Why supplier audits matter more in 2026
Supplier audits are the main way a manufacturer verifies, first-hand, that a supplier can do what its documents say. Three developments have raised their importance:
- Device audit reports are now inspectable. Under FDA’s QMSR, effective February 2, 2026, NAMSA notes that supplier audit reports, along with management review and internal audit reports, “will no longer be exempt from FDA inspection.” Audit reports that were written for internal use are now evidence.
- FDA expects real oversight of contractors. FDA’s quality agreement guidance states that, no matter who tests the products, the owners’ quality units remain “ultimately responsible” for CGMP compliance, and a quality agreement does not change that.
- EU QPs rely on audits. Annex 16 section 1.7 requires the Qualified Person to be assured that audits of relevant sites have been completed and that reports are available.
Regulatory basis
| Framework | Audit expectation |
|---|---|
| EU GMP Chapter 5 (5.29) | Audits of active substance manufacturers and distributors to confirm GMP/GDP compliance, with “any deficiencies clearly identified,” CAPA follow-up, and re-audits “at intervals defined by the quality risk management process” |
| EU GMP Chapter 7 | Audits to assess “legality, suitability and the competence of the Contract Acceptor” |
| EU GMP Annex 16 (1.7.3) | Audits of relevant sites completed, with reports available to the QP |
| ICH Q10 (2.7) | Assess suitability and competence of suppliers and contractors, for example through audits |
| ISO 13485 (7.4.1) / QMSR | Supplier evaluation, monitoring and re-evaluation, with controls proportionate to risk |
Planning the audit program
Set audit frequency by risk, not by habit.
| Supplier tier | Typical audit approach |
|---|---|
| Critical (API, sterile components, contract manufacturers, critical device parts) | On-site audit before approval; re-audit every 1–3 years based on risk and performance |
| Major | Initial audit or detailed assessment; periodic audit or questionnaire |
| Minor | Questionnaire and certificates; audit only for cause |
Trigger for-cause audits after serious nonconformances, repeated SCARs, unnotified changes, recalls or regulatory action against the supplier.
Conducting the audit
Before
- Review the supplier file: previous audits, open findings, nonconformances, SCARs, complaints, change notifications
- Define scope: sites, processes, materials and quality system elements
- Send an agenda and document request
During
- Opening meeting: scope, agenda, confidentiality
- Walk the process, not just the documents: receiving, manufacturing, testing, release, storage
- Trace a few lots end to end, from raw material to shipped product
- Check change control, deviation handling, CAPA, complaint handling, data integrity and subcontractor control
- Closing meeting: present findings and classification
After
- Report with findings classified (critical, major, minor), each with clear evidence
- Supplier responds with root cause and corrective actions
- Auditor assesses the response and agrees timelines
- Close findings only with evidence of implementation; verify effectiveness at the next audit or by data
- Update the supplier’s risk tier and qualification status
Writing reports that hold up
Under the QMSR, device makers should assume FDA may read supplier audit reports. Good practice:
- State facts and evidence, not impressions
- Classify findings using defined criteria
- Link each finding to the requirement it relates to
- Record what was not covered, so later audits can target it
- Make the conclusion clear: approve, approve with conditions, or do not approve
Supplier audit software
Typical features of supplier audit software:
- Audit program planning by risk tier, with due-date alerts
- Checklists and mobile data capture
- Findings management with supplier responses through a portal
- Links to SCARs, nonconformances and supplier qualification status
- Reporting across suppliers: overdue audits, open findings, repeat findings
As with any GMP system, audit software that holds audit records should be validated in line with Part 11 and Annex 11.
Common audit failures
- Audit frequencies that do not reflect risk
- Reports with findings but no evidence
- Findings closed on the supplier’s promise, without evidence
- Contract manufacturers requalified without checking CAPA effectiveness
- Third-party or shared audits accepted without reviewing scope
- Audit outcomes not fed back into qualification and risk tiers
Supplier audit checklist
- Audit program based on supplier risk tiers
- For-cause triggers defined
- Supplier file reviewed before each audit
- Scope, agenda and document request sent
- Lots traced end to end during the audit
- Findings classified with evidence and requirement references
- Supplier responses assessed; findings closed with evidence
- Effectiveness verified
- Qualification status and risk tier updated
- Reports written to inspection standard
Review audit files with AskDona
An audit is only as good as its follow-up. AskDona reads audit reports, supplier responses, CAPA evidence and qualification records together and flags findings closed without evidence, repeat findings across audits and reports that do not support their conclusion, each linked to the source page. Run a sample supplier audit file review on a recently closed audit. AskDona shows the evidence; your supplier quality team decides.
FAQ
What is a supplier audit? A systematic, documented examination of a supplier’s facilities, processes and quality system to verify it can meet your requirements.
How often should suppliers be audited? At intervals set by risk, typically every one to three years for critical suppliers, with for-cause audits when problems occur.
Can FDA see supplier audit reports? For medical device makers, NAMSA notes that under the QMSR (effective February 2, 2026) supplier audit reports are no longer exempt from FDA inspection.
What is a supplier quality audit? The same thing, with emphasis on the quality system and product quality rather than commercial or ESG topics.
What does supplier audit software do? Plans audits by risk, captures findings, manages supplier responses and links results to qualification and SCARs.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| NAMSA, Industry Update: QMSR | CRO / consultancy article | Audit reports no longer exempt |
| EU GMP (EudraLex Vol. 4), Chapter 5: Production | EU GMP guideline | EU GMP 5.29 |
| EU GMP (EudraLex Vol. 4), Chapter 7: Outsourced Activities | EU GMP guideline | Chapter 7 |
| EU GMP (EudraLex Vol. 4), Annex 16: Certification by a Qualified Person and Batch Release | EU GMP guideline | Section 1.7.3 |
| ICH Q10 (FDA) | ICH guideline | Section 2.7 |
| ISO 13485:2016, Medical devices: Quality management systems | International standard | ISO 13485 7.4.1 |
| FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements (Nov 2016) | FDA guidance | Owner responsibility for contract manufacturers |