ISO 13485 7.4.1 supplier evaluation: quality capability and assessment records

Supplier evaluation asks whether a provider can meet the requirements for the component or service being purchased.
An acceptable quotation and a conforming sample are useful inputs.
The decision also needs to address the capability to maintain the required quality in actual supply and to be revisited using experience after purchasing begins.

This guide addresses ISO 13485:2016 clause 7.4.1 through a fictional thermometer sensor purchase.
Document names, identifiers, responsibilities and tables below are MedQraft implementation examples, not mandatory templates, actual supplier findings or universal assessment intervals.

1. Turn purchase requirements and product impact into evaluation criteria

The official MDSAP audit approach addresses suppliers' ability to meet requirements, controls appropriate to product significance and risk, evaluation records, monitoring and re-evaluation.
Certification alone does not replace initial evaluation, and actual supply quality matters in monitoring.
MDSAP AU P0002.011, Chapter 7

A practical starting point is to replace the broad question “Is this a good company?” with “Can this supplier meet these requirements for this item?” For a sensor, identify the applicable specification revision, characteristics that could affect measurement, manufacturing site and intended purchasing scope.
Obtain tolerances and test conditions from the approved product requirements rather than inventing numbers for the evaluation form.

If variation in a sensor characteristic could affect the finished device, a useful assessment may examine how the supplier checks that characteristic and handles nonconforming items.
Another purchased item with a different effect on product quality may call for different evidence.
The reason for the chosen assessment method should be understandable.

2. A sample result and a supplier assessment answer different questions

In this fictional example, the sample test supports a conclusion about the submitted specimens under the tested conditions.
Its relevance to other items, sites or production conditions needs its own justification.

The following questions are suggested ways to examine evidence.
The table is not a universal package to request from every supplier.

A supplier may be unable to disclose complete internal records.
Redacted examples, relevant extracts, interviews or an on-site review may provide alternative ways to examine the issue.
Agree what each method can establish.
Lack of access should not silently become an acceptable finding.
Record the method and remaining uncertainty.

3. Keep criteria, evidence and decisions together

An evaluation worksheet can show the reasoning before calculating a score.
The example below depicts an assessment in progress for fictional supplier A, not an approved source.

If a scoring system is used, the organization can also identify conditions that must be met independently of a total score.
A worksheet that allows strong delivery scores to conceal missing evidence of specification capability deserves review.
This guide does not prescribe a passing score or rating scale.

4. Documents, timing and responsibilities

The following is a suggested operating structure.
Separate files or linked records in a controlled system can both be considered.
The purpose is to connect information and responsibility, rather than impose particular document names.

These role assignments do not imply that ISO mandates named departments.
In a small organization, a person may perform several functions, but the responsibilities for evaluation, technical review and selection should still be clear.

5. Make the decision usable in purchasing

After fictional supplier A's evaluation is complete, an implementation approach is to connect the decision to the list that buyers actually use.
Record the approved sensor and relevant site, so approval of one item is not mistaken for approval of every product from the company.

Evaluation SE-01 can reference specification SP-S01 Rev.B and sample report SR-01.
The supplier list can then reference the selection decision in SE-01.
A later specification or scope change becomes a reason to consider whether the previous assessment still applies.

Purchasing information connects with clause 7.4.2; verification of received product connects with 7.4.3. Assessing a supplier's capability does not by itself establish that each incoming item meets requirements or authorize omission of the applicable acceptance activities.

6. Use actual supply experience to revisit the decision

The following workflow is a practical proposal for the sensor example:

1. Link incoming results to supplier, item, lot and inspection record.
2. Investigate nonconformities to determine whether supply is implicated and identify affected items and necessary actions.
3. Connect requests to the supplier, responses and follow-up evidence to the same case.
4. Use the accumulated evidence to reconsider evaluation scope, controls and supplier status.

When counting problems, include the observation period and an appropriate denominator such as delivered units or lots.
A new candidate with no deliveries should not appear to have demonstrated stable performance merely because the count of complaints is zero.
Keep commercial criteria visible without allowing them to obscure quality evidence.

Re-evaluation timing should reflect the organization's procedure, product significance and supply performance.
This article does not prescribe annual assessment or a universal defect-rate threshold.
An operating procedure can also explain how an emerging problem triggers additional review before the next routine assessment.

7. Distinguish applicable documents from completed records

Procedures and specifications identify what to use.
Completed evaluation records explain what was examined and decided at the time.
Keeping these purposes distinct helps connect document control under 4.2.4 and record control under 4.2.5.

For example, an evaluation header can identify supplier ID, site, item, specification revision, date and evaluator.
Individual entries can refer to evidence identifiers and controlled locations.
When new supplier information arrives, preserve the basis of earlier decisions rather than silently replacing it.
A file identifier alongside a shared-drive link helps recover the reference if its location changes.

Set access according to the sensitivity of the information and the responsibilities of the users.
Determine retention from applicable regulatory and organizational requirements instead of assigning an unsupported universal period.
For electronic records, modification history, original-source access, backup and recovery are useful operating considerations.

8. Follow one purchasing decision end to end

Choose one intended sensor purchase and follow the path from specification to evaluation criteria, evidence, selection decision and approved purchasing scope.
For an established source, also check where recent incoming results will be available for the next assessment.

This practical exercise helps a new colleague understand both why the item can be purchased from that source and which quality information should be watched during supply.

Related reading

• Design transfer: production specifications and methods
• Design changes: assessing their impact
• Design and development files: connecting configurations to evidence

Sources and scope of review

• Relevant ISO 13485:2016 clauses: 7.4.1 purchasing process; related clauses 7.4.2 purchasing information, 7.4.3 verification of purchased product, 4.2.4 document control and 4.2.5 record control.
• MDSAP AU P0002.011 Audit Approach, revision 2026-08-03, Chapter 7 Tasks 1 and 5–9, and Chapter 1 Task 8.
  Verification used this official public audit document; it does not imply access to the licensed full ISO standard.
• Checked on 2026-11-06.
  Country-specific additions in the MDSAP document have not been presented as universal obligations.
  Tables, identifiers, responsibilities and operating workflows are independent implementation examples.