Conducting a comprehensive supplier audit is essential when sourcing medical controller components. The following checklist, aligned with ISO 13485 Clause 7.4 (Supplier Evaluation) and FDA QMSR requirements, provides a structured framework for evaluating potential suppliers on Alibaba.com or through direct engagement [2][5][8].
Phase 1: Pre-Audit Documentation Review
Before scheduling an on-site or virtual audit, request and review:
□ Quality Management System Certificate (ISO 13485:2016, verify scope and validity)
□ FDA Registration (if supplying to U.S. market, verify establishment registration)
□ Notified Body Certificate (for CE-marked devices, verify NB number and scope)
□ Quality Manual (overview of QMS structure and processes)
□ Organizational Chart (identify key personnel and responsibilities)
□ List of Certified Products (verify controller components are within certified scope)
□ Customer References (contact at least 2-3 current medical device customers)
□ Previous Audit Reports (request summary of recent customer or regulatory audits)
Phase 2: On-Site Audit Areas
2.1 Management Responsibility
□ Quality policy is documented, communicated, and understood
□ Management review meetings are conducted regularly (minimum annually)
□ Resources (personnel, equipment, facilities) are adequate for production volume
□ Organizational structure clearly defines quality responsibilities
2.2 Design Controls (if supplier performs design)
□ Design and development procedures are documented
□ Design inputs are traceable to user needs and regulatory requirements
□ Design verification and validation records are complete
□ Design changes are controlled with documented approval
□ Design History File (DHF) is maintained and organized
2.3 Document Control
□ Document control procedure ensures current versions are available
□ Obsolete documents are removed from use or clearly identified
□ Electronic document management system (if used) is validated
□ Records retention policy complies with regulatory requirements (minimum 2 years after device discontinuation)
2.4 Purchasing & Supplier Management
□ Supplier evaluation procedure is documented and implemented
□ Critical suppliers are identified and controlled
□ Incoming inspection criteria are defined for all materials
□ Supplier performance is monitored (quality, delivery, responsiveness)
□ Quality agreements are in place with critical suppliers
2.5 Production & Process Control
□ Work instructions are available at each production station
□ Process validation is performed for special processes (soldering, bonding, cleaning)
□ Equipment is calibrated and maintained per schedule
□ Production environment is controlled (cleanliness, temperature, humidity as required)
□ Traceability is maintained from raw materials to finished components
2.6 Inspection & Testing
□ Incoming, in-process, and final inspection procedures are documented
□ Inspection equipment is calibrated and traceable to national standards
□ Non-conforming product is identified, segregated, and dispositioned
□ Test records are complete and traceable to specific production lots
2.7 Corrective & Preventive Action (CAPA)
□ CAPA procedure is documented and implemented
□ Root cause analysis is performed for quality issues
□ Effectiveness checks are conducted for corrective actions
□ CAPA trends are reviewed in management meetings
2.8 Sterilization & Packaging (if applicable)
□ Sterilization process is validated per ISO 11135/11137/17665
□ Sterilization records include all critical parameters (dose, time, temperature, etc.)
□ Packaging validation ensures sterility maintenance through distribution
□ Biological indicators and dosimetry records are retained
2.9 Risk Management
□ Risk management file is maintained per ISO 14971
□ Hazard analysis covers all reasonably foreseeable uses and misuses
□ Risk control measures are implemented and verified
□ Production and post-production information is collected and reviewed
Phase 3: Post-Audit Actions
□ Audit Report is issued within 10 business days
□ Non-conformities are categorized (Major, Minor, Observation)
□ Corrective Action Plan is submitted by supplier within 30 days
□ Effectiveness Verification is scheduled for major non-conformities
□ Approval Decision is documented (Approved, Approved with Conditions, Not Approved)
□ Surveillance Schedule is established (annual audits for approved suppliers)
Audit Frequency Recommendations:
• New suppliers: Full audit before first production order
• Critical suppliers (Class II/III device components): Annual on-site audits
• Non-critical suppliers (Class I device components): Biennial audits or desktop reviews
• Triggered audits: Following major quality issues, significant process changes, or regulatory actions
Your gap analysis has to be honest, not optimistic. Most teams underestimate gaps because nobody wants to deliver bad news internally. Auditors see this immediately. Documented evidence beats verbal explanation every time. If you can't show it, it didn't happen. [9]
