This guide is for a small manufacturer of finished medical devices for the US market. 21 CFR 820.1 defines the scope of the US quality-system regulation and distinguishes finished-device manufacturers from manufacturers of components or parts. A contract manufacturer's role needs its own assessment; do not assume every outsourced operation is component supply.
What decision should supplier qualification produce?
Approve a supplier for a defined scope, rather than for every future purchase. Identify the supplier site, the item or service, the specification you need and the device or process it supports. That gives the reviewer something concrete to accept, restrict or hold while you resolve the missing evidence.
For example, “approved supplier” leaves too much unanswered if the evidence covers one material grade at one site. A purchase involving a different grade, process or site needs a decision about whether the existing evidence still applies. Put the approved-for boundary beside the supplier's name.
The US framework requires an appropriate quality management system, or QMS. Section 820.10 incorporates applicable ISO 13485 requirements, using the edition identified in section 820.7. The worksheet below is a practical decision aid, not the complete standard or a prescribed regulatory form.
How much evidence do you need?
Choose evidence in relation to the purchased item's effect on device quality and the associated risk. In its response to Comment 40, page 7510, the US Food and Drug Administration, or FDA, explains supplier evaluation in terms of supplier ability, performance, quality effect and proportionate risk. It also describes monitoring and reevaluation.
Begin with a failure question. If this item or service is wrong, what would your existing process detect, and what could escape? Use that answer to decide what you need to know about the supplier and what you need to verify yourself.
A dimensional check might help establish whether a machined part meets a drawing, but it does not answer every question about a material's identity or processing history. Equally, a supplier questionnaire that describes a process does not demonstrate that a particular delivered lot meets your specification. Connect each evidence request to the uncertainty it should resolve.
You can use internal risk categories to organize the work. Explain the controls behind the category, rather than treating a label such as “critical” as the decision itself. Do not copy another company's audit schedule or scorecard without checking whether it fits the supplied work.
Can a certificate, supplier audit or incoming test settle the decision?
Each can answer part of the question. Check what a certificate covers, what an audit actually examined and what your acceptance activities can detect. Then decide whether the combined evidence supports the proposed scope of supply.
FDA's response to Comment 33, page 7508 says certification may not adequately assure supplier quality without further evaluation. It also explains that a manufacturer performing product quality control entirely in-house must still assess supplier capability. Where audits are not practical, the response describes other means, including historical data, monitoring and trending, and inspection and testing.
That explanation does not make every certificate inadequate, require an on-site audit of every supplier or establish that incoming testing is always enough. Record why your selected combination addresses the uncertainty for this item or service. If it does not, identify the missing evidence before making the approval decision.
For a certificate, useful review questions include whether the named organization, site and activity match the intended purchase, and whether the certificate is current. For an audit or test report, examine its scope, findings and relevance. A document title is not a substitute for reading what the evidence establishes.
What belongs in the supplier approval record?
Use a short record that lets another qualified reviewer follow the decision without reconstructing it from email. The following fields are suggested implementation choices. Your procedure and applicable requirements determine what the final controlled record needs.
| Record area | What to enter | What the reviewer needs to resolve |
|---|---|---|
| Defined scope | Supplier and site, item or service, specification revision and intended use | What exactly would approval permit? |
| Quality effect | Relevant failure, device-quality consequence and existing detection | Why is this depth of assessment appropriate? |
| Capability evidence | Evidence references, scope, findings, reviewer and unresolved gaps | Can the supplier provide what you need? |
| Selected controls | Supplier-side measures and your acceptance or verification activities | How does the combination address the identified uncertainty? |
| Approval decision | Approve, restrict or hold, with rationale, owner and scope | What does approval permit now, and what remains unresolved? |
| Ongoing review | Selected performance measures, change triggers, review rationale and next action | What evidence would cause you to reconsider? |
Link to the actual evidence and its revision. If an assessment refers to a drawing, record which revision it assessed. If a finding remains open, explain how it affects the decision instead of burying it in an attachment.
An approval record should also be easy to retrieve. When considering where to maintain it, the medical-device startup eQMS guide helps you think about the wider workflow rather than choosing software from a feature list.
What does a filled approval record look like?
Consider this fictional example. A small finished-device manufacturer wants to buy a machined housing from a new supplier. The example illustrates decision-making, not a validated control plan for a real device. Your design, manufacturing process and risk assessment determine the evidence and controls you need.
| Record area | Illustrative entry |
|---|---|
| Scope | Supplier A, Site 1, housing H-14 against drawing revision C. No approval for other sites or materials. |
| Quality effect | An incorrect mating dimension could prevent assembly. The quality lead must also assess relevant material and process concerns; dimensional inspection alone does not resolve those questions. |
| Evidence received | Sample dimensional report and supplier capability questionnaire. Material evidence requested for the intended scope remains outstanding. |
| Initial decision | Hold approval for production supply. The dimensional report addresses only part of the defined evidence need. |
| Next action | Obtain and review the missing material evidence, resolve any resulting gaps, and document the selected supplier and manufacturer controls. |
| Approval boundary | Approve only if the completed assessment supports the stated scope and the responsible reviewer records that conclusion. A successful sample does not authorize every future purchase. |
| Reassessment | Review whether the evidence and controls remain suitable if the supplier proposes another site or material, or if acceptance results reveal a relevant performance problem. |
The important result is the connection between the gap and the decision. “Pending paperwork” is vague. “Hold production-supply approval until the quality lead reviews the material evidence needed for this scope” tells the next person what must happen.
Apply the same reasoning to services. FDA's response to Comment 40 expressly discusses assessing whether a consultant can meet the manufacturer's identified needs. For a service supplier, define the deliverable and the evidence of capability relevant to that work rather than copying a component-inspection form.
When should you reassess a supplier?
Choose monitoring that can show whether the approved scope and selected controls remain appropriate. FDA's response to Comment 40 describes monitoring and reevaluation as required. It does not provide a universal interval for every supplier in that response.
As practical review triggers, consider a proposed site, material or process change; recurring acceptance failures; unresolved assessment findings; or new information that changes the quality-risk assessment. Decide what each relevant trigger should cause, who will review it and where that reviewer will record the decision. A trigger list without an owner leaves the work unfinished.
Select measures that inform a decision. A small supplier relationship might need a focused view of acceptance results and relevant changes rather than a large dashboard. Explain your review frequency and escalation approach in the context of the supplied work.
If a supplier issue contributes to a nonconformity, distinguish fixing the immediate problem from addressing its cause. The correction and corrective action guide explains that distinction. For a deeper investigation, the root-cause analysis guide provides related reasoning in the context of notified-body findings.
Sources and further reading
- Current 21 CFR 820.1, eCFR helps you establish the finished-device manufacturer scope and its limits.
- Current 21 CFR 820.7 and the incorporated standards, eCFR identifies the ISO edition incorporated into the US framework.
- Current 21 CFR 820.10, eCFR states the quality-management-system requirement.
- FDA's 2024 final-rule explanation, Federal Register explains supplier controls in the responses to Comments 33 and 40 on pages 7508 and 7510. These responses explain the rule; they are not a separate prescribed supplier checklist.
Use the applicable standard and requirements alongside your controlled procedure. This guide deliberately does not reproduce every ISO purchasing requirement, specify a universal audit interval or assess EU conformity-assessment obligations.
