Trusting ISO 13485 Certification of a Supplier... A Sad Story

Sidney Vianna

Post Responsibly
Leader
Admin
Yep. it's all very well and good to say we folks who rely on certificates of registration to relieve our organizations of the cost of individual supplier assessments "should" follow through on the report and complaint process, but pragmatism reigns and the money men at the top of the organization are hard put to justify the delay and cost when no immediate amelioration of the problem is forthcoming. How does the aggrieved organization deal while the report and investigation drag on? What if the result comes back, "This was not a systemic problem with the certifying body, but merely an individual 'slip' beyond the scope of the CB's audit."?
Therein lies the WHOLE PROBLEM WITH THE ACCREDITED MANAGEMENT SYSTEM CERTIFICATION (MSC) sector. Most organizations want THE BENEFIT of supplier certificates, so they don't incur in onerous, repetitive, redundant audits of their suppliers, deciding, instead, to rely on a certificate as a means to keep the certified supplier in their approved supplier list. But when the supplier and/or their respective CB's show they don't deserve their trust, nothing of significance is done, other than (potentially) disqualifying the supplier. So, irresponsible CB's, without being forced to deliver confidence, are left free to grow their business.

Reliance on management systems certificates as a component of supplier monitoring and oversight REQUIRES the users of the certificates not only to be vigilant, but also keep the parties accountable to the process. If you are unwilling to engage with CB's and AB's about their performance, you should NOT rely on supplier system certificates for ANYTHING. It is analogous to people who complain about the political system but never vote, trying to change the situation.

I think MIREGMGR is being very responsible and diligent in his approach to this situation, but he represents the exception, not the rule. Most people mandating suppliers to attain certification to management system standards are utterly ignorant about the accredited certification process.

The only thing that will force AB's and CB's to clean up their acts and remain accountable to the intent of the process is the demand (by the users of certificates) for ACCOUNTABILITY at all levels, added by transparency.
 

Wes Bucey

Prophet of Profit
Therein lies the WHOLE PROBLEM WITH THE ACCREDITED MANAGEMENT SYSTEM CERTIFICATION (MSC) sector. Most organizations want THE BENEFIT of supplier certificates, so they don't incur in onerous, repetitive, redundant audits of their suppliers, deciding, instead, to rely on a certificate as a means to keep the certified supplier in their approved supplier list. But when the supplier and/or their respective CB's show they don't deserve their trust, nothing of significance is done, other than (potentially) disqualifying the supplier. So, irresponsible CB's, without being forced to deliver confidence, are left free to grow their business.

Reliance on management systems certificates as a component of supplier monitoring and oversight REQUIRES the users of the certificates not only to be vigilant, but also keep the parties accountable to the process. If you are unwilling to engage with CB's and AB's about their performance, you should NOT rely on supplier system certificates for ANYTHING. It is analogous to people who complain about the political system but never vote, trying to change the situation.

I think MIREGMGR is being very responsible and diligent in his approach to this situation, but he represents the exception, not the rule. Most people mandating suppliers to attain certification to management system standards are utterly ignorant about the accredited certification process.

The only thing that will force AB's and CB's to clean up their acts and remain accountable to the intent of the process is the demand (by the users of certificates) for ACCOUNTABILITY at all levels, added by transparency.
What I wrote about the FDA applies equally to the CBs and the ABs
Yes. In general, I agree with the premise that one or two minor complaints should not lead to public reports which could trigger a panicked exodus by customers, plunging the regulated company into bankruptcy. The question arises about the level of nonconformance which should trigger such a public report. Should it be triggered by implementing a very short response deadline, which, when passed without resolution, means public exposure? Are customers willing to agree to the net cost of regulatory bodies hiring more competent investigators to implement the heightened regulatory activity? (The net cost comes from higher fees paid by regulated companies passed on to customers.)
What Sidney says about transparency of the process is imperative if we are to persuade organizations there is a benefit to reporting apparent discrepancies between certification status and actual practice of a registrant to a Standard.

If I'm John Doe, CEO of ABC Organization, I'd like to know if anybody else besides me is complaining. I'd like periodic progress reports of the status of the investigation. I'd like a very short timetable for answers from everyone up and down the line.

