A Risk-Adjusted Supplier Quality Control Framework for Medical Device Manufacturing

A Risk-Adjusted Supplier Quality Control Framework for Medical Device Manufacturing

Kamlesh Taduka (1); Tushar S. Bendigeri (2)

(1) Primary author affiliation: Independent Researcher | (2) Secondary author affiliation: Independent Researcher | Corresponding author and

Abstract – Supplier scorecards frequently combine quality, delivery, cost, and responsiveness into a single average. In regulated medical- device manufacturing, that practice can under-prioritize a supplier whose failure could affect patient safety or whose process output cannot be fully verified by subsequent inspection. This paper proposes a Risk-Adjusted Supplier Quality Control Framework (RASQCF) that separates intrinsic product-and-process risk from observed supplier performance. Six risk dimensions are converted into a Risk- Burden Index, while five performance dimensions form a Performance-Penalty Index. A non-compensatory gate elevates suppliers associated with the highest clinical criticality or high-risk special processes even when their conventional performance score is acceptable. The combined Supplier Priority Index assigns one of four control tiers linked to qualification, incoming verification, change notification, audit, capability monitoring, and escalation requirements. A reproducible synthetic dataset of twelve suppliers demonstrates that performance-only ranking can place critical suppliers below lower-consequence suppliers. In the example, four suppliers are elevated by the safety gate, and the rank ordering changes materially after intrinsic risk is incorporated. The framework is intended as a transparent decision aid that complements, rather than replaces, ISO 13485 purchasing controls, ISO 14971 risk management, and organization- specific procedures. Empirical validation with longitudinal supplier data is identified as the next research step.

Keywords – supplier quality, medical devices, risk-based controls, supplier performance, purchasing controls, ISO 13485, supplier segmentation

1. INTRODUCTION

   Medical-device manufacturers depend on external suppliers for molded and machined components, electronic assemblies, sterilization, packaging, coatings, calibration, software, and other processes that can influence device safety and performance. Outsourcing transfers the execution of an activity, but it does not transfer the legal or quality- system responsibility for ensuring that purchased product and services conform to specified requirements. The importance of this responsibility has increased under the U.S. Food and Drug Administration’s Quality Management System Regulation (QMSR), effective February 2, 2026, which incorporates ISO 13485:2016 by reference and places risk management within the foundational quality- system framework [1], [2].

   Most supplier-management systems use periodic scorecards. Typical measures include rejected parts per million, lot acceptance, corrective-action responsiveness, on-time delivery, audit results, and purchase-price performance. Such metrics are useful, but a weighted average can create a compensation problem. Excellent delivery can offset poor change control; low recent defect counts can offset weak process validation; and favorable cost performance can obscure single- source exposure. More importantly, a supplier of a low-risk shipping carton can receive the same review cadence as a supplier performing terminal sterilization if both have similar composite scores.

   The research problem addressed here is therefore not the absence of supplier metrics, but the absence of a simple and auditable mechanism that prevents high-consequence risk from being averaged away. The objective is to develop a framework that: (1) separates intrinsic risk from demonstrated performance; (2) uses explicit safety and process gates; (3) converts the result into defined control levels; and (4) can be recalculated from routinely available supplier-quality records. The paper contributes a transparent scoring method, a tier-to- control matrix, and a reproducible numerical demonstration.

2. LITERATURE AND REGULATORY BASIS

   1. Supplier Segmentation and Selection

      Supplier selection research has long recognized that purchase decisions involve multiple criteria. Dickson’s early empirical work identified quality, delivery, performance history, warranty policy,

      production facilities, price, and technical capability among the relevant factors [3]. Kraljic later proposed segmenting purchased items according to profit impact and supply risk, establishing the strategic logic for differentiated supplier relationships [4]. Subsequent reviews show extensive use of multi-criteria decision methods, including analytic hierarchy process, data envelopment analysis, mathematical programming, and integrated models [5], [6]. These approaches are valuable for sourcing, but they are not always designed to translate medical-device product risk into operational supplier controls.

      A central limitation of compensatory multi-criteria models is that a low value in one dimension may be offset by a high value in another. Compensation is reasonable when comparing commercial preferences, but it can be inappropriate when one criterion represents a patient- safety consequence or a process whose output is not fully verified downstream. The proposed framework retains a weighted score for transparency while adding non-compensatory gates for these conditions.

