FDA 21 CFR Part 820: How Supplier Controls Work (Simple Explanation)

FDA 21 CFR Part 820 requires medical device manufacturers to have written processes for choosing, approving, and managing suppliers. Supplier controls help ensure that materials, components, and services meet quality requirements, reduce risks in the supply chain, and support the safety and performance of the final medical device. Key activities include evaluating suppliers before use, applying stronger controls to higher-risk suppliers, and maintaining an approved supplier list as part of the Quality System Regulation (QSR).

This blog explains FDA 21 CFR Part 820 supplier control requirements and how manufacturers manage suppliers in practice.

What Is FDA 21 CFR Part 820?

FDA 21 CFR Part 820, also known as the Quality System Regulation (QSR), establishes the minimum quality system requirements for medical device manufacturers that sell products in the United States. It applies to both U.S.-based and foreign manufacturers whose devices are marketed in the U.S.

Part 820 covers the entire lifecycle of a medical device, including design, purchasing, production, testing, distribution, and post-market activities. The regulation is designed to ensure that devices are consistently manufactured under controlled conditions and meet applicable safety and performance requirements.

Supplier controls are a critical part of this system because purchased products and outsourced processes can directly impact device quality. These controls are primarily addressed in 21 CFR 820.50 – Purchasing Controls, but they are closely linked to other sections such as CAPA, production controls, process validation, and records management.

What Are Supplier Controls Under FDA 21 CFR Part 820?

Supplier controls are the documented processes and activities a medical device manufacturer uses to ensure that suppliers can consistently meet defined quality and regulatory requirements. These controls apply to any supplier whose product or service may affect the finished device.

Supplier controls are not limited to initial supplier approval. FDA expects manufacturers to maintain ongoing oversight throughout the supplier relationship, including monitoring performance, managing changes, and addressing issues through corrective actions.

Supplier controls typically apply to:

• Raw material and component suppliers
• Contract manufacturers
• Sterilization service providers
• Software developers
• Packaging and labeling suppliers
• Calibration and testing laboratories

If a supplier’s output can affect device quality, safety, or regulatory compliance, that supplier must be controlled.

Key Components of 21 CFR 820.50 (Purchasing Controls)

Section 21 CFR 820.50 – Purchasing Controls is the core FDA regulation governing supplier management. This section requires medical device manufacturers to establish and maintain procedures that ensure purchased products and services conform to specified requirements. FDA does not prescribe a single method for supplier control. Instead, it expects manufacturers to apply controls that are appropriate to the supplier’s risk and impact on the finished device. During inspections, the FDA often reviews purchasing controls early because weaknesses in this area can undermine the entire quality system.

The components below explain how purchasing controls are implemented to meet FDA expectations.

1. Supplier Evaluation and Selection

Manufacturers must evaluate and select suppliers based on their ability to meet specified quality and regulatory requirements. This evaluation must be documented and based on objective evidence. FDA expects manufacturers to justify why a supplier was approved and demonstrate that the evaluation method was appropriate for the supplier’s role.

Common supplier evaluation methods include:

• Supplier questionnaires
• On-site or remote supplier audits
• Review of quality certifications (ISO 13485, ISO 9001)
• Review of quality history and performance
• Sample inspections or trial production runs

FDA inspectors often ask how suppliers were evaluated, whether risk was considered, and whether the evaluation supports the supplier’s level of responsibility.

2. Approved Supplier List

Manufacturers must maintain records of approved suppliers. An approved supplier list ensures that only qualified suppliers are used in production and prevents the accidental use of unapproved or unqualified suppliers.

FDA frequently cites companies for:

• Using suppliers that are not formally approved
• Failing to maintain supplier approval records
• Not updating the supplier approval status after performance issues

An accurate and current approved supplier list is a basic but essential requirement.

3. Purchasing Data and Defined Requirements

Manufacturers must clearly define and communicate requirements to suppliers. FDA refers to this information as purchasing data, and it must be controlled and kept up to date.

Purchasing data may include:

• Technical drawings and specifications
• Material and component requirements
• Manufacturing and process requirements
• Acceptance criteria
• Regulatory and compliance obligations

One of the most common FDA findings is vague, incomplete, or outdated purchasing specifications that do not clearly define supplier expectations.

4. Verification of Purchased Products and Services

FDA requires manufacturers to verify that purchased products and services meet specified requirements before they are used in production. Verification activities must be documented and consistently applied.

Verification methods may include:

• Incoming inspection and testing
• Review of certificates of analysis (CoA)
• Supplier test reports
• Review of qualification or validation records

If verification activities are reduced or eliminated, manufacturers must document the rationale. Skipping verification without justification is a frequent FDA observation.

5. Supplier Performance Monitoring

Purchasing controls also require manufacturers to monitor supplier performance on an ongoing basis. Supplier control is not a one-time activity; it must continue throughout the supplier relationship.

Supplier performance monitoring may include:

• Nonconformance and defect rates
• On-time delivery performance
• Audit findings
• Complaint trends
• CAPA effectiveness

FDA expects manufacturers to show how supplier performance data is reviewed and how issues are addressed.

How Supplier Controls Work in FDA 21 CFR Part 820

Supplier controls under FDA 21 CFR Part 820 extend beyond purchasing activities and are integrated throughout the quality system. FDA expects manufacturers to maintain continuous oversight over suppliers, from initial qualification through ongoing monitoring, change control, and corrective action.

