FDA changes reveal the illusion of risk-based supplier audits

FDA now inspects device makers by risk. Supplier audit programs still built on fixed rotations and one-size-fits-all checklists stand out fast, and for the wrong reasons.

By Binitkumar Vaghani, Siemens Healthineers

Ask any supplier quality team whether their audit program is risk-based and they’ll say, “Yes, the procedure says so.”

Then look at the audit schedule. Every approved supplier sits on the same rotation (usually 12 months) and every audit runs against the same checklist. A critical sterile-barrier supplier and a low-risk fastener vendor get the same visit, the same questions, and the same one-day agenda.

That is the illusion: risk-based in the procedure, calendar-based in practice.

For years nobody outside the company looked closely. That changed on Feb. 2, 2026, when FDA retired the QSIT inspection approach and began inspecting under Compliance Program 7382.850, which organizes inspections around six quality system areas. Outsourcing and purchasing is now one of them, a dedicated area in its own right.

Just as important, supplier audit reports that used to be shielded from routine review under the old exemption in 820.180(c) are now open to investigators. When an investigator sees a sterile-barrier supplier and a fastener vendor audited on the same schedule against the same template, there is an obvious thread to pull.

Score suppliers with data you already have

Fixing this does not require new software or new headcount. The data is already in the quality system.

Start with four or five inputs: receiving-inspection reject rates, SCAR and CAPA history, criticality of the purchased component, single-source exposure, and any linkage to product complaints. Weight them, score each supplier on a simple 1 to 5 scale, and let the math sort the supplier base into tiers. A weighted matrix in a spreadsheet is enough to start.

Do this honestly and the results surprise people. A quiet supplier everyone ignores turns out to be single-sourced on a critical component with a thin margin at receiving inspection. A supplier that consumes audit hours every year turns out to be low risk by every measure except habit.

Two mistakes sink these programs. The first is scoring every supplier medium, which recreates the flat calendar with extra steps. The second is scoring once and never refreshing. A risk score is a snapshot. Tie re-scoring to trigger like a major SCAR, a complaint linked to the supplier’s component, a process or site change, or simply 12 months passing.

Change the scope, not just the schedule

Most teams that adopt risk scoring stop at frequency. High-risk suppliers get audited more often, and the checklist stays universal. That misses half the value. Risk should also decide what you audit.

A top-tier supplier earns a deep look at the processes behind its score: process validation, environmental monitoring for a sterile-barrier supplier, change control, and the records connecting their process to your device.

A middle-tier supplier can be covered by a remote or desktop assessment every 24 months, focused on its top nonconformance drivers.

A low-risk supplier gets a questionnaire, with an on-site visit only if performance slips. The audit agenda should read like it was written for that supplier, because it was.

Make it defensible when the investigator asks

A risk-based schedule only works if it can be explained under questioning. Keep a one-page, data-backed rationale for each supplier’s tier and cadence and be ready for the three questions an investigator is likely to ask about any low-risk classification: What data supports this rating? When was it last refreshed? And what would move this supplier up a tier? If the answers live in a document instead of someone’s head, the conversation is short.

This documentation matters more now that audit reports themselves are inspectable. Write findings factually, close the loop between what the audit found and what the corrective action record shows, and make sure the schedule you defend matches the schedule you actually ran.

The payoff come in audit hours that move from suppliers who never posed a risk to the handful who do, findings that get deeper because the scope is focused, and the program telling a story an investigator can follow: Here is our risk, here is our data, and here is why we audit the way we do. That is what risk-based was always supposed to mean. The calendar was just easier, until now.

Binitkumar Vaghani is a senior supplier quality engineer at Siemens Healthineers who oversees comprehensive supplier management and serves as a lead auditor for a global network of suppliers, covering new product introductions, audit strategies, and contract manufacturing oversight for Class II and III medical devices dedicated to cancer care and interventional oncology. He is also focused on modernizing medtech quality systems by applying Quality at the Source principles, Industry 4.0 innovations and digital twin technology.

Read more MDO Contributions and learn how to submit your own.

The opinions expressed in this article are the author’s only and do not necessarily reflect those of Medical Design & Outsourcing or its employees.