ISO 13485 Supplier Management Process: Your Audit Is Approaching, the Gaps Are Numerous and Time Is Short. How Do You Move Forward?

Do you recognise this situation?

A notified body audit is approaching. In the lead-up during the internal review of practices, documentation and available data, you realise that your supplier management process has significant gaps: missing or unsigned quality agreements, incomplete or outdated approved supplier list, insufficiently documented evaluations and re-evaluations, poorly formalised subcontractor controls.

The difficulty in this situation: the gaps are often numerous and cannot all be corrected exhaustively before the audit. The question is therefore not only “how to correct?” but also “where to start, and in what order?”

What was at stake

Supplier management is one of the most closely scrutinised processes during an ISO 13485 audit and one where non-conformities have the widest consequences. A poorly qualified supplier, an uncontrolled subcontractor or a missing quality agreement does not just represent an audit risk: it is a real operational risk, with direct implications for product quality, traceability, and the company’s ability to react effectively in the event of a safety measure batch recall, urgent corrective action, vigilance.

What was done

As part of a preparation for a notified body audit, I supported a company across its entire supplier management process with a two-level approach, realistic given the available timelines and resources.

Level 1 – Securing the audit:

• Review of the existing process and identification of gaps against each applicable ISO 13485 requirement to establish a precise picture of the actual situation.
• Implementation of priority actions to minimise the risk of major non-conformities during the audit: formalisation of missing quality agreements for critical suppliers, update of the approved supplier list, documentation of evaluations carried out.
• Coaching of teams to enable them to defend the process to the auditor explaining the actions taken and the plan in place for next steps.

Level 2 – Correcting durably:

• Implementation of a detailed action plan to ensure, over time and in a way that is realistic given the company’s resources, the selection, evaluation and ongoing monitoring of suppliers and subcontractors in compliance with ISO 13485 requirements and applicable international reference frameworks.
• This second level also integrates process facilitation for day-to-day use: tools adapted to the size and organisation of the company, enabling the process to be maintained without becoming disproportionate relative to available resources.

What changed

The company presented itself at the audit with a defensible process and traceable corrective actions already under way. Priority actions had been implemented within the required timelines. And beyond the audit, the company had a concrete and realistic plan to correct the remaining gaps and the tools to manage its suppliers in a compliant and effective way going forward.

→ Your audit is approaching and you know your supplier management process has gaps? A One Health Compliance Workshop combines analysis of your situation, identification of priorities and operational support to secure your audit and put in place sustainable practices, adapted to your resources.

Sandra Dejean, PharmD – Founder of One Health Compliance

© One Health Compliance