Supplier Controls Under QMSR: Risk-Based Oversight, Change Control, and FDA Expectations

This course strengthens the ability to establish supplier oversight proportionate to quality risk, identify weaknesses in outsourced operations, and use supplier performance, audit findings, and change-control information to support ongoing regulatory compliance.

Medical device manufacturers remain responsible for the quality of purchased products and outsourced activities, even when manufacturing, testing, or other critical operations are performed by external suppliers. Under FDA's Quality Management System Regulation (QMSR) and its incorporation of ISO 13485, supplier controls must reflect the risks associated with externally provided products and services. Global supply chains, contract manufacturers, supplier changes, and reliance on Certificates of Analysis (COAs) or Certificates of Conformance (COCs) introduce additional oversight considerations.

This course addresses the practical management of suppliers, contractors, and outsourced operations through risk-based qualification, monitoring, auditing, and change control. It examines how supplier performance information, quality agreements, COA/COC reliability, and supplier ranking can support ongoing oversight. Particular attention is given to weaknesses in supplier change notification, excessive reliance on previous satisfactory audits, and the manufacturer's continuing accountability for outsourced activities when supplier performance or product quality comes under regulatory scrutiny.

_{WHY YOU SHOULD ATTEND:}

Establish Supplier Oversight Based on Actual Risk

Develop a clearer basis for determining which suppliers and outsourced activities require greater scrutiny, considering their influence on product quality, manufacturing continuity, and regulatory compliance. Risk-based qualification, monitoring, and audit decisions help direct oversight toward consequential supplier relationships rather than applying identical controls across the entire supply chain.

Identify Weaknesses in Supplier Change Control

Strengthen the management of supplier-initiated changes involving materials, processes, manufacturing locations, specifications, or outsourced activities. Inadequate notification and assessment can allow changes to affect product quality before the manufacturer recognizes their significance. Clear supplier expectations and documented change assessments support more controlled responses to these developments.

_{AREAS COVERED:}

• Supplier control expectations under QMSR and ISO 13485
• Global supply chain risks and manufacturer accountability for outsourcing
• Risk-based supplier qualification, selection, and ongoing oversight
• Managing CMOs, CDMOs, CROs, and other external service providers
• Evaluating COA and COC reliability and supporting quality evidence
• Supplier change notification, assessment, and change-control weaknesses
• Supplier performance trending, ranking, and continued qualification decisions
• Risk-based supplier auditing and responding to emerging quality concerns

_{WHO SHOULD ATTEND:}

• Quality Assurance
• Supplier Quality Management
• Regulatory Affairs
• Quality Systems
• Supply Chain Management
• Procurement and Purchasing
• Manufacturing Operations
• Compliance
• Supplier Auditing Teams
• Contract Manufacturing Oversight Teams

Course Director: JOHN E. LINCOLN

John E. Lincoln has over four decades of experience in FDA-regulated industries, including quality assurance, regulatory affairs, quality-system remediation, supplier controls, and compliance auditing. His consulting work addresses FDA and ISO quality-system expectations, outsourced operations, risk management, change control, and supplier oversight. He has worked with manufacturers ranging from start-ups to multinational organizations across several regulated industries.