Purchasing Process

CAPT Kimberly Lewandowski-Walker

Senior Regulatory Officer

Center for Devices and Radiological Health 

U.S. Food and Drug Administration
Course Prerequisites

• Successful completion of the following MDSAP training 

module is a prerequisite to this course:

– Introduction to the MDSAP Program

– Overview of the MDSAP Audit Process

– MDSAP: Management Process

– MDSAP: Measurement, Analysis and Improvement Process

– MDSAP: Design and Development Process

– MDSAP: Production and Service Controls Process: Parts 1-3
Learning Objectives

• Explain the Purchasing Process

• Describe the purpose of auditing the Purchasing process

• Discuss the expected outcomes from audit of the 

Purchasing process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
Learning Objectives

• Explain the Purchasing Process

• Describe the purpose of auditing the Purchasing process

• Discuss the expected outcomes from audit of the 

Purchasing process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
Purchasing process

• Ensures that purchased, subcontracted, or otherwise 

received products and services conform to specified 

requirements 

• Incorporates purchasing requirements and 

specifications

• Selects acceptable suppliers based on the capability of 

the suppliers 
Purchasing process

• The organization is expected to establish and maintain 

documented controls for planning and performing 

purchasing activities

– Controls depend on the effect of the purchased product or 

service .of the finished device

• Integral to other processes of the MDSAP audit 

sequence
Learning Objectives

• Explain the Purchasing Process

• Describe the purpose of auditing the Purchasing process

• Discuss the expected outcomes from audit of the 

Purchasing process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
MDSAP Audit Sequence
Purpose of Auditing

• Purchasing Process is audited to:

– Verify that the manufacturer’s processes ensure that 

products are in conformity with specified purchase 

requirements

Products such as components, materials and services provided 

by suppliers, including contractors and consultants
Purpose of Auditing

• Suppliers include:

– Providers of any product received from outside the 

manufacturer 

Product has an effect on subsequent product realization or the 

final product 
Learning Objectives

• Explain the Purchasing Process

• Describe the purpose of auditing the Purchasing process

• Discuss the expected outcomes from audit of the 

Purchasing process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
Expected Outcomes

As a result of the audit of the Purchasing process, objective

evidence will show whether the manufacturer has:

A. Defined, documented and implemented procedures

B. Established criteria for the selection, evaluation and re- evaluation of suppliers
Expected Outcomes

As a result of the audit of the Purchasing process, objective

evidence will show whether the manufacturer has:

C. Performed the evaluation and selection of suppliers

D. Ensured the continued capability of suppliers to provide quality 

products that meet specified purchase requirements

E. Determined and implemented an appropriate combination of 

controls applied to suppliers in conjunction with acceptance 

verification activities
Learning Objectives

• Explain the Purchasing Process

• Describe the purpose of auditing the Purchasing process

• Discuss the expected outcomes from audit of the 

Purchasing process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
Task 1

1. Verify that planning activities describe or identify products to 

purchase and processes to outsource, the specified requirements for 

purchased products, the requirements for purchasing 

documentation and records, purchasing resources, the activities for 

purchased product acceptance, and risk management in supplier 

selection and purchasing.

Clause and Regulation: [ISO 13485:2016: 4.1.2, 4.1.3, 4.1.5, 7.1, 7.4.1, 

7.4.2, 7.4.3; TG(MD)R: Sch1 P1 2, Sch3 P1 Cl1.4(5)(d)(ii); RDC 

ANVISA16/2013: 2.5.1, 2.4; MHLW MO169: 5-2, 5-3, 5-5, 26, 37, 38, 39 

(Old: 5, 26, 37, 38, 39); 21 CFR 820.20, 820.50]

MDSAP Audit Approach
Task 1

• Additional country-specific requirements: None

• Assessing conformity:

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 7: 

Purchasing under Task 1
Task 1

• Links: 

– Design and Development

Confirm that the organization has considered the 

effect of purchased product on the essential design 

outputs

o The degree of purchasing controls necessary is 

commensurate with the effect of the supplied 

product on the proper functioning of the finished 

device. 

o During the audit of the Purchasing process, confirm 

when necessary that the degree of control over 

suppliers of purchased product has been made.
Task 1

• Links: 

– Management

Confirm when necessary that the quality 

objectives related to the purchased product 

were considered for inclusion in management 

review. 
Task 2

2. Select one or more supplier evaluation files to audit.

Priority criteria for selection:

• Indications of problems with supplied products or processes from 

audit of the Measurement, Analysis and Improvement process

• Suppliers of higher risk products or processes

• Suppliers who provide products or services that directly impact the 

design outputs required for proper functioning of the device

MDSAP Audit Approach
Task 2

2. Select one or more supplier evaluation files to audit.

Priority criteria for selection:

• Suppliers of processes that require validation or revalidation

• Newly approved suppliers of products or services

• Suppliers of products or services used in the manufacturing of 

multiple products

• Suppliers of components or services not covered during previous 

audits

Clause and regulation: None

MDSAP Audit Approach
Task 2

• Additional country-specific requirements: None

• Assessing conformity: None
Task 3

3. Verify that procedures for ensuring purchased product 

conforms to purchasing requirements have been established 

and documented.