The following elements explain how supplier controls function in practice.

1. Risk-Based Supplier Classification

FDA expects manufacturers to apply supplier controls based on risk. While the regulation does not mandate a specific classification system, inspectors expect companies to demonstrate that suppliers with a greater impact on device safety or performance receive stronger oversight.

Supplier risk is typically based on:

• Impact on device safety and effectiveness
• Complexity of the supplied product or service
• Ability to detect defects through inspection
• Regulatory impact

Typical supplier categories include critical, major, and minor suppliers. Critical suppliers usually require more frequent audits, tighter controls, and closer monitoring.

2. Supplier Audits

Supplier audits are a key tool for evaluating and monitoring supplier compliance, especially for critical suppliers. Although the FDA does not explicitly require supplier audits, they are widely expected and commonly reviewed during inspections.

Supplier audits help manufacturers verify that suppliers:

• Follow documented procedures
• Maintain effective quality systems
• Control processes and changes
• Address nonconformities appropriately

FDA inspectors often review audit schedules, reports, findings, and corrective actions to assess the effectiveness of supplier oversight.

3. Control of Outsourced Processes

When manufacturing or quality-related processes are outsourced, FDA expects the manufacturer to maintain control over those processes. Outsourcing does not transfer regulatory responsibility to the supplier.

Common outsourced processes include:

• Contract manufacturing
• Sterilization
• Software development
• Packaging and labeling

Control methods may include supplier audits, quality agreements, review of validation records, and ongoing performance monitoring. Failure to control outsourced processes is a frequent FDA inspection finding.

4. Quality Agreements

Quality agreements define roles, responsibilities, and communication requirements between manufacturers and suppliers. While not explicitly required by FDA, quality agreements are strongly recommended and widely expected during inspections.

Quality agreements typically define:

• Quality and regulatory responsibilities
• Change notification requirements
• Documentation and record access
• Support during regulatory inspections

Clear quality agreements reduce misunderstandings and demonstrate strong supplier control.

5. Change Control and Supplier Changes

Supplier changes can significantly affect product quality and regulatory compliance. FDA expects manufacturers to evaluate and approve supplier changes before implementation.

Supplier changes may include:

• Material or formulation changes
• Process or equipment changes
• Sub-supplier changes
• Software updates

Manufacturers must assess the impact of changes on product safety, effectiveness, and regulatory filings. Uncontrolled supplier changes are a common root cause of FDA observations and recalls.

6. Handling Nonconforming Supplier Materials

Manufacturers must have procedures to identify, document, and address nonconforming materials received from suppliers. These procedures must ensure that nonconforming materials are not used unintentionally.

Key elements include:

• Identification and segregation
• Investigation and root cause analysis
• Disposition decisions
• Supplier notification
• Corrective actions when required

Supplier-related nonconformances often trigger CAPA activities.

7. Corrective and Preventive Action (CAPA)

Serious or recurring supplier issues must be addressed through the CAPA system. FDA expects CAPAs to focus on root cause analysis and include verification of effectiveness.

FDA inspectors frequently review supplier-related CAPAs to determine whether issues are being effectively resolved or repeatedly occurring. Weak supplier CAPA systems are a common cause of FDA warning letters.

8. Training and Supplier Control Responsibilities

Personnel responsible for supplier controls must be trained and competent. FDA expects manufacturers to ensure that employees understand purchasing controls, supplier evaluation, audits, change control, and performance monitoring.

Training records are commonly reviewed during inspections, and missing or incomplete records are frequent findings.

9. Supplier Records and Documentation

FDA requires manufacturers to maintain complete and accurate supplier-related records. These records must be readily available during inspections and demonstrate effective oversight.

Common supplier records include:

• Approved supplier lists
• Supplier evaluation and audit records
• Purchasing specifications
• Verification and inspection records
• Supplier CAPA documentation

Poor documentation can undermine otherwise effective supplier controls.

For guidance on documenting audit results, refer to our Supplier Audit Report Template: Format, Sections, and Example Findings to ensure audit reports meet regulatory and quality expectations.

Common FDA Inspection Findings Related to Supplier Controls

FDA inspections frequently identify:

• Inadequate supplier evaluation and approval
• Poor risk-based supplier classification
• Weak change control processes
• Lack of supplier audits for critical suppliers
• Incomplete purchasing specifications
• Failure to address recurring supplier issues

Understanding these trends helps manufacturers focus on high-risk areas and improve inspection readiness.

To support consistent supplier evaluation and performance monitoring, review Supplier Audit Scoring System: How to Rate Suppliers for practical guidance on rating and comparing suppliers.

Prepare for FDA Inspections with AMREP Mexico Supplier Audits

Supplier controls under FDA 21 CFR Part 820 are critical to ensuring medical device quality, safety, and regulatory compliance. Risk-based supplier control processes help reduce compliance risk, improve product quality, and strengthen supply chains.

AMREP Mexico’s Supplier Factory Auditing services support medical device manufacturers through risk-based supplier audits aligned with FDA 21 CFR 820.50 and QSR requirements. These audits assess supplier quality systems, process controls, change management, CAPA effectiveness, and documentation to identify gaps before they result in FDA observations or supply disruptions.