Supplier control is now the #2 QMSR finding
In the first ~100 QMSR inspections, FDA’s Keisha Thomas ranked risk management first and “outsourcing problems” second (RAPS). One analysis calls it “the most consequential change in inspection scope” (MedDeviceOnline). Under the old QSR, § 820.50 purchasing controls drew 115 FY2025 citations (GMP Insiders).
For the full evaluation and qualification process across pharma and devices, see Supplier Evaluation and Qualification: A Step-by-Step Guide for GMP and Medical Devices.
What FDA expects under QMSR
- Risk-informed supplier control. FDA’s final rule says manufacturers must “apply an ongoing risk-informed assessment of suppliers,” “clearly document the type and extent of control they intend to apply,” and that “certification may not provide adequate assurances of supplier quality without further evaluation” (Federal Register).
- Outsourced processes and services count. “services may be parts of the manufacturing or quality system that are contracted to others.” Contract manufacturers must meet ISO 13485 clauses 4.1.5 and 7.4 (FDA CP 7382.850).
- Every inspection looks at it. Model 1 inspections cover at least one element of “Outsourcing and Purchasing”; baseline and PMA preapproval inspections include outsourcing as a minimum element.
- Supplier audit reports are inspectable. “The QMSR gives the FDA the authority to inspect management review, quality audits, and supplier audit reports” (FDA QMSR FAQ).
- Risk drives depth. FDA noted that “a purchasing process for a device with outsourced design and manufacturing may carry higher risk” (FDA transcript).
What inspectors are finding
The MedDeviceOnline analysis highlights two recurring gaps: a contract manufacturer that “accepts a generic sampling plan with an acceptable quality limit (AQL) appropriate for consumer goods,” and a quality agreement that “does not require the supplier to report nonconformances or process changes.” Its advice: audit critical suppliers “for substance, not for completed checklists.”
Supplier qualification checklist
The phases follow GHTF guidance on supplier controls (GHTF/SG3/N17:2008), still hosted by IMDRF: planning, selection, evaluation and acceptance, finalizing controls, monitoring, and feedback (IMDRF).
- Supplier and outsourced process classified by risk to product quality and patient safety, not by spend
- Type and extent of control documented for each risk class
- Qualification evidence collected: questionnaire, certificates, audit or sample evaluation, as risk requires
- ISO 13485 certificate reviewed for scope and validity, but not relied on alone
- Specifications, drawings and acceptance criteria agreed and controlled
- Incoming inspection or sampling plan justified for medical device risk (not a generic consumer AQL)
- Approved supplier list updated with status, scope and next review date
Supplier audit checklist
- Audit frequency and depth set by supplier risk
- Audit covers the supplier’s QMS, process validation, change control, nonconformance handling and traceability
- Sub-tier suppliers for critical components identified
- Findings issued as supplier corrective action requests (SCARs) with due dates
- SCAR effectiveness verified before closure
- Audit report complete and ready for FDA review
Quality agreement essentials
GHTF notes that “Irrespective of their title it is the content of such agreements which is essential.” Cover at least:
| Topic | What to require |
|---|---|
| Nonconformances | Supplier reports nonconformances promptly, including shipped product |
| Changes | Prior notice and approval of process, material, site or sub-tier changes |
| Complaints and recalls | Support for investigations, field actions and data requests |
| Audits | Right to audit, including for-cause |
| Records | Retention periods and access to batch and test records |
| Regulatory | Cooperation with FDA inspections and requests |
Check supplier documents before FDA does
Supplier files are spread across purchasing, quality and engineering, and quality agreements are often years old. AI document assessment can review supplier procedures, quality agreements and audit reports against QMSR expectations, flag missing clauses such as nonconformance or change notification, and cite the passage behind every finding.
Run a sample regulatory document assessment on one critical supplier’s quality agreement. AskDona shows the evidence; your supplier quality team decides.
FAQ
Is an ISO 13485 certificate enough to qualify a supplier? FDA says “certification may not provide adequate assurances of supplier quality without further evaluation” (Federal Register).
Can FDA see our supplier audit reports? Yes. Under QMSR, supplier audit reports are inspectable (FDA QMSR FAQ).
Are component suppliers subject to QMSR? No, but the finished device manufacturer must control them. FDA notes contracts may still require compliance.
What should a quality agreement include? At minimum: nonconformance reporting, change notification, complaint and recall support, audit rights and record access.
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| Federal Register: QMSR final rule | Regulator | Feb 2, 2024 | Risk-informed supplier control |
| FDA: CP 7382.850 | Regulator | Feb 2, 2026 | Outsourcing area, clauses 4.1.5 and 7.4 |
| FDA: QMSR FAQ | Regulator | Oct 2, 2026 | Supplier audit reports inspectable |
| FDA: QMSR webinar transcript | Regulator | Apr 1, 2026 | Outsourced design risk |
| RAPS: Top QMSR observations | Trade press | May 14, 2026 | Outsourcing #2 |
| MedDeviceOnline: Risk Is the Spine | Expert column | May 29, 2026 | AQL and quality agreement gaps |
| GMP Insiders: FY2025 observations | Industry analysis | Jan 5, 2026 | 115 purchasing citations |
| IMDRF: GHTF/SG3/N17:2008 | International guidance | Dec 11, 2008 | Supplier control phases, agreements |