      Bendigeri proposed a five-gate engineering change-control framework that links the initiating change, risk assessment, control selection, verification or validation, and post-implementation monitoring [11]. That work treats supplier assessment as part of the evidence chain for medical-device changes. The present study extends the underlying risk-based logic by providing a dedicated supplier- prioritization method and by translating supplier risk and performance into minimum oversight tiers.

   2. Medical-Device Quality and Risk Requirements

   ISO 13485:2016 provides a medical-device-specific quality- management framework and is applicable not only to manufacturers but also to suppliers and external parties providing product or quality- system-related services [2]. Its purchasing controls require the organization to establish criteria for supplier evaluation and selection, determine the type and extent of control based on the effect of purchased product on subsequent realization and final product, define purchasing information, and verify that purchased product meets requirements. ISO 14971:2019 establishes a systematic process for identifying hazards, estimating and evaluating risk, controlling risk, and monitoring control effectiveness across the device life cycle [7].

   Together, these standards support a risk-proportionate approach but do not prescribe a universal supplier scoring equation.

   The FDA states that the QMSR incorporates ISO 13485:2016 and now specifically requires risk management within the U.S. device quality-system framework [1]. Consequently, a supplier-control method should preserve traceability between the supplier’s activity, the associated product or process risk, the observed evidence of performance, and the controls selected by the manufacturer. The method proposed below is designed around that traceability.

3. RESEARCH METHOD

   1. Design Principles

      The framework was developed as a design-science artifact: a practical decision model constructed from regulatory requirements, risk-management principles, and supplier-performance practice. Four design principles were applied. First, intrinsic risk is evaluated before supplier performance. Second, clinical criticality and high-risk special processes are non-compensatory. Third, each score must be supported by objective evidence. Fourth, the output must prescribe a minimum control package rather than merely produce a ranking.

   2. Risk-Burden Index

      Each supplier-scope combination is rated from 1 (lowest) to 5 (highest) on six dimensions: clinical criticality (C), process criticality (P), escape potential (E), continuity exposure (S), change-governance exposure (G), and adverse history (H). A supplier with multiple commodities is assessed separately for materially different scopes; the highest applicable tier governs unless the controls are demonstrably segregated.

      RBI = 25[(0.30C + 0.20P + 0.15E + 0.15S + 0.10G + 0.10H) 1] (1)

      Equation (1) maps the weighted rating to a 0100 Risk-Burden Index (RBI). Clinical criticality receives the greatest weight because supplier failure may contribute directly to hazardous situations. Process criticality captures special or validated processes and characteristics not fully verified later. Escape potential represents the practical likelihood that a defect will pass receiving and manufacturing controls. Continuity exposure addresses single-source status, lead time, capacity, and sub-tier dependence. Change-governance exposure addresses the supplier’s ability to identify and obtain approval for changes. History includes recurring nonconformity, audit findings, field linkage, and ineffective corrective actions.

      TABLE I. RISK-DIMENSION ANCHORS

      Factor	Rating 1 anchor	Rating 3 anchor	Rating 5 anchor
      C	No device-function effect	Temporary performance degradation	Potential serious harm
      P	Fully verified commodity	Key characteristic with effective verification	Validated/special process or irreplaceable control
      E	Defect reliably detected	Sampled or indirect detection	Latent or not practically detectable
      S	Multiple qualified sources	Moderate lead time/capacity constraint	Single source; difficult or lengthy transfer
      G	Mature notification controls	Some manual dependencies	Weak or previously missed change notification
      H	Stable, effective history	Intermittent issues	Recurring/major issues or ineffective actions

   3. Performance-Penalty Index

      Performance is converted to penalty values in which 0 represents acceptable performance and 100 represents the defined worst condition. The five components are quality loss (Q), corrective-action weakness (A), audit-system weakness (U), delivery/capacity loss (D), and change-control weakness (N). Organizations should define normalization limits before calculationfor example, zero penalty

      below a commodity-specific defect threshold and full penalty at or above a documented escalation threshold.

      PPI = 0.35Q + 0.20A + 0.15U + 0.15D + 0.15N (2)

      The quality component may combine lot rejection, defect rate, severity-weighted escapes, and trend signals. Corrective-action weakness should consider timeliness, root-cause adequacy, action completion, and recurrence rather than closure time alone. Audit weakness reflects the severity and persistence of quality-system findings. Delivery/capacity loss is retained because supply interruption can affect patient access and may induce unplanned manufacturing changes. Change-control weakness includes late, incomplete, or unapproved changes.

