Outsourced Sterilization and the Risk-Based Process Approach
A contract manufacturer of Class III orthopedic implants outsources ethylene oxide sterilization to a single supplier. The QMS scope includes sterilization as an outsourced process. During a surveillance audit, the lead auditor finds the approved supplier file contains only the supplier's ISO 13485 certificate and a 2023 sterilization validation report. The EO load configuration changed six months ago from 12 to 18 pallets after a production increase. The supplier's change notification was filed without assessment. Finished device release relies on the supplier's certificate of sterilization, and no independent review of sterility assurance or residuals data occurs. Top management states sterilization is controlled by the supplier's certified QMS. The auditor has two days remaining and a planned sample of five batch records. The sterilization process is identified as high risk in the risk file.
1. Which fundamental MDQMS principles are engaged here, and why is this not merely a supplier control issue?
Read the worked answer
The central principles are the process approach, risk-based control, and the organization's responsibility for outsourced processes. ISO 13485 does not allow a manufacturer to transfer responsibility for product conformity by purchasing a certified service. Sterilization is a special process whose output cannot be fully verified by subsequent inspection, so validation and change control are integral to the manufacturer's own QMS. The risk file identifies sterilization as high risk; that should drive more intensive oversight, not reliance on a certificate. Relevant clause intent includes 4.1.2 (risk-based approach to process control), 4.1.5 (control of outsourced processes), 7.4 (purchasing and supplier evaluation), 7.5.5 (sterile medical devices), and 7.5.6 (validation of processes). The supplier's ISO 13485 certificate proves that the supplier has a QMS; it does not prove that the changed 18-pallet load was validated or that residuals remain acceptable. The issue is systemic because release depends on an unassessed change.
2. What audit evidence should the auditor obtain, and what nonconformity would be most defensible?
Read the worked answer
Obtain the supplier qualification and re-evaluation records, the sterilization validation protocol and report, the change notification, any load-configuration assessment, batch records for loads before and after the change, release records, and residuals/sterility data. Interview the sterilization process owner and release authority separately to establish who reviewed the change and on what basis. Compare the validation report's validated load pattern with the actual 18-pallet configuration. Confirm whether the supplier's certificate states the load configuration. A defensible nonconformity is against 7.5.6 and 4.1.5: the organization has not validated the changed sterilization process and has not ensured control of the outsourced process. If release decisions were made without reviewing validation status, 7.5.1 and 8.2.6 may also apply. Avoid writing only 'supplier certificate insufficient'; state the failed control and the product risk.
3. Given only two days and five planned batch records, how should the auditor proceed?
Read the worked answer
Adjust the sampling toward the highest-risk evidence rather than completing the original random sample. Spend the remaining time on the sterilization change trail, release decisions for the three most recent loads after the change, and interviews with the process owner and release authority. Use the five batch records to test whether validation status and residuals review are documented before release. If the trail cannot be completed in two days, escalate to the audit program manager and propose an extension, a focused follow-up audit, or a documented limitation. Do not close the issue as 'supplier responsibility.' Record the audit trail, preserve copies of relevant records, and frame any nonconformity in terms of the organization's control of a high-risk outsourced process.