1 

MDSAP: Purchasing Process

Slide 1

I am CAPT Kimberly Lewandowski-Walker, Senior Regulatory Officer at the Center for Devices and 

Radiological Health at the U.S. Food and Drug Administration. I will be your presenter for this training 

module.

In this training module, we will be reviewing the Purchasing process for the Medical Device Single Audit 

Program (or MDSAP) and how to audit this process. 

Slide 2

Successful completion of the MDSAP training modules “Introduction to the MDSAP Program”, “Overview 

of the MDSAP Audit Process”, “Management Process”, “Measurement, Analysis and Improvement 

Process”, “Design and Development Process”, and the three modules of “Production and Service 

Controls Process” are prerequisites to this course. 

Slide 3

Successful completion of the MDSAP training modules “Introduction to the MDSAP Program”, “Overview 

of the MDSAP Audit Process”, “Management Process”, “Measurement, Analysis and Improvement 

Process”, “Design and Development Process”, and the three modules of “Production and Service 

Controls Process” are prerequisites to this course. 

Slide 4

Let’s begin with explaining the Purchasing Process.

Slide 5

The intent of the Purchasing process is to ensure that purchased, subcontracted, or otherwise received 

products and services conform to specified requirements; incorporate purchasing requirements and 

specifications; and select acceptable suppliers based on the capability of the suppliers.

An effective purchasing processes selects acceptable suppliers based on the capability of the suppliers to 

provide acceptable product, perform necessary acceptance activities, and maintain required quality 

records.

Slide 6

The organization is expected to establish and maintain documented controls for planning and 

performing purchasing activities. The controls necessary depend on the effect of the purchased product 

or service on the quality, safety, and effectiveness of the finished device. 

The purchasing process is integral to the other processes of the MDSAP audit sequence.

Slide 7

We will now move to a discussion of the purpose of auditing the Purchasing process

Slide 8

The Purchasing process is integral to the other processes of the MDSAP audit sequence. 
2 

As the audit of the organization's Measurement, Analysis and Improvement, Design and Development, 

and Production and Service Controls processes is being performed, the audit team should be assessing 

the effect purchased products have on the quality of the finished device.

The audit team should be using information learned about: actual and potential product and process 

nonconformities during the audit of the Measurement, Analysis and Improvement process; higher risk 

elements and essential design outputs from the design projects reviewed during audit of the Design and 

Development process; and significant outsourced products and production processes identified during 

the audit of the Production and Service Controls process, to make decisions as to supplier evaluation 

files to be reviewed during the audit of the Purchasing process.

The organization's Purchasing process may be reviewed in conjunction with the Measurement, Analysis 

and Improvement process, the Design and Development process, and the Production and Service 

Controls process, being mindful of the MDSAP process linkages. 

The Purchasing process should be considered a critical process for those organizations that outsource 

essential activities such as design and development or production to one or more suppliers.

Slide 9

The purpose of auditing the Purchasing process is to verify that the manufacturer's processes ensure 

that products, such as components, materials and services provided by suppliers, including contractors 

and consultants, are in conformity with specified purchase requirements, including quality management 

system requirements.

 

This is particularly important for those organizations who outsource activities such as design and 

development or production to one or more suppliers, and when the supplied product or service cannot 

be verified by inspection, as is the case with sterilization services. 

Slide 10

Suppliers include those providers of any product received from outside the manufacturer, including 

corporate or financial affiliates, where the product has an effect on subsequent product realization or 

the final product.

Slide 11

The next few slides will discuss the expected outcomes of auditing the Purchasing Process.

 

Slide 12

As a result of the audit of the Purchasing process, objective evidence will show whether the 

manufacturer has: defined, documented and implemented procedures to ensure purchased or 

otherwise supplied products conform to specified purchase requirements; established criteria for the 

selection, evaluation and re-evaluation of suppliers based on the type and significance of the product 

purchased and the impact of the supplied product on subsequent product realization or the quality of 

the finished device.

Slide 13

Performed the evaluation and selection of suppliers based on the capability of the supplier 

to meet specified requirements; ensured the continued capability of suppliers to provide 

quality products that meet specified purchase requirements through re-evaluation; and 
3 

determined and implemented an appropriate combination of controls applied to suppliers 

in conjunction with acceptance verification activities to ensure conformity to product and 

quality management system requirements, based on the impact of the supplied product on 

the finished device.

Slide 14

We will now move to a discussion of each audit task.

The next few slides will explain the audit tasks in terms of the description and related Clauses and 

Regulations for each audit task, the country-specific requirements and assessment of conformity, and 

the Links of the Purchasing process to other MDSAP processes.

 

Slide 15

Task 1: Verify that planning activities describe or identify products to purchase and processes to 

outsource, the specified requirements for purchased products and services, the requirements for 

purchasing documentation and records, purchasing resources, the activities for purchased product 

acceptance, and the integration of risk management in supplier selection and purchasing.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 16

There are no additional country-specific requirements for this task.

Detailed Information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 7: Purchasing, under Task 1. 

Slide 17

This task has a link to Design and Development Processes. 

