Early in my career I walked into a supplier audit armed with a forty-page questionnaire the supplier had already filled out. Every answer was “Yes.” Documented procedure for nonconforming material? Yes. Calibrated equipment? Yes. Controlled work instructions? Yes, yes, yes.
Twenty minutes onto their shop floor, I found a torque driver with a calibration sticker that had expired during the previous administration, a “quarantine” shelf that was really just a shelf with dusty products, and a laminated work instruction two revisions behind the one they’d sent us. The questionnaire wasn’t lying, exactly. It was describing the company they meant to be.
That’s the whole case for supplier audits in one paragraph. Now let’s talk about how to do them well.
What the requirement actually asks
ISO 13485 §7.4.1 (which the QMSR now makes the law, as we covered when §820.50 retired) asks you to set criteria for evaluating and selecting suppliers, to plan how you’ll monitor and re-evaluate them, and to do all of that proportionate to the risk the supplied product poses to your device. It does not literally say “you must audit every supplier on site.” What it says is harder: you have to be able to defend why your level of oversight matches the risk.
For a supplier of corrugated shipping boxes, a signed quality agreement and a watch on incoming inspection results is probably a proportionate answer. For your sterilizer, your contract manufacturer, or the machine shop making the part that goes inside the patient, “they sent us their ISO certificate” is not.
And under the QMSR, the old §820.180(c) exemption is gone. FDA can now read your supplier audit reports, just like your internal ones. An investigator can open the file, see that you rated a supplier “critical,” and see what you actually did about it. The gap between those two things is where the conversation goes.
A supplier audit is still an audit
Good news: nearly everything in this series so far applies. A supplier audit is what ISO 19011 calls a second-party audit. That’s the same discipline as an internal audit, pointed outward.
- Plan it by risk. The same logic from building an audit program that isn’t theater applies to your supplier list. Rank suppliers by what happens to the patient if they get it wrong, then factor in their track record: SCARs, rejects, late deliveries, and changes they didn’t tell you about. High risk plus poor performance means you go on site, and soon.
- Scope it to what you buy. You are not certifying their whole QMS. That’s their registrar’s job. You’re auditing the processes that touch your product: their controls for your spec, their process validation for your part, how they handle nonconforming product and changes that affect you.
- Collect evidence, not reassurance. “Show me” beats “tell me” twice as hard with suppliers, because they’re also trying to keep your business. Pull a lot traveler for a recent shipment of your part and trace it backward. Ask to see the last change they made to your process and how they notified you. (If the answer is “we didn’t need to notify you,” write that down.)
- Write findings like findings. Requirement, evidence, done. Same rules as internal findings. Your supplier quality agreement is often the requirement you cite, which is one more reason it should actually say something.
Where it goes wrong in real life
The failure I see most often isn’t a bad audit. It’s no follow-up. A supplier gets audited, has three findings, sends back a corrective action plan that says “procedure updated, staff retrained,” and someone marks it closed. Two years later the same problem shows up in your incoming inspection data, and nobody connects it to the audit. That’s because the supplier audit lived in one binder, the rejects lived in a spreadsheet, and the SCAR lived in somebody’s inbox.
If this sounds familiar, it’s the same disease from the root cause and effectiveness posts, only now it’s happening in someone else’s building. You can’t do their root cause analysis for them. What you can do is decline to accept “retrained the operator,” ask what in their process allowed it, and check your own incoming data later to see whether the fix held.
The runner-up failure: the audit that happens once, at supplier approval, and never again. Seven years later the supplier has new owners, a new plant manager, and a new second shift. You’re still leaning on an audit of a company that no longer exists in that form.
What to do today
- Pull your approved supplier list and highlight the critical ones. For each, write down the date and type of your last real evaluation. Blank spaces are your answer.
- Check that each critical supplier’s oversight matches your own risk rating. A supplier you call critical but only monitor by questionnaire is a contradiction an investigator can read.
- Connect the data. Supplier audit findings, SCARs, incoming rejects, and re-evaluation decisions should all be visible together. If you have to open four systems to see one supplier’s story, you won’t see it.
- Put open supplier findings on the management review agenda. Supplier performance is an input there, and “we’re waiting on them” is a status, not a plan.
This is exactly the kind of thing a system of record keeps honest. In Candor, supplier audit findings sit in the same place as your internal audit findings and follow the same lifecycle, so a repeat problem at a supplier looks like a trend instead of a coincidence. And if your team doesn’t have the bandwidth to get on a plane to visit a contract manufacturer, Red Hen Admin does supplier audits too. Either way, you still own the decisions. We just make sure they get made on evidence.
Your suppliers are part of your quality system whether or not their name is on your org chart. The questionnaire tells you who they’d like to be. The audit tells you who showed up.