Supplier Qualification: An Important - and Often Neglected - Validation Component

I’ve been in the blood establishment software business for more than 30 years and have worked with many blood bank organizations in the United States and other countries around the world. I’ve learned that an important part of validation that is given scant contemplation and consideration is the role of supplier qualification during the procurement process.

Often, when facilities are ready to purchase a new computer system, much time is spent assessing the functionality and usability of the possible systems. An RFP is assembled with questions meant to establish whether or not the systems under consideration will meet the needs of the organization. This is, of course, very important since it is well established in the software business that ‘ease of use’ is necessary to keep users from making mistakes during data entry and interpretation of results. However, the GMP (Good Manufacturing Practices) policies of the manufacturing company for the development, implementation and maintenance of the software are hardly considered at all. Questions about the vendor’s organizational structure, responsibilities, procedures, processes, and resources for implementing quality management are given little importance.

What is Supplier Qualification?

Supplier qualification is part of the validation process according to the FDA in 21 CFR 211 US-American GMP regulations. It is the process used to ascertain that the supplier’s procedures for development, support, maintenance and distribution comply with quality regulations and GMPs. It is one of the activities that should be performed before a medical device, such as a blood bank computer system, can be put into production.

Why are so few qualifications of the vendor/supplier done by blood bank organizations around the country? The first reason is that GMP processes are not well understood by the blood bank’s information technology personnel since they are not used to working with medical devices. Blood bank personnel do not always know how to relate the qualifications they perform on reagent suppliers, new instruments, new test kits, etc. to automated systems. The functionality and usability of the system are easier to evaluate for both of these groups in a medical facility.

The second possible cause is that the medical facility will often hire third parties to perform the validation too late in the purchase process---most often after the automated system has been selected. Therefore, any advice the validation experts might give to their client about doing a good supplier qualification usually occurs after the contract is signed, which of course is too late. The “ISBT Guidelines for Validation of Automated Systems in Blood Establishments” prescribe that validation begins when the initial decision is made to purchase a system. The supplier qualification should take place during this phase.

Thirdly, vendors/suppliers of automated systems do not encourage their clients to look deeply into how well they adhere to the GMPs. Vendors do not tell the potential clients to examine in-house design review and programming procedures for adequate code review. Suppliers do not encourage their potential clients to ask about change management procedures for upgrading systems when bugs and enhancements are added to the automated system, or about complaint handling processes and training policies, etc.

The fourth reason is that the standardized set of questions that compare possible suppliers’ GMP business practices are not usually included in the RFP used to select the automated system. Again, the RFP used to purchase a system very nicely compares the functionality included in the various systems but not supplier adherence to the GMP’s.

Each potential supplier’s quality management system should have a documented policy that ensures the automated systems introduced to blood establishments are compliant with GMPs and adequate for the system’s intended use. The policy should typically include the following practices:

1. Comply with all applicable GMP requirements
2. Integrate life cycle activities into the regulated company’s QMS
3. Ensure GMP regulated systems are compliant and fit for intended use according to established SOPs
4. Follow a validation framework, including the use of validation plans and validation reports as necessary
5. Maintain compliance throughout the life of a system

Following is a set of questions that blood establishments should ask all potential suppliers of automated systems to help establish manufacturers’ adherence to GMPs:

1. Does the manufacturer have a DHF (design history file) for the current finished device as it exists today, as well as a DHR (device history record) and a DMR (device master record)?
2. Are there design specifications that have been developed for the system?
3. How does the company ensure that their design specifications have been implemented in the system? Is there a final validation before release of the system? Are enhancements tested as part of a new/upgrade version?
4. Are there SOP’s for all of the development, implementation and maintenance phases?
5. Is there a document control system in place?
6. Is the system configurable and if so, how is configuration management controlled?
7. Is there a security policy in place for the system? Does it meet HIPAA standards?
8. How well does the supplier understand the importance of designing the quality into products and processes during the development of the automated system?
9. Do the suppliers have adequate resources for design issues such as assessing new product; training and retraining of design managers and design staff; use of consultants; evaluation of the design process; product evaluation, including third party product certification and approvals; patenting or other means of design protection?
10. Is there a robustly documented risk management process?

So what is the problem if a thorough qualification process is not performed on the selected manufacturer? There may be many issues, but the biggest is that a contract, many times worth millions of dollars, will be signed and the blood establishment is locked into purchasing the system before it becomes known that the manufacturer is out of control with good manufacturing practices. Personnel may not be adequately trained to help the blood establishment with the configuration of the system, sometimes not even knowing how the parameters and truth tables relate to the possible functionality of the system. Next, if the manufacturer doesn’t have an adequate change management policy, enhancements and bug fixes will become unmanageable for the manufacturer and the blood establishment. This ultimately puts the patients at risk. If an automated system supplier’s processes are terribly out of control (the worst case scenario), then the supplier will ultimately lose clients and may go out of business. Then what? The blood establishment gets no fixes for bugs found in the system and again the patients are at risk. This is not the outcome we in the blood banking business want.

We can prevent these horrible outcomes by not only assessing functionality of a system, but by investigating how well the manufacturer builds quality into their system by performing a good supplier qualification before the purchase of an automated system. This is the best way to ensure we are using safe systems in our blood establishments!

Sources:

1. MasterControl GxP Lifeline: Top 7 Takeaways from AdvaMed 2016, http://mastercontrolinc.blogspot.com/2016/10/top-7-takeaways-from-advamed-2016.h (accessed January 30, 2017).

2. Park, Christine. Interview by author. November 23, 2016.

3. Questions about ISO 13485:2016, Webinar, May 5, 2016. (accessed January 30, 2017).

4. ISO 13485:2016 - What Are the Changes About? | MedTech .., https://www.medtechintelligence.com/feature_article/iso-134852016-what-are-the-c (accessed January 30, 2017).

5. Ibid.