Audit Questions … and Answers
The early stages of the customer-supplier mating dance are an invitation for discovering what a potential partner is all about.
Say the word “audit” to just about anyone and the first blood-chilling thought may turn to an income tax inquiry by the Internal Revenue Service. Say it to someone involved with the quality program at a medical product manufacturing firm and the immediate thought most likely turns to the U.S. Food and Drug Administration (FDA).
But say the magic word to professionals on either end of the OEM/supplier equation and their first thoughts are on the questions to be asked and answered in the initial stages of the new-business mating dance. Whether it’s called a capabilities audit or cultural audit or just plain audit, what it amounts to is a look at what the potential supplier is all about. And the level of detail being sought has grown as the FDA has stepped up its focus on supplier management.
As the agency’s emphasis in that area has sharpened, OEMs have stepped up their own attention to detail in their relationships with suppliers. One of the results of that growing focus is that OEMs are trying to pare down supplier lists, seeking to partner only with those companies that bring to the table very sound practices in quality systems.
The information being sought in these up-front audits was described by several industry insiders with whom Orthopedic Design & Technology talked as demonstrably more detailed and nuanced than in the not-too-distant past, when each company’s checklist was pretty basic, mostly revolving around compliance with ISO requirements. Now it is not uncommon to see multi-day, multi-person visits designed to make sure all the necessary bases are covered right from the beginning.
That “right from the beginning” phrase applies more broadly, as well, covering the range of expectations from both sides of the equation. As the respondents to our queries were universal in pointing out, it’s important that the expectations be crystal clear for both parties from the get-go.
Steven Niedelman, who sees many such contacts in his role as lead quality system and compliance consultant for King & Spalding in the giant law firm’s Washington, D.C., office, said OEMs should be looking for a number of things in their initial audits of potential suppliers, “one of which is a good fit.
Dealing with suppliers is sort of creating a partnership: everybody should be on board, understand the importance of what they’re doing and how the piece that they’re providing contributes to the finished product.”
He said an early vetting of these suppliers is important “so there are no surprises as you go through the process.”
Niedelman said OEMs need to understand what their limitations are.
“Are you limited to sole-source suppliers, single-source suppliers, or are there any other limitations that should be considered?” he asked. And from the supplier’s perspective, companies should determine if they can provide sufficient quantities or if the quantities required are so small that it would be a nuisance to produce the required amount.
Suppliers “need to be able to demonstrate conformance to requirements,” he said. “They need to be able to demonstrate that their equipment is suitable for what they’re going to be building for you, that they have validations, that they have verifications, that they maintain appropriate records, there is adequate documentation, they have a compliant CAPA (corrective and preventative action) system, and both parties are able to satisfy each other’s needs.”
Bottom line, he said, the focus always should be on the quality system perspective.
“That’s what the FDA expectation is under the supplier quality requirements, and should be your primary business expectation as well. Make sure there is conformance to all supplier quality agreements that should be in place, especially with the highest-risk suppliers.”
Though it may sound like a no-brainer, Niedelman advises OEMs to be sure to note the overall appearance of a supplier firm.
“Is it someplace you want to do business with? Is it someplace that is really messy? Perform your due diligence before you enter into agreements to find out that your supplier is someone you would want to do business with,” he said.
Being comfortable with the people who’ll be involved in the relationship is important, too.
“This is a partnership; you have to be able to work together,” he said. “You have to be reading from the same page, both understanding the importance of what you’re contributing as a supplier. If you’re going to be at odds from the very beginning, the odds of its success from a personal perspective are going to be low.”
Niedelman also noted that it’s important that both sides demonstrate a commitment to collaborative relationships and that they are thorough in their vetting processes.
“Don’t hesitate for both sides to ask for references of other people that you do business with. Similarly, understand from both perspectives that the OEM and the supplier may be inspected by the FDA. Go to fda.gov; there may be information about each company that you may want to weigh into your decision to enter into a relationship.”
With regulatory being an immensely important part of the equation, Niedelman said “suppliers need to know what the expectations are, need to know what the requirements are, what the consequences are of not being compliant. They need to know the importance of calibrating equipment, they need to know the importance of cleanliness, they need to understand the importance of validation and verification if those are going to be requirements that are going to be placed on the suppliers.”
Niedelman also emphasized the need to keep each other current on changes.
“Change control is essential. From the supplier’s perspective, in my opinion any change should have the approval of the OEM,” he said. “All too many times the most innocent, innocuous change has resulted in product recalls.”
Paul Puleo, senior manager of Strategic Sourcing at Skaneateles Falls, N.Y.-based Welch Allyn Inc., said the manufacturer of a broad range of medical diagnostic and monitoring equipment conducts such audits of potential suppliers, which it calls capability audits.
“Capability audits to are a way to gather some high-level information on the company—i.e., financials, organizational structure, the product and service offering, everything from their technical capabilities to their overall business strategy to what type of market sectors they support, maybe a little about their quality systems and manufacturing capabilities—really the full gamut, all the way down to what would they say their factory capacity is at and service and repair capabilities.”
He said this is not a formal audit.
