5 Keys to Supplier/Purchasing Controls – And Product Quality

By Fran DeGrazio, executive editor, Drug Delivery Leader

Issues stemming from poor quality in drug and device development and manufacturing can negatively impact patient safety, as well as disrupt supply or lead to product shortages. Such issues often result from insufficient or ineffective approaches to supplier or  purchasing controls. A recent FDA warning letter illustrates the very real consequences of a biopharmaceutical company not attending with enough diligence to one of its critical suppliers.

This warning letter reinforces the importance of qualification and oversight of a Contract Manufacturing Organization (CMO) used to manufacture pharmaceutical products. It emphasizes that a sponsor company must understand what is going on at its supplier/CMO. The letter also clearly expresses that the pharma company is ultimately responsible for the quality of its drug product, regardless of how, where, and by whom the manufacturing was done.

The expectation that supplier/purchasing controls play a critical role in ensuring quality management and compliance became even more evident with the FDA’s introduction in early 2024 of the Quality Management System Regulation (QMSR). (See my recent take on the QMSR here.) This regulation amends 21 CFR 820 by incorporating by reference the quality management system requirements set by ISO 13485:2016 – Quality Management systems – Requirements for regulatory purposes. This revision also extends to Part 4 – on maintaining cGMPs for combination products. For instance, the combination product owner must clearly describe how it chooses suppliers and provide clearly specified product requirements.

So, what can biopharmaceutical organizations do to put into practice increased, effective supplier/purchasing controls? I recommend five foundational considerations, as follows:

#1: Apply Risk Management Principles

The FDA reinforces the need for risk management to be fundamentally incorporated into the Quality Management System (QMS) of any biopharmaceutical organization developing combination products. It suggests that ISO 14971:2019 Application of risk management to medical devices be incorporated, although it is not mandated. With or without a mandate, sponsor companies should not only apply risk management but also position purchasing controls as, among other things, an aspect of managing risk.

In evaluating the suppliers it relies upon, a sponsor company must assess the relative degree of criticality of each supplier to its products and processes and, from a risk management perspective, treat that supplier accordingly. For example, a supplier of raw materials used in several of a sponsor company’s drug products likely poses a higher degree of potential risk than does the supplier of raw materials for just one product. If something were to happen to that cross-product supplier or to its raw materials, the potential for widespread impact would be greater and, therefore, so would the degree of risk.

Another consideration regarding relative degree of criticality and, therefore, degree of risk could be the number and/or location of production sites at which an outsourced supplier can manufacture a product on behalf of the sponsor company. For instance, does the supplier maintain and operate only one production site? Is that site in an area of significant environmental concern, such as one with a high frequency of hurricane or tsunami activity? These are just some of the considerations that may result in identifying a supplier as high risk.

Based on differences in supplier criticality, differing approaches to risk management may be appropriate. For example, for a less critical supplier, perhaps a cGMP self-assessment could be employed, while, for a more critical supplier, an on-site audit may be warranted and advisable.

#2: Document Supplier/Purchasing Controls Diligently

From a regulatory standpoint, if purchasing controls have not been documented, it is as though they were not applied at all. For that reason, sponsor companies should implement procedures that clarify by documenting its supplier qualification and purchasing process. The new FDA QMSR makes clear that the purchasing organization/market applicant must establish and document criteria for evaluating and selecting suppliers. As part of the evaluation/selection process, the purchaser must determine the suppliers’ ability to provide a product or service that adequately meets requirements.

Reiterating a point I made in recommendation #1 above, the performance of each supplier must be understood and monitored with a degree of attention proportionate to the level of risk associated with the product and with the criticality of the supplier to that product’s quality. Again, we are in the realm of risk management.

When it comes to demonstrating adequate supplier oversight via documentation, two of the most important documents are 1) a quality agreement, and 2) a change control agreement. A quality agreement clarifies responsibilities and expectations during a development or manufacturing process. This documentation should clearly state which organization owns different activities within the supplier/sponsor relationship.

A change control agreement is commonly included as part of the quality agreement, although it can also exist as a standalone document. In any case, it should clearly lay out expectations for how a supplier will deal with changes. The document should include such aspects of change control as evaluations, communication, and timelines for critical events. Communication, for instance, should include ways in which the supplier will notify the sponsor of a change and the process by which the two parties will align on whether the change should be identified and addressed as major, minor, critical, and so on.

Kept on file for every supplier should be their qualification information, audit reports, copies of quality and change agreements, and various other communications.

#3: Treat Service Providers as Suppliers

Establishing and implementing purchasing controls should not be limited to suppliers of products, components, and materials. A provider of a service is also a supplier and, therefore, must be assessed with the same kinds of standards and controls as those applied to other kinds of suppliers. Service providers to be considered as suppliers include those that provide engineering support, sterilization, analytical testing, or contract manufacturing, to name just a few of the most common contributions.

#4: Consider Supplier/Purchasing Controls as a Lifecycle Activity

Just as risk management should be woven throughout the entire development and product lifecycle, so should the purchasing controls process. Regulatory agencies, especially the FDA, no longer – if they ever did – think of ensuring product quality as merely a test-and-inspect activity. The broad scope of development and manufacturing requires that pharmaceutical companies apply oversight of suppliers throughout the product lifecycle.

Even early stages, such as design development, fall under the imperative to apply supplier controls. Often, components or devices that become part of a final combination product are purchased from a third party. These devices or components may be provided as a custom design or as a “platform” that is owned and manufactured by the third party. Nevertheless, the compliance standards around purchasing controls and the ultimate responsibility for product quality are the same in either scenario. The marketing sponsor of the final combination product must understand these expectations for controls and quality when engaging with a supplier.

#5: Commit to a Collaborative Process

Suppliers are more important to the industry now than ever before. They are a critical piece of the execution of a comprehensive supply and control strategy. Every drug device combination product will utilize third parties for various services, constituent parts, or other components. The growth of combination products in the market, as well as the new quality and regulatory standards that apply to them, are driving the increased significance of suppliers.

For execution of a supplier/purchasing controls strategy, it is imperative for sponsor organizations to grow talent and resources – for example, supplier quality groups – that can effectively engage with suppliers. The collaboration that occurs must be mutually supportive and not just dictated by pharma to suppliers. Disengaged delegation is not the goal of these relationships. Suppliers not only represent the pharma companies in performing their activities but can also bring to the collaboration enhanced understanding of their own products and processes.

Frankly, it is vital that pharma companies provide the necessary attention and resources to supplier relationships, not only for compliance purposes, but to acknowledge the substantial role that suppliers play in bringing a final product to market.