How Supplier Performance Improves Medical Device Quality and Patient Safety

How Supplier Performance Improves Medical Device Quality and Patient Safety

Kamlesh Taduka (1), Arish Dandu (2), Tushar S Bendigeri (3)

(1) Primary Author (2) Secondary Author (3) Third Author

Conceptual Literature-Based Study

Abstract – Medical device manufacturers depend on suppliers for materials, components, packaging, and specialized processes. A weak supplier process may therefore affect much more than incoming inspection results; it can also influence assembly, device performance, and, in some cases, patient safety. Most supplier scorecards are built around practical measures such as parts per million (PPM), lot acceptance, delivery, audit results, and corrective-action closure. These measures are useful, but they do not always show which supplier problems deserve the most attention.

This paper proposes a Patient-Risk-Centered Supplier Performance Model (PRC-SPM). The model combines routine supplier metrics with component criticality, failure severity, process capability, defect escape potential, and downstream quality information. Its purpose is to help quality teams distinguish a frequent but low-consequence problem from a less frequent issue that could affect an important device function. The model also gives weight to early warning signs, such as a declining Cpk or repeated corrective actions, so that intervention can occur before a major defect escape. The PRC-SPM is presented as a conceptual framework and will require validation with real supplier and product-quality data.

1. INTRODUCTION

   A finished medical device is often the result of work performed by many organizations. One supplier may provide resin, another may mold a component, a third may perform a special process, and another may manufacture the package. The legal manufacturer remains responsible for the finished device, but the stability of these external processes has a clear effect on the manufacturers ability to meet product requirements.

   Supplier failures can take many forms. A dimension may drift, a material may vary, a package may not seal as intended, or a process change may be made without adequate review. Some problems are found during receiving inspection or assembly. Others are difficult to detect and may not become visible until functional testing or later in the product lifecycle.

   The usual supplier scorecard helps answer an important question: How well is the supplier performing? This paper adds a second question: What could happen to the device if this supplier problem escapes? That distinction is especially important in medical-device manufacturing because the same defect rate can carry very different consequences depending on the component and its function [3-8].

2. BACKGROUND AND RESEARCH GAP

   Risk-based thinking is already part of medical-device quality management. FDAs Quality Management System Regulation (QMSR), effective February 2, 2026, incorporates ISO 13485:2016 by reference [1,2]. ISO 13485 establishes quality-management-system requirements for medical-device organizations, while ISO 14971 describes a lifecycle process for identifying hazards, estimating and evaluating risks, applying controls, and reviewing the effectiveness of those controls [3,4].

   Supplier-selection research also recognizes that supplier performance cannot be reduced to price or delivery alone. Published studies have considered sustainability, reliability, agility, technology, quality, and other decision criteria in the medical-device sector [5-8]. Risk-based thinking has also been applied to engineering change control in medical-device manufacturing [9].

   Even with these developments, supplier scorecards and product risk files are often managed as separate systems. A scorecard may show PPM and on-time delivery, while the risk file describes potential harms associated with product failures. The practical gap is the link between them. The PRC-SPM is intended to provide that link by adding product criticality and possible downstream impact to the interpretation of supplier data.

3. WHY DEFECT COUNTS ALONE ARE NOT ENOUGH

   Consider two hypothetical suppliers. Supplier A provides a noncritical external part and records 800 PPM, mostly for cosmetic defects. Supplier B provides a critical functional component and records 80 PPM. The defect from Supplier B is less frequent, but it could interfere with the intended function of the device. A scorecard based mainly on PPM would likely rank Supplier A lower. A risk-centered review may reach the opposite conclusion and give Supplier B more attention.

   This example does not make PPM unimportant. It shows that PPM needs context. The significance of a supplier problem depends on what failed, where the component is used, how severe the effect could be, and how likely the defect is to escape existing controls.

4. PROPOSED PATIENT-RISK-CENTERED SUPPLIER PERFORMANCE MODEL

   The PRC-SPM uses five connected areas: supplier performance, component criticality, failure risk, downstream signals, and the level of action.

   Supplier performance. This area includes incoming acceptance, PPM, process capability, SPC behavior, audit findings, change-control compliance, delivery, corrective-action effectiveness, and recurrence. No single metric is expected to describe the supplier completely.

   Component criticality. Supplied items are considered according to their role in device safety and performance. A cosmetic feature and a dimension that controls an important device function should not receive the same risk treatment simply because both are out of specification.

   Failure risk. The review considers the potential severity of the failure, how often it may occur, and how likely it is to be detected before product release or use.

   Downstream signals. Supplier monitoring should continue beyond receiving inspection. Assembly rejects, functional-test failures, finished-device failures, complaints, returns, CAPA investigations, and other post- market information can reveal supplier effects that incoming inspection did not capture.

