One Possible Approach to an Approved Vendor List

         Based on part / component criticality (to patient / end user / clinician).    

               Based on product risk, supplier / vendor audit results, incoming QC trend data,    

               and other factors, a list of approved vendors, and their criticality should be 

               established and maintained by QA, separately, or in each vendor’s file. 

                 

Criticality (based on risk to the patient / end user / clinician):

   

Criticality Category	Ranking	Category
01.  Lab services – contracted – clean room         / controlled manufacturing area testing,           biocompatibility, EO / BI / gamma        validation and testing, GMP        compatibility issues	High (Major)	Services
02.  Calibration services -- contracted	High	Services
03.  Patient fluid path contact	High	Parts
04.  Tissue, bone and dentin contact	High	Parts
05.  Sterile barrier	High	Parts
06.  Sterilization services – contracted	High	Services
07.  Patient contact, general	Moderate	Parts
08.  Test equipment, tooling, fixturing          manufacturers – company validated	Moderate	Services / Equipment
09.  Equipment, tooling, fixturing;            manufacturers – company validated	Low (Minor)	Services / Equipment
10.  No patient contact	Low	Parts
11.  Manufacturing Materials – fully            removed during processing (validated)	Low	Parts

Ranking explained (reference: “Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices Document”, May 11, 2005):

Ranking:	Explanation:
Major	A failure or latent flaw could directly result in death or serious injury to the patient or operator. The level of concern is also Major if a failure or latent flaw could indirectly result in death or serious injury of the patient or operator through incorrect or delayed information or through the action of a care provider.
Moderate	A failure or latent design flaw could directly result in minor injury to the patient or operator. The level of concern is also Moderate if a failure or latent flaw could indirectly result in minor injury to the patient or operator through incorrect or delayed information or through the action of a care provider.
Minor	Failures or latent design flaws are unlikely to cause any injury to the patient or operator

     

      6.11  Critical Vendors:  Suppliers / vendors ranked “High / Major” on the above tables     

               are determined to be “critical”.  Critical suppliers are to be subjected to an initial

               site (or virtual) audit.  Follow-up reviews / frequency will be determined by patient /

               user risk factors as mentioned above and/or a Product Risk Management File, and the

               quality of their deliverables, maintenance of their CGMP compliance and/or

               certifications. 

               The type of vendors to be considered “critical” could consist of: 

               Independent test labs, calibration services, contract sterilizers, manufacturers of   

               critical / high risk components, compliance consultants, Notified-Bodies (generally

               will not be audited by the company, as they are subject to their own competent

               authority oversight), and similar. 

               Moderate risk vendors will be subject to an initial desk audit (see Attachment 1),

               supplemented by any additional follow up phone interviews (document in memo to    

               file) and/or e-mail correspondence (initialed and dated)

               All High and Moderate vendors will be subject to a periodic review, usually

               annually, as to performance, retention or replacement, and/or need for any

               supplemental re-audit / re-inspection; documented by a memo to their file.  

               Low risk ranked vendors will be subject to review / action if any deliverable is found

               non-conforming, and such review will be included in the NCMR or other CAPA

               documentation.

              --  jel@jelincoln.com