1

CDRH Learn - Purchasing Controls - Script 

Slide 1

Hello, my name is Joseph Tartal and I am the Postmarket and Consumer Branch Chief in the Division of 

Industry and Consumer Education. In this presentation, we will review the topic of Purchasing Controls. 

The medical device industry has a direct impact on patients and their health, and you as manufacturers 

have the final responsibility for the medical devices that you distribute. This includes responsibility over 

the materials, components and services used. I understand and have seen firsthand the impact that 

suppliers can have on a product and the importance of purchasing controls. I can provide examples 

from over the last ten years where failed components and contaminated materials have directly related 

to device failures and adverse events, including deaths. In the world today that is global and with 

connected economies, accountability is important and you are responsible for establishing and 

maintaining that accountability as it relates to everything received for your finished device. This is the 

expectation of FDA and the expectation of your customers.

Slide 2

Let's review the Learning Objectives for this presentation. By the time I am finished, I want you to know 

the following:

First, understand the intent and background as it relates to purchasing controls. Why does it matter? 

Why is is important to FDA? And what is unique about medical devices?

Know the definitions of Product, Component and Service, as you want to use the correct terms and 

know their meaning to properly communicate within your organization and with suppliers.

Next, understand the purchasing control requirements in the regulation, which is what you have to do

legally, as well as the voluntary guidance and best practices for qualifying suppliers. These are good 

ideas on how to meet the requirements.

And finally, I hope you'll be able to recognize the links between Purchasing and other quality systems 

requirements, such as design controls and acceptance activities, and know how they interact with one 

another. This is important as the most effective quality systems are interconnected.

Slide 3

During this presentation, I’ll refer to several key documents that address purchasing controls. 21 Code 

of Federal Regulations, or CFR, section 820 refers to the Quality System Regulation. 21 CFR 820.50 

codified the regulations for Purchasing Controls. And finally, we have the Preamble to the 1996 Quality 

System Regulation. Public comments and the FDA responses to those comments are found in the 

Preamble of the 96 Quality System Regulation and they provide further insight into the Agency’s 

thinking with respect to Purchasing Controls. As appropriate, I’ll cross reference the applicable 

comment found in the Preamable with the particular topic. These are listed at the bottom of the slide 

and highlighted in blue.
2

Overall, we do not think of quality as just test and inspect; the evolution of quality in our industry has 

moved from a test and inspect mentality to control over design and manufacturing to also qualifying and 

selecting suppliers in the medical device supply chain that are both capable and can meet your needs.

Slide 4

Preamble Comment #106 makes the intent of purchasing controls clear in that we need to look at 

suppliers and select them on their capabilities to provide quality product and services and that quality 

cannot be inspected or tested into products or services. 

Slide 5

Why does Purchasing Controls matter? Technologies are coming more complex and firms are becoming

more dependent on each other in the manufacturer of these complex medical devices. As a result, the 

quality of finished medical devices depends on a number of factors, many of which you do not directly

control within your facility as a finished device manufacturer, even though you have the final 

responsibility for your product. 

With increased globalization, it becomes apparent that quality is not bound by borders. The quality of 

raw materials, components and services will directly affect your finished device.

For example, back in 2008, a contaminated raw material was used in a medical device and resulted in 

dozens of related adverse events, including 11 deaths. Other supplier-related issues have also been the 

cause of both medical device recalls and customer dissatisfaction. 

Slide 6

FDA is concerned about Purchasing Controls because FDA rarely looks at suppliers. FDA inspections 

often only extend to the finished device manufacturers, and FDA does not perform routine inspections 

of component manufacturers. Also there is a potential for the problems due to the risk of failure in the 

supply chain and that supply chain has grown to include contract manufacturing of the finished device 

itself and virtual companies. Therefore, purchasing controls are necessary to assure that only 

acceptable raw materials, components and services are used. The expectation, not just from a 

compliance perspective, the bare minimum, but also from a quality perspective, is that you have control 

over the components, raw materials and services you use and that you are confident that suppliers can

continually provide quality product and services. 

Slide 7

There are unique aspects to medical devices. First, there are a wide range in type of received products 

and services, which could be raw materials, components, software, contract manufacturers and 

consultants, to name a few. There is a wide range of complexity with received products, including its 

role in the overall medical device total product life cycle. As examples, you may have a consultant who 

prepares a premarket submission or a service contractor who performs maintenance on a medical 

device in distribution. 

