Supplier’s quality management systems

Audits on supplier premises are used to assess a supplier s quality management system at first hand with detailed examination of procedures and documentation relating to a product or service. As discussed earlier, such audits are primarily conducted for suppliers of bespoke (custom) software and systems. 

The pharmaceutical manufacturer is obliged by the regulations to ensure suppliers are suitable to conduct a project. The Supplier Audit is a means to identify the strength of the supplier s Quality Management System and level of experience in the Life Sciences sector. 

Conversely, if the supplier s Quality Management System is very well written and there is documented evidence that the supplier adheres to it, the definition of risk levels might be relaxed a bit in the Function Risk Assessment. If the supplier s own acceptance testing is well documented and thorough, the Validation Plan should document the intent to reference some of the supplier testing in lieu of internal tests. It is not necessary to specify exact tests to be used at this point that can wait until the test plans are being prepared later on. 

As with any computer system handling critical data, the choice of supplier is crucial to on-time and in-full delivery of a system meeting both client and regulatory expectations. Key considerations should be the robustness of the supplier s Quality Management System, the caliber of the project team put forward by the supplier, and the supplier s previous experience with similar blood establishment clients/projects. 

Due to the expanding nature of the LIMS market, there are a growing number of suppliers moving into the field. If a pharmaceutical manufacturer proposes to use a new supplier or a new LIMS product, it makes a great deal of sense to conduct a Supplier Audit of the proposed LIMS supplier. If it has been some time since a supplier has been audited (e.g., one year or more), it is recommended that a follow-up audit be conducted to confirm that the supplier s Quality Management System (QMS) continues to be followed. It is important that this audit be conducted prior to placing an order for the LIMS, as there may be some concerns regarding the ability of the supplier to produce a quality product. 

EMPHASIS asks questions about the supplier s quality management systems, such as ... 

The laboratory suppliers should be considered as part of the laboratory s quality management system. The type and extend of control applied to the suppliers and the purchased materials shall be dependent upon the effect of the piuehased product on the subsequent output. 

A presentation by the snppher of the firm s quality management system, perhaps reviewing the supplier s internal ISO 9000 mapping report... 

Supplier management, including the analysis of the vendor s Quality Management System (QMS) and its ability to deliver the requested system... 

There is a note in clause 4.1.2.3 of ISO 9001 which states The responsibility of a management representative mag also include liaison with external parties on matters relating to the supplier s quality system. 

GxP data, records, and documentation including computer vahdation should be archived. Internal audit reports from self-inspections monitoring a pharmaceutical or healthcare company s compliance with its own quality management system do not have to be retained once corrective actions have been completed, so long as evidence of those corrective actions is kept (e.g., change control records). Supplier audit reports and periodic reviews are not internal audits and should be retained. 

Because of such uncertainties, each supplier should be audited at the start of the project to establish whether a Quality Management System (QMS) exists that will support the validation of the equipment or process. Where none exists, an agreement must be reached with each supplier as to what quality measures will be used. This should be outlined by each company in their Quality Plan. In our case, we decided that all companies concerned should comply with the GAMP Guide, as this outlines validation documentation that is suitable for the U.S. Food and Drug Administration s (FDA) requirements and may also be used to support the European Union s CE mark accreditation (see Table 40.1). The device was to be released in both the American and European markets. 

BS 5750-1979, Specification for Design, Manufacture, and Installation CSA Z299-1978, Quality Assurance Program Requirements NVS-S-1594, Requirements of the Contractor s Quality Assurance Program SABS 0157-1979, Code of Practice for Quality Management Systems AS 1821-1975, Suppliers Quality Control System... 

Customers-and the automotive industry in particular-demand certification of a quality management system from their supplier, which is based on one of the earlier mentioned standards. The reason is, that the supplier s own assessment can be dispensed with, as far as possible, because certification is carried out by an independent organization. Granting of a certificate is subject to regular checks (audits). 

After ISO 9000 was established, the U.S. auto companies decided that it did not go far enough. They wanted their suppliers to have a quality management system in place that not only described what the company did, but would... 

The standard requires that the supplier s management with executive responsibility appoints a member of its own management with responsibility for ensuring that quality system requirements are established, implemented, and maintained in accordance with ISO 9001, and for reporting on the performance of the quality system to management for review and as a basis for improvement of the quality system. 

Many companies have adopted Total Quality Management as a way to promote continuous improvement in a broad range of business applications. TQM considers all business activities as processes, each one of which involves specific customer-supplier relationships. These relationships may be entirely internal, defined in terms of the process under study. For example, delivering efficient electronic mail service is a "process" in TQM terms. The "customers" for your company s electronic mail system are the employees who use it the "supplier" may office services, MIS, or other support personnel. 

The supplier-user or vendor-vendee relationship, as it pertains to quality, is well described in the American National Standard s ANSI/ASQC Q90-1987 to Q94-1987. The standards are technically equivalent to the ISO 9000 to ISO 9004 series of the international Quality Management and Quality Assurance Standards. The recommended quality system specifies quality policy, organization, authority, personnel, management review, and so on. 

Source Code Reviews are used to ensure that controlled development and a consistent programming style have been used. It also checks GMP critical features. Source Code Reviews need a standard against which to check, and programming practices for all programs should be documented. An audit of the supplier s compliance with its own quality management procedures should have been carried out to ensure that appropriate quality is being built into the system. 

SAP founded a so-called "FDA work group" with interested customers and consultants to define a common idea about GMP compliance for a software supplier. This group met several times, and SAP learned a lot about validation and qualification and changed its quality management to fulfill these legal requirements. Comparing GMP with other industry-specific quality rules like AQAP (Association of Quality Assurance Professionals) or QS 9000, SAP learned to see "validation as common sense", as Pfizer s Ken Chapman once stated in an article. SAP now has quality systems and a qualification strategy that satisfies the expectations of different industries. 

The basic difference between ISO 9001 and ISO 9002 is that the former includes the supplier s capability to design. Both standards use the same numbering system and a simplified guide for the Quahty requirements [personal communication with Alex McClean, Quality Management Consultant, Inverness] would be ... 

---