Why supplier quality is under more scrutiny
Purchasing controls were already a weak spot before QMSR. In FDA’s FY2025 device inspection data, 820.50 (purchasing and supplier controls) was the third most-cited observation with 115 citations, behind only CAPA and complaint handling (GMP Insiders).
Since February 2, 2026, two things raise the stakes further:
- Outsourcing and Purchasing is one of six QMS Areas in FDA’s new device inspection program, CP 7382.850, so it is examined in most inspections (Ropes & Gray).
- Supplier audit reports are now reviewable. FDA used to stay away from them; its QMSR FAQ says they can be reviewed, and King & Spalding advise telling staff that investigators can request them (King & Spalding).
For a supplier quality engineer (SQE), the audit report you write is no longer just for your own company.
What ISO 13485 clause 7.4 expects, in practice
QMSR incorporates ISO 13485:2016, so clause 7.4 (Purchasing) now carries the weight that 820.50 used to. In summary (SimplerQMS):
| Sub-clause | What it covers | Records an SQE should be able to show |
|---|---|---|
| 7.4.1 Purchasing process | Criteria for evaluating and selecting suppliers based on their ability to meet requirements and on risk; monitoring and re-evaluation | Selection criteria, qualification records, performance data, re-evaluation results, actions on suppliers who fail requirements |
| 7.4.2 Purchasing information | What must be communicated to the supplier, including specifications and quality and change requirements | Purchase orders and specifications, quality agreements |
| 7.4.3 Verification of purchased product | Checks that purchased product meets requirements | Incoming inspection or other verification records, supplier certificates, documented controls when verification happens at the supplier |
FDA’s own MDSAP training on the purchasing process stresses the same point: the degree of control should depend on the effect the purchased product has on the finished device, and auditors check that records of supplier evaluations and verification activities are kept (FDA MDSAP training deck).
A risk-based supplier control model
| Supplier risk | Example | Typical controls |
|---|---|---|
| High | Sterilization, critical components, contract manufacturing | On-site audit, quality agreement with change notification, process validation evidence, tighter incoming checks |
| Medium | Machined parts to drawing, packaging materials | Questionnaire plus periodic audit, certificate review, sampling inspection |
| Low | Catalogue items with no effect on safety | Approved-supplier listing, certificate of conformance |
Write the risk rationale down. Under the new inspection approach investigators choose what to examine based on patient and user risk, so they will look for the logic that links your controls to that risk.
Writing supplier audit reports FDA can read
- Use a controlled template with scope, criteria, auditors, dates and supplier version of documents seen.
- State facts with evidence: “Work instruction WI-14 rev C did not include the torque value” is better than “documentation weak”.
- Classify findings using your own procedure’s definitions.
- Close the loop: link each finding to a supplier corrective action and to the supplier’s status in your approved supplier list.
- Avoid opinion that you cannot support with evidence; the same report may now be read by an investigator.
Monitoring and re-evaluation
ISO 13485 requires monitoring and re-evaluation at defined intervals or after significant changes. A practical scorecard draws on:
- Incoming inspection rejections and nonconformances
- Supplier corrective action timeliness and effectiveness
- Complaints and CAPAs traced to supplied product
- Change notifications received (or missed)
- Audit results
Feed the scorecard into management review; FDA’s MDSAP training notes that auditors check whether quality objectives for purchased product were considered there.
Who you work with
- Purchasing: supplier selection, contracts and purchase orders.
- Design and R&D: specifications and critical characteristics.
- Receiving inspection: verification of purchased product.
- Regulatory affairs: supplier-related MDRs and FDA-specific requirements.
- The quality manager: supplier risk decisions and management review input.
Common weaknesses
- Selection criteria that ignore risk.
- Quality agreements without change notification terms.
- Re-evaluations that are overdue or not documented.
- Supplier audit reports written informally.
- Incoming inspection plans that are not linked to supplier risk.
Checklist
- Documented, risk-based supplier selection criteria
- Quality agreements for high-risk suppliers, including change notification
- Re-evaluation schedule and records current
- Supplier audit template controlled and inspection-ready
- Scorecard data feeding management review
- Verification method for each purchased item linked to its risk
How AskDona helps
Supplier files are long and scattered: questionnaires, certificates, audit reports, agreements and corrective actions. AskDona reads a supplier’s file against your purchasing procedure and ISO 13485 7.4 and flags missing evaluations, expired agreements or open findings, with page citations. Run a sample supplier file review on one high-risk supplier. AskDona shows the evidence; your supplier quality team decides.
Editor’s note: The clause summaries are paraphrased from secondary sources; ISO 13485 text is copyrighted. The supplier risk tiers are an illustrative model, not a regulatory requirement. Not legal advice. The LinkedIn count was supplied by the client.
FAQ
Can FDA review supplier audit reports under QMSR? Yes. FDA’s QMSR FAQ says supplier audit reports are reviewable.
Which ISO 13485 clause covers supplier controls? Clause 7.4, Purchasing.
How often should suppliers be re-evaluated? At intervals you define based on risk, and after significant changes.
Was purchasing a common FDA observation? Yes. 820.50 was the third most-cited device observation in FY2025, with 115 citations.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| GMP Insiders: FY2025 FDA inspection observations | Industry analysis | 820.50 citation count |
| Ropes & Gray: A QMSR state of mind (Feb 17, 2026) | Law firm analysis | QMS Areas, supplier audit reports |
| King & Spalding: The QMSR goes live (Feb 3, 2026) | Law firm analysis | Inspectable records |
| SimplerQMS: Medical device supplier management | Vendor explainer | ISO 13485 7.4 summary |
| FDA: MDSAP purchasing process training | Regulator training | Degree of control, audit tasks |