   4. Supplier Priority Index and Safety Gate

      SPI = 0.60RBI + 0.40PPI (3)

      The Supplier Priority Index (SPI) gives greater weight to intrinsic risk while allowing demonstrated performance to influence oversight. The non-compensatory gate assigns Tier IV when C = 5, or when P = 5 and E 4. Without a gate, Tier IV is assigned at SPI 75; Tier III at 6074.9; Tier II at 4059.9; and Tier I below 40. Thresholds are proposed starting values, not universal acceptance criteria. Each organization must calibrate them against its product risk policy, complaint history, regulatory commitments, and available resources.

      TABLE II. MINIMUM CONTROL PACKAGE BY TIER

      Tier	Minimum control intent	Typical review
      I	Approved supplier status; specification and PO controls; routine receiving verification	Annual performance review
      II	Tier I plus risk-based sampling, documented change agreement, trend monitoring	Semiannual review
      III	Tier II plus capability evidence, focused audit, formal improvement plan, sub-tier visibility	Quarterly review
      IV	Tier III plus executive escalation, validation oversight, enhanced traceability, contingency plan, approval of material/process/site changes	Monthly or event-driven review

   5. Evidence and Governance

   A cross-functional team should assign ratings using approved evidence. Quality engineering owns defect, escape, audit, and corrective-action evidence; design or product-risk personnel interpret clinical and functional criticality; manufacturing engineering evaluates process controls and validation; supply management assesses continuity; and regulatory affairs evaluates reportability or submission implications of supplier changes. Rating rationales, source documents, approvers, and effective dates should be retained. Recalculation is triggered by periodic review, a new part or process, significant change, major nonconformity, complaint or field signal, capacity disruption, ownership change, or sub-tier relocation.

4. ILLUSTRATIVE APPLICATION

   1. Dataset and Calculation

      To demonstrate the mechanics without disclosing proprietary information, a synthetic dataset of twelve supplier scopes was constructed. Ratings were intentionally varied to represent common medical-device supply categories. The PPI values are aggregate synthetic penalties rather than observations from an actual company. Equations (1)(3) were applied without adjustment.

      TABLE III. SYNTHETIC SUPPLIER-SCOPE RESULTS

      /tr>

      ID	Supplier scope	C	P	E	S	G	H	RBI	PPI	SPI	Gate	Tier
      S01	Injection-molded patient-contact component	5	4	4	4	3	3	77.5	58	69.7	Yes	IV
      S02	Printed packaging	2	2	2	2	2	2	25.0	44	32.6	No	I
      S03	Sterilization service	5	5	4	5	3	2	83.8	35	64.2	Yes	IV
      S04	CNC-machined structural component	4	4	3	3	4	4	67.5	72	69.3	No	III
      S05	Commercial fastener	2	2	2	1	2	1	18.8	31	23.6	No	I
      S06	Electronic control assembly	5	4	3	5	4	3	80.0	63	73.2	Yes	IV
      S07	Label converter	3	3	4	2	3	4	52.5	67	58.3	No	II
      S08	Resin compounder	4	4	3	4	5	3	71.3	76	73.2	No	III
      S09	Secondary machining service	3	3	3	2	2	2	41.3	49	44.4	No	II
      S10	Validated coating process	5	5	4	4	4	4	87.5	61	76.9	Yes	IV
      S11	Corrugated shipping carton	1	1	2	2	1	2	10.0	55	28.0	No	I
      S12	Precision spring	4	4	4	3	3	5	71.2	82	75.5	No	IV

   2. Results

      The example produces five Tier IV scopes (S01, S03, S06, S10, and S12). Four of themS01, S03, S06, and S10are elevated by the non- compensatory gate. S03, the sterilization service, has a comparatively low performance penalty of 35, yet its C, P, and E ratings require the highest control tier. A performance-only system would rank S03 near the lower-risk group and could reduce oversight precisely where validation, change control, and continuity are most consequential.

      S12 reaches Tier IV without the gate because poor performance coincides with high intrinsic risk. S08 and S04 fall in Tier III, indicating a need for active improvement and more frequent review. S11, a shipping-carton supplier, has a midrange performance penalty but remains Tier I because intrinsic risk is low. This does not excuse nonconformity; it indicates that the intensity of system-level oversight can be proportionate to consequence while normal controls remain in place.

