Supplier audit: the responsibility stays with you, not with your subcontractor.
Qualification or monitoring of a critical supplier, carried out remotely by an independent auditor, from the assessment questionnaire through to action follow-up.
Initial scoping is free, with no commitment. Audit carried out remotely, at a fixed price.
What you get
- Assessment questionnaire
- Remote audit
- Audit report
- Follow-up of actions
Good to know
- Remote audit only
Ideal if: a critical supplier needs to be qualified or monitored and you have neither the time nor the checklist to do it by the book.
What ISO 13485 clause 7.4 requires
The standard requires you to define criteria for selecting, evaluating and re-evaluating your suppliers, proportionate to the effect of the purchased product or service on the conformity of the finished device.
The point many miss: outsourcing an activity does not outsource the responsibility. You must be able to show that any activity entrusted to a third party that affects product conformity is monitored and controlled. In front of the Notified Body, you answer for your subcontractor's work.
The supplier's ISO 13485 certificate is not always enough
It shows the supplier has a quality management system, not that this system covers the specific activity you entrust to them, or that they perform it to your requirements. For a critical activity, documented qualification is still expected.
Re-evaluation is an obligation, not good practice
A supplier qualified once is not qualified forever. Periodic monitoring must be planned and recorded, at a frequency justified by criticality.
Supplier changes must reach you
A subcontractor that modifies a process, moves site or changes material source can affect your device's conformity without you knowing. The obligation to notify changes must be written into the contract and verified.
Why a remote audit is enough, and when it is not
We run these audits remotely, and that is a deliberate choice rather than a constraint. For the vast majority of critical medical device suppliers, what needs checking is documentary: procedures, records, qualifications, traceability, change management. All of this can be examined just as well remotely, faster and without the cost of travel.
An on-site audit remains relevant in one specific case: when what needs checking is physical, such as a controlled production environment, a sterilisation line or storage conditions. If your situation falls into that case, we will tell you at scoping rather than sell you a service that will not meet your need.
What tooling changes in a supplier audit
A conventional supplier audit relies on sending a questionnaire, then reading the documents returned in response. The volume is such that the auditor samples, and inconsistencies between documents often go unnoticed.
The platform reads every document submitted and flags whatever does not match: a procedure dated after the record that is supposed to apply it, an expired qualification, a drawing revision that does not match the one referenced elsewhere.
The auditor can then spend the interview on what matters: understanding how the supplier actually works, not just what it declares.
Frequently asked questions
No. Clause 7.4.1 calls for an approach proportionate to the effect of the purchased product or service on device conformity. A supplier of office consumables does not warrant the same treatment as a sterilisation subcontractor. Scoping is precisely where we establish which suppliers are critical for you.
It is one element of qualification, rarely the only one. The certificate attests to a quality management system, without guaranteeing that it covers the activity you entrust or that the activity is performed to your requirements. Depending on criticality, Notified Bodies still expect a qualification audit.
Yes. What is expected is evidence that the supplier is evaluated and monitored against defined criteria. The method is yours to decide, provided it is justified and proportionate. We document that justification in the report.
The standard does not set a frequency; it requires you to plan and justify one. Common practice ranges from one to three years depending on criticality, with an unscheduled re-evaluation triggered by a significant change or an identified non-conformity.
The report grades the findings and proposes an action plan. Depending on severity, this ranges from a request for corrective actions with follow-up to a recommendation not to qualify the supplier for the activity concerned. Our role is to give you what you need to decide, not to reassure you.
A critical supplier to qualify?
Tell us about the outsourced activity and how critical it is. Scoping is free.