Purchasing Controls

November 4, 2015

Joseph Tartal

Postmarket and Consumer Branch Chief

Division of Industry and Consumer Education

Office of Communication and Education

Center for Devices and Radiological Health

U.S. Food and Drug Administration
2 

Learning Objectives

• Understand the Intent and Background of Purchasing 

Controls

• Define Product, Component and Service 

• Understand Purchasing Controls Requirements, 

Voluntary Guidance and Best Practices

• Recognize the Links between Purchasing Controls and 

other Quality System (QS) requirements such as Design 

Controls and Acceptance Activities
3 

References

• 21 Code of Federal Regulations (CFR) 820: 

Quality System Regulation

• 21 CFR 820.50: Purchasing Controls

• Preamble to 1996 Quality System (QS) 

Regulation
4 

Intent of Purchasing Controls

The intent of § 820.50 is to ensure that device 

manufacturers select only those suppliers, contractors, and 

consultants who have the capability to provide quality 

product and services. As with finished devices, quality 

cannot be inspected or tested into products or services. 

FDA Response to Comment #106 [Preamble to 1996 QS Regulation]
5 

Why Does This Matter?

• Quality of the finished medical device depends on the 

quality of the raw materials, components and services 

that went into it.

• Poor Medical Device Quality Can Cause:

– Injuries from the medical device

– Recalls

– Customer dissatisfaction
6 

Why is FDA Concerned about 

Purchasing Controls?

• Inspections often extend only to the finished device 

manufacturer. 

• FDA does not perform routine inspections of component 

manufacturers.

• Increasing outsourcing of the manufacturing of critical 

components and entire medical devices.
7 

What is Unique about Medical Devices?

• Wide range in type of received products and 

services

– Raw materials, Components, Software, etc.

– Laboratories, Sterilizers, Calibration, Installers and Service 

Providers, Auditors, Consultants

• Wide range in complexity in received products

– From components to finished devices
8 

What Else is Unique about

Medical Devices?

• Wide range in risk associated with received 

products and services 

– Same received product or service may have different risks 

based on use.

– Same supplier may have different risks for different 

supplied product or service.
9 

When are Purchasing Controls 

Applicable?

• Received Products 

• Received Services 

• Consultants
10

Definition: Product

Product includes components, manufacturing 

materials, in-process devices, finished devices, 

and returned devices.

§ 820.3(r)
11

Definition: Component

Component means any raw material, 

substance, piece, part, software, firmware, 

labeling, or assembly which is intended to be 

included as part of the finished, packaged, and 

labeled device.

 § 820.3(c)
12

Definition: Service

Service means parts of the manufacturing or 

quality system that are contracted to others, for 

example, plating of metals, testing, and 

sterilizing...

FDA Response to Comment #102 [Preamble to 1996 QS Regulation]
13

Requirements and Best Practices

• The Quality System Regulation, 21 CFR 820.50

http://www.ecfr.gov/cgibin/retrieveECFR?gp=&SID=0588847128f3ca65f7192b250f242cc1&mc=true&n

=pt21.8.820&r=PART&ty=HTML#sp21.8.820.e 

• Preamble to QS Regulation 

• GHTF Guidance: Quality Management System Medical 

Devices – Control of Products and Services Obtained 

from Suppliers; SG3; 2008

http://www.imdrf.org/docs/ghtf/final/sg3/technical-docs/ghtf-sg3-n17-guidanceon-quality-management-system-081211.pdf 
14

Requirements for

Purchasing Controls

Establish and maintain procedures to ensure that 

all purchased or otherwise received product and 

services conform to specified requirements

Paraphrase § 820.50
15

Six Steps to Supplier Controls

These six steps are typically involved in establishing 

controls for products and services obtained from 

suppliers:

1. Planning

2. Selection of potential supplier/s

3. Evaluation/acceptance of supplier

4. Finalization of responsibilities and controls

5. Delivery, measurement and monitoring

6. Communication including the CAPA process

 GHTF Guidance General Principals Section 3.0
16

Requirements for

Purchasing Controls

Establish and maintain requirements, including 

quality requirements, that suppliers, contractors 

and consultants must meet

Paraphrase § 820.50(a)
17

Requirements for

Purchasing Controls

Evaluate and select potential suppliers, 

contractors, and consultants on the basis of their 

ability to meet specified requirements, 

including quality requirements. The evaluation 

shall be documented.