      The practical effect is a reallocation of supplier-quality effort. Resources move toward high-consequence processes and components even before a large defect signal appears. At the same time, low-risk suppliers with isolated performance concerns can be managed through targeted corrective action without automatically receiving the audit and governance burden intended for critical suppliers.

   3. Sensitivity and Robustness Checks

   Three checks are recommended before operational use. First, vary each weight by ±20% while renormalizing the remaining weights. A supplier whose tier changes repeatedly is threshold-sensitive and requires documented expert review. Second, conduct inter-rater agreement testing on a representative sample. Weighted kappa or an intraclass correlation coefficient can identify ambiguous rating anchors. Third, back-test the framework against at least twelve to twenty-four months of supplier escapes, major nonconformities, complaint linkages, change-notification failures, and disruptions. Predictive performance can then be assessed using tier-wise event rates, ordinal association, and receiver-operating-characteristic analysis where the event definition and sample size permit.

   The gate itself should be challenge-tested. Reviewers should ask whether any historical high-consequence supplier would have avoided Tier IV, whether low-risk suppliers are being elevated solely by noisy short-term data, and whether scope-level assessments are being incorrectly generalized to the supplier’s entire portfolio. Challenge results should lead to clarified anchors or thresholds rather than undocumented overrides.

5. IMPLEMENTATION MODEL

   1. Integration with the Supplier Life Cycle

      During supplier selection, a provisional RBI can be calculated before performance history exists. Qualification evidence then determines the initial PPI or a conservative default penalty. During approval, the tier determines audit depth, validation review, sample strategy, quality-agreement content, and required contingency planning. During routine monitoring, current performance data updates the PPI while product and process changes update the RBI. During escalation, the same factors support decisions to contain, develop, suspend, dual-source, or disqualify the supplier.

      The model should be linked tonot duplicated outsidethe approved supplier list, part or service master, risk-management file, nonconformance system, corrective-action system, change-control process, and audit program. Data ownership and system interfaces matter because a mathematically sound index will fail if part criticality, supplier scope, or change status becomes stale. This integration also supports the change-to-evidence traceability previously described for medical-device engineering changes [11].

   2. Control Effectiveness

      Tier assignment is not evidence that risk is controlled. Each prescribed control requires an effectiveness measure. Incoming verification can be assessed through escape performance and measurement-system adequacy. Supplier corrective actions can be assessed through recurrence and sustained capability. Change agreements can be assessed through notification timeliness and detection of unapproved changes. Audits can be assessed through closure quality and repeated findings. Contingency plans can be assessed through capacity trials, transfer readiness, and recovery-time exercises.

      Where a special process is involved, oversight should focus on validated parameters, equipment and software state, operator qualification, material controls, maintenance, environmental conditions, revalidation triggers, and sub-tier dependencies. Finished- product inspection alone may be insufficient when the process outcome cannot be completely verified without destructive or impractical testing.

   3. Escalation and De-escalation

   Escalation may occur immediately after a major escape, repeated nonconformity, ineffective corrective action, unapproved change, adverse audit result, or continuity event. De-escalation should require a predefined period of stable performance, completion and effectiveness verification of actions, and confirmation that intrinsic risk

   has genuinely changed. A supplier should not be de-escalated simply because recent shipmet volume is low or open records were administratively closed.

6. DISCUSSION

   1. Advantages

      The principal advantage of RASQCF is interpretability. Each tier can be traced to six risk ratings, five performance penalties, and an explicit gate. This makes the model easier to audit and challenge than an opaque algorithm. Separating RBI from PPI also clarifies two different management questions: how much harm or disruption could arise from failure, and how much current evidence suggests control weakness.

      A second advantage is resistance to false reassurance from low defect counts. Critical suppliers may ship modest volumes, and rare failure modes may not appear in a short scorecard window. The intrinsic-risk component preserves oversight even during periods of apparently good performance. A third advantage is operational linkage: the output is not only a rank but a minimum control package.

