FDA requirements for supplier management are outlined by EduQuest president Martin Browning, who also provides practical advice for avoiding common mistakes companies make in managing relationships with third-party vendors, suppliers and auditors.

1. Supplier Management:
A Primer for Meeting
FDA Requirements
Managing Relationships with
Your Third-Party Vendors, Suppliers
and Auditors
By: Martin Browning, President & Co-Founder, EduQuest, Inc.
www.EduQuest.net or email Martin@EduQuest.net
Washington, DC

2. EduQuest
EDUcation: QUality Engineering, Science and Technology
 Global team of FDA compliance experts based near Washington, DC,
with staff located in U.S. and Europe
 Founded by former senior officials and expert investigators from
FDA’s Office of Regulatory Affairs (ORA) Headquarters
 Advisors to medical device, pharmaceutical, biologics, tobacco and
food companies since 1995 – Fortune 500s and Start-Ups
 Authorities on audits & training for Quality Systems, Supplier Control,
Risk Management, Part 11, Validation, and Inspection Readiness
2© 2014 EduQuest, Inc.

3. Martin Browning
President & Founder, EduQuest
 22 years with U.S. FDA as expert investigator and rule-maker
 Special Assistant to Associate Commissioner of
Regulatory Affairs
 Co-Author of 21 CFR Part 11 for Electronic Records & Electronic Signatures
 Former chair of U.S. ISO 9000 committee; served as FDA liaison to the Global
Harmonisation Task Force (GHTF)
 Helped to develop the Quality System Regulation (QSR) for Medical Devices
 Chair of EduQuest’s classroom training courses (www.EduQuest.net)
, & Technology

4. Managing Relationships with Third-Party
Vendors, Suppliers and Auditors
Overview
• What’s Behind the Drive to Outsource
– A growing problem
• FDA Requirements and Expectations
– Who’s responsible for what?
– Selecting partners
– Notifying FDA
• What NOT to Outsource
• Common Pitfalls & Advice for Avoiding Them
• Looking Ahead at the Trends
© 2014 EduQuest, Inc. 4

5. © 2014 EduQuest, Inc. 5
What’s Behind the Drive to Outsource
“What can be outsourced?
Everything, except responsibility.”

6. © 2014 EduQuest, Inc. 6
What’s Behind the Drive to Outsource
Why outsource?
• Cost reduction
• Better focus on “core” business
• Reduce or control personnel “overhead”
• Improve organizational performance

7. © 2014 EduQuest, Inc. 7
What’s Behind the Drive to Outsource
Outsourcing IT, for example
• Reduce the cost of supporting an IT
infrastructure
• Improve the organization’s efficiency and
performance
• Comply with the company’s strategic direction

8. © 2014 EduQuest, Inc. 8
What’s Behind the Drive to Outsource
Outsourcing Manufacturing, for example
• Reduce the cost of supporting a manufacturing facility
(or unique line, or special product)
• Improve the organization’s efficiency and
performance
• Comply with the company’s strategic direction and
core expertise (development, marketing, etc.)

9. © 2014 EduQuest, Inc. 9
FDA Requirements and Expectations
• You, the regulated entity, are responsible for
compliance with all of the applicable regulatory
requirements.
• If you outsource, you are responsible for the
performance of your outsourcing partners.

10. © 2014 EduQuest, Inc. 10
FDA Requirements and Expectations
• If you outsource IT, you are still responsible for
assuring that all required activities are performed
and documented.
• Monitoring is critical, so typically a more robust
quality organization is needed for audit,
oversight, etc. (note that this also can be
outsourced)

11. © 2014 EduQuest, Inc. 11
FDA Requirements and Expectations
• If you outsource manufacturing, you are still responsible
for assuring that all specifications are met, required
activities are performed, data is maintained, and
regulatory requirements are met.
• Monitoring is critical, so typically a more robust quality
organization is needed for audit, oversight, etc. (note
that this also can be outsourced)

12. © 2014 EduQuest, Inc. 12
Select Partners Compatible with Your
Standards and Integrity
• Those who outsource must have established:
– Company moral and integrity standards clearly stated
in policy documents
– Mission statement
– Quality policy
– Management responsibilities
– Quality responsibilities

13. © 2014 EduQuest, Inc. 13
Select Partners Compatible with Your
Standards and Integrity
• Management (not Quality) must have processes
for evaluating potential partners (suppliers, sub-
contractors, etc.)
– Survey, audit, selection process
– CAPA processes
– Clearly defined risk analysis
– Clearly defined regulatory compliance processes

14. © 2014 EduQuest, Inc. 14
Select Partners Compatible with Your
Standards and Integrity
• Potential partners should have already defined
their own moral standards and integrity and these
must be a good “fit”
• Potential partners must understand and be willing
to fully comply with regulatory requirements
• Potential partners must understand and be willing
to accept regulatory risks

15. © 2014 EduQuest, Inc. 15
Notify FDA About Your Partners
• Disclosure (in advance) is required for some
submissions
• Disclosure is made during inspections,
discussions, meetings, formally and informally
• Some outsourcing partners are required to
register with the FDA

16. © 2014 EduQuest, Inc. 16
Notify FDA About Your Partners
• FDA has authority to inspect most (if not all)
outsourcing partners
• A corporation can outsource to itself but…
• Changes of suppliers may require Agency
notification
• Document everything!

