Buyer Beware: A Quest for Vendor Qualification

Caveat emptor, the buyer takes the responsibility for the condition of the items or quality of the services that he or she purchases. Prior to the current consumer protection laws, buyers had no warranties for the goods or services that they purchased. Today, most states require goods to be of merchantable or sellable quality. Because this condition is often next to impossible to define and enforce, buyers are advised to embrace the principle of caveat emptor prior to signing on the dotted line.

Although being conscious of the products and services purchased is good practice, it is also a regulatory requirement for medical device manufacturers. For these organizations, the purchase decisions for components, raw materials, manufacturing and testing equipment, and consulting services, must be well informed (and documented). Poor purchasing decisions can lead to situations that affect product quality, regulatory compliance, company profits, and even the reputation of the company. OEMs should adopt a practical and compliant methodology to qualify vendors and make well-informed purchasing decisions.

Vendor Qualification and Quality Systems

The American Society for Quality defines the qualification process as “the process of demonstrating whether an entity is capable of fulfilling the specified requirement.” Vendor qualification is the process in which a vendor is evaluated to determine whether it can provide the necessary goods or services to the standards that the purchasing company requires.

Before discussing the best approach to qualifying different types of vendors, it is important to first understand the concept of quality systems. Quality systems are defined as the processes, organizational structure, procedures, and resources that are used to control variables associated with producing a product of consistent quality and that meets predefined specifications. In simpler terms, an organization’s entire operation is a measure of a product’s quality and not simply the testing of its finished product. This article employs the theme that vendor qualification is not solely an auditing process but rather a quality system in itself for medical device manufacturers.

To introduce the quality systems approach to vendor qualification, consider the following analogy. Professional football organizations do not sign on prospective athletes purely by the athlete’s stated bench press or 40-yard dash statistics (i.e., final test results). The team management first determines what specifications the team requires for the open position, including what the team is willing and able to spend for the position to be filled. Once user requirements are defined, candidates are identified.

After identifying the top prospect on paper, a selection is made. However, the process is far from over at this point. The selected individuals are then physically and mentally evaluated. Only after successful fulfillment of the specific financial, physical, and mental requirements is the player contracted. This one-time assessment does not guarantee consistent performance throughout the contract. Therefore, performance is regularly assessed to ensure continued ability to meet the needs of the team. If the professional cannot meet the team’s current requirements, he is subjected to performance improvement training and risks being traded or released. 

A potential vendor should be thoroughly assessed against a medical device company’s requirements, compared to other candidate vendors, physically evaluated once selected (and before a contract is signed), and reevaluated as required and as defined on a regular basis. This article presents the QUEST approach as a simple, effective, and compliant approach to vendor qualification.

Vendor Qualification—The QUEST Approach

How does a company qualify a vendor? What approach will give the best probability of an accurate vendor assessment, meet current regulatory expectations, and still remain practical? One method is the QUEST approach, which stands for question, understand, evaluate, site audit, and track (see Figure 1).

Q. The Question Phase—What a Potential Vendor Needs to Supply

The first step in qualifying a vendor is for the medical device company to document what it needs from a vendor of this type. For example, does the vendor need to sell to medical device firms already? Does the vendor have the ability to supply the required units, resources, etc.? Of course, one of the most important questions is, “What is our budget for this vendor’s products or services?” Especially in a tough economic environment, many hours, days, and weeks are wasted by defining requirements without a real budget number established up front. Often, an OEM’s change control system is a good place to document and capture these data and the overall effort to ensure understanding and commitment by all internal parties.

U. Understanding Phase—How Vendors Meet the Requirements

Once the question phase is complete, vendors that appear to meet the company’s requirements are contacted directly to gauge interest in being a new vendor for the OEM. The company’s requirements (as defined in the question phase) are then supplied to interested vendor organizations. The vendor should supply all of its administrative information (e.g., key contacts, locations, etc.), applicable sales and marketing materials, and most importantly, documentation that supports its ability to meet the specified requirements (including, but not limited to, pricing). At this time, it should also be requested that the vendor send a sample of the product or service that they will potentially provide.