Clause and regulation: [ISO 13485:2016: 7.4.1; TG(MD)R Sch3 

P1 Cl1.4(5)(d)(ii); RDC ANVISA 16/2013: 2.5.1; MHLW MO169: 

37; 21 CFR 820.50]

MDSAP Audit Approach
Task 3

• Additional country-specific requirements: None

• Assessing conformity:

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 7: 

Purchasing under Task 3
Task 4

4. Verify that the procedures assure the type and extent of 

control applied to the supplier and the purchased product is 

dependent upon the effect of the purchased product on 

subsequent product realization or on the final product. 

Verify that criteria for the selection, evaluation and re- evaluation of suppliers have been established and 

documented. 

Clause and regulation: [ISO 13485:2016: 7.4.1; RDC ANVISA 16/2013: 

2.5.2, 2.5.3; MHLW MO169: 37; 21 CFR 820.50]

MDSAP Audit Approach
Task 4

• Additional country-specific requirements: None

• Assessing conformity:

– Be mindful or organizations that use a “one-size fits all” 

approach to managing their suppliers

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 7: 

Purchasing under Task 4
Task 5

5. Verify that suppliers are selected based on their ability to 

supply products or services in accordance with the 

manufacturer’s specified requirements. 

Confirm the degree of control applied to the supplier is 

commensurate with the significance of the supplied product 

or service on the quality of the finished device, based on risk.

Verify that records of supplier evaluations are maintained.

Clause and regulation: [ISO 13485:2016: 4.2.1, 7.1, 7.4.1; TG(MD)R: 

Sch1 P1 2; RDC ANVISA 16/2013: 2.3.3, 2.5.3, 2.4; MHLW MO169:6, 

26, 37 (Old: 6, 26, 37); 21 CFR 820.50(a)]

MDSAP Audit Approach
Task 5

• Additional country-specific requirements: Australia (TGA); 

Canada (HC); Japan (MHLW)

• Assessing conformity:

– Confirm that the selection of the supplier was based on defined criteria 

commensurate with the risk posed

– Confirm that the evaluation was made according to defined criteria

Detailed information on how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 7: Purchasing under Task 5
Task 5

• Links: 

– Design and Development

Ensure the establishment of the necessary 

purchasing controls and required acceptance 

activities as a design output

Ensure the degree of the purchasing controls 

necessary and extent of acceptance activities is 

based on risk 
Task 5

• Links: 

– Production and Service Controls 

Auditors may encounter situations where the 

organization outsources processes that require 

validation. 

During the review of the Purchasing process, review 

(when necessary) the controls the organization has 

instituted over suppliers that perform validated 

processes. 

Confirm that the finished device manufacturer has 

reviewed the process validation data.
Task 5

• Links: 

– Production and Service Controls

Consider reviewing the purchasing controls and 

requirements for suppliers of products that 

undergo minimal acceptance activities at the 

device manufacturer.
Task 6

6. Verify that the medical device organization maintains 

effective controls over suppliers and product, so that specified 

requirements continue to be met.

Clause and regulation: [ISO 13485:2016: 7.4.1; RDC ANVISA 

16/2013: 2.5.3; MHLW MO169: 37; 21 CFR 820.50(a)]

MDSAP Audit Approach
Task 6

• Additional country-specific requirements: None

• Assessing conformity:

– Confirm that the supplier monitoring is documented and reviewed by 

appropriate individuals

– Be mindful of instances were supplied product has caused complaints 

and/or product nonconformities

– Verify that the organization has performed the appropriate monitoring

Detailed information on how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 7: Purchasing under Task 6
Task 6

• Links: 

– Production and Service Controls

Confirm when necessary that the appropriate 

acceptance activities have been implemented and 

monitored to ensure that the received product 

meets specified requirements.
Task 6

• Links: 

– Measurement, Analysis and Improvement

Confirm that analysis of supplier performance data 

has been performed and considered for corrective or 

preventive action when necessary. 
Task 7 

7. Confirm the re-evaluation of the capability of suppliers to meet specified requirements is performed at intervals 

consistent with the significance of the product on the finished 

device.