During the review of a design project, confirm that the organization has considered the effect of 

purchased product on the essential design outputs. 

For suppliers that provide product and services related to the essential design outputs, the degree of 

purchasing controls necessary is commensurate with the effect of the supplied product on the proper 

functioning of the finished device. 

During the audit of the Purchasing process, confirm when necessary that the degree of control over 

suppliers of purchased product has been made based on the risk the supplied product poses to the 

ability of the finished device to meet specified requirements.

Slide 18

This task also has a link to the Management Process. Confirm, when necessary, that the quality 

objectives related to the purchased product were considered for inclusion in management review.

Slide 19

Task 2: Select one or more supplier evaluation files to audit. The audit team should use the 

following priorities when making the selection:
4 

• Suppliers with indications of problems with products or processes they supply as 

uncovered during the audit of the Measurement, Analysis and Improvement process

• Suppliers of higher risk products or processes

• Suppliers who provide products or services that directly impact the design outputs 

required for proper functioning of the device. 

Slide 20

Task 2: Select one or more supplier evaluation files to audit. The audit team should also use these 

following priorities when making the selection:

 

• Suppliers of processes that require validation or revalidation

• Newly approved suppliers of products or services

• Suppliers of products or services used in the manufacturing of multiple products, and

• Suppliers of components or services not covered during previous audits.

 

There are no specified clauses and regulations for this Task.

Slide 21

There are no additional country-specific requirements for this task.

There is no information on how to assess conformity and there are no other linkages to Task 2. 

Slide 22 

Task 3: Verify that procedures for ensuring purchased product conforms to purchasing requirements 

have been established and documented. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 23

There are no additional country-specific requirements for this task.

Detailed Information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 7: Purchasing, under Task 3.

There are no linkages to Task 3.

Slide 24

Task 4: Verify that the procedures assure the type and extent of control applied to the supplier and the 

purchased product is dependent upon the effect of the purchased product on subsequent product 

realization or on the final product. Verify that criteria for the selection, evaluation and re-evaluation of 

suppliers have been established and documented.
5 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 25 

There are no additional country-specific requirements for this task.

In Assessing conformity to Task 4, be mindful or organizations that use a “one-size fits all” approach to 

managing their suppliers. Detailed Information on how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 7: Purchasing, under Task 4.

There are no linkages to Task 4.

Slide 26

Task 5: Verify that suppliers are selected based on their ability to supply products or services in 

accordance with the manufacturer’s specified requirements. Confirm the degree of control applied to 

the supplier is commensurate with the significance of the supplied product or service on the quality of 

the finished device, based on risk. Verify that records of supplier evaluations are maintained.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 27

There are additional country-specific requirements for Australia (TGA); Canada (HC); and Japan (MHLW) 

for this task.

Assessing conformity includes confirming that the medical device organization’s selection of the supplier 

was based on defined criteria commensurate with the risk posed and confirming that the evaluation was 

made according to defined criteria and is commensurate with the effect the supplied product has on the 

essential design outputs.

Detailed Information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 7: Purchasing, under Task 5.

Slide 28

This task has a link to the Design and Development Process. 

Ensure the establishment of the necessary purchasing controls and required acceptance 

activities as a design output.

The degree of the purchasing controls necessary and extent of acceptance activities should be 

based on the risk posed by the product not meeting its specified requirements and essential 

design outputs. Ensure the degree of the purchasing controls necessary and extent of 

acceptance activities is based on risk.

Slide 29

This task also has a link to Production and Service Controls Process. 
6 

Auditors may encounter situations where the organization outsources processes that require validation. 

During the review of the Purchasing process, review the controls the organization has instituted over 

suppliers that perform validated processes. This typically includes confirming that the finished device 

manufacturer has reviewed the process validation data generated by the supplier to ensure the process 

is effective, reproducible, and stable. This can be particularly important for higher risk validated 

processes performed by suppliers, since the finished device manufacturer does not have immediate 

control over those processes. 

Slide 30

The audit team should also consider reviewing the purchasing controls and requirements for suppliers of 

products that undergo minimal acceptance activities at the device manufacturer.

Slide 31

Task 6: Verify that the medical device organization/manufacturer maintains effective controls over 

suppliers and product, so that specified requirements continue to be met.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 32

There are no additional country-specific requirements for this task.

Assessing conformity includes confirming that the supplier monitoring is documented and reviewed by 

appropriate individuals responsible for the supplier selection, being mindful of instances were supplied 

product has caused complaints and/or product nonconformities; and verifying that the medical device 

organization has performed the appropriate monitoring of the supplier and taken actions when 

necessary. 

Detailed Information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 7: Purchasing, under Task 6.

Slide 33

This task has a link to Production and Service Controls Process. Confirm when necessary during the audit 

of the Production and Service Controls process that the appropriate acceptance activities have been 

implemented and monitored to ensure that the received product meets specified requirements.

 

Slide 34

This task also has a link to Measurement, Analysis and Improvement. Organizations are required to 

determine, collect, and analyze appropriate data to demonstrate the ability of suppliers to provide 

acceptable product. 

