InfoCard #: COMM-QA-002 JA1 Rev. 06 Effective Date: 19 Mar 2019

DUKE

DOCUMENT NUMBER: COMM-QA-002 JA1

DOCUMENT TITLE:Supplier Risk Assessment JA1

DOCUMENT NOTES:

Document Information

Revision: 06 Vault: COMM-QA-rel

Status: Release Document Type: COMM-QA

Date Information

Creation Date: 10 Oct 2018 Release Date: 19 Mar 2019

Effective Date: 19 Mar 2019 Expiration Date:

Control Information

Author: RB232

Previous Number: COMM-QA-002 JA1 Rev 5

Owner:

Change

BS76

Number: COMM-CCR-075

CONFIDENTIAL - Printed by: ACM93 on 19 Mar 2019 08:02:55 am

InfoCard #: COMM-QA-002 JA1 Rev. 06 Effective Date: 19 Mar 2019

COMM-QA-002 JA1SUPPLIER RISK ASSESSMENT

1 PURPOSE

1. 1 To provide guidance for assessing the level of risk/potential risk forsuppliers/vendors and for determining the type and frequency of supplier/vendorqualifications.

2 INTRODUCTION

2. 1 Suppliers should be selected according to their ability to reliably provide high-quality materials/products that meet manufacturer's defined requirements andexpectations. Supplier qualification is based on a Quality Management System(QMS) that ensures that any goods, materials, services or components comingfrom a supplier are produced and delivered under a set of controls that ensuretheir predetermined standards are met. The objective is to preempt qualityproblems, prevent defects and guarantee consistent quality through effectivemanagement and monitoring of suppliers.

2. 2 Critical materials that have the potential to affect quality should be qualifiedbefore use and should be obtained from suppliers who can meet definedrequirements. Once suppliers are qualified, periodic evaluation of supplierperformance helps to ensure the supplier's continued ability to meet requirements.

3 SCOPE AND RESPONSIBILITIES

3. 1 This JA applies to the Quality Systems Unit (QSU) when determining the typeand frequency ofsupplier/vendor qualifications.

3.2 The QSU in collaboration with the Program/Medical Director, is responsible fordetermining the type and frequency ofsupplier/vendor qualifications.

4 DEFINITIONS/ACRONYMS

4. 1 JA-Job Aide

4.2 QSU - Quality Systems Unit

5 MATERIALS

5. 1 N/A

6 EQUIPMENT

6. 1 N/A

7 SAFETY

7. 1 N/A

COMM-QA-002 JA1 Supplier Risk AssessmentQSU, ORAQ, DUDurham, NC Page 1 of 4

CONFIDENTIAL - Printed by: ACM93 on 19 Mar 2019 08:02:55 am

InfoCard #: COMM-QA-002 JA1 Rev. 06 Effective Date: 19 Mar 2019

8 PROCEDURE

8. 1 Every supplier will receive an initial Supplier Impact Assessment COMM-QA-002FRM2.

8.2 Based on the results of the initial Impact Assessment, perform a risk assessmentfor the material/service based on the following risk matrix and identify thematerial/service risk grade (Z, A, B, C or D).

8. 3 Assess the potential patient impact by considering the impact on patient safety, ifthe material/service failed.

8.4 When assessing the likelihood ofmaterial/service failure, consider the followingfactors:

8. 4. 1 The complexity of the material/service

8.4.2 The size and history of the supplier

8.4. 3 The relation of the material/service to the supplier's core business

8.4.4 The reputation of the supplier

8.4. 5 Relevant certifications (e.g. ISO)

8.4. 6 The overall historical integrity issues of the material/service

Likelihood ofMateriaI/Service

Failure ThatWould Not BeReadily Detected

HIGH/1\ \

LOW

5

4

3

2

1

A

A

z

z

z

1

B

B

A

A

z

2

c

c

B

A

z

3

LOW

D

c

c

B

A

4

D

D

c

B

A

5

-*' HIGH

Potential Patient Impact

COMM-QA-002 JA1 Supplier Risk AssessmentQSU, ORAQ, DUDurham, NC Page 2 of 4

CONFIDENTIAL - Printed by: ACM93 on 19 Mar 2019 08:02:55 am

InfoCard #: COMM-QA-002 JA1 Rev. 06 Effective Date: 19 Mar 2019

8. 5 Based on the risk grade, determine the appropriate degree of supplier follow-upqualification:

