Authors, Nancy Cafmeyer and Jonathan M. Lewis, Advanced Biomedical Consulting
One (1) of the timeless principles of commerce is caveat emptor (latin for, "Let the Buyer Beware"). Under the principle of caveat emptor, the buyer takes the responsibility for the condition of the items or quality of the services that he or she purchases. Prior to the current consumer protection laws, buyers had no warranties for the goods or services that they purchased. Today, most states require goods to be of "merchantable or sellable quality". As this condition is often next to impossible to define and enforce, buyers are advised to embrace the principle of caveat emptor prior to "signing on the dotted line".
While being conscious of the products and services purchased is good practice for consumers and most businesses, it is a regulatory requirement for medical device manufacturers. For these organizations, the decisions where to purchase components, raw materials, manufacturing and testing equipment, and even consulting services, need to be well informed (and documented). The results of making poor purchasing decisions can lead to situations that impact product quality, regulatory compliance, company profits, and even the reputation of the company.
This article presents a practical and compliant methodology for medical device companies to qualify vendors and hence make well informed purchasing related decisions.
Vendor Qualification and Quality Systems
The qualification process is defined by the American Society for Quality Control (ASQC) as, "the process of demonstrating whether an entity is capable of fulfilling the specified requirement". Vendor qualification is the process where a vendor is evaluated to determine if it can provide the necessary goods or services to the standards that the purchasing company requires.
Before discussing the best approach to qualifying different types of vendors, it is important to first understand the concept of "Quality Systems". Quality Systems are defined as "the processes, organizational structure, procedures and resources that are used to control variables associated with producing a product of consistent quality and that meets predefined specifications. In simpler terms, an organization's entire operation is a measure of a product's quality and not simply the testing of its finished product.
This article employs the theme that vendor qualification is not solely an auditing process but rather a quality system in itself for medical device manufacturers.
In order to introduce the quality systems approach to vendor qualification, consider the following simple analogy. Professional football organizations do not sign on prospective athletes purely by the athlete's stated bench press or 40-yard dash statistics (i.e. final test results). There are several factors that are taken into consideration. The team management first determines what "specifications" the team requires for the open position, including, but not limited to, what the team is willing and able to spend for the position to be filled.
Once these "user requirements" are defined, candidate athletes are identified. After identifying the top prospect (or prospects) "on paper" a selection is made. However, the process is far from over at this point! The selected individual (or individuals) is then physically and mentally evaluated by team doctors to determine his readiness to play professional football for that specific team. Only open successful fulfillment of the team's specific financial, physical, and mental requirements is the player contracted. However, as many are aware, this one (1) time assessment does not guarantee consistent performance throughout the player's contract. Therefore, the athlete's performance is regularly assessed to ensure continued ability to meets the needs of the team. If the professional cannot meet the team's current requirements, the he is subjected to performance improvement training and risks being traded or released.
Similar to the professional football candidate, a potential vendor should be thoroughly assessed against a company's requirements, compared to other candidate vendors, "physically evaluated" once selected (and before a contract is signed), and reevaluated as required and as defined on a regularly basis. This article presents the "Q.U.E.S.T. Approach" as a simple, effective, and compliant approach to vendor qualification.
Vendor Qualification – The Q.U.E.S.T. Approach
How does a company qualify a vendor? What approach will give the company the best probability of an accurate vendor assessment, meet current regulatory expectations, and still remain practical? One (1) method is by using the Q.U.E.S.T. Approach (i.e. Question, Understand, Evaluate, Site Audit, and Track).
Q = Question Phase – What a Potential Vendor Needs to Supply
The first step in qualifying a vendor is for the medical device company to document what are the needs from a vendor of this type. For example, does the vendor need to sell to medical device firms already? Does the vendor have the current ability to supply the required units, resources, etc.? Of course, one (1) of the most important questions is, "What is our budget for this vendor's products or services?" Especially in the current economic environment, many hours, days, and weeks are wasted by defining requirements without a "real" budget number established upfront. Often times, a company's change control system is a good place to document/capture this information and overall effort to ensure understanding and commitment by all internal parties involved.
U = Understanding Phase – How Vendors Meet the Requirements
Once the Question Phase is complete, vendors that appear to meet the company's requirements are contacted directly to gauge interest in being a new vendor for the company. The company's requirements (as defined in the Question Phase) are then supplied to those interested vendor organizations. It should be requested that the vendor supply all its administrative information (e.g. key contacts, location(s), etc.), applicable sales and marketing materials, and most importantly, documentation that supports its ability to the specified company requirements (including, but not limited to, pricing). At this time, it should also be requested that the vendor send a "sample" of the product or service that they will potentially providing.
For example, a valve supplier should be requested to supply samples of the valves that they would offer for sale in addition to the certificate of analyse (C of A) for the valve. A laser supplier should provide include nominal pulse energy density specifications. Even a consulting or contracting organization should provide "samples". These organizations should provide sample resumes of resources with experience in the medical device industry.