 § 820.50(a)(1)
18

Requirements for

Purchasing Controls

• Define the type and extent of control to be exercised 

over product, services, suppliers, contractors, and 

consultants based on the evaluation results.

§ 820.50(a)(2)

• Establish and maintain records of acceptable suppliers, 

contractors, and consultants

§ 820.50(a)(3)
19

Control Over Suppliers

... A finished device manufacturer may choose to 

provide greater in-house controls to ensure that 

products and services meet requirements, or may 

require the supplier to adopt measures necessary 

to ensure acceptability, as appropriate. 

FDA Response to Comment #99 [Preamble to 1996 QS Regulation]
20

Requirements for Purchasing Controls, 

continued Purchasing Data

• Establish and maintain data that clearly describe or 

reference the specified requirements, including quality 

requirements, for purchased or otherwise received 

products and services

• Approve in accordance with Document Controls in § 

820.40

 

Paraphrase § 820.50(b)
21

Requirements for Purchasing Controls

Purchasing documents shall include, where 

possible, an agreement that the suppliers, 

contractors, and consultants agree to notify the 

manufacturer of changes in the product or service 

so that manufacturers may determine whether the 

changes may affect the quality of a finished 

device. § 820.50(b)
22

Ongoing Supplier Reviews

The capability of the product or service suppliers 

should be reviewed at intervals consistent with 

the significance of the product or service 

provided and the review should demonstrate 

conformance to specified requirements.

FDA Response to Comment #103 [Preamble to 1996 QS Regulation]
23

Ongoing Communication

• Discuss supplier’s complaint handling system 

and any defects in product that could result in 

problems with the device.

• Discuss supplier’s willingness to provide 

information when the device manufacturer is 

performing a CAPA where the device defect may 

be due to the supplier’s product.
24

Purchasing Controls Link to Other 

Quality System Requirements

Design Controls (21 CFR 820.30)

– Product design drives purchasing decisionmaking

Acceptance Activities (21 CFR 820.80)

– In-house Acceptance activities complement 

supplier controls
25

Purchasing Controls Link to 

Design Controls

... the quality of a product or service is established 

during the design of that product or service, and 

achieved through proper control of the manufacture 

of that product or the performance of that service... 

FDA Response to Comment #106 [Preamble to 1996 QS Regulation]
26

Specifications

Specifications for the device are determined in 

Design Controls, (21 CFR 820.30)

– Design Inputs ensure that design requirements 

relating to the device are appropriate and address 

intended use

– Design Outputs must contain or make reference to 

acceptance criteria and identify essential design 

outputs
27

Acceptance Activities

• Establish and Maintain Procedures for 

Acceptance Activities of Incoming Product §820.80

• Acceptance activities include:

– Inspections, Tests and other Verification Activities

– Documenting Acceptance or Rejection
28

Purchasing Controls and 

Acceptance Activities

... The extent of incoming acceptance activities can 

be based, in part, on the degree to which the 

supplier has demonstrated a capability to provide 

quality products or services.

FDA Response to Comment #106 [Preamble to 1996 QS Regulation]
29

Summary

• Purchasing controls pertain to received products and 

services 

• Select suppliers based on their capabilities and your 

manufacturing requirements

• Establish adequate supplier controls

• Documentation is important! Establish and maintain 

records regarding purchases, data, reviews, etc.

• Following purchasing control requirements is good for 

business and public health
Providing Industry Education

1. CDRH Learn – Multi-Media Industry Education

 over 80 modules - videos, audio recordings, power point presentations, software-based 

“how to” modules

 accessible on your portable devices: http://www.fda.gov/Training/CDRHLearn

2. Device Advice – Text-Based Education

 comprehensive regulatory information on premarket and postmarket topics:

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance

3. Division of Industry and Consumer Education (DICE) 

 If you have a question - Email: DICE@fda.hhs.gov 

 Phone: 1(800) 638-2041 or (301) 796-7100 (Live Agents 9am – 12:30 pm; 1-4:30 pm EST)

 Web Homepage: 

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/ContactUs-- DivisionofIndustryandConsumerEducation/default.htm 

30