ISO 13485 Approved Supplier List Risk Ranking and Audit Plan Worksheet
Auditors do not expect every supplier to be treated the same. They expect your controls to be proportional to risk and documented. This worksheet ranks suppliers with a simple risk priority number, assigns audit intervals, and tells you what the resulting audit schedule costs.
| Supplier | Product or service supplied | Category | Severity if it fails (1-5) | Occurrence (1-5) | Detectability (1-5) | Risk priority number | Audit interval (months) | Audits per year | Cost per audit | Annual audit cost | |
|---|---|---|---|---|---|---|---|---|---|---|---|
40 | 1 | $2,400 | |||||||||
50 | 1 | $3,200 | |||||||||
24 | 0.5 | $900 | |||||||||
36 | 0.5 | $900 | |||||||||
9 | 0.3333 | $400 | |||||||||
2 | 0 | $0 |
Scores and example suppliers are illustrative. ISO 13485 clause 7.4.1 requires supplier evaluation criteria proportionate to the risk of the product and its effect on the device, so define the 1 to 5 scales in your own procedure. A supplier with an interval of 0 is not audited and is controlled by other means, such as questionnaires or incoming inspection.
Drive supplier risk from real performance data
Optional: we can compute occurrence scores from your receiving, NCR and delivery history in the ERP.
Optional. The tool and every export work without this. No spam.
How to use it
List each supplier on your approved supplier list with what they provide and a category. Score severity (effect on device safety or performance if the item fails), occurrence (history of nonconformance, complexity, change frequency) and detectability (how likely you are to catch a problem at incoming inspection). The sheet multiplies them into a risk priority number. Set an audit interval for each supplier, enter an expected cost per audit, and the sheet gives audits per year and annual cost.
- Document the meaning of scores 1 to 5 in your supplier control procedure
- Rescore suppliers after any nonconformance, change notice or audit finding
- Use detectability honestly: sealed or validated processes score high
- Record the rationale for any interval that does not follow the ranking
Method and regulatory basis
ISO 13485:2016 clause 7.4.1 requires criteria for evaluation and selection of suppliers that are proportionate to the risk of the medical device and the supplier's ability to provide conforming product. Clause 4.1.5 requires control of outsourced processes, and clause 7.4.3 requires verification of purchased product. The severity, occurrence and detectability scoring borrows the FMEA risk priority approach familiar from ISO 14971 practice and quality tools. It is a prioritization aid, not a statistical measure, so keep the scales short and well defined.
Reading the results
Sort the list by risk priority number and compare it to the assigned intervals. High-ranking suppliers with long intervals, or low-ranking suppliers audited annually, are the first things a reviewer will question. The annual cost total helps you plan travel and auditor capacity, and shows when a remote audit or a third-party certificate such as an ISO 13485 or ISO 17025 accreditation can supplement an on-site audit for lower-risk suppliers. Review the table at least annually and at management review.
Common mistakes
Scoring everything as critical makes the ranking useless, and scoring based on spend rather than effect on the device misses small but important suppliers like a calibration lab or a sterilizer. Another mistake is to treat a supplier's certificate as a replacement for your own evaluation. A certificate is evidence, not a substitute for judgment. Finally, remember that suppliers on the list also need agreements that require notice of changes, which is part of risk control.
Frequently Asked Questions
How often should I audit ISO 13485 suppliers?
ISO 13485 does not set a fixed interval. It requires a risk-proportionate approach. Many companies audit critical suppliers annually or every two years and use questionnaires, certificates and performance data for lower-risk suppliers. Document your rationale.
Is a risk priority number required?
No. It is one common way to rank suppliers. Any documented, risk-based method is acceptable, including a simple critical, major and minor classification, provided it is applied consistently and reviewed.
Do distributors and calibration labs go on the list?
Yes, if they affect product quality or the quality system. Calibration labs, sterilizers, test labs and packaging suppliers are often more significant than a component supplier, so include them and score them on the effect of failure.
