SOP Purchasing

​

Summary

Your Purchasing SOP establishes systematic processes for qualifying, evaluating, and managing suppliers to ensure that all purchased products and services meet quality requirements and do not compromise the safety, performance, or regulatory compliance of your medical devices.

​

Why is SOP Purchasing important?

Purchasing controls exist because regulators recognize that supply chain quality directly impacts device safety and performance. Poor quality components or services can introduce risks that may not be detected until devices reach patients. The SOP ensures that third-party suppliers meet the same quality standards that apply to your internal processes.

Your purchasing system demonstrates systematic supplier management rather than ad-hoc procurement decisions. It provides traceability for quality issues, enables effective corrective actions when supplier problems occur, and ensures consistent quality regardless of personnel changes. This protects both patients and your organization from supply chain-related quality failures.

​

Regulatory Context

​

Guide

Your Purchasing SOP establishes controlled procurement processes that ensure supply chain quality while maintaining efficiency. Focus on risk-based approaches that apply appropriate controls without creating unnecessary bureaucracy.

​

Supplier Classification and Criticality Assessment

Implement systematic criteria for determining supplier criticality based on potential impact on device safety, performance, and regulatory compliance. Classify suppliers as critical if their products or services directly affect device characteristics or if no alternative suppliers exist. Apply enhanced controls only where justified by risk.

Create clear definitions for critical versus non-critical suppliers with consistent application across your organization. Document criticality assessments to provide auditors with evidence of your risk-based approach to supplier management.

​

Supplier Qualification and Evaluation

Develop standardized qualification processes that evaluate supplier capability, quality systems, resources, and performance history. Create qualification checklists and scoring systems that provide objective assessments while allowing flexibility for different supplier types and risk levels.

Establish qualification criteria covering technical capability, quality system maturity, regulatory compliance, and business stability. Include verification methods such as documentation review, facility audits, or sample testing based on supplier criticality and risk assessment.

​

Approved Supplier List Management

Maintain an Approved Supplier List (ASL) that provides clear status for all qualified suppliers including approval status, criticality classification, and any special requirements or restrictions. Include surveillance requirements and re-evaluation schedules based on supplier performance and risk level.

Implement version control for your ASL with clear approval authority and change control procedures. Include procedures for adding new suppliers, updating existing supplier status, and removing or blocking suppliers when performance issues arise.

​

Purchasing Controls and Documentation

Establish systematic purchasing procedures that ensure only approved suppliers are used for critical components or services. Create purchasing documentation requirements that adequately describe product specifications, acceptance criteria, and quality requirements.

Include change notification agreements with critical suppliers requiring advance notice of any changes that could affect product conformance. Establish procedures for evaluating supplier-initiated changes and updating your own documentation when necessary.

​

Incoming Inspection and Verification

Implement risk-based incoming inspection procedures that verify purchased products meet specified requirements. Establish inspection criteria, sampling plans, and acceptance procedures appropriate for different product types and supplier risk levels.

Create nonconformance procedures for handling substandard purchased products including supplier notification, return processes, and impact assessment on your quality system. Include procedures for updating supplier evaluations based on incoming inspection results.

​

Supplier Surveillance and Continuous Monitoring

Establish ongoing surveillance procedures for monitoring supplier performance including delivery performance, quality metrics, and compliance status. Implement annual supplier reviews that evaluate performance trends and update criticality assessments.

Create procedures for responding to supplier performance issues including corrective action requests, enhanced surveillance measures, and supplier blocking when necessary. Include supplier performance data in management review reporting for trend analysis.

​

Example

​

Scenario

MedTech Solutions needs to qualify cloud hosting services for their diabetes monitoring app and establish purchasing controls for critical software components and third-party services that could impact device performance or data security.

​

Purchasing System Implementation

Supplier Criticality Assessment:

• Cloud Hosting Provider: Critical (directly affects device availability and data security)
• Analytics Software: Critical (affects glucose calculation accuracy)
• Marketing Agency: Non-critical (no impact on device performance or safety)
• Legal Services: Non-critical (no direct impact on product quality)

Critical Supplier Qualification Process: Cloud Hosting Provider Evaluation:

1. Technical Capability: Review infrastructure specifications, uptime guarantees, disaster recovery procedures
2. Quality System: Evaluate ISO 27001 certification, SOC 2 Type II compliance, change management procedures
3. Regulatory Compliance: Verify GDPR compliance, data residency requirements, security certifications
4. Business Stability: Review financial statements, customer references, service level agreements
5. Scoring: Rate each category 0-3, calculate average score of 2.8 (approved with surveillance)

Purchasing Documentation Requirements:

• Service Specifications: Detailed SLA requirements, uptime guarantees, data backup procedures
• Acceptance Criteria: Performance monitoring thresholds, security audit requirements
• Change Notification: 30-day advance notice for infrastructure changes affecting service
• Quality Requirements: Compliance with medical device data handling requirements

Supplier Surveillance Implementation:

• Monthly Performance Review: Uptime monitoring, security incident tracking, SLA compliance
• Quarterly Business Review: Service performance discussion, upcoming changes, improvement planning
• Annual Assessment: Full re-evaluation of qualification criteria, contract renewal process
• Continuous Monitoring: Automated alerting for service disruptions, security notifications

Approved Supplier List Entry:

​

Q&A