ISO 13485 7.4.2 purchasing information: specification revisions and delivery evidence

Purchasing information defines what a supplier must provide and which requirements apply.
An accurate part number and quantity can still leave the applicable specification or delivery documentation unclear.
Before communicating an order, the organisation needs to establish that the order and its references convey suitable, consistent requirements.

This article explains ISO 13485:2016 clause 7.4.2 through a fictional thermometer sensor order.
Document identifiers, roles and record fields are MedQraft implementation examples, not mandatory forms or a universal requirement to obtain inspection reports for every purchase.

1. The order and its references form the purchasing information

A purchase order can identify the item and quantity while referring to a controlled specification or drawing for technical requirements.
Contracts or quality agreements can carry continuing quality conditions.
The objective is a coherent set of requirements that the supplier can locate and apply.

Tasks 8 and 9 of the official MDSAP purchasing audit guidance address the adequacy of requirements before communication, documented purchasing information and applicable traceability connections.
The necessary detail reflects the purchased product's effect on the finished device.
Official MDSAP audit guidance

2. Identify the specification that applies to the order

Consider fictional sensor S-01.
Revision B of specification SP-S01 applies to this purchase, but the draft order shows only S-01 and a quantity.
The buyer may intend revision B while the supplier refers to revision A from an earlier exchange.
This is a gap to resolve before sending the order, not a claim that a wrong product has already been delivered.

One approach is to state the specification identifier and revision on the order, then compare them with the attached file.
When using a link, check supplier access and whether the applicable version at the time of ordering can later be identified.
A reference to the “latest version” alone can become ambiguous after that version changes.

Revision B is a fictional identifier.
Actual characteristics, methods and acceptance criteria must come from the organisation's approved technical requirements.
Whether a specification change can retain the same part number depends on configuration and change controls; this example does not establish a general rule permitting unchanged part numbers.

3. Define the delivery evidence needed for the intended decision

If inspection results are needed, clarify which results are required, what they will be compared against and which delivery they represent.
This makes the purpose of the evidence explicit and can reduce requests for missing information after receipt.

In this example, the organisation has chosen to require results for specified inspection items and a link to the delivered lot.
Whether measured values, a conformity statement or another form of evidence is appropriate depends on product impact, risk and applicable requirements.
Neither full raw test data for every supplier nor automatic acceptance upon receiving a certificate should be assumed.

The receiving verification function can explain the intended decision and evidence needs.
Technical personnel can identify the criteria and methods.
Purchasing can ensure those requirements are included in the communicated package.
These are illustrative responsibilities that an organisation can allocate differently.

4. Give each document a purpose and preparation point

These five names do not represent five universally prescribed standalone forms.
Existing purchasing system fields, electronic review histories and controlled attachment lists may serve the same purposes.
Connect the adequacy review with the organisation's approval process while keeping country-specific approval formalities distinct from common ISO requirements.

5. Compare the requirements with the actual attachments before sending

Start with the order and follow its references to the specification, evidence requirements and quality conditions.
A specification identifier is insufficient if the attachment contains a different revision or is absent.
Conflicting requirements should be resolved by the appropriate functions instead of leaving the supplier to select an interpretation.

A supplier acknowledgement can help establish receipt.
It does not replace the organisation's own review of requirement adequacy.
If requirements change after communication, link the revised order and specification to their applicability and the information communicated again to the supplier.

6. Apply conditional requirements where they are relevant

Purchasing information can include, where appropriate, requirements for approval of products, procedures, processes and equipment, personnel qualification and quality management system requirements.
An outsourced process may need relevant qualification or process approval conditions; copying the same conditions into every ordinary component order would not explain their applicability.

Review change-notification arrangements together with the relevant purchasing requirements.
Confirm the conditions and scope for suppliers to notify changes to supplied product that affect fulfilment of specified purchase requirements.
An agreement can specify communication routes and links to impact review.
This article focuses on the initial communication of requirements; change impact assessment and receiving verification remain connected activities with their own purposes.

7. Preserve the purchasing information that was actually communicated

Specifications evolve, but a completed order should still be understandable in terms of its original requirements.
One implementation is to link the order identifier with specification revision, quality conditions, the actual attachment list and communication history.
Distinguish internal drafts from the package actually sent.

Document and record controls should address approved versions, changes, identification, retrieval, access and retention.
Preserve the identifier and location of the applicable revision so replacing a linked file does not erase the basis for an earlier order.
Set retention according to applicable regulations and the organisation's record controls rather than assigning an invented universal duration to purchasing records.

8. Follow one real order through the connections

Choose an order awaiting release and follow the item through the applicable specification and revision, required delivery evidence, quality conditions and pre-communication review.
A practical question is whether the supplier can identify the requirements from that package and whether the receiving function can prepare verification using the same basis.

The next activity, verification of purchased product, compares what was received with the specified requirements.
Clear purchasing information gives ordering and receiving a shared reference.

Related reading

• Supplier evaluation: capability to supply the required quality
• Design transfer: connecting design to production specifications
• Design changes: impact and decision evidence

Sources and scope of verification

• Relevant ISO 13485:2016 clause: 7.4.2 purchasing information.
  Connected activities include 7.4.1 purchasing process, 7.4.3 verification of purchased product, 4.2.4 document control and 4.2.5 record control.
• MDSAP AU P0002.011 Audit Approach, revision 2026-08-03, Chapter 7 Tasks 8–9 and related document and record guidance.
  Verification used this official public audit guidance; it does not imply review of the complete licensed ISO text.
• Checked 2026-11-07.
  Additional national requirements need market-specific assessment.
  The order examples, document names, role allocations and tables are independent implementation suggestions.