“It’s an on-site visit that starts with a factory tour and we try to tease out as much of that information as we can,” he explained. “So at the end of the capability audit, we’re assessing whether we think their production and process controls align with our particular needs for a product or a sub-assembly.”
Puleo said Welch Allyn doesn’t really ask for a self-assessment from the supplier.
“It’s more of a supplier questionnaire that is the very first thing we would do before even considering adding a supplier to our database. The questionnaire asks general information about the company—previous year’s sales, future growth, supplier factory locations, highlights of their expected payment terms, hopefully get some information on some of their top customers and top suppliers that they deal with, trying to get a better idea of their overall structure.”
He said more formal assessment audits are conducted on suppliers that get classified as a provider of an essential commodity.
“We have written standard operating procedures that a component is either an essential commodity or a standard commodity, so from an essential commodity standpoint, it’s any supplier that provides a product or service that impacts the safety or effectiveness of the finished medical device that we build,” Puleo said, adding that such suppliers “might have substantial involvement in our product realization process or the design and manufacturing of that particular device, or just simply that the supplier might pose a high supply change risk—that could be a sole-source supplier. So we look at all of that, and if we deem them an essential supplier, then we plan a formal, on-site assessment audit.”
Puleo said Welch Allyn has written procedures in place that call for on-site reassessment audits every two years, and a global supply base management team meets every two weeks. That team has the ability to extend the duration between site assessments based on the performance of the supplier.
“We have a very substantial regulatory team within Welch Allyn across our various locations, but we rely on our suppliers to either self-certify the component that we’re buying from them or to actually coordinate that certification with the appropriate notified body,” he said. “In other cases where it might be a joint design, our regulatory team partners with their regulatory team.”
Making the relationship between OEM and supplier the best that it can be is a simple matter, according to Puleo: “It comes down to good communication and collaboration between the two parties. I also think that understanding a supplier’s capabilities and their limitations are important. And setting clear expectations early on regarding key performance metrics really sets the stage for a successful partnership.”
B. Braun Medical, a well-known global medical device supplier with a U.S. base in Bethlehem, Pa., offers a look at the OEM/supplier issue from both sides of the equation. It contracts with many outside suppliers as an OEM, but also provides a lot of products on an outsourcing basis to other OEMs.
Kimberly Paris, vice president of Quality Operations, wore the OEM hat during our discussion, and Tom Black, vice president of OEM and International Division sales and marketing, chimed in from the supplier perspective.
“First and foremost, we’re looking for capabilities,” Paris said. “Does the company that we are looking to partner with have the capabilities that we will need from them in order to produce the product or the service that we need them to provide? When I say capabilities, I mean, do they have the technical capabilities, do they have the knowledge, do they have the infrastructure, do they have the quality programs, etc.”
The key point Paris noted was that B. Braun wants to ensure that suppliers are not just capable of being able to provide product once, but are able to provide a quality product on a consistent “go-forward” basis in order to minimize potential quality issues.
“The other thing that we’re looking for, and I’m speaking primarily from the quality side, is the relationship itself,” she said. “Is the company that we’re looking to partner with also looking to foster the relationship and not be a hands-off supplier? Are they someone … that understands our business and wants to make sure that we are successful and that they are helping contribute to that success by providing a quality product or service?”
Paris said that audits are part of the ongoing relationship, both on a scheduled and as-needed basis.
“Audits are a good way of continuing to assess a supplier’s quality system and the controls that they have in place,” she said. “Quality systems are continuing to change. Some of that is changing with the regulatory environment and regulatory expectations. It also is changing as technology changes, so ongoing audits are a good way to help you understand how your suppliers are maintaining their business and maintaining the controls that they have in place in their quality systems.”
She said audits generally are conducted on somewhat of a set schedule, with the frequency varying “depending on the product, the material, the service, the company, and the type of controls that you’re employing on a routine basis to monitor the supplier. But they can also be conducted on as as-needed basis if there is a significant issue or a change in business that might trigger a new audit be conducted.”
As for regulatory expertise, Paris said it depends on what both parties are looking for and what their capabilities are internally.
“That really is dependent on what it is that you need from them,” she said. “Since B. Braun is a full-service company with a full regulatory department in-house, it becomes less of a driving need for us to partner with a supplier that has this capability because we include them on our end. However, there are some smaller companies that lack that knowledge or capabilities in-house, so they might be looking for that as part of the relationship.”
She stressed, as others have, that communication is the most important component to a strong manufacturing relationship.
“You want to make sure that you have established open communication with your supplier so there is a good working partnership between the organizations. But communication becomes very people-dependent, so if there are specific controls that you want to have in place with your supplier to make sure there are certain things that are communicated, you want to make sure that they are embedded into their quality system and are not just handled on an ad hoc basis,” she said.
Taking the supplier side of the question, Black said there are really two audits.
“There’s the quality systems audit, which is the standard audit, and then there’s the cultural audit, if you will,” he explained. “We love having our customers come in because we have a lot of expertise to share, not just in manufacturing but throughout our operations from regulatory to quality to sterilization to packaging, injection molding, our lab work, our testing.”