Clause and regulation: [ISO 13485:2016: 7.4.1; TG(MD)R: Sch1 

P1 2; RDC ANVISA 16/2013: 2.5.2, 2.4; MHLW MO169: 37; 21 

CFR820.50(a)]

MDSAP Audit Approach
Task 7

• Additional country-specific requirements: None

• Assessing conformity:

– Confirm that the re-evaluation of the supplier was performed 

commensurate with the risk the supplied product poses to 

the ability of the finished device to meet specifications

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 7: 

Purchasing under Task 7
Task 7

• Links: 

– Measurement, Analysis and Improvement

The frequency and extent of supplier reevaluation activities may be based on the 

performance of the supplier demonstrated by:

o statistical monitoring of the supplier, 

o monitoring of complaints and nonconformities 

related to supplied product

o corrective or preventive actions related to the 

supplier 
Task 8

8. Verify that the medical device organization assures the adequacy of 

purchasing requirements for products and services that suppliers are to 

provide, and defines risk management activities and any necessary risk 

control measures. 

Confirm that the medical device organization ensures the adequacy of 

specified purchase requirements prior to their communication to the 

supplier and that a written agreement with the supplier is established in

which suppliers has to notify the organization about changes in the product.

Clause and regulation: [ISO 13485:2016: 4.2.1, 7.4.2, TG(MD)R: Sch1 P1 2; 

RDC ANVISA 16/2013: 2.4, 2.5.4, 2.5.6; MHLW MO169: 6, 38; 21 CFR 

820.50(b)]

MDSAP Audit Approach
Task 8

• Additional country-specific requirements: Brazil (ANVISA)

• Assessing conformity:

– Confirm that risk control measures have been identified when 

appropriate 

– Confirm that the risk control measures have been implemented and are 

effective

Detailed information on how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 7: Purchasing under Task 8
Task 9

9. Verify that the medical device organization documents purchasing 

information, including where appropriate the requirements for 

approval of product, procedures, processes, equipment, 

qualification of personnel, sterilization services, and other quality 

management system requirements. 

Confirm that documents and records for purchasing are consistent 

with traceability requirements where applicable.

Clause and regulation: [ISO 13485:2016: 7.4.2, 7.5.9 ; RDC 

ANVISA 16/2013: 2.3.3, 2.5.4, 2.5.5, 6.4; MHLW MO169: 38, 48, 

49: 21 CFR 820.50(b), 820.65, 820.160]

MDSAP Audit Approach
Task 9

• Additional country-specific requirements: None

• Assessing conformity:

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 7: 

Purchasing under Task 9
Task 10

10. Confirm that the verification (inspection or other activities) of purchased 

products is adequate to ensure specified requirements are met. 

Confirm that the manufacturer has implemented an appropriate 

combination of controls applied to the supplier, the specification of 

purchase requirements, and acceptance verification activities that are 

commensurate with the risk of the supplied product upon the finished 

device. Verify that records of verification activities are maintained. 

Clause and regulation: [ISO 13485:2016: 4.2.1, 7.1, 7.4.3; TG(MD)R: Sch1 

P1 2, Sch3 1.4(5)(e); RDC ANVISA 16/2013: 2.4, 2.5.2, 3.35.3.1, 5.3.2, 

5.3.3; MHLW MO169: 6, 26, 39; 21 CFR 820.50, 820.80(b)]

MDSAP Audit Approach
Task 10

• Additional country-specific requirements: Brazil (ANVISA)

• Assessing conformity:

– Confirm the medical device organization has appropriately handled the 

nonconformity according to the medical device organization’s established 

procedures

– Confirm the records of verification activities have been maintained

– Confirm the acceptance activities have been documented

Detailed information on how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 7: Purchasing under task 10
Task 10

• Links: 

– Production and Service Controls

Confirm the organization has taken the appropriate 

action to determine the suitability of the acceptance 

activities. 
Task 11

11. Verify that data from the evaluation of suppliers, verification 

activities, and purchasing are considered as a source of 

quality data for input into the Measurement, Analysis and 

Improvement process.

Clause and regulation: [ISO 13485:2016: 8.4; RDC ANVISA 

16/2013: 7.1.1.1; MHLW MO169: 61; 21 CFR 820.100]

MDSAP Audit Approach
Task 11

• Additional country-specific requirements: None

• Assessing conformity:

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 7: 

Purchasing under Task 11
Task 11

• Links: 

– Design and Development

Confirm, as necessary, that supplied product was 

evaluated as to the effect on the essential design 

outputs. 

Verify the appropriate acceptance activities were 

implemented
Task 11

• Links: 

– Measurement, Analysis and Improvement

Confirm that the analysis of supplier performance 

data from the evaluation and monitoring of supplier 

process activities has been performed and 

considered for corrective or preventive action when 

necessary. 
Task 12

12. Determine, based on the assessment of the overall purchasing 

process, whether management provides the necessary 

commitment to the purchasing process.

Clause and regulation: [ISO 13485:2016: 4.1.3, 4.1.5, 5.2; RDC 

ANVISA 16/2013: 2.2.1; MHLW MO169: 5-3, 5-5, 11 (Old: 5, 11]

MDSAP Audit Approach
Task 12

• Additional country-specific requirements: None

• Assessing conformity:

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 7: 

Purchasing under task 12
Conclusion

• This concludes the training for MDSAP process: Purchasing 

Process
52