Also, who supplies your product can be important, such as off-the-shelf software from a large 

corporation or sole source material from a single researcher at a University. All of it will come under 

purchasing controls.
3

Slide 8

We have a wide range of risks associated with received products and services.

Materials and components that are being used in medical devices may have never been originally 

intended for medical device usage. At DICE, we receive calls and questions about "FDA approved food 

grade materials" and their use in medical devices. We then explain that medical devices and the 

materials used are dependent upon their intended use. If a material is approved as a food grade 

material or even in a medical device that contacts the skin, it does not mean it will then be okay for use 

in an implant. Depending on use, the same exact material may have increased risk and may need to be 

controlled differently. For example, stainless steel may be graded and controlled differently, depending 

on the specific intended use of the device in which it's used.

Slide 9

Purchasing Controls are applicable when you do not have direct control over the product, such as,

received materials and components, or services you receive that can potentially impact the quality of 

the medical device. A good rule of thumb is to determine if these are covered under your own quality 

system and subsequent internal quality audits. If they are not, purchasing controls apply. 

Slide 10

Over the next few slides, we'll review a few key terms and definitions. It is important to know and use 

the correct terms so that when communicating, everyone is on the same page. Most regulations have 

their definitions under the "dot" 3 section of that regulation.

Product is defined as components, manufacturing materials, in-process devices, finished devices, and 

returned devices: basically everything, except service. This is found in 21 CFR 820.3 R. 

Slide 11

Components are any raw material, substance, piece, part, software, firmware, labeling, or assembly 

which is intended to be included as part of the finished, packaged, and labeled device. Note this is 

different than a finished device which is any device or accessory to any device that is suitable for use or 

capable of functioning whether or not it is packaged, labeled, or sterilized. This definition is found in 21 

CFR 820.3 C.

Slide 12

In Preamble Comment #102, Service is defined as parts of the manufacturing or quality system that are 

contracted to others, for example, plating of metals, testing, and sterilizing - any contractual work that is 

being done for you that can affect the quality of your medical device or quality system. FDA believes 

that all suppliers of such services must be assessed and evaluated, just like a supplier of a product. The 

degree of control necessary is related to the product or service purchased. Please note consultants 

provide a service.

Slide 13

As mentioned earlier, Purchasing Controls are codified in the regulation under 21 CFR 820.50. These are 

shall statements, or requirements that you must do in order to comply with the regulations. In addition, 

pay attention to the Preamble Comments that relate to purchasing controls, some of which are

referenced in this presentation. Last, there is the Global Harmonization Task Force 2008 Supplier 

Control Guidance that provides the most up-to-date guidance on medical device supplier controls. As a 
4

reminder, all guidances, such as this one, are voluntary, and not mandatory. This guidance may be 

found at the International Medical Device Regulators Forum webpage in the GHTF archives under Study 

Group Three. Please feel free to click on each hyperlink after the presentation. 

Slide 14

I will now start with the regulatory requirements for purchasing controls. Establish – meaning define, 

document, implement (do) and maintain procedures to ensure that all purchased or otherwise received

product and services conform to specified requirements. This is a requirement and it does not matter if 

you purchased it or if it was given to you. For example, if materials were provided to you as part of a 

grant or “sister facility”, purchasing controls still apply. See Preamble Comment #100. Again, all entities 

not covered by your own quality systems and internal quality audits should be treated as suppliers.

Slide 15

The following comes from a good flow chart on page ten in the voluntary GHTF guidance document. It 

provides a great overview on what to consider when setting up your procedures. There are 6 steps to 

supplier controls.

One - planning. Two - selection of potential suppliers. Three - evaluation and acceptance of suppliers. 

Four - finalization of responsibilities and controls. Five - delivery, measurement and monitoring. And six

- communication, including the corrective and preventive action process. However, please note these 

steps are not strictly sequential as some activities may occur in parallel and overlap one another.

Slide 16

The next regulatory requirement is to establish and maintain requirements, including quality 

requirements that suppliers, contractors and consultants must meet. These are Objective Measureable 

Requirements that are put into place to determine how suppliers will be evaluated.

Slide 17

You then evaluate and select potential suppliers, contractors, and consultants on the basis of their 

ability to meet specified requirements, including quality requirements. The evaluation shall be 

documented. From a compliance perspective, if it is not documented, it did not happen. I want to also 

caution you to not exclusively rely on third party certification for initial evaluation of a supplier and with 

the use of any certification ask what it means to you and your device. 

Slide 18

You will now need to define the type and extent of control to be exercised based on the evaluation 

results. You determine what is required. You are their customer and depending upon this you may be 

able to leverage more control if needed. Be mindful of higher risk products and services as they relate 

to your device and of sub-tier suppliers, meaning suppliers of your supplier.