Can a supplier certificate replace an audit?
It can reduce the audit scope or frequency for lower-risk suppliers if you review the certificate scope and keep evidence. For critical suppliers, most manufacturers still audit directly or through a qualified third party.
If your supplier performance, audit and quality data sits across ERP, email and spreadsheets, we can consolidate it so risk scores are driven by actual receiving and NCR history.
Related Tools
ISO 13485 Supplier Audit Checklist
A clause-based checklist for auditing component, material and service suppliers to a medical device manufacturer, covering QMS, process control, traceability and change control.
Quality & InspectionMedical Device Supplier Evaluation Scoring Worksheet
Weighted scoring of critical and non-critical suppliers with approval status, for ISO 13485 clause 7.4 purchasing controls.
Quality & InspectionISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
Costing & FinanceMedical Device NCR Labor, Rework and Scrap Cost Calculator
Builds a cost per NCR and an annual cost from NCR volume, burdened labor, MRB time, rework and scrap mix, and CAPA escalation rate. Includes a volume sweep.
More Supply Chain & Inventory tools
See all- Oracle Fusion Inventory Turns and Carrying Cost Calculator
- Distribution ERP Fill Rate Calculator
- Distributor Rebate Tracking Worksheet
- Branch Transfer Planning Worksheet
- Distributor Slow-Moving Inventory Review Worksheet
- Distributor Vendor Performance Scorecard Worksheet
- Distributor GMROI Calculator
- Distributor Backorder Cost and Fill Rate Calculator
- EOQ with Vendor Minimum Order Calculator
Keep exploring
Free tools
- ISO 13485 Supplier Audit ChecklistA clause-based checklist for auditing component, material and service suppliers to a medical device manufacturer, covering QMS, process control, traceability and change control.
- ISO 13485 Internal Audit Plan and Management Review TemplateFill-in ISO 13485 internal audit plan and management review minutes covering required inputs and outputs, with guidance on clause 7.5.
- ISO 13485 Internal Audit ChecklistA clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
ERP fixes and how-tos
- Epicor: No Employee Attached to User, Supplier Not Approved, Serial Mask TokensFix the Epicor error no employee attached to user, plus supplier not approved for operation and serial mask token setup, and where to look in Kinetic.
- MPN in Infor LN: Manufacturer Part Numbers, Items and SuppliersHow to manage a manufacturer part number (MPN) in Infor LN: item codes, supplier item data, alternates, and how to keep MPNs clean and searchable.
Guides
- ISO 13485 ERP Requirements for Medical Device Contract ManufacturersWhat ISO 13485 and FDA QMSR actually require of an ERP at a medical device contract manufacturer: records, traceability, change control and software validation.
- Lot Traceability for Medical Turned ComponentsLot traceability for medical turned components: heat numbers, ISO 13485 records, device history, recall readiness and how Swiss shops tie bar lots to shipments.
- How to Configure Vendor Qualification in SyteLineLearn how to set up vendor qualification and approved supplier management in Infor SyteLine. Configure vendor assessments, quality scorecards, approval workflows, and ongoing performance monitoring.
AI on your ERP
- AI on Infor SyteLine for Medical Device Manufacturers: Genealogy, DHR and Audit EvidencePrivate AI on Infor SyteLine for medical device makers: lot and serial genealogy, DHR assembly, UDI and QMSR evidence, with human approval on every write.
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.
Manufacturing hubs
- Medical Device Manufacturing in Minneapolis-St. PaulMedical device manufacturing in Minneapolis-St. Paul: ecosystem, FDA and ISO 13485 requirements, and ERP, quoting and document problems contract makers face.
- MDMA, AdvaMed and medical device manufacturing: regulation, ERP and AI realitiesMDMA and AdvaMed medical device manufacturing: FDA QMSR, ISO 13485, UDI and EU MDR, plus the ERP, traceability and private AI issues device makers face.