KGMP Supplier Controls: What MFDS Inspectors Actually Check
Supplier quality management is a top-3 KGMP inspection finding area for foreign manufacturers. Here's what MFDS inspectors evaluate and what they expect to see.
What KGMP Requires Beyond ISO 13485
KGMP supplier controls require everything in ISO 13485:2016 Section 7.4 plus:
- Korean-language documentation of critical supplier audits
- Supplier risk classification documented in Korean for critical suppliers
- Supplier changes affecting Korean-marketed devices reported to MFDS via KLH
- Korean quality agreements with critical suppliers (when Korean suppliers used)
- Supplier monitoring records traceable to specific KMD-numbered products
The 6 Areas MFDS Inspectors Evaluate
Area 1: Supplier Risk Classification
Inspectors expect a documented supplier risk classification system:
| Risk Tier | Definition | Examples |
|---|---|---|
| Critical | Affects device safety or efficacy | Material suppliers, contract manufacturers, sterilization providers |
| Significant | Affects regulatory compliance | Calibration services, validation services, software providers |
| Standard | Routine operational suppliers | Packaging materials (non-sterile), office supplies |
What inspectors look for:
- Documented risk criteria
- Each supplier classified per criteria
- Critical suppliers subject to enhanced controls
- Classification reviewed annually
Area 2: Supplier Qualification
Initial supplier qualification process:
For critical suppliers, inspectors expect:
- On-site audit by qualified auditor (within last 3 years)
- Quality agreement (or terms in purchase agreement)
- ISO 13485 / 9001 certificate or alternative qualification evidence
- Performance specifications (acceptance criteria documented)
For Korean-affected products, additional expectations:
- Audit findings translatable to Korean if requested
- Supplier accountability extends to Korean MFDS obligations
Area 3: Quality Agreements
Quality agreements should specify:
- Notification of supplier changes affecting product
- Notification of supplier nonconformances
- Right of audit by manufacturer (and MFDS, indirectly)
- Record retention (typically 5+ years for Korea)
- Termination conditions
Common gap: Standard purchase agreements without quality agreement language. Inspectors flag as inadequate.
Area 4: Receiving Inspection
Receiving inspection records should demonstrate:
- Inspection per acceptance criteria
- Lot/batch traceability to manufacturing
- Nonconformance handling
- Korean traceability for Korean-marketed product lots
Common gap: Receiving records electronic and not linked to Korean product lots.
Area 5: Ongoing Monitoring
Supplier performance monitoring:
- Nonconformance rate tracking
- On-time delivery monitoring
- Periodic re-evaluation (typically annual)
- Score-based supplier rating system
Common gap: Monitoring data collected but not reviewed during management review.
Area 6: Supplier Change Management
When suppliers change:
| Change Type | KGMP Action |
|---|---|
| New supplier for non-critical component | Internal qualification, no MFDS filing |
| New supplier for critical component | Internal qualification + change notification to MFDS if affects approved device |
| Supplier process change (critical) | Risk assessment + potential MFDS change notification |
| Supplier discontinuation | Risk assessment + sourcing replacement |
Common gap: Manufacturer changes critical supplier without notifying KLH, leading to MFDS inspection finding.
What Inspector Typically Requests
During the supplier controls portion of inspection (typically 2–3 hours):
- Approved supplier list
- Risk classification documentation
- Three critical supplier files (selected by inspector)
- Quality agreements for selected suppliers
- Audit reports for selected suppliers (last 3 years)
- Receiving inspection records for last Korean-shipped product lots
- Supplier nonconformance trend data
- Recent supplier change records
- Management review minutes covering supplier performance
Critical Supplier File Contents
Each critical supplier file should contain:
| Section | Documents |
|---|---|
| Qualification | Initial audit report, certificates, qualification approval |
| Agreement | Signed quality agreement |
| Monitoring | Annual evaluation reports, performance metrics |
| Changes | Supplier change notifications received and assessed |
| Audits | Periodic audit reports (typically every 3 years) |
| Records | Recent receiving inspection records traceable to Korean product lots |
Common Findings Patterns
Finding Pattern 1: "Supplier File Incomplete"
Most common finding. Critical supplier file missing one or more required documents.
Severity: Major if quality agreement missing, minor if recent monitoring missing.
Fix: Quarterly supplier file completeness check.
Finding Pattern 2: "Risk Classification Outdated"
Supplier list shows tier classifications but documentation does not support tier assignment.
Severity: Minor.
Fix: Annual risk re-classification with documented rationale.
Finding Pattern 3: "Korean Traceability Gap"
Receiving records cannot trace specific Korean-shipped lots to supplier batches.
Severity: Major (affects post-market obligations).
Fix: Receiving records reference both supplier lot AND Korean-destined manufacturing lot.
Finding Pattern 4: "Supplier Change Not Reported"
Critical supplier changed without MFDS change notification through KLH.
Severity: Major.
Fix: Change control workflow includes supplier change assessment with Korean impact analysis.
Quick Self-Assessment
Before KGMP inspection, check:
- Approved supplier list current (updated within 6 months)
- All critical suppliers risk-classified with documentation
- All critical suppliers have signed quality agreements
- All critical suppliers audited within last 3 years
- Receiving records traceable to Korean product lots
- Recent supplier changes documented with Korean impact assessment
- Supplier performance reviewed in management review (last 12 months)
- Korean-language summaries available for critical supplier documentation
If any item is "no," remediate before inspection.
Frequently Asked Questions
Q: Do we need to audit suppliers in Korean?
A: No, audits can be conducted in English. However, audit findings and quality agreements affecting Korean-marketed products should be translatable to Korean if requested by MFDS.
Q: How often should we audit critical suppliers?
A: Every 3 years for routine critical suppliers. Annually for high-risk suppliers (e.g., contract sterilization). After significant changes or quality events, regardless of schedule.
Q: What if our critical supplier won't sign a quality agreement?
A: Document the issue in supplier file, attempt to negotiate, and consider risk-based alternatives. MFDS inspectors expect to see effort, not necessarily success. Long-term: identify alternative supplier.
Q: How does Leanabl help with supplier controls?
A: Leanabl's Korea QMS Foundation service includes supplier control framework implementation with Korean-specific extensions.
Q: Does our distributor count as a supplier?
A: Yes. Distributors providing logistics or marketing services are suppliers under your QMS. Their quality agreement should address Korean post-market obligations interface.
How Leanabl Helps
- Korea QMS Foundation — supplier control framework
- KGMP Gap Analysis — supplier control gap identification
- KGMP Certification — end-to-end KGMP program
Contact Leanabl for supplier control scoping.
Last updated: 2026-05-15.
Have a regulatory question?
Talk to a Korea regulatory specialist about your device, your timeline, or your next submission.
Talk to a specialist