Black said it’s important to understand each company’s culture, particularly for long-term partnerships.
“We want them to come in and see what we’re capable of doing, as well as meet the people,” he said.
“A lot of it is the people-to-people [experience], so we want them to meet the folks who have this expertise. We have some people who have been here 20, 30, 40 years, so we want them to get a feel for our culture, the experiences we have with medical device manufacturing.”
As for follow-up audits, he said the timing varies, with some companies conducting them yearly or every two years.
“There might be others where we do what we call quarterly business reviews,” he said. “They’re not really audits, but at the same time that’s the time to talk about any changes to the quality system or changes to manufacturing or any upgrades to the systems.”
To ensure a strong relationship, Black said it’s important to have clear expectations up front.
“We need to make sure we’re aligned clearly from an expectations standpoint so that we can do whatever is necessary to meet our customer’s requirements. More and more, the win-win attitude is important,” he said.
Kelly Lucenti, president of Millstone Medical Outsourcing, a Fall River, Mass.-based provider of customized outsourcing solutions to the medical device industry, noted that as part of the FDA’s audits of OEMs, the agency has focused on supplier management.
“As a result, there have been a number of observations, findings, if you will, regarding supplier management,” he said. “The trickle-down effect is that these medical device manufacturers are putting more emphasis on partnering with suppliers with outstanding quality systems as a result of the FDA’s pressure.”
He said that when the FDA makes quality a focus, “all of the quality leadership within the medical device organizations makes it a focus, and now they’re spending more time on beefing up their audits.
They’re trying to streamline or trim down their approved supplier lists in order to partner with fewer suppliers, so the ones they do partner with have to have very robust and sound quality systems.”
Lucenti said that, historically, OEMs’ checklists for audits were pretty similar, but that “enhanced” audits are becoming the norm.
“I have been seeing some three-day audits now, whereas before it was one person, one day, and mostly just going through the requirements of ISO 13485 and kind of check-marking that,” he said. “But now I’m seeing a cross-functional team; we might see a microbiologist, a quality engineer, an operations person come—any of those disciplines, to make sure everything is covered. The sophistication or the level of detail in the audit is much more than it was in the past.”
He said self-assessments play a role in the process as well.
“Some companies will send a written assessment. We’ll complete that assessment and, depending on our answers, they will decide whether they’re coming in or not,” Lucenti said. He also noted that it’s very important that OEMs demonstrate an interest in a collaborative relationship.
“It’s a partnership—as you’re trying to associate with fewer vendors and partners, it has to be because you value them for the special knowledge and expertise they bring to the table, so the information stream has to go both ways,” he added.
He said that most of Millstone’s customers audit the company “routinely” every year.
“If they see a significant trend in the quality of the product, if there were any complaints or something like that, it could trigger an increased frequency, but normally with our business we’re on the annual cycle,” he said. “Other suppliers may be put on a three-year cycle based on what they provide.”
He said Millstone, in turn, audits its sub-suppliers.
“We have the flexibility to utilize the OEM’s requirements, so as they outsource it, they pass their requirements on to us, and we’ll be their eyes and ears,” he said. “We’ll perform the inspections for these manufacturers and we of course want to partner with suppliers who are good as well, because we don’t want to have to deal with high reject rates that cost us time and money. If we need to be at that supplier and see what is going on, we absolutely will do that.”
Lucenti said a supplier’s expertise in regulatory areas is important, too.
“It’s a matter of regulatory and quality system knowledge,” he explained. “Manufacturers want to partner with somebody who they can trust with their outsourcing. They want to make sure that the team they’re partnering with understands the regulations and the rules, which are changing dynamically these days.”
Joe Zuzula, director of sales and marketing at Holt, Mich.-based Orchid Orthopedic Solutions, said that while it’s desirable that an OEM customer be committed to a collaborative relationship, “we are able to adapt to our customers’ needs. We have some customers that are willing to partner together with us while others just want a strictly transactional relationship.”
He said Orchid is “willing to put resources toward collaborative relationships as much as our customers desire us to. This is important as it creates a strong relationship where we can provide more value for each other.”
While quality systems are an obvious area of focus for initial audits, Zuzula said, “they also look at our viability as a business, our ability to avert risk and our ability to grow with them.” He said Orchid is audited on a regular schedule as part of ongoing relationships with its OEM customers.
As for suppliers having expertise in the regulatory aspects of the business, he agreed that it is more important than ever before.
“Demands for the OEMs are increasing in the area of regulatory and quality, so it is natural for these requirements to move towards the supply base,” he said. “We are and have been investing in the area of quality, regulatory and validation for a long time. Having a strong regulatory capability will build confidence with the customer in that you understand the challenges they are facing and can address issues they deal with everyday.”
Zuzula carried the “collaborative” message over to his keys for making the OEM/supplier relationship work.
“A collaborative relationship includes a team from each company working together to remove wastes such as complicated logistics, excess inventory, long lead times, and other soft costs,” he said. “We need to work together to make the process better and bring more value toall stakeholders.”
Jim Stommen, retired editor of industry publication Medical Device Daily, is a freelance writer focusing on the medical product sector.