Purchasing and Supplier Control Procedure Template & Guide — ISO 13485:2016

$149

A complete, fill-in-the-blanks purchasing and supplier control procedure for ISO 13485:2016 Clause 7.4, written as a worked example rather than a hollow outline. Control follows the effect of the purchased product on the finished device, not its cost, and the procedure carries the obligations that come from regulation rather than from the standard — including a written change-notification agreement with the change categories enumerated and a recorded impact determination for every notification received. Since the FDA Quality Management System Regulation took effect on 2 February 2026, incorporating ISO 13485:2016 into 21 CFR Part 820, these supplier records are inspectable. Includes an evaluation record built to act as the approval gate, a provider register, a Device Variant Decision record, a process interaction map, a desk-level work instruction and the maturity ladder the free assessment scores against.

Quantity

Purchasing & Supplier Control · ISO 13485:2016

ISO 13485 Purchasing and Supplier Control Procedure Template & Guide

A completed, worked procedure for ISO 13485:2016 Clause 7.4

Device supplier control is separated from ordinary purchasing by two things: control follows the effect on the medical device, and a set of obligations arises from regulation rather than from the standard. This template is a completed, worked example that carries both.

The obligations that come from regulation, not the clause

Since 2 February 2026 the FDA Quality Management System Regulation incorporates ISO 13485:2016 into 21 CFR Part 820, which makes supplier records inspectable. The strongest single addition to a device purchasing procedure is a written change-notification agreement with the change categories enumerated — material, formulation, method, site, subcontractor — and a recorded impact determination for every notification received. This template includes it.

Control follows the effect on the device

Rating is proportionate to the effect of the purchased product on the finished device, not to its price — the requirement at ISO 13485:2016 Clause 7.4, whose numbering does not align with ISO 9001 because 13485 predates the harmonized structure.

What is in it

A complete, worked ISO 13485:2016 purchasing and supplier control procedure at Clause 7.4
A change-notification agreement and recorded impact determination for the regulatory obligations
An evaluation record built to act as the approval gate, and a provider register
Appendix D — a Device Variant Decision record
A process interaction map and a desk-level work instruction
The maturity ladder the free assessment scores against, with Level 2 marked as a legitimate place to stop

Who it is for

Medical device organizations certified to — or preparing for — ISO 13485:2016, and those managing the QMSR transition in the United States.

A complete, worked purchasing and supplier control procedure — in editable Word, ready to adopt into your own document control.

View the template & current pricing →

On the product page, select the ISO 13485:2016 variant.

Score first. Fix second.

Not sure where your purchasing process stands?

Take the free Purchasing and Supplier Control Maturity Check — about six minutes, five standard paths — and get your band and a priority order before you buy anything.

Take the Maturity Check →

Recommended MSI courses

QMS Interviews — prepare your team to evidence conformity in the audit interview

Other ways to buy

Prefer the complete documentation package?

Each package collects every MSI procedure template and guide for its standard set in one purchase, at a package price:

A combined ISO 9001 + ISO 13485 (Device) procedure variant is on the roadmap; the Device documentation package above is available now.

Browse the full set: all MSI template packages.

Prefer to be invoiced? If your organization purchases by purchase order or invoice rather than card, contact MSI at 760-434-9141 or through msi-international.com and we will raise an invoice for you.

About MSI

Diana Lynn is President and Principal ISO Consultant at Management Systems International (MSI), a consulting firm she co-founded in 1998. With 28 years of experience, MSI has supported 80+ certifications, attended 200+ audits, and trained 600+ professionals across manufacturing, technology, medical device, government, healthcare, and other regulated industries. MSI is veteran-owned and female-owned.

To talk through your own purchasing and supplier controls, call 760-434-9141 or visit msi-international.com.

This template is general guidance and does not replace ISO 13485:2016, any applicable regulation, or the judgement of a competent professional. Standards are revised, amended and withdrawn; confirm the current status of your standard at iso.org before relying on clause references.