Customer, Supplier and Internal Audits
Customer Audit
If you make components, subassemblies or finished devices for another company, your customers will audit you. A customer audit isn't regulatory, but it can decide whether you keep the business, and what the customer records about you can be reviewed by FDA in their files.
At a Glance
- Conducted by
- Your customer's quality or supplier quality team, or a third party acting for them
- Basis
- Your quality agreement, purchase requirements and the customer's own regulatory obligations
- Notice
- Typically scheduled in advance; problem-driven visits can come at short notice
- Possible outcome
- Findings to address, changes to supplier status, or added controls
What It Is
Device manufacturers are responsible for controlling their suppliers, and auditing is one of the main ways they do it. When you're the supplier or contract manufacturer, the customer audit is how they check your quality system against their requirements, the quality agreement and the regulations they answer to.
Unlike a certification or FDA audit, the criteria are partly set by the customer. One may focus on process validation for the parts you make, another on change notification or traceability. The quality agreement is the place to start, because it defines what you've promised.
Under the QMSR, a manufacturer's supplier audit records are open to FDA inspection. Your customer's audit reports on you can therefore be read during their own inspection, which makes those findings more consequential than they used to be.
Who Conducts It
Supplier quality engineers or auditors from the customer, sometimes joined by engineering or sourcing. Some customers use consultants or third-party audit firms instead.
Expect different styles from different customers. A large manufacturer may bring a detailed checklist, while a smaller one may focus on a few specific risks.
What Triggers It
- Supplier qualification before a customer places production orders with you
- Periodic requalification on the customer's audit schedule
- A quality problem, complaint or nonconformance traced to your product
- Significant changes you've notified, such as a new site, process or sub-supplier
- The customer's own preparation for FDA, notified body or MDSAP audits
What They Look At
Quality Agreement Commitments
Whether you do what the agreement says: change notification, records retention, nonconformance reporting and right of access.
Process Validation and Control
Validation and monitoring of the processes that make the customer's parts, especially special processes.
Change Notification
Whether changes affecting their product were notified and approved before you implemented them.
Traceability and Production Records
Lot and component traceability, and the production records the customer relies on for its own files.
Nonconformance and CAPA
How nonconforming product is handled, communicated to the customer and prevented from recurring.
Your Own Supplier Controls
How you control the sub-suppliers that affect the customer's product.
How to Prepare
- 01
Reread the Quality Agreement
List every commitment and gather evidence that each one is being met.
- 02
Pull the Customer's History
Collect complaints, nonconformances, deviations and changes affecting this customer's product since the last audit.
- 03
Prepare Product-Specific Records
Have validations, inspection records and traceability for their parts ready to walk through.
- 04
Protect Other Customers' Information
Make sure records shown during the audit don't expose another customer's product, drawings or pricing.
- 05
Assign a Host and Experts
Choose someone who knows the account well and can bring in process experts as questions come up.
Common Pitfalls
- Changes made without notifying the customer because they seemed minor internally.
- Showing records that reveal another customer's product or pricing.
- Quality agreements signed and filed but never built into procedures.
- Corrective action responses that promise more than the plant can deliver by the date given.
- Treating each customer's findings separately instead of fixing the system issue behind them.
How QMSAdvisor Helps
- An AI-assisted first pass that checks your procedures against what your quality agreements commit you to, with advisor review.
- Findings and corrective actions from every customer audit tracked in one action plan, so system-level issues show up across customers.
- Evidence submission with advisor acceptance, so the response you send a customer is backed by records.
- CAPA records for customer-reported issues, from correction and root cause through effectiveness verification.
Supplier Audits and Supplier Controls
Risk-based supplier selection, quality agreements, monitoring and supplier audits that hold up under QMSR.
Full Audit Readiness Assessment
Documents, records, evidence and interviews, checked against the specific audit you're facing next.
CAPA System Remediation
Fixing a CAPA system auditors keep citing: the procedure, the records, root cause, effectiveness and backlog.
Internal Audit Program
A risk-based internal audit program, run by your team or our advisors, with reports written for FDA to read.
Standards and Regulations Involved
Questions About the Customer Audit
Do we have to allow customer audits?
That depends on your contract and quality agreement, which commonly include a right to audit. Device manufacturers are expected to control their suppliers, so refusing reasonable audits usually becomes a commercial problem even where the contract is silent.
Can FDA see our customer's audit report about us?
Under the QMSR, a manufacturer's supplier audit records are open to FDA inspection, so your customer's reports on you can be reviewed during their inspection. Address findings properly and keep your response records in order.
How do we handle confidentiality during the audit?
Show what the customer needs to verify their product and your system, and protect other customers' information. Agree in advance what can be copied or photographed, and keep a log of what you provide.
What if several customers find the same issue?
That's a strong sign of a system problem rather than a customer-specific one. Open a single CAPA for the underlying cause and reference it in each customer response.
Related Audits and Inspections
Supplier Audit
Audits you perform of your own suppliers and contract manufacturers as part of purchasing controls.
Internal Audit
Audits your own team runs of your quality system, now open to FDA inspection under the QMSR.
FDA Baseline Surveillance Inspection
FDA's comprehensive surveillance inspection of your quality system under Compliance Program 7382.850.
Request an Assessment
Prepare for Your Customer Audit With an Advisor
Tell us what's coming and when, and an advisor will scope readiness work around it. Please don't send confidential documents yet: secure upload is set up after onboarding.
