Mark,
I agree with your list for assessing a longterm suuply of ECG leads or pulse-oximeter probes from a third source but for a resistor from RS?
If we use a replacement component I add another section to a list I keep saying why it was purchased instead of the manufacturers part and giving details of each part. In this way I am not neglagent but can show I have assessed the situation. I also have blanket acceptance such as "identical" semi-conductors or discrete components from an approved (ISO9000 hence tracable) supplier. But then comes the definition of "identical".....
Sometimes it does seem easier to pay the price of a PCB than go through hoops to order a component.
Robert