The U.S. Government Accountability Office (GAO) says it has identified essential missing details and gaps in the FDA’s audit policies for its Third Party Review program.
“FDA’s policies do not include the audit selection criteria that it informally employs, its post-audit policies contain outdated information, and there are no time frames specifying the maximum amount of time it should take FDA to complete an audit and communicate findings to third parties,” GAO said in a report to Congress.
GAO recommends FDA update its policies and include target time frames for completing audits in order to strengthen the agency’s oversight of third-party reviewers and ensure reviewers are meeting accreditation standards to extend eligibility to review 510(k) submissions.
What is the FDA Third Party Review program?
FDA’s Third Party Review program offers medical device manufacturers a voluntary, alternative review process that allows accredited third-party organizations to review certain low to moderate risk devices at a negotiated fee. The pathway also allows sponsors to communicate with the third parties.
Third-party reviewers assess the submission using the same 510(k) criteria as FDA. After conducting its review, the third party sends its recommendation to FDA to consider before the agency makes a final decision. FDA then informs the third party of the decision to relay to the 510(k) submitter.
The program is designed to enable faster premarket reviews and allow FDA to focus its resources on reviewing high-risk devices while maintaining oversight, the report said.
FDA has accredited 32 third-party organizations since the program began in 1998. As of May 2026, there are nine third parties with active accreditation, the report said.
From fiscal years 2018 through 2025, accredited third parties submitted 617 submission reviews and recommendations to the agency, accounting for about 2% of the Center for Devices and Radiological Health’s (CDRH) annual 510(k) submission reviews.
In recent years, the number of 510(k) submissions reviewed by third parties has declined. In fiscal 2021, third parties reviewed 90 510(k) submissions, and that figure declined each year after, reaching only 67 reviews in fiscal 2025, according to the report.
GAO analysis of FDA third-party reviewer data [Image courtesy of GAO]
Frequent changes of oversight lead to confusion
FDA received $8 million for the program in fiscal years 2023 through 2027, the agency told GAO.
FDA said the program is “primarily administered by one official within CDRH who spends about 50 to 70 percent of their time on program activities.”
Other FDA employees associated with the program conduct onsite audits, accredit and recredit organizations, provide training for third parties, review the third parties’ recommendations and make final decisions.
The program has undergone several transitions and has been overseen by three different offices within CDRH, the report said, despite being primarily managed by one official.
“Institutional knowledge is concentrated among the program’s limited staff, adding to the risk that undocumented practices may be lost during transitions,” the report said. “For example, officials from Office of Regulatory Policy, which has overseen the program since 2022, noted that they could not provide detailed information about findings of audits conducted prior to their tenure because the officials who oversaw those audits are no longer at the agency.”
GAO recommended internal agencies develop documentation standards for internal control systems to retain organizational knowledge and mitigate risks associated with one person understanding the system.
“Without documenting selection criteria in policy, audit selection practices may be lost during office or staff transitions,” the report said.
Related: FDA, CMS unveil accelerated Medicare coverage pathway for breakthrough devices
How the FDA conducts audits, and its flaws
FDA has conducted 25 periodic audits since its inception in 1998. The agency’s most recent guidance defined periodic audits as “occurring at least once every 3 years.” As of May 2026, five of the nine accredited third parties have been audited, with the remaining four parties never undergoing an audit by FDA.
The agency said two of the four unaudited parties were accredited in 2026 (FDA requires an audit within the next three years) and the remaining two were accredited in 2017 and 2020 but had not reviewed any 510(k) submissions as of June 2026.
Prior to FDA’s 2024 guidance, periodic audits were conducted less frequently. Agency officials told GAO, “prior CDRH offices overseeing the program may have had other priorities or lacked resources to conduct audits on a more regular basis.”
FDA conducted one “for cause” audit in 2021 in which it found the third-party reviewer falsified credentials and sent fraudulent documents to FDA. The party’s accreditation was withdrawn.
FDA third-party audits are managed by different offices with varied policies, the report said. CDRH officials initiate audits, the Office of Inspections and Investigations (OII) conducts onsite audits and proposes its findings for CDRH to finalize, FDA said.
GAO found that certain stages of the audit process are guided by detailed policies while others have policies that “lack the specificity needed to facilitate the timely oversight of third parties and contain outdated information,” the report said.
For example, FDA’s pre-audit policy outlines the frequency with which audits should be conducted but doesn’t include the selection criteria FDA officials told GOA they utilize when selecting parties for audit.
“Neither criterion is documented in policy, though officials told us the criterion of prioritizing active third parties was used for audit selection during the most recent audit phase, which was the first conducted under the 2024 pre-audit policy,” the report said.
GAO found post-audit policies out of date and no longer used for the program. The report says another post-audit policy was in draft at the time of the office’s review but still included outdated information. FDA confirmed to GAO that the draft was the most updated version of the policy, effective May 2021.
“While officials did not have a timeline for finalizing the draft, they said that amending FDA’s policies to ensure they reflect current practices was something they had previously considered,” the report said.
Related: The three tests that decide whether a cleared device gets used
Unclear time frames could lead to operating while noncompliant
GAO found FDA’s post-audit policies did not specify time frames for how long the agency should take to complete an audit and communicate the results to the third parties.
FDA told GAO that there is “no set timeline for the review of audit memos that do not indicate potential violations,” but that its “strives to review audit memos in a timely manner when violations of regulatory significance are noted.”
GAO reviewed documentation that indicates it’s taken six or more months for some audits with deficiencies found to be resolved.
In another instance, CDRH took five months to relay findings to the third party and gave the party a month to implement corrective action. Due to the vague language in standard operating procedures, the organization could have been able to continue operating while not in compliance with program standards, the report said.
Related: FDA pilots program for more facilities inspections
GAO’s recommendation and HHS’s response
GAO recommended that the FDA commissioner update the agency’s policies for the Third Party Review program audit process. It recommends including existing criteria for selecting parties to audit, reflecting current, up-to-date post-audit practices and adding target time frames for completing audits and communicating findings.
In response, Health and Human Services said it would update its policies “to provide staff with clear guidance regarding the selection of third parties for audit and to clarify procedures and time frames for audit review and closure.”
