Marc Miller05.19.08
Risk Management Drives Supplier Development... and Demise
Two tectonic forces are converging in the medical device industry today: risk management and outsourcing. Their impact is producing waves that are only now beginning to wash up on the shores of industry’s numerous suppliers.
Until recently, the predominant trend in the medical device supplier market has been outsourcing. According to information presented at the 2007 Medical Product Outsourcing Symposium, the market for medtech outsourcing stood at $4.4 billion in 2005, with an estimated 20% of all medical equipment production outsourced. By 2010, this percentage is expected to double to 40%. Outsourcing in the medical device industry spans a broad array of activities, including design and development, research and development as well as component manufacturing. Companies with annual revenue in excess of $20 million outsource the most—at approximately twice the rate of their smaller brethren. Responding to an industry survey, these companies confirmed that they expect the percentage of outsourced operations to double over the next five years.
Of course, the economic drivers for long-term, continued growth in outsourcing are extremely powerful. However, a second, countervailing force has emerged over the last several years: risk management. Ever since the introduction of ISO 14971:2000, the industry’s seminal standard, risk management practices have gained a solid foothold both inside and outside the medical device industry. Evidence is provided by the sheer number of cross-standard references to ISO 14971, which have ballooned from 10 to more than 100 in the past seven years—each one a professional endorsement to the effectiveness of an ISO 14971 approach to risk management.
From its beginning in manufacturers’ design and development departments, risk management principles and concepts now exert a growing influence in functional areas such as software development, post-market surveillance and supplier management. It is in the area of supplier management that the collision between outsourcing and risk management is most strongly felt. Here, issues of quality, audit and regulatory scrutiny are driving significant changes for a large number of industry participants. Specifically, FDA pressure on large manufacturers to exert ever-more rigorous control on their suppliers is creating a two-tier structure in the supplier market. Whether lower-tier suppliers will survive in the long term remains an open question.
Attention, Interest, Decision, Action (AIDA)
In the well-known AIDA formula, the cognitive progression from attention to action, from introduction to buy-in, is chronicled. In this case, what is true for individual psychology is equally true for the entire medical device industry—attention and interest forecast coming action.
One of the best ways to determine “hot spots” of professional attention is through the subject matter of industry seminars, conferences and webinars. In the medical device industry, we find many high-profile programs dedicated to supplier control and risk management. These include a new Association for the Advancement of Medical Instruments webinar, Purchasing Controls: Best Practices in a Regulated Environment; a featured session at the upcoming Medical Device Congress, Supplier Control: Maintaining Quality and Reducing Risk; and a recent presentation at Harvard University, Implementing Effective Supplier Management Programs. In response to increased regulatory pressure, industries typically train and teach through professional educational programs—hoping, thereby, to mitigate a perceived risk.
Of course, the industry’s response to the perceived hazard of uncontrolled suppliers has not been entirely benign and educational. It also has carried the hard edge of market discipline. Regulators around the world now realize that inadequate supplier controls have combined with outsourcing’s 15% cumulative annual growth rate to create a potentially hazardous situation for the entire medical device industry. The regulators’ response to this perceived threat has been to impose stricter control of the industry’s supplier base by means of placing more responsibility of oversight by large manufacturers. In one case, FDA-related pressure forced a manufacturer to staff and train a dedicated 14-person supplier audit group.
“Some natural tears they dropped, but wiped them soon…”
— John Milton, Paradise Lost
But don’t expect regulators to shed many tears over the plight of the poor manufacturer. Dr. Harvey Rudolph, a senior risk management consultant, co-author of ISO 14971 and 25-year FDA veteran, echoing statements from European notified bodies, observed:
“Until recently, outsourcing has often been pursued by companies in a less-than-thought-through manner. Now, supplier control issues are getting special attention in ISO 13485 registration audits, and all regulators are expressing newfound concerns about supplier risk management—not just FDA.”
In other words, regulators may consider this a case of the “chickens coming home to roost.”
Whatever your perspective on the ethics of the situation, the impact of increased regulatory attention is undeniable. During the PharmaMedDevice conference held in March in Philadelphia, PA, participants in the session Improving Quality and Compliance Through Internal and Supplier Audits unanimously agreed that manufacturers already are taking next steps and thinning their supplier ranks based on the supplier’s quality systems and risk management rigor. The first step in this process is supplier qualification. And it is here that standards, such as ISO 13485 and ISO 14971, once again are playing an important role.
In 2007, results from the industry’s first supplier certification research (published by Crimson Life Sciences) clearly demonstrated that suppliers were facing increased pressure to achieve so-called “quality system parity” through certification to ISO 13485. One manufacturer stated:
“The supplier still needs to prove [itself], but ISO 13485 certification helps to establish a common language for discussion of quality requirements. Seventy-five percent (75%) of our suppliers are certified to 13485–for us, it’s an important prerequisite.”
During his time as the senior medical program manager at Underwriters Laboratories (UL), Dr. Rudolph set the stage for what may become another important prerequisite: certification to ISO 14971. Several manufacturers and one supplier already have completed UL’s newly introduced registration audit and at least one ISO 14971 certificate has been issued.
“Many are called, but few are chosen.”
—Matthew, 22:14
Suppliers that are willing to shoulder the burden of increased regulatory compliance can expect to benefit from positive manufacturer attention. Speaking on the condition of anonymity, the vice president of regulatory affairs and quality assurance for one of the country’s largest and most highly regarded medical device manufacturers explained his viewpoint:
“I can tell you from experience, some suppliers will step up and make the required investment in developing their internal quality and risk management systems. Those are the ones we will choose to work with and create real supplier partnerships… the others won’t be able to make the next step—and they will get left behind.”
This sense of shared responsibility for the improvement of a supplier’s quality and risk management systems was in evidence at the PharmaMedDevice conference. There, manufacturers proclaimed their commitment to work with suppliers to help them resolve systemic issues, to develop their skills and systems as well as grow their businesses. These manufacturers also made it clear that this partnership relationship would be limited to a select few—they will be outsourcing’s next class of winners.