

• change notification: the supplier must tell you before changing materials, processes, sites or subcontractors;
• access for audits by you, your notified body and regulators;
• handling of nonconformances, complaints and corrective actions;
• record retention and traceability;
• responsibilities for validation, such as process validation of the supplier’s special processes;
• confidentiality and ownership of data and tooling.

Step 4: verify purchased product

Incoming inspection and testing is set by risk and by supplier performance. The sampling approach must be justified; see sampling plan generation. Good suppliers with proven history may justify reduced inspection, such as skip-lot sampling, or acceptance based on certificates of conformance with periodic verification. Poor performers receive tighter inspection until they show improvement.

Step 5: monitor performance

Track on-time delivery, incoming reject rates, complaints linked to supplier components and corrective action responsiveness. Review at set intervals and feed the results into management review. A supplier that is repeatedly late closing corrective actions should trigger escalation, re-audit or replacement. Use a supplier corrective action request (SCAR) when a nonconformance traces to the supplier, and link serious issues to your CAPA process.

Special cases

• Software and cloud services: software that is used in the quality system or is part of the device needs assessment and validation proportionate to risk. See software validation and the guide on SOUP for software components.
• Sterilisation and special processes: results cannot be fully checked in the finished device, so supplier validation and revalidation need careful oversight.
• Materials and biocompatibility: a changed resin or additive may need a fresh biological evaluation.
• Critical single-source suppliers: document the risk and a continuity plan.
• Distributors and importers: under the EU MDR they have their own verification duties, and you should include them in supplier-like controls.

Common audit findings

• The approved supplier list is out of date, or suppliers are used outside their approved scope.
• No documented rationale for the level of control applied.
• Quality agreements missing for critical suppliers, or no change-notification clause.
• Supplier audits overdue, with no risk-based justification.
• Supplier performance data collected but never reviewed.
• Purchasing records that do not reference the current specification revision.

Frequently asked questions

Is an ISO 13485 certificate enough to approve a supplier?

No. It is useful evidence but does not prove that the supplier can meet your specific requirements. Combine it with product-specific evidence and risk-based controls.

How often should critical suppliers be audited?

There is no fixed rule. Many companies use one to three years for critical suppliers, adjusted by performance and risk. Document your rationale.

Do I need a quality agreement with every supplier?

Not necessarily. Use it for suppliers that materially affect product quality, such as contract manufacturers and sterilisers. For low-risk suppliers, purchasing terms may be enough.

What if a supplier refuses an audit?

For critical suppliers, this is a serious concern, since you must be able to give regulators access. Look for alternatives, or accept the risk only with documented justification and extra controls.

Preparing for supplier quality roles

Supplier quality engineers are in steady demand. See our supplier quality engineer interview guide for model answers and case studies, and our Advanced QMS course for structured training.

Talk to the AptSkill team

Want practical supplier quality training for your team? Send us a message.