At least three (3) vendors should provide the information requested in its entirety before moving to the next phase in the vendor qualification process.
At this point, it is imperative that each vendor package be thoroughly assessed for adequacy and completeness and be understood with regards to the vendor's ability to meet the company requirements specified.
E = Evaluation Phase – Identification of the Best Potential Vendor
Now that at least three (3) vendors have been identified to meet the company's requirements, it is time for vendor evaluation. First, each vendor is assessed against the company requirements as specified in the Question Phase. Remember, all of the potential vendors previously identified will be able each and every requirement specified. Vendors that could not meet the requirements have already been "weeded out". This evaluation pertains to how well each vendor meets each requirement when compared to the other short-listed vendors. The format of this evaluation can be as simple as a table with columns for the vendor and for the requirements where a simple rating system is applied to each requirement for each vendor.
Once the ratings are assigned, a simple average can be used to determine the best overall option. Keep in mind that this is not the final step in the process! The Evaluation Phase has only identified and documented the best potential vendor.
S = Site Audit Phase – Onsite and Offsite Verifications
The next to last phase in the vendor qualification process involves a site audit of the potential vendor's facility. As the cost of an audit is a potentially pricey activity, the site audit may be performed onsite or offsite depending on the criticality of the potential vendor type and is limited to the best potential vendor identified in the Evaluation Phase. Vendor types need to be divided into "Critical" and "Non-Critical" suppliers. A critical vendor is one (1) who supplies goods or services that directly controls or dictates the quality and integrity of medical device products. A non-critical vendor is one (1) that supplies goods or services that assist and support the quality of these products. As the interpretation of the definitions of critical and non-critical suppliers varies among companies, it is imperative that an approved and controlled company document (or documents) clearly defines which vendor types are deemed critical and which are deemed as non-critical.
If the best potential vendor identified in the Evaluation Phase is a potential critical vendor, it is highly recommended that this vendor be subjected to an onsite audit with predetermined (i.e. documented and approved) items requiring onsite verification. The onsite audit procedure should contain clear pass/fail criteria for the onsite vendor audit.
If the best potential vendor identified in the Evaluation Phase is a potential non-critical vendor, the vendor should be subjected to an offsite audit with its own predetermined (i.e. documented and approved) audit "checklist" containing predetermined Pass/Fail criteria for the overall audit. While the verifications may be similar to that of an onsite audit, the offsite audit relies on verbal discussions, e-mails and documentation provided by the potential vendor to determine acceptability of the vendor's practices/quality systems.
Based upon the overall score for both onsite and offsite audits, a potential vendor is either accepted or rejected. If accepted, the vendor is considered qualified. If rejected, the company can either:
1. Work with the vendor to address the deficiencies and perform a verification audit at a later date (but prior to using the vendor or considering the vendor qualified)
- Or -
2. Select another potential vendor identified during the Evaluation Phase and subject that vendor to the Site Audit Phase.
T = Track Phase – Monitor and Requalify
Once a vendor is qualified the process does not end. The vendor's performance must be monitored on a continuous basis. The monitoring process involves a review of any problems associated with the good or service supplied by the vendor.
A schedule is determined so that each qualified vendor is re-qualified on a periodic basis (whether a critical or non-critical vendor type) and in accordance with the most recent vendor practices. Similar to regulatory authority audits (e.g. FDA audits), the medical device company should not only run through the preapproved audit verification steps, but should also revisit items that were found to be deficient during previous audits to make sure that any corrective and preventive actions (CAPAs) commitment to by the vendor have in fact been implemented satisfactorily. All vendor qualification activities (i.e. qualification, re-qualification, and disqualification) should be documented in a vendor information file.
Conclusion
Throughout history, the concept of caveat emptor has been the bane of many consumers. Even though there have been some protections provided by legislature, this has not stopped the headaches, the loss of time and the loss of money from substandard goods or services. Just as an individual consumer has the responsibility for verifying the quality of goods and services he or she plans to purchase, medical device companies are responsible by regulation as well as through moral obligation to ensure that their vendors will consistently provide raw materials and components, compliance consulting services, manufacturing equipment, etc., that yield safe and effective devices and other therapeutic products.
Bibliography
1. Code of Federal Regulations, 21 CFR § 820.
2. George J. Grigonis, Jr., Steve Baldwin, Warren Campbell, et al, "Technical Report No. 32 – Auditing of Suppliers Providing Computer Products and Services for Regulated Pharmaceutical Operations," PDA Journal of Pharmaceutical Science and Technology. 58 (5), Sept./Oct. 2004
3. Liz Michalski, "Audits Aren't Enough to Ensure Quality," Pharm. Tech. 74-76 (April 2001)