A signed quality agreement and a current certificate prove very little on their own. Neither shows that a supplier can support an invasive medical device month after month. A good medical device supplier audit checklist tests what happens between the approved procedure and the finished lot. How do materials arrive? Can operators follow the work instructions in practice? And who controls change, then closes out faults?
For OEM procurement, quality, and regulatory teams, the audit is a real decision point. This medical device supplier audit checklist shows whether a supplier fits initial qualification. It also shows which controls belong in the quality agreement, and where you need extra oversight before commercial production starts.
Medical Device Supplier Audit Checklist: Eight Controls
1. Verify the scope of the quality management system
Start with the quality system, and look past the certificate status. Confirm that ISO 13485:2016 certification, published by ISO, is current, comes from a proper certification body, and covers the exact site and activities you plan to use. A certificate that covers distribution does not qualify a plant for contract manufacturing, sterile-barrier packaging, cleanroom assembly, or final release.
Next, request the quality manual, the org chart, the internal audit schedule, management review evidence, and the list of procedures. In short, your goal is simple. Find out whether the system runs daily or wakes up once a year for the audit. Look for named duties across quality, manufacturing, engineering, and regulatory work, plus clear authority to stop production or reject product.
For a critical component or a finished invasive device, check that the procedures suit your target markets and device class. The right depth follows the outsourced activity. A supplier making a noncritical machined part carries a very different risk profile from one assembling a nitinol localization wire in a controlled room.
2. Follow traceability from raw material to shipment
Above all, test traceability with a real production lot rather than a slide deck. For example, pick a recently released batch and ask the team to pull the full device history record. That file should link incoming material records, lot numbers, work orders, in-process results, packaging records, release decisions, and shipping papers.
For nitinol-based invasive devices, material control needs extra care. Check that material certificates stay on file and that incoming acceptance criteria exist. Lot identity must survive cutting, forming, heat treatment, cleaning, assembly, and packaging. Where shape-memory behavior is a device requirement, trace the process parameters and inspection records right through to the finished lot.
Traceability must also run backwards. Ask how the supplier would find every affected lot after a late discovery, such as a material issue, a calibration failure, or a process deviation. You want a documented retrieval process backed by records, not a guess based on production dates.
3. Inspect process validation and production controls
Naturally, a written procedure never proves that a process is capable. Review the steps that drive safety, performance, and cleanliness. Then confirm that the validation or verification evidence matches the method actually in use.
For special processes, read the approved protocols, acceptance criteria, reports, revalidation triggers, and routine monitoring. Thermal forming, bonding, cleaning, and sealing all qualify, as does any step that later inspection cannot fully confirm. If process parameters create wire geometry or shape-memory behavior, those parameters need set limits, controlled access, and recorded evidence for every run.
Furthermore, watch production whenever you can. Check that current work instructions sit at the point of use, that equipment settings are locked, and that operators can explain the critical steps. An operator’s grasp of the job often reveals whether a procedure works in practice. Where visual inspection decides the outcome, review inspector training, lighting, defect samples, and the consistency of accept-reject calls.
4. Confirm cleanroom and contamination controls
When staff assemble or pack an invasive device in a controlled area, cleanroom discipline becomes part of product quality. Confirm the classification the activity requires. Then review qualification, monitoring, cleaning, gowning, maintenance, and excursion procedures.
An ISO Class 8 cleanroom may suit certain assembly and packaging steps, yet the class number alone settles nothing. The audit should show that personnel and material flows block cross-contamination. It should show that cleaning happens at the stated frequency and that someone reviews monitoring data for trends. Ask how the team handles an out-of-limit result, and whether product impact gets assessed before release. A worked cleanroom audit example shows how these questions play out during an on-site review.
Finally, look hard at transfers into the room. Uncontrolled tools, packaging materials, or maintenance work can undo an otherwise tidy environment. The practical question stays simple. Can the supplier show that it finds, controls, and records contamination risk right through production?
