MDSAP Audit Approach (MDSAP AU P0002) C7-T4-T5: Set documented, risk-based criteria for selecting, evaluating and re-evaluating suppliers, select suppliers on their ability to meet requirements, keep evaluation records and qualify Canadian regulatory correspondents

What does C7-T4-T5 require?

Procedures must make the type and extent of control over a supplier and its product depend on the product's effect on later realization and the finished device, with documented criteria for supplier selection, evaluation and re-evaluation. Suppliers must be chosen on their ability to meet the organisation's requirements, with control scaled to the significance and risk of what they supply, and evaluation records kept. Australia: the sponsor's specifically imposed duties (reporting adverse events and recalls to the TGA, passing complaint and event information to the manufacturer, 120-day follow-up reports, storage and transport while it holds the device, record keeping, annual reports for high-risk devices, spinal infusion and IVD notifications, holding conformity evidence, conducting Australian recalls and showing its name and address) are not the manufacturer's, though the manufacturer often supports them and a sponsor doing outsourced work such as installation, servicing, labelling or implant cards is a supplier; a sponsor's customer requirements become auditable once specified. Canada: a regulatory correspondent must be treated and qualified as a supplier. Clauses: ISO 13485:2016 4.2.1, 7.1, 7.4.1; TG(MD)R Sch 1 Pt 1 EP 2; RDC 665/2022 Arts 16 to 18, 22, 23; MO169 Arts 6, 26, 37.