During the audit of the Measurement, Analysis and Improvement process, confirm that analysis of 

supplier performance data has been performed and considered for corrective or preventive action when 

necessary. 

Slide 35
7 

Task 7: Confirm that the re-evaluation of the capability of suppliers to meet specified requirements is 

performed at intervals consistent with the significance of the product on the finished device.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 36

There are no additional country-specific requirements for this task.

Assessing conformity includes confirming that the re-evaluation of the supplier was performed 

commensurate with the risk the supplied product poses to the ability of the finished device to meet 

specifications.

Detailed Information on how to assess conformity for this audit task can be found in the MDSAP Audit

Approach, Chapter 7: Purchasing, under Task 7.

Slide 37

This task has a link to Measurement, Analysis and Improvement process. The frequency and extent of 

supplier re-evaluation activities may be based, in part, on the performance of the supplier as 

demonstrated by such activities as statistical monitoring of the supplier, monitoring of complaints and 

nonconformities related to supplied product, and corrective or preventive actions related to the 

supplier.

Slide 38

Task 8: Verify that the medical device organization assures the adequacy of purchasing requirements 

for products and services that suppliers are to provide and defines risk management activities and any 

necessary risk control measures. Confirm that the medical device organization ensures the adequacy of 

specified purchase requirements prior to their communication to the supplier and that a written 

agreement with the supplier is established in which suppliers has to notify the organization about 

changes in the product.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 39

There are additional country-specific requirements for Brazil (ANVISA) for this task.

Assessing conformity includes confirming that risk control measures have been identified when 

appropriate and that the risk control measures have been implemented and are effective. Detailed 

Information on how to assess conformity for this audit task can be found in the MDSAP Audit Approach, 

Chapter 7: Purchasing, under Task 8

There are no linkages to Task 8.

Slide 40

Task 9: Verify that the medical device organization documents purchasing information, including where 

appropriate the requirements for approval of product, procedures, processes, equipment, qualification 
8 

of personnel, sterilization services, and other quality management system requirements. Confirm that 

documents and records for purchasing are consistent with traceability requirements where applicable.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 41

There are no additional country-specific requirements for this task.

Detailed Information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 7: Purchasing, under Task 9.

There are no linkages to Task 9.

Slide 42

Task 10: Confirm that the verification (inspection or other activities) of purchased products is adequate 

to ensure that specified requirements are met. Confirm that the manufacturer has implemented an 

appropriate combination of controls applied to the supplier, the specification of purchase requirements, 

and acceptance verification activities that are commensurate with the risk of the supplied product upon 

the finished device. Verify that records of verification activities are maintained.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 43

There are additional country-specific requirements for Brazil (ANVISA) for this task.

Assessing conformity includes confirming the medical device organization has appropriately handled the 

nonconformity according to the medical device organization’s established procedures, confirming the 

records of verification activities have been maintained for the supplied products being reviewed, and 

confirming the acceptance activities have been documented, including the documents and appropriate 

disposition of nonconforming product.

Detailed Information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 7: Purchasing, under Task 10. 

Slide 44

This task has a link to Production and Service Controls Process. The audit team may encounter instances 

where product has been deemed acceptable by the successful completion of acceptance activities but 

the product is later shown to not meet specified requirements, such as failure of the device due to 

nonconforming component leading to product complaint. 

Confirm the medical device organization has taken the appropriate action to determine the suitability of 

the acceptance activities. For example, the organization may need to validate the test method used for 

incoming acceptance to ensure the test method is actually capable of identifying nonconforming 

product.

Slide 45
9 

Task 11: Verify that data from the evaluation of suppliers, verification activities, and purchasing are 

considered as a source of quality data for input into the Measurement, Analysis and Improvement 

process. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 46

There are no additional country-specific requirements for this task.

Detailed Information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 7: Purchasing, under Task 11.

Slide 47

This task has a link to Design and Development Process. The medical device organization must 

determine the appropriate acceptance activities for supplied product, based on the essential design 

outputs of the device and the risk the device poses if specified requirements are not met. 

Confirm as necessary that supplied product was evaluated as to the effect on the essential design 

outputs. Additionally, verify the appropriate acceptance activities were implemented, based on the 

potential effect the supplied product poses to the essential design outputs.

Slide 48

This task also has a link to Measurement, Analysis and Improvement Process. Organizations are required 

to determine, collect, and analyze appropriate data to demonstrate the ability of suppliers to provide 

acceptable product. 

During the audit of the Measurement, Analysis and Improvement process, confirm that the analysis of 

supplier performance data from the evaluation and monitoring of supplier process activities has been 

performed and considered for corrective or preventive action when necessary. 

Slide 49

Task 12. For the last task in this process, determine, based on the assessment of the overall purchasing 

process, whether management provides the necessary commitment and resources to the purchasing

process. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 50

There are no additional country-specific requirements for this task.

No additional Information on how to assess conformity for this audit task is provided in the MDSAP 

Audit Approach, Chapter 7: Purchasing, under Task 12.

There are no other linkages for this task.

Slide 51
10

This concludes the training for MDSAP process: Purchasing process.