5. Review equipment, calibration, and maintenance records
As you would expect, measuring equipment must suit the tolerance it checks. Look at calibration status on the floor, then sample the certificates. Judge whether the standards, intervals, and measurement uncertainty fit the job. A calibrated gauge still fails you if it cannot resolve a critical dimension.
Meanwhile, preventive maintenance deserves the same look. Check forming equipment, inspection systems, sealing gear, and any fixture that shapes the product. Ask what happens when a gauge drifts out of calibration or maintenance falls overdue. The procedure should force an impact assessment on affected product, with a documented decision and customer notice where the agreement demands it.
6. Test change control before approving the supplier
Uncontrolled change is a common source of regulatory and supply pain. Review recent changes to materials, sub-suppliers, drawings, process parameters, software, equipment, test methods, packaging, and sites. Confirm that each request gets cross-functional review. Validation, regulatory assessment, and customer approval must all land before implementation when the case requires it.
This point matters greatly in OEM programs. A different nitinol lot source, a revised heat-treatment fixture, or a new packaging film can shift performance or shelf-life assumptions. The change may look minor on the shop floor and still matter to you. The supplier should hold a clear notification process, and it should separate changes it may make alone from changes that need your written approval.
Ask to see one finished change record from start to close. It should show the reason, the risk assessment, the testing, the approval chain, the implementation date, and proof that the affected documents were updated.
7. Evaluate nonconformity and CAPA effectiveness
At first glance, a low fault count can signal good control. It can also signal weak detection or shy reporting. Review how the site records, contains, investigates, and trends nonconformities. Judge whether each disposition holds up technically, and whether repeat issues rise into corrective and preventive action.
Similarly, sample a few closed CAPAs and look for genuine root-cause work rather than restated symptoms. A finding of “operator error” should open a wider look at training, instruction clarity, fixture design, workload, or process capability. Confirm that corrective actions carry effectiveness checks, and that someone verifies the issue has not crept back.
Audit findings deserve the same attention. Zero nonconformities in the latest ISO audit can reflect a disciplined system. Even so, the sharper question is how the site handled earlier observations, and whether those lessons reached daily practice.
8. Assess capacity, continuity, and quality agreement readiness
Of course, quality evidence must meet operational reality. To assess OEM capacity, review monthly capacity, lead times, staffing plans, reliance on single machines, approved material sources, and continuity measures. Production data and scheduling practice should back the capacity figure, not a headline maximum.
For an OEM device, ask how the plant will meet a demand spike without skipping validated steps or trimming inspection. Discuss safety stock, forecast visibility, supplier lead times, single-source materials, and plans for equipment failure. A specialist supplier may reasonably run deep expertise with limited redundancy, provided the risk stays visible and the controls fit.
Consequently, the quality agreement turns audit findings into binding expectations. Define release duties, record retention, complaint support, notification timelines, audit rights, change approval, escalation of faults, and cooperation during regulatory inspections. In other words, an audit qualifies the relationship. The agreement governs it once purchase orders start.
These audits carry even more weight for products that enter the body. Our guide to invasive medical device contract manufacturing explains which of the eight controls become non-negotiable in that setting.
Turning Audit Evidence Into a Supplier Decision
As a rule, no single threshold suits every supplier. The right depth follows the criticality of the outsourced work, the maturity of the supplier, the device risk profile, and the controls you keep in house. A distributor, a contract packager, and a maker of invasive shape-memory wire assemblies each call for different evidence.
Instead, record every observation with its objective evidence, risk rationale, owner, due date, and closure proof. Separate the blockers from the gaps you can close before first production, and from ideas that simply improve things later. That discipline keeps procurement aligned with quality and regulatory needs rather than commercial pressure. Once findings are ranked, the remaining decision is whether the supplier qualifies at all, which our guide on how to qualify medical device suppliers addresses step by step.
A medical device supplier audit checklist works best when it ends in action. For OEM partners sourcing invasive nitinol wire systems, Pharmtex works to documented ISO 13485:2016 processes and ISO Class 8 cleanroom production, with focused manufacturing experience behind open qualification talks. The best audit ends with technical evidence turned into a shared, workable plan for reliable supply.