A medical device factory audit should establish whether a manufacturer can consistently deliver compliant products at the required quality, volume and lead time. Buyers should look beyond certificates and prepared presentations by testing how the manufacturer’s systems operate in practice.
This matters even more in 2026. The US Food and Drug Administration’s Quality Management System Regulation became effective on 2 February 2026 and incorporates ISO 13485:2016 into US medical device manufacturing requirements (FDA, February 2026). :contentReference[oaicite:0]{index=0}
1. Does the quality management system cover the audited facility?
Start by asking which activities and manufacturing locations appear within the scope of the manufacturer’s ISO 13485 certificate. Confirm that the legal manufacturer, audited address, product categories and relevant processes match the supplier and products under evaluation.
Ask to see the original certificate, its expiry date, issuing certification body and latest surveillance audit status. ISO describes ISO 13485:2016 as the internationally recognised quality management system standard for organisations involved in medical device design and manufacturing (ISO, 2026). :contentReference[oaicite:1]{index=1}
A certificate covering distribution or servicing does not automatically demonstrate that the facility manufactures the product being purchased. Buyers should also investigate any subcontracted production steps excluded from the certificate’s scope.
2. Who is legally responsible for the medical device?
Ask whether the factory operates as the legal manufacturer, an original equipment manufacturer, a contract manufacturer or a private-label supplier. Identify the organisation whose name appears on the product label, declaration of conformity and regulatory registrations.
Buyers should request a clear map of responsibilities covering product design, regulatory documentation, manufacturing, batch release, complaint handling and field safety actions. Unclear responsibility between a brand owner and factory can delay investigations, recalls and corrective actions.
3. How does the factory qualify and monitor its suppliers?
Ask how the manufacturer approves suppliers of critical components, raw materials, sterile barriers, software, packaging and outsourced services. Review the criteria used to classify suppliers according to risk.
Useful follow-up questions include:
- Which suppliers are considered critical?
- How often are they reassessed?
- What quality agreements are in place?
- How are supplier changes communicated and approved?
- What happens after repeated incoming inspection failures?
Request examples of supplier scorecards, audit reports, rejected-material records and corrective actions. A factory that cannot control its own supply chain may struggle to maintain consistent specifications, even when its internal production processes appear strong.
4. How are incoming materials inspected and released?
Ask the factory to walk through the complete receiving process. Auditors should observe how staff identify, quarantine, inspect, approve and store incoming components.
Check whether approved materials remain physically or electronically separated from rejected and uninspected stock. Select a component from the warehouse and ask the manufacturer to show its supplier, purchase order, inspection record, acceptance criteria and current inventory status.
Pay close attention to components that directly affect safety or performance. These may include sensors, medical-grade polymers, electronic boards, filters, reagents, sterile packaging and patient-contact materials.
5. Which manufacturing processes require validation?
Ask the manufacturer to identify processes whose results cannot be fully verified through final inspection. Typical examples include sterilisation, sealing, welding, moulding, software-controlled production, cleanroom operations and automated assembly.
Review process validation protocols, acceptance criteria, results, deviations and revalidation triggers. Ask what happens when equipment, materials, software, production location or process parameters change.
Do not accept a validation report based only on a successful final sample. The manufacturer should demonstrate that the process remains controlled across defined operating limits and under repeatable production conditions.
6. How are nonconforming products controlled?
Ask staff to explain what happens when a component, work-in-progress item or finished device fails inspection. Then compare the explanation with the written procedure and actual records.
Review how the factory labels and segregates nonconforming material. Check who can authorise rework, concession, return to supplier or destruction, and whether reworked products receive appropriate reinspection.
Buyers should also ask how management identifies recurring defects. A high volume of isolated rejection reports can conceal a systemic production problem if the manufacturer does not analyse trends.
7. Can the manufacturer demonstrate effective CAPA?
Corrective and preventive action records reveal how seriously a manufacturer treats quality failures. Select several closed CAPAs and ask the factory to show the original problem, root-cause analysis, action plan, deadlines, responsible employees and effectiveness checks.
Weak responses include blaming operator error without deeper analysis, closing actions without evidence and repeatedly extending deadlines. Strong systems use production data, complaint trends, audit findings and supplier issues to identify problems before they affect larger volumes.
Ask specifically whether previous corrective actions prevented recurrence. A completed form does not prove that the underlying risk has been controlled.
