The first thing to consider is ISO 13485, which states, “The type and extent of control applied to the supplier and the purchased product shall be dependent upon the effect of the purchased product on subsequent product realization or the final product.” It is therefore essential to consider, evaluate, and document the potential risk and then determine how to manage this. Risk control measures may include selecting suppliers that use validated methods under GMP. However, when this is not possible, other methods of control may need to be considered. For example, can the product be tested on receipt, and can large batches be purchased and qualified for use in the IVD application? This assumes that processes can be subsequently verified on the principle that processes that cannot be verified by subsequent monitoring or measurement should be validated. When the incoming material or product cannot be verified, and there are no validated methods, for example if the product being purchased is sterile, then an alternative supplier may need to be found.
The GHTF Document Guidance on the Control of Products and Services Obtained from Suppliers is a useful source of guidance: http://www.ghtf.org/documents/sg3/sg3final-N17.pdf