It is also true that relying solely on 3rd party certification prior to approving a supplier is very risky in the best of times. In a recession like our current one, however, it is tantamount to giving the keys to your new car to a drunk stranger who bumps into you at a tavern. The economic pressure of a recession tempts upper and middle managers to cut corners. I recall an infamous case in the aerospace industry where a supplier of titanium tubing decided to forgo the expense of inspection and merely duplicated the results of ONE inspection and reported it as the results of every inspection thereafter (and that was BEFORE 2008!)

So the question still remains:
How do we, as quality professionals, counsel upper management in our organizations to proceed? If we counsel redundant supplier site visits and nothing deleterious is found, we look like Chicken Little crying, "The sky is falling!"

Are there some signals we can be on the lookout for to trigger a site audit of a registered supplier?

How do we sell this to upper management without looking alarmist?

How do we justify our own existence and salary when a supplier we have approved turns traitor and "cheats?"

Should CBs be more alert and look for cues beyond the Standard "warned long in advance" audit?

Should a CB have a duty to alert end customers and users when the CB discovers one (or more) of its auditors has been "less than rigorous" in auditing certain companies, whether from incompetence, laziness, or collusion with the organization being audited?

Yes, Sidney, TRANSPARENCY of the process is key to protecting the system against total anarchy.
 

Ronen E

Problem Solver
Moderator
Without diminishing the accountability argument :)applause:) -

2 notes:

So the question still remains:
How do we, as quality professionals, counsel upper management in our organizations to proceed? If we counsel redundant supplier site visits and nothing deleterious is found, we look like Chicken Little crying, "The sky is falling!"

That is always the issue with risk management and risk mitigation. If you succeed (i.e. harm prevented) someone could always claim that the risk wasn't real or wasn't as high, and the mitigation resources were a waste; while YOU could argue that in fact the risk was well identified and well mitigated and therefore the allocation was justified. Who's right? In most cases it's not a clear call :(

It is also true that relying solely on 3rd party certification prior to approving a supplier is very risky in the best of times. In a recession like our current one, however, it is tantamount to giving the keys to your new car to a drunk stranger who bumps into you at a tavern.

When validation is too costly / too complicated - verify.
When you can't count on certification (or any other "across the board" means) to get confidence - go back to the basics and look at what you get.
In recession times, the linear concept of "more is better" must be replaced with wits. Concerned about a supplier's performance? Pay them an unannounced (or minimally announced) visit, and see how they react. It doesn't have to be a full scale audit. When things run by the book (I mean, really) nobody has a reason to hide anything. Too blunt for in your culture? Run a random sampling on that other incoming lot and send for 3rd party analysis, after having your own risk analysis (so you know what to focus on). Heck, if I were buying contact gel for my device, I wanted to know exactly what's in there - be it viable matter or not.

Ronen.
 

sonflowerinwales

In the country
Thanks for this post. It's confirmed what I've been thinking for several months. We "approve" suppliers by telecon/vendor form. I've been trying to get all our suppliers visited, just to judge their apporoach to the work ethic etc.

But I'm getting lots of resistance from the senior management......:mad:

Regards
Paul
 
M

MIREGMGR

What is the significance in AB terms of the subject company's CAB issuing an ISO 13485 certificate, but not having ISO 13485 listed within the scope of the ANAB certificate issued to that CAB?

Is ISO 13485 formally defined at the AB level as a variant of ISO 9001, and therefore any CAB certified for ISO 9001 also may certify to ISO 13485?

This link is dead as of 30 June 1014 --> anab.remoteauditor.com/EQM/CustomData/Controls/Certificates/IssuedCertificates.bb9ec374-83be-420c-83dd-78fc46d45c14.pdf
 
Last edited by a moderator:

Sidney Vianna

Post Responsibly
Leader
Admin
What is the significance in AB terms of the subject company's CAB issuing an ISO 13485 certificate, but not having ISO 13485 listed within the scope of the ANAB certificate issued to that CAB?

Is ISO 13485 formally defined at the AB level as a variant of ISO 9001, and therefore any CAB certified for ISO 9001 also may certify to ISO 13485
ISO 13485 certification requires it's own accreditation. In this case, as I mentioned before, the ISO 13485 certificate was issued under the RvA Accreditation and the CB is accredited with RvA for 13485.
 
M

MIREGMGR

Given accreditation of the CAB for ISO 13485 only by RvA, what is the chain of control under ISO 17021, both at present and in regard to the eventual implementation of the IAF guidance discussed above?

The guidance will require the certified organization to comply with "the statutory and regulatory requirements applicable to the safety and performance of the medical devices", and to "show that appropriate action has been taken in cases of non-compliance with relevant legislation and regulations, including the notification to the Regulatory Authority of any incidences that require reporting."