   Level of action. The response should increase when poor supplier performance is combined with high component criticality, high severity, or a strong chance of escape. Actions may range from routine monitoring to enhanced review, corrective action, temporary containment, validation assessment, or cross-functional risk evaluation.

   Figure 1. Conceptual pathway from supplier performance to possible patient risk.

5. CONCEPTUAL SUPPLIER PATIENT RISK INDEX

   To make the model easier to discuss, this paper proposes a conceptual Supplier Patient Risk Index (SPRI):

   SPRI = Supplier Performance Risk × Component Criticality × Failure Severity × Escape Potential

   Supplier Performance Risk represents evidence that the supplier process is weak or becoming unstable. Component Criticality describes the importance of the supplied item to the device. Failure Severity reflects the possible consequence if the defect reaches a finished device. Escape Potential reflects the chance that the defect will pass through existing controls without being found.

   The SPRI is not a validated equation and should not be used as a universal scoring formula. An organization would need to define its own scales, weighting, thresholds, and validation plan. In this paper, the equation is only a simple way to show that supplier performance and product risk should be considered together.

6. BUILDING A RISK-ADJUSTED SUPPLIER SORECARD

   A risk-adjusted scorecard does not discard familiar supplier metrics. It changes how they are read. PPM is reviewed together with defect severity. Lot acceptance is reviewed together with the criticality of the rejected characteristic. Corrective-action closure is reviewed together with effectiveness and recurrence. Cpk receives more attention when it applies to a characteristic that is important to device function.

   This approach shifts the discussion from How many defects were found? to What do these defects mean for the product, and what evidence suggests the process may get worse?

   Measure	Common Interpretation	Risk-Centered Interpretation
   Defect rate	PPM	PPM reviewed with defect type and severity
   Lot acceptance	Percent accepted	Acceptance reviewed with characteristic criticality
   Corrective action	Time to closure	Effectiveness, recurrence, and sustained control
   Process capability	Current Cp/Cpk	Trend and capability of critical characteristics
   Inspection	Accepted or rejected	Ability of the control to prevent an escape
   Downstream quality	Managed separately	Used as part of the supplier-risk review

   Table 1. Example of how common supplier measures can be interpreted in a risk-centered scorecard.

7. EARLY WARNING SIGNS

   A supplier process does not need to be producing a large number of defects before it becomes a concern. A critical characteristic may still meet specification while the process gradually loses capability. For example, a hypothetical Cpk trend of 1.80, 1.55, 1.32, and 1.12 shows a steady loss of margin. Waiting for the process to generate a major rejection would waste the opportunity for preventive action.

   Other useful warning signs include adverse SPC patterns, repeated deviation requests, recurring nonconformances after corrective-action closure, measurement-system concerns, unplanned tooling changes, and a rise in assembly or functional-test failures. The appropriate response should depend on the characteristic and its possible effect on the device.

   Figure 2. Hypothetical capability trend used only to illustrate a possible early warning; the values are not empirical study data.

8. SUPPLIER RISK SEGMENTATION

   Quality resources are limited, so supplier oversight should be prioritized. A low-criticality component from a strong supplier may remain under routine review. A high-criticality component from a supplier with moderate performance may justify additional data review or a focused improvement plan. Poor performance on a high- criticality component may require prompt escalation and containment.

   This segmentation does not replace supplier qualification or approved-supplier controls. It helps determine where additional attention is most likely to prevent a meaningful product-quality problem.

   Figure 3. Conceptual supplier-risk segmentation based on component criticality and supplier performance.

9. CLOSED-LOOP USE OF SUPPLIER INFORMATION

   Supplier performance should be reviewed as a continuous loop. Information begins with selection and qualification, continues through process validation and production monitoring, and is supplemented by receiving, manufacturing, test, complaint, and post-market data.

   When a downstream investigation identifies a supplier contribution, that information should return to the supplier-risk assessment. The supplier rating may need to change, controls may need to be strengthened, and the corrective action should be followed long enough to determine whether the issue truly stopped recurring.

10. ILLUSTRATIVE APPLICATION

    Assume that a supplier makes a precision component used in an important device function. The usual scorecard looks acceptable: incoming acceptance is high, PPM is low, delivery is stable, and recent audits show no major issue. During a periodic review, however, the quality team notices that Cpk for a critical dimension has declined over several reporting periods.

    Under a conventional scorecard, the supplier may continue to appear satisfactory because no large rejection has occurred. Under the PRC-SPM, the capability trend is treated as an early warning because the process margin is shrinking on a critical feature. A reasonable response could include a review of process settings, tooling condition, maintenance, raw-material variation, and the measurement system. The team might also increase SPC review or temporarily strengthen inspection while the supplier restores capability.

    The point of the example is not that every Cpk decline requires the same action. It is that the decision should reflect both the process trend and the consequence of the characteristic involved.

