Your ISO 13485 certificate does not shield your contract manufacturer from an FDA inspection, and it does not shield you either. FDA has confirmed that certification to ISO 13485 does not exempt a manufacturer from inspection, and that the agency now inspects under the updated Inspection of Medical Device Manufacturers Compliance Program 7382.850 rather than the retired QSIT model (FDA, QMSR Final Rule FAQ). That shift changes how you should qualify and audit the firms that build your product.
The Quality Management System Regulation (QMSR) took effect February 2, 2026, revising 21 CFR Part 820 to incorporate ISO 13485:2016 by reference (FDA, Quality Management System Regulation). Because the standard is incorporated by reference, it becomes part of Part 820 as if written out in full (AAMI, QMSR: What You Need to Know). For OEM quality directors, that means your purchasing controls now run through ISO 13485:2016 Clause 7.4, and the records that prove those controls are inspectable. This article is a spoke of our QMSR quality systems hub, and it walks through what Clause 7.4 requires, what to request before an audit, what to watch on site, and how to write a quality agreement that leaves no ambiguity when an investigator arrives.
What ISO 13485 Clause 7.4 Requires for Supplier Controls
Clause 7.4 is where your contract manufacturer relationship lives under QMSR. It has three parts, and each one generates records an investigator can ask for.
Clause 7.4.1 requires you to establish documented procedures for evaluating and selecting suppliers based on their ability to supply product that meets your requirements, the effect of the purchased product on device quality, and criteria that are proportionate to the risk associated with the device (ISO 13485:2016 Clause 7.4.1). Selection is not a one-time event. The same clause requires you to monitor and re-evaluate supplier performance, to take action proportionate to risk when a supplier fails to meet purchasing requirements, and to maintain records of evaluation, selection, monitoring, and re-evaluation (ISO 13485:2016 Clause 7.4.1). If you qualified a CM three years ago and have no monitoring record since, you have a gap.
Clause 7.4.2 governs purchasing information. It requires that your purchasing information describe or reference the product to be purchased, including product specifications, requirements for acceptance, personnel qualification, and quality management system requirements. Where applicable, it requires a written agreement that the supplier notify you of changes to the purchased product before those changes are implemented (ISO 13485:2016 Clause 7.4.2). That change-notification clause is the practical backbone of a quality agreement, and I return to it below.
Clause 7.4.3 requires you to establish and implement inspection or other activities necessary to verify that purchased product meets your purchasing requirements, with the extent of verification based on your supplier evaluation results and proportionate to the risk of the purchased product (ISO 13485:2016 Clause 7.4.3). In plain terms: a well-qualified, low-risk CM can earn reduced incoming inspection, but you need the evaluation record that justifies the reduction.
What Documentation to Request Before the Audit
A good on-site audit starts weeks before you arrive. Request and review documents in advance so your time on the floor tests what the paper claims, rather than discovering the paper for the first time.
Ask for the CM's ISO 13485:2016 certificate and the accredited scope, and confirm the scope covers the processes they perform for you. If they participate in the Medical Device Single Audit Program, request the MDSAP audit report; ISO 13485 forms the basis for MDSAP, so those findings are directly relevant (AAMI, QMSR: What You Need to Know). Request the quality manual, the top-level procedure list, and the specific procedures that touch your product: process validation, control of nonconforming product, CAPA, complaint handling, and change control.
Request their internal audit schedule and the last two internal audit reports, along with any open CAPAs. A mature CAPA system with visible open items is a better sign than a suspiciously empty log. Ask for training records for the operators and inspectors who will run your build, since Clause 7.4.2 makes personnel qualification a purchasing requirement you are entitled to specify. Request validation summaries for the processes you depend on, whether that is cleanroom assembly, packaging sealing, or sterilization. Finally, ask for their supplier management procedure and their own sub-tier supplier list. Your CM's suppliers are your extended supply chain, and sub-tier supplier performance can directly affect the product your CM delivers to you. Clause 7.4.1 requires that your evaluation criteria be proportionate to the risk of the purchased product, which in practice means understanding how your CM manages its own suppliers for components or services that affect your device.
Which On-Site Observations Matter Most
The floor tells you what the procedures do not. In our experience, the observations that predict future problems cluster in a few areas.
Watch whether operators follow work instructions as written, or from memory. Ask an operator to show you the current revision of the instruction they are working to, then confirm it matches the document control record. Trace one device history record end to end, from incoming material through final release, and see whether the record is complete and contemporaneous or reconstructed. Look at how nonconforming product is physically segregated and dispositioned, and pull the corresponding nonconformance records.
Check the calibration status of the equipment running your process and confirm out-of-tolerance events trigger an impact assessment. In cleanroom operations, review environmental monitoring trends and gowning discipline against the CM's own limits; contamination control is a Clause 6.4 work-environment requirement under QMSR, and it is one an investigator will look at. Above all, verify that change control is real. If the CM changed a bonding parameter, a supplier, or a fixture, was it assessed, documented, and, where your agreement requires it, communicated to you before implementation? A CM that changes process silently is the single failure mode a quality agreement exists to prevent.
Structuring the Quality Agreement for an FDA Inspection
A quality agreement is inspectable. FDA's guidance on contract manufacturing quality agreements, written for drug CGMP but built on principles that transfer cleanly to device relationships, states that a quality agreement should define provisions allowing the owner to evaluate and audit contract facilities for both routine and for-cause audits, and to set expectations around FDA inspections (FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements). Two of those principles matter most for how you write yours.
First, the agreement cannot delegate away your statutory responsibility. The same FDA guidance is explicit that the owner retains ultimate product release authority even when a contract facility does the work (FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements). Write the agreement to allocate tasks, not accountability. You can assign incoming inspection, in-process checks, and record-keeping to the CM, but the document should state plainly that final release authority stays with you.
Second, make responsibilities unambiguous at the level an investigator reads. For every quality activity, name who owns it: incoming inspection, process validation, calibration, nonconformance disposition, CAPA ownership, complaint data flow, and retention of device history records. Build the Clause 7.4.2 change-notification requirement into the agreement in specific terms: define what counts as a change, the notification lead time before implementation, and your right to approve changes that affect form, fit, function, or the validated state of the process. Spell out audit rights for routine and for-cause visits, and define how each party handles an FDA inspection that lands at the CM, including notification timing and access to records. When an investigator opens your agreement and asks who was responsible for a given release, the document should answer in one sentence.
The agreement should also be severable from the commercial contract so the quality terms can be reviewed on their own. A quality director who can hand an investigator a clean, current agreement that maps every responsibility to a named owner has removed one of the most common sources of confusion in a supplier-related inspection.
The Through-Line: Records Prove Control
QMSR did not invent supplier controls, but it did make ISO 13485:2016 the enforceable baseline and put your supplier qualification records squarely in scope for a 7382.850 inspection. Qualification, on-site auditing, and the quality agreement are three views of the same obligation under Clause 7.4: select suppliers on risk-proportionate criteria, monitor them, verify what they ship, and document all of it. Do that well and a CM audit stops being an annual scramble and becomes evidence you can hand an investigator.