Medical Device Audits in 2026: Internal, Supplier, Notified Body and MDSAP

Why medical device audits matter more in 2026

Audits are how a device company, its customers and its regulators check that a quality management system works. Two changes in 2026 raised their importance.

First, FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, removed the old exception that kept audit reports away from investigators. FDA states that “The exceptions that existed in the QS regulation at § 820.180(c) are not maintained,” so management review, quality audit and supplier audit reports are now open to inspection (FDA QMSR FAQ). An internal audit report is no longer a private conversation; it is evidence.

Second, the auditing guideline itself was revised. ISO 19011:2026, published May 26, 2026, replaced the 2018 edition (ISO), with updated guidance on remote auditing, digital tools and auditor competence.

Types of medical device audits

Audit type	Who audits	Against what	Frequency	Output
Internal audit	Your own trained auditors (independent of the area)	ISO 13485, QMSR, EU MDR, your procedures	Planned by risk; typically all processes at least annually	Internal audit report, CAPAs; now inspectable by FDA
Supplier audit	Your supplier quality team	Quality agreement, ISO 13485, your requirements	Based on supplier risk and performance	Supplier audit report; now inspectable by FDA
Certification audit (ISO 13485)	Accredited certification body	ISO 13485:2016	Initial, annual surveillance, 3-year recertification	Certificate, nonconformities
Notified body audit (EU MDR)	Designated notified body	MDR Annex IX, X or XI	Surveillance at least annually; unannounced at least once every five years	MDR certificate, nonconformities
MDSAP audit	MDSAP-recognized auditing organization	Requirements of five regulators	Initial, annual surveillance, 3-year recertification	Audit report shared with regulators
FDA inspection	FDA investigators	QMSR and other 21 CFR parts	Risk-based; not a certification audit	Form FDA 483, establishment inspection report

A few details deserve attention:

• Unannounced notified body audits. Under EU MDR Annex IX section 3.4, notified bodies must carry out unannounced audits at least once every five years, which can extend to critical suppliers or subcontractors (TÜV SÜD).
• MDSAP and FDA. FDA’s compliance program states that “Surveillance inspections are not conducted at manufacturers actively enrolled in MDSAP” (FDA CP 7382.850). But FDA notes that inspections under the QMSR “will not follow the MDSAP audit plan or procedures” (FDA QMSR FAQ).
• An FDA inspection is not an audit. It does not certify anything, and it can be for-cause. Its outcome is classified as NAI, VAI or OAI (FDA).

What QMSR changes for audit programs

Write reports for two audiences. Audit reports must still drive improvement internally, but an FDA investigator may now read them. Reports should be factual, specific and backed by objective evidence, with follow-up tracked to closure. Vague findings and missing follow-up are both visible.

Organize by FDA’s six QMS areas. CP 7382.850 inspects change control; design and development; management oversight; measurement, analysis and improvement; outsourcing and purchasing; and production and service provision (FDA CP 7382.850). Aligning your audit schedule to those areas means your audits test what FDA will test.

Audit risk integration, not just procedures. QMSR inspections look at how risk management feeds design, production, complaints and CAPA. Audits should trace one risk from the risk file through to production controls and postmarket data.

Retire legacy checklists. Checklists built on old QSR section numbers miss ISO 13485 requirements such as clause 4.1.6 software validation and clause 7.1 risk-based planning of product realization.

Building a risk-based audit program

1. Define the audit universe. List every QMS process, site, critical supplier and regulatory requirement set (QMSR, ISO 13485, EU MDR, MDSAP country requirements).
2. Rank by risk. Weigh product risk, past findings, complaint and CAPA trends, process changes and time since the last audit. New sites and tariff-driven supplier changes deserve early attention.
3. Schedule by FDA’s six areas. Make sure every area is covered each cycle, with high-risk areas audited more often.
4. Assign competent, independent auditors. ISO 19011:2026 emphasizes auditor competence, including for remote and digital audits (ISO).
5. Sample evidence, not just procedures. Trace records end to end: a complaint to its risk assessment, MDR decision and CAPA; a design change to its verification and regulatory assessment.
6. Report precisely. State the requirement, the evidence and the gap. Grade findings consistently.
7. Close the loop. Link findings to CAPA, verify effectiveness and feed results into management review.