8. How does the factory maintain traceability?
Select a finished product and perform a backward trace. The manufacturer should be able to identify the production date, equipment, operators, inspection results, software or firmware version and relevant component lots.
Then conduct a forward trace from a critical component lot to every finished batch in which it was used. The speed and accuracy of this exercise indicate whether the manufacturer could manage a complaint, safety notice or recall effectively.
Buyers should also confirm how long the factory retains device history records and whether retention periods meet the requirements of the intended market.
9. How are equipment and measuring instruments controlled?
Ask to review maintenance schedules, calibration records and equipment status labels. Select several measuring tools directly from the production floor rather than reviewing only examples prepared by management.
Check whether calibrations remain valid and traceable to recognised standards. Ask what the manufacturer does when equipment is discovered to be outside acceptable limits, including how it assesses products previously tested with that equipment.
10. How are cleanliness and contamination risks controlled?
For cleanroom, sterile or contamination-sensitive products, inspect personnel flows, material flows, gowning, environmental monitoring and cleaning records. Ask how the manufacturer controls particles, microorganisms, electrostatic discharge or cross-contamination, depending on the product.
Review environmental excursions and the actions taken after limits were exceeded. Employees should understand why each control exists rather than following procedures mechanically.
11. How does the manufacturer manage complaints and post-market data?
Ask how complaints enter the quality system, who evaluates them and how the company decides whether an incident requires regulatory reporting. Review examples connected to the product category being sourced.
EU manufacturers must maintain post-market surveillance systems and use field information to assess device quality, performance and safety. Recent European Commission guidance continues to emphasise structured feedback channels, post-market reports and periodic safety update reports where applicable (European Commission, 2025). :contentReference[oaicite:2]{index=2}
Check whether complaint data feeds into risk management, CAPA, supplier controls and design changes. A manufacturer that treats each complaint as an isolated customer-service issue may miss wider safety signals.
12. What changes require buyer notification?
Ask the factory to define its change-control process and provide a list of changes that require customer approval or notification. These should normally include changes to materials, critical suppliers, design, manufacturing location, production methods, software, sterilisation, packaging and product specifications.
Request a contractual notification period before implementation. Buyers should also establish whether changes could affect regulatory submissions, registrations, validation status or tender specifications.
13. Can the factory meet the required production volume?
Review actual production data rather than relying on stated maximum capacity. Ask for monthly output, utilisation, rejection rates, equipment constraints, labour availability and current order backlog.
Test capacity claims against the buyer’s forecast, seasonal peaks and expected growth. Ask which process represents the main bottleneck and how the manufacturer would respond to an urgent increase in demand.
Buyers should distinguish theoretical capacity from sustainable output. Running equipment continuously for a short period does not prove that the factory can maintain quality and delivery performance over a long-term contract.
14. What is the business continuity plan?
Ask how the manufacturer would respond to loss of electricity, cyber incidents, equipment failure, raw-material shortages, transport disruption, fire or closure of a critical supplier. Review backup arrangements for utilities, production data, tooling, inventory and alternative suppliers.
For EU supply chains, buyers should also ask how the manufacturer handles anticipated product interruptions. Current MDR and IVDR rules require manufacturers to provide advance information in certain cases where interruption or discontinuation could cause serious harm or a risk of serious harm to patients or public health (European Commission, 2026). :contentReference[oaicite:3]{index=3}
15. What evidence should buyers collect before closing the audit?
Conclude the audit by recording objective evidence for every major finding. Evidence may include document identifiers, batch numbers, photographs where permitted, interview notes and copies of relevant records.
Classify findings according to patient risk, regulatory impact and supply impact. Require the manufacturer to provide root-cause analysis, corrective actions, responsible owners and completion dates for significant gaps.
Turn factory audit answers into a sourcing decision
A factory audit should end with a documented decision: approve, approve conditionally or reject. Buyers should evaluate not only the number of findings but also their severity, recurrence, systemic impact and the manufacturer’s willingness to provide transparent evidence.
The strongest suppliers can connect procedures to real production records, explain deviations clearly and demonstrate that corrective actions work. When evaluating manufacturers discovered through Suplivia, buyers can use the platform’s verification tiers and available certification information as an initial screening layer, but product-specific due diligence and a risk-based factory audit remain essential before placing significant orders.
