Purchasing and Supplier Control Procedure Template & Guide — Combined ISO 9001 & ISO 13485 (Device)

$249

One combined, fill-in-the-blanks purchasing and supplier control procedure covering ISO 9001:2015 and ISO 13485:2016 in a single document — written as a completed worked example, not a hollow outline. Rates providers on the effect of what they supply, not spend; records the provider and output controls as a pair; and carries the device-market obligations that a general quality procedure misses — control proportionate to the effect on the medical device, a change-notification agreement, and the regulatory records made inspectable by the FDA Quality Management System Regulation and 21 CFR Part 820. Includes an Integration Record documenting where the two standards diverge, a Determination Worksheet, a process interaction map, an evaluation record built to act as the approval gate, a provider register, a desk-level work instruction and the maturity ladder the free assessment scores against.

Quantity

Purchasing & Supplier Control · Combined (Device)

Combined Purchasing and Supplier Control Procedure Template & Guide

One procedure for ISO 9001:2015 and ISO 13485:2016

A device purchasing and supplier control procedure has to do two things a commercial one does not: control follows the effect of the purchased product on the medical device, and a set of obligations arises from regulation rather than from the standard. This template is a completed, worked example that carries both, integrated with ISO 9001 in a single document.

The requirement almost nobody implements

ISO 13485:2016 Clause 7.4.2 requires a written agreement that the supplier notify you before implementing a change to the purchased product — and it has no ISO 9001 equivalent. A clause reading ‘the supplier shall notify us of changes’ is not sufficient, because it leaves the supplier to decide what counts as a change. This template enumerates the categories — material, process, site, sterilization, sub-tier supplier, certification status — because an undetected supplier change defeats every other control at once: the supplier is still approved, the certificate still valid, receiving inspection still passes, and the product is nonetheless different.

Rate on device effect, not spend

ISO 13485 Clause 7.4.1 rates suppliers on the effect of the purchased product on the medical device and on proportionality to device risk — never on cost. That is the determination that catches the cheap, device-critical component a spend-rated process controls as though it were office stock.

Device purchasing is a regulatory instrument

Since the FDA Quality Management System Regulation took effect on 2 February 2026, incorporating ISO 13485:2016 into 21 CFR Part 820, supplier records are inspectable. The most common device supplier-control findings are not exotic — a missing change-notification agreement, a supplier rated on spend, an outsourced sterilization process with no quality agreement. This template is built to make the routine purchases faster and the device-critical ones defensible.

What is in it

A complete, worked purchasing and supplier control procedure combining ISO 9001:2015 and ISO 13485:2016
Inline [Q]/[D] scope markers so an auditor for either system finds their clause fast
The device-effect and risk determination that rates suppliers on what they do to the device, not what they cost
The supplier change-notification agreement, with the change categories enumerated — the ISO 13485 7.4.2 requirement most device organizations are missing
The awareness-of-changes determination, and quality agreements for outsourced special processes such as sterilization
Appendix D — the Integration Record, documenting where ISO 9001 and ISO 13485 diverge and what was decided
Appendix E — a one-page Determination Worksheet, plus a process interaction map, an evaluation record built to act as the approval gate, a provider register and a desk-level work instruction
The maturity ladder the free assessment scores against, with Level 2 marked as a legitimate place to stop

Who it is for

Medical device organizations certified to — or preparing for — both ISO 9001:2015 and ISO 13485:2016, who want one purchasing procedure that satisfies both and carries the device and regulatory obligations a general quality procedure misses. If you hold ISO 13485 only, the standalone ISO 13485 variant is the better fit.

One combined procedure, written as a completed worked example — in editable Word, ready to adopt into your own document control.

View the template & current pricing →

Score first. Fix second.

Not sure where your supplier controls stand?

Take the free Purchasing and Supplier Control Maturity Check — about six minutes, five standard paths — and get your band and a priority order before you buy anything.

Take the Maturity Check →

Recommended MSI courses

QMS Interviews — prepare your team to evidence ISO 9001 and ISO 13485 conformity in the audit interview

Other ways to buy

Prefer the complete documentation package?

Each package collects every MSI procedure template and guide for its standard set in one purchase, at a package price:

Need the single-standard procedure instead? The ISO 9001 and ISO 13485 single-standard variants are available separately. Browse the full set: all MSI template packages.

Prefer to be invoiced? If your organization purchases by purchase order or invoice rather than card, contact MSI at 760-434-9141 or through msi-international.com and we will raise an invoice for you.

About MSI

Diana Lynn is President and Principal ISO Consultant at Management Systems International (MSI), a consulting firm she co-founded in 1998. With 28 years of experience, MSI has supported 80+ certifications, attended 200+ audits, and trained 600+ professionals across manufacturing, technology, medical device, government, healthcare, and other regulated industries. MSI is veteran-owned and female-owned.

To talk through your own supplier controls, call 760-434-9141 or visit msi-international.com.

This template is general guidance and does not replace ISO 9001:2015, ISO 13485:2016, any applicable regulation, or the judgement of a competent professional. Standards are revised, amended and withdrawn; confirm the current status of your standard at iso.org before relying on clause references.