# ISO 13485 Supplier Audit Checklist for Medical Device Suppliers > Source: https://netray.co/tools/iso-13485-supplier-audit-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A clause-based checklist for auditing component, material and service suppliers to a medical device manufacturer, covering QMS, process control, traceability and change control. ## Category quality ## Industry Medical Devices ## Audience - Supplier quality engineer - Auditor - Quality manager - Purchasing manager ## Tool **Kind:** checklist **Groups:** #### Quality system and management **Items:** **Text:** Quality manual or equivalent defines scope and any exclusions, and certificate scope matches the product supplied (4.2.2) **Critical:** true Current ISO 13485 or ISO 9001 certificate seen, with issuing body, scope and expiry confirmed Quality policy and objectives exist and are reviewed in management review (5.3, 5.4, 5.6) Management review records show inputs from audit results, customer feedback and process performance Internal audits completed on schedule with findings closed (8.2.4) **Text:** Document control is effective: obsolete documents removed from points of use (4.2.4) **Critical:** true Records are legible, retrievable and retained for a defined period (4.2.5) #### Purchasing and outsourced processes **Items:** **Text:** Supplier's own suppliers are evaluated with risk-based criteria (7.4.1) **Critical:** true Purchasing information is complete: specification, revision and quality requirements (7.4.2) Incoming inspection or verification is defined and records show it is performed (7.4.3) Approved supplier list is current and includes sub-tier suppliers affecting your product Any subcontracted special process is controlled and its supplier audited Your quality agreement or purchase terms are known and flowed down as needed #### Production, validation and environment **Items:** **Text:** Control plan, work instructions and routings are current and match drawing revision (7.5.1) **Critical:** true **Text:** Processes whose output cannot be fully verified are validated, with IQ OQ PQ records (7.5.6) **Critical:** true Revalidation triggers are defined and followed after significant change Software used in production or quality is validated for intended use (4.1.6) Work environment and contamination controls meet product needs, such as cleanroom class and gowning (6.4) Environmental monitoring records are reviewed and out-of-limit results investigated Preservation, handling, storage and packaging protect product conformity (7.5.11) #### Identification, traceability and equipment **Items:** **Text:** Product is identified throughout production and status is clear: inspected, held, rejected (7.5.8) **Critical:** true **Text:** Lot or serial traceability to materials and processes can be demonstrated in a live trace test (7.5.9) **Critical:** true **Text:** Measuring equipment is calibrated to traceable standards and out-of-tolerance impact is assessed (7.6) **Critical:** true Gauges and fixtures are controlled and measurement systems analysis exists for key characteristics Equipment maintenance schedule is followed and records are available Operators are trained and competent for the tasks and training records exist (6.2) #### Nonconformance, corrective action and change **Items:** **Text:** Nonconforming product is identified, segregated and dispositioned with authority (8.3) **Critical:** true **Text:** Corrective and preventive actions are documented, with root cause and effectiveness checks (8.5.2, 8.5.3) **Critical:** true Complaint or customer feedback handling exists and has been used on your product **Text:** A change control process requires notice to you before changes to materials, process, location or subcontractors **Critical:** true Statistical techniques used for control and acceptance are appropriate (8.4) Delivery performance and quality performance data for your product are reviewed Recall and field action cooperation is defined with contact names and response times **Scoring Note:** Mark each item conforming, minor or major. Any critical item that is not conforming should be treated as a potential major finding. Clause references are to ISO 13485:2016. Adapt to your supplier's risk, since a resin supplier and a sterilizer need different depth. ## Content **Intro:** A supplier audit is only useful if you ask for evidence, not intentions. This checklist organizes the questions a medical device manufacturer should ask a supplier under ISO 13485 purchasing and outsourced process control, with the critical items marked so an under-time audit still covers what matters. **Sections:** #### How to use the checklist **Body:** Select the groups relevant to the supplier. A sterilization service needs everything in the production and validation group, while a distributor may need only the quality system, identification and change groups. Before the visit, send the supplier the list of records you will want. During the audit, sample a real lot from your own purchase history and follow it from receipt through shipment. Record evidence, such as record numbers and dates, beside each answer rather than a plain yes or no. **Bullets:** - Audit against your purchasing requirements as well as the standard - Perform a live trace test on one of your own lots - Sample records from your last three shipments - Close the audit with a written report and agreed due dates #### Standard and regulatory basis **Body:** ISO 13485:2016 requires purchasing controls proportionate to risk in clause 7.4, controls over outsourced processes in clause 4.1.5, and records of supplier evaluation and monitoring. FDA's Quality Management System Regulation, effective February 2, 2026, incorporates ISO 13485:2016 by reference, so the same expectations apply to US manufacturers. The checklist follows the structure of these clauses without reproducing standard text. Clause numbers help you reference findings back to the standard in your audit report. #### Scoring and follow-up **Body:** Count the items conforming and weigh the critical items most heavily. A result with all critical items conforming and a few minor findings supports approval or continued approval. Any open major finding, especially on process validation, change notification or traceability, should be tied to a corrective action request with a due date and an effectiveness check. Record the result in your approved supplier list, adjust the risk ranking and audit interval, and keep the report as evidence for your own audit. #### Common mistakes **Body:** Auditors often accept a certificate as proof and never look at the process that makes your parts. Another frequent weakness is skipping the change control question, even though uncommunicated supplier changes are a leading cause of device field problems. Do not forget sub-tier suppliers: if your supplier outsources the critical step, you need to know and ensure it is controlled. Finally, close the loop. An audit without tracked corrective actions does not satisfy the standard. **Cta:** If you want audit findings, supplier corrective actions and receiving data tracked in one place instead of across documents, we can set that up alongside your ERP. **Faq:** #### Do I need to audit every supplier on site? **Answer:** No. ISO 13485 requires evaluation proportionate to risk. Low-risk suppliers can be controlled through questionnaires, certificates and performance data. Critical suppliers and special process suppliers usually warrant on-site or remote audits, with a documented rationale. #### What is the difference between a major and minor finding? **Answer:** A major finding is a failure of a required element or a systemic breakdown that could affect product conformity. A minor finding is an isolated lapse that does not threaten conformity. Define the terms in your procedure, and treat critical items as major when they fail. #### Can I use this for a contract manufacturer? **Answer:** Yes, but add items for design transfer, device master records, sterilization and labeling controls, and regulatory responsibilities defined in your quality agreement. A contract manufacturer performs a larger share of your regulated activities than a component supplier. #### How long does a supplier audit take? **Answer:** A focused audit of a small supplier takes one day. A contract manufacturer or sterilizer commonly takes two days or more including preparation and reporting. Use the critical items to prioritize if time is short. ## Search terms ISO 13485 supplier audit checklist, medical device supplier audit questions, supplier quality audit checklist medical, 7.4 purchasing audit checklist, outsourced process control checklist, supplier qualification checklist device, contract manufacturer audit checklist, supplier onsite audit form --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json