17. © 2014 EduQuest, Inc. 17
Common Pitfalls of Outsourcing
• A partner changes processes, personnel,
locations, ownership, etc. without notifying you
• If it’s not in the contract…
• The service, system, software, product, etc.
doesn’t really exist…yet
• A partner has your data…now what?

18. © 2014 EduQuest, Inc. 18
How to Avoid the Pitfalls
• Diligent audits
• More diligent monitoring
• Review the data
• Make sure everything is in writing
• Train them on your requirements, regulatory
requirements -- and retrain as necessary
• Constantly measure compliance

19. © 2014 EduQuest, Inc. 19
What Should NOT be Outsourced
• Activities where a company holds the technical
expertise and does not want to give away control
• Activities that cannot be monitored
• Activities involving specific commitments to
FDA or other government Agencies

20. © 2014 EduQuest, Inc. 20
How to Protect Your Company
• Contracts and Service Level Agreements (SLAs)
– Responsibility and processes must be established for
handling non-conformances
– Responsibility for initial investigation, root cause
analysis, follow-up, correction, corrective action, etc.
must be established
– Issue closure must be clearly defined and assured

21. © 2014 EduQuest, Inc. 21
Keys to Supplier Oversight and Monitoring
• Monitor and Trend
– Monitor based upon defined processes and defined
risk
– Collect key process data on performance (control
points)
– Trend past, current, and future performance relative
to expectations and quality goals

22. © 2014 EduQuest, Inc. 22
Keys to Supplier Oversight and Monitoring
• Continuous Improvement
– Actions based upon defined risks
• Reevaluate risks
• Reevaluate processes
– Predefined mitigations
• Measure effectiveness
• Refine mitigations

23. © 2014 EduQuest, Inc. 23
Looking Ahead at Trends
• FDA currently inspects outsourced activities
based upon submissions (GLP, GCP), upon risk
(contract sterilizers, etc.), or upon complaint
– Inefficient
– Costly
– Too late
– Embarrassing

24. © 2014 EduQuest, Inc. 24
Looking Ahead at Trends
• FDA’s movement toward Quality Systems and
risk-based approaches for Agency activity
logically leads toward a QS approach in the GLP
and GCP areas (periodic quality systems
inspections rather than submission specific
inspections)
• Preventive rather than reactive oversight is far
more efficient

25. © 2014 EduQuest, Inc. 25
Looking Ahead at Trends
• Increased use of standards and international
harmonization efforts
• More regulation of research and development
(standards, regulation, guidance)
• Continued growth of outsourcing
• New data risks
• More regulatory oversight

26. © 2014 EduQuest, Inc. 26
Need Help with Your
Supplier Management?
Contact:
EduQuest, Inc.
1896 Urbana Pike, Suite 14
Hyattstown, MD 20871 USA (near Washington, DC)
+1 (301) 874-6031
info@EduQuest.net
www.EduQuest.net
To subscribe to free monthly EduQuest-ions & Answers e-
newsletter:
http://bit.ly/EduQuestQAsignup

27. © 2014 EduQuest, Inc. 27
For continued news & updates:
Subscribe to free monthly
EduQuest-ions & Answers
e-newsletter:
http://bit.ly/EduQuestQAsignup

28. EduQuest
EDUcation: QUality Engineering, Science and Technology
FDA Compliance Training Classes available from EduQuest:
Managing and Auditing Supplier Quality
(Learn to measure and monitor supplier quality systems, processes and documentation)
FDA Auditing of Computerized Systems and Part 11/Annex 11
(FDA’s expectations for data integrity. Includes 3 mock FDA audits of real-world computer systems.)
Quality Risk Management for FDA/ICH Q9 Compliance
(How to identify, assess, and mitigate GxP risks while meeting FDA rules and international guidance)
The CAPA Clinic: Effective CAPA Systems, Failure Investigations and Complaint Management
(Improving your CAPA system through better data collection, management reporting, trending, and root cause analysis)
QSR Compliance Basics: Complying with FDA’s 21 CFR 820 Quality System Regulation
(Fully understand your company’s obligations for Quality Systems under 21 CFR 820)
Design Control for Medical Devices
(How FDA expects you to develop, implement, and manage design controls)
All offered publicly or as on-site, on-demand classes -- when and where you need them.
Details at www.EduQuest.net , or Email: Info@EduQuest.net