Risk Grade

z

A

B

c

D

Qualification Required

Supplier Impact Assessment

Supplier Questionnaire

Supplier Questionnaire

Supplier Questionnaire

Audit

Frequency

Initial impact assessment to bereviewed bienniallyInitial Questionnaire, then only ifsignificant change to material ormanufacturing process. Impactassessment to be reviewed

biennially.Biennial Questionnaire and impactassessment.

Annual Questionnaire and impactassessment.

Audit (desk or onsite) if deemedappropriate by the QSU and/orMedical/Program Director. AnnualQuestionnaire and impactassessment.

8. 6 If a Supplier Questionnaire is deemed necessary, this risk assessment should becompleted again in conjunction with review of the supplier's responses onCOMM-QA-002 FRM1. Document any changes in the risk grade as outlined onthe supplier questionnaire.

9 RELATED DOCUMENTS/FORMS

9. 1 COMM-QA-002 Supplier Qualifications

9.2 COMM-QA-002FRM1 Supplier Questionnaire

9. 3 COMM-QA-002 FRM2 Supplier Impact Assessment

9. 4 COMM-QA-002 FRM3 Qualifications Review Form

10 REFERENCES

10. 1 American Association of Blood Banks. Standards for Hematopoietic ProgenitorCell and Cellular Product. Current edition

10.2 Foundation for the Accreditation of Hematopoietic Cell Therapy (FACT) andNetcord. International Standards for Cord Blood Collection, Processing, Testing,Banking, Selection and Release Current edition

10. 3 U. S. Food and Drug Administration. Vaccines, Blood & Biologies. 7342. 001 -Inspection of Licensed and Unlicensed Blood Banks, Brokers, ReferenceLaboratories, and Contractors. Completion Date: September 30, 2009

10.4 21CFR Part 820. 50, Purchasing Controls

10. 5 21 CRF Parts 211. 22, 606, 1271. 210

COMM-QA-002 JA1 Supplier Risk AssessmentQSU, ORAQ, DUDurham, NC Page 3 of 4

CONFIDENTIAL - Printed by: ACM93 on 19 Mar 2019 08:02:55 am

InfoCard #: COMM-QA-002 JA1 Rev. 06 Effective Date: 19 Mar 2019

11 REVISION HISTORY

Revision No.

06Author

R. BryantDescription of Change(s)

. Clarified frequency of items needed forrequalification

. Added option for desk audit.

COMM-QA-002 JA1 Supplier Risk AssessmentQSU, ORAQ, DUDurham, NC Page 4 of 4

CONFIDENTIAL - Printed by: ACM93 on 19 Mar 2019 08:02:55 am

InfoCard #: COMM-QA-002 JA1 Rev. 06 Effective Date: 19 Mar 2019

Signature Manifest

Document Number: COMM-QA-002 JA1

Title: Supplier Risk Assessment JA1

Revision: 06

All dates and times are in Eastern Time.

COMM-QA-002 JA1 Supplier Risk Assessment

Author

Name/Signature

Richard Bryant (RB232)

Medical Director

I Title 1 Date ___ ___lj^eanLn?l'?eason_14 Mar 2019, 09:43:29 AM Approved

Name/Signature

Joanne Kurtzberg(KURTZ001)

Quality

i Title Date Meaning/Reason

14 Mar 2019, 09:55:31 AM Approved

I Name/SignatureLisa Eddinger (LE42)

Document Release

! Title I D?t^.. __ ...... - .... J l!l/leani!1?/?eason14 Mar 2019, 11:34:04 AM Approved

|,j^, !Z12^!S!]^!l!I^.-,^^^, »^,,.

J -Zitle-Sandy Mulligan (MULL1026)

J Date j Meaning/Reason18 Mar 2019, 05:48:35 PM Approved

CONFIDENTIAL - Printed by: ACM93 on 19 Mar 201 9 08:02:55 am