Establish and maintain records of acceptable suppliers, contractors and consultants. I have seen this 

accomplished through approved vendor lists. As for whatever methods you use make sure it is followed 

and you have documented procedures and records of it.

Slide 19

Regarding control over suppliers, you may need more in-house controls during receiving, or you may 

leverage the supplier to adopt certain measures. For some suppliers, I have seen examples of quality 
5

system and process validation knowledge being transferred to the supplier as part of an agreement, to 

better control the product being supplied as both parties wanted a win – win scenario. I suggest that 

you make sure to document all expectations in your supplier agreements and have them agreed upon by 

both parties. 

Slide 20

Now you must make sure that purchasing control data are established and maintained and the data 

clearly describes or references the specified requirements. These have to be approved per your 

document controls. 

 

Slide 21

Purchasing documents shall include where possible an agreement to be notified of changes. I 

recommend that the notification for change controls be done before those changes are implemented. 

Then make sure the agreement is being followed. Also define what those changes are. They may be to 

their process or even changes to their suppliers. Last, beware of informal communication channels and 

of over-reliance on notification, especially for suppliers over which you have limited control. 

Slide 22

The capability of the product or service suppliers should be reviewed at intervals consistent with the 

significance of the product or service provided and the review should demonstrate conformance to 

specified requirements. “Action” threshold should be objective and consistently applied.

Slide 23

Ongoing Communication - what happens when things go wrong? In every relationship, both parties 

have a proportion of responsibility to the relationship, whether it is 50-50 or 99 to 1 percent. As you 

become aware of information, you will process it through your quality system but also report it back to 

your supplier depending upon its importance. Discuss how they handle complaints, and their 

willingness to provide information. Examples of things I have seen used in industry are vendor 

corrective action reports and supplier corrective action reports.

 

Slide 24

Purchasing controls are driven by and linked to other quality systems such as design controls, 21 CFR 

820.30, and acceptance activities, 21 CFR 820.80. If you design in quality the first time, you design the 

right device. Your design specifications will drive your purchasing controls and you want to spend the 

time upfront to identify the right suppliers. For acceptance activities, I recommend using risk to strike a 

balance for controlling supplied product and services through a combination of purchasing controls and 

acceptance activities. If, for example, you have a sole source supplier and cannot perform active 

supplier evaluations, then you’ll need more emphasis on acceptance activities. 

Slide 25

The quality of a product or service is established during the design of that product or service, and 

achieved through proper control of the manufacture of that product or the performance of that service. 

That quality includes the product and services that you received and are subsequently used in your 

finished device. During design, you have to select suppliers that provide quality product and service.
6

Slide 26

Design specifications are determined in design controls such as design inputs and then verified as design 

outputs. These will drive your purchasing decisions. For example, a supplier who provides an essential

design output will likely have greater controls. In industry, I have seen suppliers rated in tiers depending 

upon the product risk or service provided. This even included contractors who were performing a 

critical service. Be cautious of “one size fits all” approaches to balancing supplier controls and 

assessment activities. You determine it. 

Slide 27

Establish and maintain procedures for acceptance activities of incoming product. Inspections, tests, and 

other verification tools are an important part of ensuring that raw materials, components and other 

received product conform to approved specifications. Document all acceptance and rejection activities. 

Use a combination of purchasing controls and acceptance activities to ensure all received product meet 

your specified requirements. 

Slide 28

The extent of incoming acceptance activities can be based, in part, on the degree to which the supplier 

has demonstrated a capability to provide quality products or services. For example, doc-to-stock: the 

practice of using document review to accept supplied product is acceptable if you can show effective 

purchasing controls and a history of providing quality products or services.

Slide 29

In summary, I ask that you take on the following calls to action.

First, know that purchasing controls pertain to all received products and services. Second, select your 

suppliers based on their capabilities and your manufacturing requirements. Third, establish adequate 

supplier controls. Fourth, documentation is important. Establish and maintain records regarding 

purchasing, purchasing data and reviews. And finally, understand that following purchasing controls are 

good for your business and the public health in general.

Slide 30

This presentation and other helpful videos and educational resources can be found at CDRH Learn. For 

text-based information on premarket and postmarket topics including how to bring a medical device to 

market, please visit Device Advice. For additional information on these or any other medical device 

regulatory topics, we encourage you to contact the Division of Industry and Consumer Education 

Monday with your questions. Thanks for watching.