This I think begs the question: what expectations or obligations currently exist for RvA's supervision of the CAB, so that RvA can identify if the CAB has correctly verified the certified organization's performance?

Is there a current requirement that RvA be aware of matters indicating potential non-compliance with legislation and regulations, such as FDA issuance of a 483 or Warning Letter?
 

Sidney Vianna

Post Responsibly
Leader
Admin
Given accreditation of the CAB for ISO 13485 only by RvA, what is the chain of control under ISO 17021, both at present and in regard to the eventual implementation of the IAF guidance discussed above?

The guidance will require the certified organization to comply with "the statutory and regulatory requirements applicable to the safety and performance of the medical devices", and to "show that appropriate action has been taken in cases of non-compliance with relevant legislation and regulations, including the notification to the Regulatory Authority of any incidences that require reporting."

This I think begs the question: what expectations or obligations currently exist for RvA's supervision of the CAB, so that RvA can identify if the CAB has correctly verified the certified organization's performance?

Is there a current requirement that RvA be aware of matters indicating potential non-compliance with legislation and regulations, such as FDA issuance of a 483 or Warning Letter?
ISO 17011 (which applies to the AB's) state
7.11.7 The accreditation body may conduct extraordinary assessments as a result of complaints or changes (see 8.1.2), etc. The accreditation body shall advise CABs of this possibility.
So, if an interested party were to complain to the RvA, they MIGHT trigger a special audit IF they think it is justified. And, in case the AB does not take appropriate action, ISO offers to get involved: ISO accepting complaints about Management System Certificates to ISO Standards
 
Last edited:
M

MIREGMGR

Wes expressed the opinion:
It is absolutely unacceptable for any CB to be unaware of an adverse report from FDA or any regulatory body.

I'm trying to sort out how our QMS should be corrected to reflect how this currently works as a matter of rule. In particular, I'm trying to sort out whether the upstream aspects of ISO 13485 amount to a viable Corrective and Preventative Action mechanism under FDA rules.

Under the current standards and guidances:

Is a CB mandated to be aware (as soon as reasonably possible) of a regulatory action by a third party, such as an inspection-finding 483 or a Warning Letter issued by US FDA?

Is a CB, having learned of US FDA findings in a Warning Letter, mandated (after verifying the substance of the findings) to take action in regard to any corresponding non-conformances to ISO 13485?

Do I correctly understand per the above explanation of ISO 17011 that an AB is not mandated to take substantial action in the event that a CB does not take substantial action regarding an FDA Warning Letter, etc.?

If all of this is non-mandatory, I don't think it's acceptable under 21CFR 820.100.

If it's not acceptable under 21CFR 820.100, then my company's practice of relying partially or completely (depending on material/service criticality) on third party audits (i.e. ISO 13485 certificates) to implement supplier and material/service qualification under 21CFR 820 is out the window.

I wish I'd pursued this line of thinking two years ago.
 

Wes Bucey

Prophet of Profit
For my part, I think the contract between registrar and registrant should include a clause requiring registrant to notify registrar instantly of such "pending action" from a regulatory agency. The penalty should be that certification is immediately withdrawn if registrar learns independently of the regulatory action more than a week after registrant. Note, regulatory notice or action alone is not sufficient to invalidate a certificate (especially when it is not final), but it should put the registrar on alert and maybe trigger its own review of its registrant.

The relationship between a CB and an AB often seems like a shell game to outsiders. I've never been personally involved in the complaint process, but it seems from "anecdotal evidence" that the primary reason ABs penalize CBs and CBs penalize registrants is only when the requisite fees for registration have not been paid. Any real "nonconformance" on the part of a registrant or CB never seems to come to public light.

In the past we had threads which pointed out CBs were not required (except as a "courtesy") to advise their registrants if the CB had its approval/registration withdrawn by the AB. I don't recall seeing anything saying that state of affairs had changed.

Given that neither CBs nor ABs seem eager to "rat out" their registrants, organizations which rely on a supplier's registration as a primary factor in approval as a supplier seem to be shooting craps with loaded dice with the current system. How is the average organization to know if registration has any value if there is no public notice when a link from registrant to CB to AB is broken because of REAL nonconformance, not just a matter (especially in today's economic climate) of whether the renewal fees were paid on time?

Sidney has indeed put his finger on the point - TRANSPARENCY!
 
Top Bottom