   2. Limitations

      The framework has not been empirically validated in this paper. The numerical example is synthetic and cannot establish predictive validity, causal impact, or generalizability. Weights and thresholds reflect a reasoned design proposal and require calibration. Rating scales can be affected by assessor judgment, inconsistent evidence, and organizational risk tolerance. Correlated factors may double-count related conditions; for example, poor change control can appear in both G and N. This is intentional only when intrinsic exposure and observed performance are separately documented.

      The model also does not replace part-specific risk analysis, process validation, statistical acceptance-sampling design, supplier agreements, or regulatory assessment. Cost is excluded from the index because it should not lower patient-safety oversight, although cost can be considered in sourcing decisions after minimum quality controls are established. Finally, a four-tier system simplifies continuous risk and should always permit documented escalation by qualified personnel.

   3. Future Research

   Future work should test the framework on longitudinal, multi-site data. A useful study would compare performance-only and risk- adjusted models in predicting severe incoming nonconformities, manufacturing escapes, complaint-linked supplier failures, unauthorized changes, and supply interruptions. Calibration could use logistic or ordinal regression while retaining non-compensatory safety gates. Further research should evaluate inter-rater reliability, control cost by tier, lead-time effects, and whether tier-specific interventions reduce recurrence. External validation across device classes and supplier technologies is necessary before broad claims are made.

7. CONCLUSION

Supplier quality in medical-device manufacturing cannot be managed reliably by performance averages alone. A scorecard may describe recent behavior while failing to represent the consequence of failure, the limitations of downstream verification, or dependence on a critical source. The proposed Risk-Adjusted Supplier Quality Control Framework separates intrinsic risk from observed performance, applies a safety and special-process gate, and connects the result to four defined control tiers. The synthetic application shows how the method elevates critical suppliers that a performance-only ranking could under- prioritize. The framework offers a transparent starting point for risk- proportionate supplier controls, but its weights, thresholds, and predictive value must be calibrated and validated using an organization’s actual data before use as a governed quality-system method.

ACKNOWLEDGMENT

The author acknowledges the broader quality-engineering and supply- chain literature that informed the framework. The illustrative data in this paper are synthetic and do not represent any employer, supplier, product, or confidential manufacturing record.

REFERENCES

1. U.S. Food and Drug Administration, Quality Management System Regulation (QMSR), updated Feb. 2, 2026. [Online]. Available: https://www.fda.gov/medical-devices/postmarket-requirements- devices/quality-management-system-regulation-qmsr

2. International Organization for Standardization, ISO 13485:2016, Medical devicesQuality management systemsRequirements for regulatory purposes, 3rd ed., Geneva, Switzerland, 2016; confirmed 2025.

3. G. W. Dickson, An analysis of vendor selection systems and decisions, Journal of Purchasing, vol. 2, no. 1, pp. 517, 1966, doi: 10.1111/j.1745- 493X.1966.tb00818.x.

4. P. Kraljic, Purchasing must become supply management, Harvard Business Review, vol. 61, no. 5, pp. 109117, 1983.

5. L. de Boer, E. Labro, and P. Morlacchi, A review of methods supporting supplier selection, European Journal of Purchasing & Supply Management, vol. 7, no. 2, pp. 7589, 2001, doi: 10.1016/S0969-7012(00)00028-9.

6. W. Ho, X. Xu, and P. K. Dey, Multi-criteria decision making approaches for supplier evaluation and selection: A literature review, European Journal of Operational Research, vol. 202, no. 1, pp. 1624, 2010, doi: 10.1016/j.ejor.2009.05.009.

7. International Organization for Standardization, ISO 14971:2019, Medical devicesApplication of risk management to medical devices, 3rd ed., Geneva, Switzerland, 2019; confirmed 2025.

8. T. L. Saaty, The Analytic Hierarchy Process. New York, NY, USA: McGraw-Hill, 1980.

9. C. A. Weber, J. R. Current, and W. C. Benton, Vendor selection criteria and methods, European Journal of Operational Research, vol. 50, no. 1, pp. 2 18, 1991, doi: 10.1016/0377-2217(91)90033-R.

10. International Organization for Standardization, ISO 9001:2015, Quality management systemsRequirements, Geneva, Switzerland, 2015.

11. T. S. Bendigeri, Risk-Based Engineering Change Control for Medical Device Manufacturing: A Framework and Representative Quantitative Case Study, International Journal of Engineering Research & Technology (IJERT), vol. 15, no. 7, Paper ID IJERTV15IS070115, July 2026, doi: 10.5281/zenodo.21305220.