You checked your suppliers once. Can you prove they still pass?

Clause 7.4.1 is short. What it asks for is not.

You must set documented criteria for evaluating and selecting suppliers. Those criteria rest on three things:

• the supplier's ability to provide product that meets your requirements;
• the supplier's performance;
• the effect the purchased product has on the quality of your medical device.

The criteria must be proportionate to the risk of the device. A cold-chain courier for an in vitro diagnostic reagent deserves more scrutiny than the company that supplies your printer paper.

The clause then asks for three more things. You decide in advance how you will monitor and re-evaluate suppliers. You monitor their performance, and the results feed the re-evaluation. When a supplier fails to meet your purchasing requirements, you act, again in proportion to the risk.

Finally, you keep records. Records of evaluation, selection, monitoring, re-evaluation, and any action that came out of them.

Two neighbours matter. Clause 7.4.2 covers what you tell the supplier when you buy. Clause 7.4.3 covers how you verify what arrives. And clause 4.1.5 says outsourced processes stay your responsibility, controlled through a written quality agreement.

For a distributor or importer, "supplier" is wider than it first looks. It is the manufacturer whose devices you bring in. It is also the freight forwarder, the courier, the third-party warehouse and the calibration service for your temperature loggers. Anyone whose work can affect the device is in scope.

If you distribute devices, you did not make them. Your suppliers did. So the question your file has to answer is simple: how do you know the product you sell is what it claims to be?

The answer lives in your supplier file. It shows who you buy from, why you chose them, and how you keep checking. It is also where gaps hide easily. Evaluations get done once, at onboarding, and never again. The approved-supplier list drifts away from the people you actually buy from.

The live Heatmap finding for this area says it plainly: "Supplier re-evaluation records incomplete." Starting a supplier file is the easy part. Keeping it alive is where it breaks.

1. Do you evaluate and approve suppliers before use against defined criteria?

What "we do this" sounds like: "We only use reputable manufacturers. We know them well."

What you could put on the table: a written set of criteria, graded by risk. A completed evaluation for each supplier, dated before the first purchase order. A signature from the person who signed them off.

The date matters. An evaluation signed three months after the first order is a record of catching up, not of control.

2. Do you maintain an approved-supplier list with the records of those evaluations?

What "we do this" sounds like: "Finance has a vendor list in the accounting system."

What you could put on the table: one controlled list that names each supplier, what they supply, their risk level, their approval status, and the date of their next review. Each line links to the evidence behind it: the evaluation, the supplier's quality certificate, the quality agreement.

A vendor list tells you who gets paid. An approved-supplier list tells you who is allowed to supply. They are not the same document.

3. Do you monitor and re-evaluate suppliers on a schedule, acting when performance slips?

What "we do this" sounds like: "If there is a problem, we would know."

What you could put on the table: a re-evaluation date for every supplier, set by risk. Monitoring data that feeds it: rejected deliveries at receiving inspection, late shipments, complaints traced back to the supplier, expired certificates. And when a supplier slipped, a record of what you did about it, whether that was a corrective action request, closer inspection or removal from the list.

"We would know" is an intention. A dated re-evaluation is evidence.

• A Supplier Evaluation SOP that defines your criteria and risk grades
• An approved-supplier list, controlled, with status and next review date
• A completed evaluation for each supplier, dated before first use
• Current quality certificates for critical suppliers, with expiry dates tracked
• Signed quality agreements for outsourced processes and critical suppliers
• Monitoring data per supplier: receiving inspection results, delivery performance, related complaints
• Re-evaluation records for each supplier that has passed its review date
• Records of action taken when a supplier did not meet requirements
• Evidence that purchase orders only go to suppliers on the list

These are patterns I see, not statistics.

The onboarding-only file. The evaluation was thorough, five years ago. Nothing has been added since. The certificate in the file expired two years back.

The missing middle suppliers. The manufacturer is on the list. The courier, the warehouse and the calibration lab are not. Each of them touches the device.

Two lists that disagree. Quality has one list. Procurement has another. Nobody checks one against the other until someone else does.

Monitoring with no memory. Rejected stock gets sent back, and the supplier is told. But nothing links that rejection to the supplier's re-evaluation. The pattern never shows up.

Approval without criteria. The list says "approved", but there is no written rule for what approval means. Two people would approve two different suppliers.

SAHPRA is phasing in mandatory ISO 13485:2016 certification, per its MD01 notice dated 18 September 2025. Phase 2 covered renewals from 1 June 2025, for manufacturers and for distributors and importers. Phase 3, from 1 April 2026, applies to companies already holding a certificate: holders "will be requested to submit". SAHPRA describes the requirement as mandatory. Amendments follow on 1 June 2027, and all new applications on 1 April 2028.

If you import electromedical products, you also make an annual submission of compliance information, the ASOCI, to SAHPRA's Radiation Control unit. It is separate from supplier control, but it is one more annual date to keep in the calendar.

Whatever the phase, an inspector's job is to see evidence, not intentions. Your supplier file is either current or it is not.

Set aside 60 minutes. You need your supplier list and last quarter's purchase orders.

1. 10 minutes. Pull every supplier you paid in the last 90 days. Include couriers, warehousing and calibration.
2. 15 minutes. Compare that list with your approved-supplier list. Mark anyone you paid who is not on it.
3. 15 minutes. For each supplier on the list, write down the date of their last evaluation and the expiry date of their certificate.
4. 10 minutes. Give each supplier a risk grade: high, medium or low. Base it on how much their product or service can affect the device.
5. 10 minutes. Set a re-evaluation date for the three highest-risk suppliers whose review is overdue. Put the dates in a calendar with a named owner.

You will not fix the whole file in an hour. You will know exactly where it stands, and the riskiest gaps will have a date against them.