# ISO 13485 Approved Supplier List Risk Ranking and Audit Plan Worksheet > Source: https://netray.co/tools/iso-13485-approved-supplier-list-risk-ranking-worksheet > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Scores suppliers with a risk priority number, sets audit intervals, and totals audits per year and audit cost so your supplier control is proportional to risk. ## Category supply-chain ## Industry Medical Devices ## Audience - Supplier quality engineer - Purchasing manager - Quality manager - Regulatory affairs ## Tool **Kind:** worksheet **Mode:** editable **Currency:** $ **Columns:** #### Supplier **Key:** supplier **Type:** text #### Product or service supplied **Key:** item **Type:** text #### Category **Key:** category **Type:** select **Options:** - Critical component - Raw material - Sterilization service - Calibration service - Testing lab - Packaging - Distributor - Indirect #### Severity if it fails (1-5) **Key:** sev **Type:** number **Format:** integer **Help:** Impact on device safety or performance. #### Occurrence (1-5) **Key:** occ **Type:** number **Format:** integer **Help:** Likelihood of nonconformance based on history. #### Detectability (1-5) **Key:** det **Type:** number **Format:** integer **Help:** 5 means incoming inspection is unlikely to catch the problem. #### Risk priority number **Key:** rpn **Type:** number **Expr:** sev * occ * det **Format:** integer #### Audit interval (months) **Key:** interval **Type:** number **Format:** integer **Help:** Typical values are 12, 24 or 36. #### Audits per year **Key:** per_year **Type:** number **Expr:** if(gt(interval, 0), 12 / interval, 0) **Format:** decimal #### Cost per audit **Key:** cost **Type:** number **Format:** currency **Help:** Travel plus auditor time. #### Annual audit cost **Key:** annual **Type:** number **Expr:** per_year * cost **Format:** currency **Rows:** **Supplier:** Supplier A **Item:** Extruded catheter tubing **Category:** Critical component **Sev:** 5 **Occ:** 2 **Det:** 4 **Interval:** 12 **Cost:** 2400 **Supplier:** Supplier B **Item:** Ethylene oxide sterilization **Category:** Sterilization service **Sev:** 5 **Occ:** 2 **Det:** 5 **Interval:** 12 **Cost:** 3200 **Supplier:** Supplier C **Item:** Polycarbonate resin **Category:** Raw material **Sev:** 4 **Occ:** 2 **Det:** 3 **Interval:** 24 **Cost:** 1800 **Supplier:** Supplier D **Item:** Pouch and Tyvek lid **Category:** Packaging **Sev:** 4 **Occ:** 3 **Det:** 3 **Interval:** 24 **Cost:** 1800 **Supplier:** Supplier E **Item:** ISO 17025 calibration lab **Category:** Calibration service **Sev:** 3 **Occ:** 1 **Det:** 3 **Interval:** 36 **Cost:** 1200 **Supplier:** Supplier F **Item:** Corrugated shippers **Category:** Indirect **Sev:** 1 **Occ:** 2 **Det:** 1 **Interval:** 0 **Cost:** 0 **Totals:** #### Highest risk priority number **Key:** rpn **Agg:** max **Format:** integer #### Audits per year **Key:** per_year **Agg:** sum **Format:** decimal #### Annual audit budget **Key:** annual **Agg:** sum **Format:** currency #### Suppliers on list **Key:** supplier **Agg:** count **Format:** integer **Summary:** #### Average risk priority number **Key:** avg_risk **Expr:** avg_rpn **Format:** decimal #### Audit cost per listed supplier **Key:** cost_per_supplier **Expr:** if(gt(count, 0), sum_annual / count, 0) **Format:** currency **Notes:** Scores and example suppliers are illustrative. ISO 13485 clause 7.4.1 requires supplier evaluation criteria proportionate to the risk of the product and its effect on the device, so define the 1 to 5 scales in your own procedure. A supplier with an interval of 0 is not audited and is controlled by other means, such as questionnaires or incoming inspection. ## Content **Intro:** Auditors do not expect every supplier to be treated the same. They expect your controls to be proportional to risk and documented. This worksheet ranks suppliers with a simple risk priority number, assigns audit intervals, and tells you what the resulting audit schedule costs. **Sections:** #### How to use it **Body:** List each supplier on your approved supplier list with what they provide and a category. Score severity (effect on device safety or performance if the item fails), occurrence (history of nonconformance, complexity, change frequency) and detectability (how likely you are to catch a problem at incoming inspection). The sheet multiplies them into a risk priority number. Set an audit interval for each supplier, enter an expected cost per audit, and the sheet gives audits per year and annual cost. **Bullets:** - Document the meaning of scores 1 to 5 in your supplier control procedure - Rescore suppliers after any nonconformance, change notice or audit finding - Use detectability honestly: sealed or validated processes score high - Record the rationale for any interval that does not follow the ranking #### Method and regulatory basis **Body:** ISO 13485:2016 clause 7.4.1 requires criteria for evaluation and selection of suppliers that are proportionate to the risk of the medical device and the supplier's ability to provide conforming product. Clause 4.1.5 requires control of outsourced processes, and clause 7.4.3 requires verification of purchased product. The severity, occurrence and detectability scoring borrows the FMEA risk priority approach familiar from ISO 14971 practice and quality tools. It is a prioritization aid, not a statistical measure, so keep the scales short and well defined. #### Reading the results **Body:** Sort the list by risk priority number and compare it to the assigned intervals. High-ranking suppliers with long intervals, or low-ranking suppliers audited annually, are the first things a reviewer will question. The annual cost total helps you plan travel and auditor capacity, and shows when a remote audit or a third-party certificate such as an ISO 13485 or ISO 17025 accreditation can supplement an on-site audit for lower-risk suppliers. Review the table at least annually and at management review. #### Common mistakes **Body:** Scoring everything as critical makes the ranking useless, and scoring based on spend rather than effect on the device misses small but important suppliers like a calibration lab or a sterilizer. Another mistake is to treat a supplier's certificate as a replacement for your own evaluation. A certificate is evidence, not a substitute for judgment. Finally, remember that suppliers on the list also need agreements that require notice of changes, which is part of risk control. **Cta:** If your supplier performance, audit and quality data sits across ERP, email and spreadsheets, we can consolidate it so risk scores are driven by actual receiving and NCR history. **Faq:** #### How often should I audit ISO 13485 suppliers? **Answer:** ISO 13485 does not set a fixed interval. It requires a risk-proportionate approach. Many companies audit critical suppliers annually or every two years and use questionnaires, certificates and performance data for lower-risk suppliers. Document your rationale. #### Is a risk priority number required? **Answer:** No. It is one common way to rank suppliers. Any documented, risk-based method is acceptable, including a simple critical, major and minor classification, provided it is applied consistently and reviewed. #### Do distributors and calibration labs go on the list? **Answer:** Yes, if they affect product quality or the quality system. Calibration labs, sterilizers, test labs and packaging suppliers are often more significant than a component supplier, so include them and score them on the effect of failure. #### Can a supplier certificate replace an audit? **Answer:** It can reduce the audit scope or frequency for lower-risk suppliers if you review the certificate scope and keep evidence. For critical suppliers, most manufacturers still audit directly or through a qualified third party. ## Search terms approved supplier list template, ISO 13485 supplier risk assessment, supplier risk ranking worksheet, ASL template excel medical device, supplier audit schedule template, purchasing controls 7.4.1, supplier criticality classification, risk based supplier evaluation --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json