ISO 13485 and Factory Audits for Medical Equipment Suppliers: What to Expect

A medical equipment supplier with an ISO 13485 certificate has demonstrated that it operates a quality management system. Buyers sometimes read that as a guarantee about the product they are buying, which is a reasonable misunderstanding and an expensive one.

The certificate describes a system. The product is what the buyer needs to verify. Understanding the difference changes what a buyer asks for and makes a factory visit considerably more productive.

What ISO 13485 Actually Covers

The standard sets out requirements for a quality management system specific to medical devices. It covers how a company designs, produces, inspects and traces its products, and how it handles complaints and corrective actions.

What it does not do is certify any particular product. A certificate says the system is capable of producing conforming product; it does not say that every product leaving the factory conforms.

The practical consequence is that a certificate is a starting point for trust rather than a substitute for verification, and a buyer who treats it as the finish line is relying on a system rather than on evidence about the goods arriving.

Certification Audit Versus Buyer Audit

A certification audit checks the system against the standard. An auditor samples processes, records and controls, and decides whether the system meets the requirements. It is a breadth exercise.

A buyer audit is narrower and deeper. It asks whether this factory produces the specific product being purchased, with the documentation to prove it: the specification, the test regime, the traceability chain and the change control that protects all three.

Both are useful and they are not interchangeable. A supplier that performs well in a certification audit may still have no records answering the buyer’s question about the exact model being ordered.

Documents That Prove Audit-Readiness

Five document families answer most buyer audit questions. The device specification as agreed, with revisions. The incoming inspection records for critical components. The in-process and final test records, with pass criteria. The traceability record linking the delivered units to their component batches. And the change control log with the approvals behind each change.

A supplier that can produce all five from the file, during the visit rather than a week later, is genuinely operating a system. A supplier that needs to retrieve them from several departments is operating a system that exists on paper.

Where a buyer needs the audit to support import documentation, the same files overlap with the pack that customs and regulators request, described in our notes on import document packs for medical devices.

The Regulatory Layer

Quality system requirements sit alongside regulation rather than replacing it. In the United States, device quality system provisions are set out under eCFR Title 21, including device quality system requirements, structured in a way that aligns with ISO 13485, so a supplier serving both the standard and the regulation is generally working to one system.

Buyers should know which market the equipment is destined for before the audit, because that decides which regulatory evidence matters. A unit bound for one market may need documentation that is irrelevant to another, and the audit should focus accordingly.

Market-specific requirements also shape service obligations, which is why the service contract is often reviewed in the same visit. The terms a buyer should negotiate, from response times to spare parts commitments, are described in our notes on OR equipment service contracts and SLAs.

What to Look at on the Floor

Documentation can be prepared; a shop floor is harder to dress. Four observations are worth more than a document review alone.

The test area should look used, with equipment and records at hand rather than in a cupboard. Components should be identifiable to their batches, not loose in unlabelled bins. The quarantine area for non-conforming material should exist and contain something. And the assembly stations should match the process the documents describe.

Questions are as revealing as observations. Ask what happens when a test fails, and follow the answer to the record. Ask who signs a change, and where that signature appears. Ask how a unit in the field is traced back to its components. The answers show whether the system is lived or documented.

Running the Audit Well

Five steps make a supplier audit effective: define the product and market being audited rather than the company in general, request the document list in advance, verify documents against physical product on the floor, follow one unit through the traceability chain end to end, and agree corrective actions in writing with dates.

A well-run audit is not an adversarial exercise. The supplier’s ability to answer questions quickly is itself useful commercial information, because it predicts how service issues will be handled after installation. Our OEM and localisation programme keeps the audit file current per model, so a buyer visit starts from evidence rather than from preparation.

Preguntas frecuentes

Video: Should-Cost Analysis: TCO vs Price in Procurement

If you are qualifying a medical equipment supplier, send the models and destination markets. Our OEM team will prepare the audit file per model so the visit can focus on production rather than retrieval.