For example, a valve supplier should be asked to supply samples of the valves that it would offer for sale in addition to the certificate of analyses (C of A) for the valve. A laser supplier should provide nominal pulse energy density specifications. Even a consulting or contracting organization should provide samples, such as resumes of personnel with experience in the medical device industry.

At least three vendors should provide the information requested in its entirety before moving to the next phase in the qualification process. At this point, it is imperative that each vendor package be assessed for adequacy and completeness and be understood with regard to the vendor’s ability to meet the company requirements specified.

E. Evaluation Phase—Determining the Best Potential Vendor

Now that at least three vendors have been identified to meet the company’s requirements, it is time for vendor evaluation. First, each vendor is assessed against the company requirements as specified in the question phase. Remember, all of the potential vendors previously identified must be able to meet each and every requirement specified. Vendors that could not meet the requirements should have already been weeded out. This evaluation pertains to how well each vendor meets each requirement when compared with the other short-listed vendors. The format of this evaluation can be as simple as a table that uses a simple rating system to evaluate how well a vendor fulfills each requirement. An example of the evaluation of a tubing supplier is in Table I.

Once ratings are assigned, a simple average can be used to determine the best option. Keep in mind that this is not the final step in the process. The evaluation phase has only identified and documented the best potential vendor.

S. Site Audit Phase—On-Site and Off-Site Verifications

The next phase in the vendor qualification process involves a site audit of the potential vendor’s facility. Because an audit is a potentially pricey activity, the site audit may be performed on-site or off-site depending on the critical nature of the potential vendor and it should be limited to the best potential vendor identified in the evaluation phase. Vendors need to be divided into critical and noncritical suppliers. A critical vendor supplies goods or services that directly control or dictate the quality and integrity of devices. A noncritical vendor supplies goods or services that assist and support the quality of products. The interpretation of critical and noncritical suppliers varies among companies. Therefore, an approved and controlled company document should clearly define critical and noncritical vendors (see Table II).

If the best potential vendor identified in the evaluation phase is a critical vendor, it is recommended that an on-site audit with predetermined (i.e., documented and approved) items requiring on-site verification take place. The on-site audit procedure should contain clear pass-fail criteria. A sample portion of a form to be completed during the on-site verification for a contract packager is shown in Table III.

If the best potential vendor identified in the evaluation phase is deemed a noncritical vendor, the vendor can be subjected to an off-site audit with its own predetermined (i.e., documented and approved) audit checklist containing predetermined pass-fail criteria for the overall audit. Although the verifications are similar to that of an on-site audit, the off-site audit relies on verbal discussions, e-mails, and documentation provided by the potential vendor to determine acceptability of the vendor’s practices and quality systems. An example portion of a checklist for an off-site audit for a calibration contractor is in Table IV.

Based on the overall score for audits, a potential vendor is either accepted or rejected. If accepted, the vendor is considered qualified. If rejected, the OEM has the following options:

T. Track Phase—Monitor and Requalify

The process does not end once a vendor is qualified. The vendor’s performance must be monitored on a continual basis, including review of any problems associated with the good or service supplied by the vendor.

A schedule is determined so that each vendor is requalified on a periodic basis and in accordance with the most recent vendor practices. Similar to regulatory authority audits (e.g., FDA audits), the medical device company should not only run through the preapproved audit verification steps, but should also revisit items that were found to be deficient during previous audits to make sure that any actions committed to by the vendor have been implemented satisfactorily. All vendor qualification activities should be documented in a vendor information file.

Conclusion

The concept of caveat emptor has been the bane of many consumers. Even though there are some protections provided by legislation, this has not stopped the headaches, the loss of time, and the loss of money from substandard goods or services. Just as an individual consumer has the responsibility for verifying the quality of goods and services, medical device companies are responsible to ensure that their vendors consistently provide products and services that yield safe and effective devices.

Bibliography

Code of Federal Regulations, 21 CFR 820.

George J. Grigonis et al. “Technical Report No. 32—Auditing of Suppliers Providing Computer Products and Services for Regulated Pharmaceutical Operations.” PDA Journal of Pharmaceutical Science and Technology 58, no. 5 (September/October 2004).

Nancy Cafmeyer is project manager at Advanced Biomedical Consulting LLC (Saint Petersburg, FL). Jonathan M. Lewis is principal at the firm.