11. DISCUSSION

    The main advantage of the PRC-SPM is prioritization. Supplier quality teams regularly face many defects, audit observations, deviation requests, and corrective actions. Treating every event as equally important can spread resources too thin. A risk-centered review helps the team focus on the issues most likely to affect device performance or patient safety.

    The model also encourages better use of information that already exists. Manufacturing quality may see an increase in assembly rejects, design engineering may understand the functional importance of a dimension, and post-market teams may recognize a complaint pattern. When those signals are considered together with supplier data, the organization has a more complete view of the risk.

    Implementation would require cross-functional agreement. Supplier quality, design, manufacturing, reliability, purchasing, regulatory, and post-market functions may need to define criticality categories, escalation rules, data ownership, and review frequency. The framework is therefore less about creating one more score and more about improving the quality of supplier decisions.

12. REGULATORY ALIGNMENT

    The PRC-SPM is intended to support existing supplier-control and risk-management processes, not replace them. Its risk-based structure is consistent with the broader direction of FDAs QMSR, ISO 13485, and ISO 14971 [1-4]. The reference to risk-based engineering change control in medical-device manufacturing also shows that similar thinking can be applied to other quality-system decisions [9].

    Any organization using the model would still need to follow applicable regulations, standards, internal procedures, product specifications, validation requirements, and approved risk-management methods.

13. LIMITATIONS AND FUTURE WORK

    This paper is conceptual. It does not analyze patient, clinical, supplier, or proprietary manufacturing data. The SPRI has not been validated, and the proposed weighting or escalation logic may not work equally well for every type of device or supplier process.

    The relationship between a supplier issue and patient impact is also affected by many intermediate controls. Receiving inspection, automated inspection, assembly controls, functional testing, sterilization, packaging, and final acceptance may all reduce the chance of an escape. For this reason, the model should not be interpreted as proving that a particular supplier metric causes a clinical outcome.

    Future studies should test the framework using anonymized supplier and product-quality data. Useful variables may include PPM, Cpk trends, SPC signals, corrective-action recurrence, manufacturing rejects, component criticality, finished-device failures, and complaint trends. A comparison between coventional scorecards and risk-adjusted rankings could show whether the proposed approach identifies emerging problems earlier or directs resources more effectively.

14. CONCLUSION

Supplier performance affects medical-device quality long before the device is released. PPM, lot acceptance, delivery, audits, and corrective actions remain important, but they do not fully describe the risk created by a supplier problem.

The PRC-SPM adds component criticality, severity, escape potential, process trends, and downstream quality information to the supplier review. Its central idea is straightforward: a supplier defect should be judged not only by how often it occurs, but also by what could happen if it reaches the finished device.

Used carefully, a risk-centered approach may help manufacturers identify process deterioration earlier, direct supplier-quality resources toward higher-consequence issues, and strengthen the connection between supplier management, device reliability, and patient safety. Empirical validation is the necessary next step.

REFERENCES

1. U.S. Food and Drug Administration. Quality Management System Regulation (QMSR). Updated February 2, 2026.

2. U.S. Food and Drug Administration. Quality Management System Regulation – Frequently Asked Questions. Updated February 2, 2026.

3. International Organization for Standardization. ISO 13485:2016. Medical devices – Quality management systems – Requirements for regulatory purposes. Geneva: ISO; 2016.

4. International Organization for Standardization. ISO 14971:2019. Medical devices – Application of risk management to medical devices. Geneva: ISO; 2019.

5. ForouzeshNejad AA. Leagile and sustainable supplier selection problem in the Industry 4.0 era: a case study of the medical devices using hybrid multi-criteria decision making tool. Environmental Science and Pollution Research. 2023;30(5):13418-13437. doi:10.1007/s11356-022-22916-x.

6. Ghadimi P, Heavey C. Sustainable supplier selection in medical device industry: Toward sustainable manufacturing. Procedia CIRP. 2014;15:165-170. doi:10.1016/j.procir.2014.06.096.

7. Ozel Sonmez G, Toktas P. Supplier selection using the integrated MEREC-CoCoSo methods in a medical device company. Journal of Scientific Reports-A. 2024;(56).

8. Critical Success Factors for Supplier Selection and Performance Enhancement in the Medical Device Industry: An Industry 4.0 Approach. Processes. 2025;13(5):1438. doi:10.3390/pr13051438.

9. T. S. Bendigeri, Risk-Based Engineering Change Control for Medical Device Manufacturing: A Framework and Representative Quantitative Case Study, International Journal of Engineering Research & Technology (IJERT), vol. 15, no. 7, Paper ID IJERTV15IS070115, July 2026, doi:10.5281/zenodo.21305220.

Evidence and Use of Examples

This manuscript is a conceptual literature-based study. It does not report collected patient, clinical, supplier, or proprietary manufacturing data. The numerical example and capability graph are hypothetical and are included only to explain the proposed framework. The PRC-SPM and SPRI require empirical validation before they can be presented as predictive tools.