ISO 13485 Supplier Audit Checklist for Medical Device Suppliers
A supplier audit is only useful if you ask for evidence, not intentions. This checklist organizes the questions a medical device manufacturer should ask a supplier under ISO 13485 purchasing and outsourced process control, with the critical items marked so an under-time audit still covers what matters.
0 of 33 items complete
11 critical items still open - these are the highest-risk gaps.
Quality system and management
Purchasing and outsourced processes
Production, validation and environment
Identification, traceability and equipment
Nonconformance, corrective action and change
Mark each item conforming, minor or major. Any critical item that is not conforming should be treated as a potential major finding. Clause references are to ISO 13485:2016. Adapt to your supplier's risk, since a resin supplier and a sterilizer need different depth.
Track supplier audits and corrective actions
Optional: we can build an audit and SCAR tracker tied to your supplier master and receiving data.
Optional. The tool and every export work without this. No spam.
How to use the checklist
Select the groups relevant to the supplier. A sterilization service needs everything in the production and validation group, while a distributor may need only the quality system, identification and change groups. Before the visit, send the supplier the list of records you will want. During the audit, sample a real lot from your own purchase history and follow it from receipt through shipment. Record evidence, such as record numbers and dates, beside each answer rather than a plain yes or no.
- Audit against your purchasing requirements as well as the standard
- Perform a live trace test on one of your own lots
- Sample records from your last three shipments
- Close the audit with a written report and agreed due dates
Standard and regulatory basis
ISO 13485:2016 requires purchasing controls proportionate to risk in clause 7.4, controls over outsourced processes in clause 4.1.5, and records of supplier evaluation and monitoring. FDA's Quality Management System Regulation, effective February 2, 2026, incorporates ISO 13485:2016 by reference, so the same expectations apply to US manufacturers. The checklist follows the structure of these clauses without reproducing standard text. Clause numbers help you reference findings back to the standard in your audit report.
Scoring and follow-up
Count the items conforming and weigh the critical items most heavily. A result with all critical items conforming and a few minor findings supports approval or continued approval. Any open major finding, especially on process validation, change notification or traceability, should be tied to a corrective action request with a due date and an effectiveness check. Record the result in your approved supplier list, adjust the risk ranking and audit interval, and keep the report as evidence for your own audit.
Common mistakes
Auditors often accept a certificate as proof and never look at the process that makes your parts. Another frequent weakness is skipping the change control question, even though uncommunicated supplier changes are a leading cause of device field problems. Do not forget sub-tier suppliers: if your supplier outsources the critical step, you need to know and ensure it is controlled. Finally, close the loop. An audit without tracked corrective actions does not satisfy the standard.
Frequently Asked Questions
Do I need to audit every supplier on site?
No. ISO 13485 requires evaluation proportionate to risk. Low-risk suppliers can be controlled through questionnaires, certificates and performance data. Critical suppliers and special process suppliers usually warrant on-site or remote audits, with a documented rationale.
What is the difference between a major and minor finding?
A major finding is a failure of a required element or a systemic breakdown that could affect product conformity. A minor finding is an isolated lapse that does not threaten conformity. Define the terms in your procedure, and treat critical items as major when they fail.
Can I use this for a contract manufacturer?
Yes, but add items for design transfer, device master records, sterilization and labeling controls, and regulatory responsibilities defined in your quality agreement. A contract manufacturer performs a larger share of your regulated activities than a component supplier.
How long does a supplier audit take?
A focused audit of a small supplier takes one day. A contract manufacturer or sterilizer commonly takes two days or more including preparation and reporting. Use the critical items to prioritize if time is short.
If you want audit findings, supplier corrective actions and receiving data tracked in one place instead of across documents, we can set that up alongside your ERP.
Related Tools
ISO 13485 Approved Supplier List Risk Ranking and Audit Plan Worksheet
Scores suppliers with a risk priority number, sets audit intervals, and totals audits per year and audit cost so your supplier control is proportional to risk.
Quality & InspectionMedical Device Supplier Evaluation Scoring Worksheet
Weighted scoring of critical and non-critical suppliers with approval status, for ISO 13485 clause 7.4 purchasing controls.
Quality & InspectionSupplier Audit Checklist
A 30-point supplier audit checklist covering quality system, process control, receiving, delivery and records. Tick items, see a score, export the result.
Quality & InspectionISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
More Quality & Inspection tools
See all- CAPA Corrective and Preventive Action Form Template
- Device History Record (DHR) Template
- Process Validation IQ OQ PQ Template
- Medical Device Complaint Handling Form Template
- ISO 14971 Risk Management Worksheet
- Sterilization Load Record Template
- Medical Device Design Verification Protocol Template
- Medical Device Cleanroom Environmental Monitoring Log
- Medical Device Accelerated Aging Calculator (ASTM F1980)
Keep exploring
Free tools
- ISO 13485 Internal Audit ChecklistA clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
- ISO 13485 Quality Plan Template with Medical Device File ExampleA fill-in ISO 13485 quality plan with a medical device file content example and a clause compliance checklist table.
- ISO 13485 Internal Audit Plan and Management Review TemplateFill-in ISO 13485 internal audit plan and management review minutes covering required inputs and outputs, with guidance on clause 7.5.
Guides
- ISO 13485 ERP Requirements for Medical Device Contract ManufacturersWhat ISO 13485 and FDA QMSR actually require of an ERP at a medical device contract manufacturer: records, traceability, change control and software validation.
- Lot Traceability for a Medical Device Contract ManufacturerSet up lot traceability in your ERP for medical device work: material certs, forward and backward genealogy, recall drills, and what auditors ask to see.
- ERP for Medical Device Manufacturing: Compliance, Traceability, and ValidationERP for medical device manufacturing: FDA 21 CFR Part 820, ISO 13485, UDI and DHR traceability requirements, plus vendor fit and implementation guidance.
AI on your ERP
- AI on Infor SyteLine for Medical Device Manufacturers: Genealogy, DHR and Audit EvidencePrivate AI on Infor SyteLine for medical device makers: lot and serial genealogy, DHR assembly, UDI and QMSR evidence, with human approval on every write.
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.
Manufacturing hubs
- MDMA, AdvaMed and medical device manufacturing: regulation, ERP and AI realitiesMDMA and AdvaMed medical device manufacturing: FDA QMSR, ISO 13485, UDI and EU MDR, plus the ERP, traceability and private AI issues device makers face.
- Medical Device Manufacturing in Minneapolis-St. PaulMedical device manufacturing in Minneapolis-St. Paul: ecosystem, FDA and ISO 13485 requirements, and ERP, quoting and document problems contract makers face.