Supplier audits under QMSR

Supplier audit reports are now open to FDA, and FDA examines outsourcing and purchasing as a distinct QMS area. That makes supplier audits a frontline control. Prioritize suppliers whose output cannot be fully verified on receipt, such as sterilizers, contract manufacturers and software providers, and confirm that quality agreements require change notification and cooperation with regulatory audits, including unannounced ones. FDA’s expansion of unannounced inspections at foreign facilities applies to device manufacturers too (Emergo by UL).

Common audit findings to look for

Early QMSR inspections show where to look. In May 2026, an FDA official told RAPS that “Risk management is the top observation,” followed by outsourcing problems, complaint handling, UDI systems and corrective actions (RAPS). Enforcement remains active: Hogan Lovells counted 19 device quality system warning letters in 2025 through September 4, versus 12 in the same period of 2024 (Hogan Lovells). Areas auditors should test hard:

• Risk files not updated with complaint, nonconformance and CAPA data
• CAPAs closed without verified root cause or effectiveness checks
• Complaints without documented MDR reportability decisions
• Process validations not repeated after equipment, material or site changes
• QMS and production software used without risk-based validation
• Supplier controls not proportionate to risk; missing quality agreements
• Procedures still citing QSR section numbers instead of ISO 13485 clauses

Medical device audit program checklist

• Audit universe covers all processes, sites, critical suppliers and markets
• Risk-based schedule, reviewed at least annually and after major changes
• Every FDA QMS area audited each cycle
• Auditor competence and independence documented (ISO 19011:2026)
• Remote and hybrid audit methods planned and controlled where used
• Audit reports factual and evidence-based, written for FDA visibility
• Findings linked to CAPA with effectiveness verified
• Supplier audits risk-based, with quality agreements current
• Readiness for unannounced notified body audits and FDA inspections
• Audit results reviewed in management review

For a clause-by-clause internal audit checklist, see our ISO 13485 internal audit checklist.

Prepare evidence before the auditor arrives

Auditors spend much of their time finding and reading documents. AI document assessment can do the first pass: read procedures and records against ISO 13485, QMSR or the EU MDR, flag likely gaps and cite the passage behind every finding, so auditors can spend their time sampling and interviewing.

Run a sample regulatory document assessment on one process before your next audit. AskDona shows the evidence; your auditors decide.

FAQ

What is a medical device audit? A systematic, independent examination of whether a quality management system meets requirements, carried out internally, at suppliers, or by certification bodies, notified bodies or MDSAP auditing organizations.

Can FDA read internal audit reports now? Yes. Under QMSR, the §820.180(c) exception no longer applies (FDA QMSR FAQ).

How often do notified bodies make unannounced audits? At least once every five years under EU MDR Annex IX (TÜV SÜD).

Which audit standard applies? ISO 19011:2026, published May 26, 2026, provides guidance for auditing management systems (ISO).

References

All pages opened and checked by October 13, 2026.

Source	Type	Date	Used for
FDA: QMSR FAQ	Regulator	2026	Audit report access, MDSAP
FDA: CP 7382.850	Regulator	Feb 2, 2026	Six areas, MDSAP
FDA: Inspection classifications	Regulator	Current	NAI/VAI/OAI
ISO: ISO 19011:2026	Standards body	May 26, 2026	Audit guideline
TÜV SÜD: Unannounced audits	Notified body	Current	Annex IX 3.4
Emergo by UL: Unannounced inspections	Consultancy	May 8, 2025	Foreign inspections
Hogan Lovells: Device inspections in 2025	Law firm	2025	Warning letters
RAPS: Top observations from QMSR inspections	Professional body	May 14, 2026	Top QMSR observations