Managing Your Medical Device Suppliers

Michelle Bonn
Note: The views expressed in this article are those of the author and do not necessarily represent those of his or her employer, GxP Lifeline, its editor or MasterControl Inc.
If you are using off shore suppliers for parts or finished devices, it is critical to ensure those suppliers have not been placed on the FDA import "Red-List."

Since the medical device and drug industries have transitioned into global market players, the concept of “virtual manufacturing” has grown in popularity and necessity.

What exactly is a virtual manufacturer?
In the eyes of the FDA, virtual manufacturing applies to any medical device or drug company that outsources any of its manufacturing functions.  This includes, design, packaging, sterilization & regulatory functions.

Let’s look at a typical “virtual manufacturing scenario.”

A medical device company has developed a new surgical product which required the expertise of an outside design firm and an FDA regulatory consulting firm.   Once the designs were developed and approved for safety & efficacy, registered & cleared by the FDA, the company then outsourced its manufacturing to a plant in Ohio.  Since the product was rather expensive to produce, some of the non-technical/non-critical components were sourced from China.  Additionally, the product required sterilization & specialized packaging.  Therefore, the development and training surrounding and FDA quality system manual were required and outsourced to a regulatory consulting team.

You can see the complexity involved with managing the various suppliers.   As a specification developer (the “virtual manufacturer” and reseller) you are not only responsible for product quality, legal and financial interactions with your suppliers, you are completely responsible for the FDA compliance status of your suppliers and all finished products and services received

Three critical areas of corporate liability related to your suppliers revolve around (1) regulatory failures (i.e. suppliers not registered with the FDA);  (2) past regulatory failures of your current suppliers, and (3) these past failures can lead to delayed or unaccepted marketing submissions by the FDA.   It’s critical that any supplier listed in your FDA marketing submission not be under any form of regulatory investigation. 

How do you choose the right suppliers, service providers and sub-tier suppliers to ensure FDA compliance?

1.  Set up a due diligence checklist to vet your suppliers.
Common criteria include:

  • Evaluate technical expertise, production capabilities and logistical experience. 
  • Evaluate business risks:  is the supplier familiar with FDA standards and is the company financially stable enough to manage your business for a long period of time?
  • Evaluate personnel risks:  be absolutely sure the facility is without individuals who are either debarred from or under investigation with the FDA. 
  • Ask yourself:  if key personnel ever leave the facility, will product quality or safety be jeopardized?

Be Aware:  If you are using off shore suppliers for parts or finished devices,  it is critical to ensure those suppliers have not been placed on the FDA import “Red-List.”  Upon delivery at port, if the supplier is marked on this Red List, your products can be placed on detention without inspection and held for up to 30 calendar days.   “Red List” companies can kill the productivity and profitability of your company because of the prevention of sales and fees to hold the products in detention.

The FDA’s PREDICT program (Predictive Risk Based Evaluation for Dynamic Import Compliance Technology) is an electronic system that grants import admission of FDA regulated products. Based on the data provided by this program, the FDA estimates that medical devices “may proceed” through customs (smoothly, without holding or delays) 15.2% of the time.   The lesson here: know your foreign and domestic suppliers WELL.

2.  Set up an evaluation system for your suppliers

  • A good rule of thumb:  make sure your suppliers meet FDA regulatory requirements on their own.  They should be following cGMP standards under 21CFR 820 Quality System Regulations.  These standards should apply to both internal production and materials purchased from their sub-tier suppliers. 
  • All standards should be documented within the supplier facility and sub-supplier quality system procedures.  Ask to review these quality control documents, CAPA files and testing certificates for approved materials, if possible.
  • When dealing with process suppliers such as sterilization companies, ensure they have documented process validation procedures in place.  These procedures should outline all methods used during the sterilization, packaging and /or testing processes.
    Sterilization Process validation is an FDA QSR 820 requirement.
  • Set up either a paper (quality manual investigation) or a physical plant audit system to check your suppliers.  The paper process should investigate past work performances & process control documentation. The on-site audit should look for things like clean work environments and possible on-site hazards that could impact the safety of your finished products.  The two most common forms of supplier audits are second party audits, including customer audit of suppliers and third party audits performed by independent, outside parties. 

3. Develop supplier acceptance criteria for your finished products.

  • Contracts are a critical component to ensuring product specifications and manufacturing processes are followed carefully.  The contract can be your safety net for both financial and product quality purposes.
  • Supplier contracts typically outline how products should be produced and which specifications are to be followed.  Other important details to include: sub-supplier standards and documentation regarding testing procedures; materials testing certificates; process and product validations; how defective products will be handled or disposed of; and who is financially responsible for product defects.  Lastly, the contract should outline how the factory will respond or inform you of critical materials, process or personnel changes.   All of the product controls, drawings and details should be included with the contract.
  • Purchase orders including product and payment specifications can be used, like a contract, if you are working on a non-critical product or service.  This is a common practice when using training or regulatory consultants and/or ordering minor product parts from outside factories.

4.  Develop a process for controlling suppliers for the long-term.

  • Design specific supplier metrics than can be measured and checked over time.

Good measurements include items like:
Effectiveness (how well is the process satisfying you, the customer)
Efficiency (how well the process is using resources and materials)
Cycle time metrics (how well does the process convert inputs into outputs)
Supplier Audit programs should also be incorporated into your control process*


Using suppliers is a necessary process for most medical device manufacturing.  To ensure the safety, efficacy and compliance of all facets of your end product, close management and auditing of your suppliers is as necessary as managing other product functions like design, sales or marketing.

Remember, it’s your responsibility to make sure your products meet exact product safety and regulatory requirements. This includes ensuring your suppliers have up to date certificates and registrations.  Due diligence should be performed not only in the supplier selection process but also throughout the life of your supplier relationship.

Michelle Bonn’s expertise is centered on international business management, manufacturing quality control, medical device regulatory affairs and international trade. Her company, Expedient Trade, offers global, medical device regulatory services and medical device sourcing services from Asia. She has serviced customers in the medical, industrial and consumer products sectors. Her company has helped both food and medical device companies manage FDA regulation, quality management processes, set up off-shore manufacturing and streamline FDA compliance documentation. She has worked with companies in China, Cambodia, Singapore, Mexico, Italy, Scotland, England and Iceland.Michelle is a certified Six Sigma Black Belt (manufacturing quality control) and holds an MBA with a focus on international business. She has also completed RAPS medical-device regulatory certificate programs.

Contact Michelle at Expedient Trade if your company needs help managing FDA regulations, FDA manufacturing compliance or supplier management processes. She can be reached at 716 276 1255 or