Supplier Audit Question

Hi everyone,

I am new to the forum and to the world of conducting supplier audits. I work at a startup medical device company and I am trying to schedule an audit of one of our critical suppliers that is FDA registered. The problem is, they are quite hesitant to have an in depth qms audit conducted due to their "proprietary nature." My boss did a very minor supplier qualification audit with them last year where they would not allow a tour and when I reached out to schedule, I mentioned I understood that this would not be an option for this audit. They are also stating that past supplier audits of theirs have taken less than 2 hours, which tells me they probably won't let me review various records either.

My question is, how can I conduct a thorough audit of their qms while respecting their limitations? We have only placed one order with them in the past year, so there aren't really any records for my company to review (especially relating to things like CAPA).

Any guidance and advice is appreciated. Thank you

 

Thank you! The purpose of the audit is to perform our annual supplier audit of critical suppliers per our SOP. We are on course to be commercial with our medical device by end of Q1 next year, so my manager wants to especially ensure we do a more thorough audit this time around.

What you are saying makes sense though. Is performing a critical supplier once a year too frequent in general?

 

M

Appreciate the insight. They are only FDA registered, not ISO certified. I think the thought process of my boss to have me perform this was since we are going commercial soon, and knowing a subpar qualification audit was done, that doing a better one now would be beneficial. I will talk to him about this and also propose we update our SOP to not lock us into annual audits. Thank you so much!

 

Are they really a critical supplier? Regardless, Andy is correct, there's no need for an annual on-site audit. You need to plan on how you monitor and the frequency of re-evaluation. I think most companies do tend to default to an annual re-approval but that's not written in stone anywhere. (Although with a critical supplier, it would be a difficult risk-based argument to not re-approve them annually.) R-approvals are typically not on-site audits.

It's a little disconcerting that they won't let you see things. There are, certainly, secret-sauce recipes that they may not want (or need) to reveal but most companies will allow you in with a non-disclosure agreement in place.

Do bear in mind that you're not necessarily auditing them for full compliance. You want to focus on what they do for you (in relation to the regulations). When I do a supplier audit (contract manufacturer), I never ask for things like management review minutes or internal audit reports.

You'll also want to be sure a Quality Agreement is in place. That might help spell out your expectations and help focus your audit.

 

I agree with the comments above, its very common when writing our SOPs and QMS to include whatever sounds like a good idea at the time - I have done it and I have been on the receiving end from customers who don't really understand our process (and maybe their own) and ask for things they really should not.

Once its all in place though it's difficult to roll it back and if your supplier isn't interested in cooperating with a minnow I get that you are in a difficult position.

One thing you could try is to do a desk based audit of the order you placed; review all of the requirements of your PO and specifications, develop a questionnaire based on that asking how they contract reviewed it, what SOPs controlled each requirement etc , then follow up with the 2 hour visit to review their answers and collect evidence.

And when you have done all that you can ask yourself whether your organization has benefited in any way; other than ticking a box for your QMS.......