How to Make Sure Your Supply Chain Doesn't Fail You in an External Audit
When an external audit or inspection comes up, whether by a notified body, the FDA or a major customer, the auditor does not only look at your own processes. They want to see that your supply chain is well managed too. If you don't have full control over your suppliers, you are exposed to findings that can lead to corrective actions, delays and even consequences for your product's approval.
Where do failures show up in an external audit?
The supplier list is not up to date
Suppliers change and components are replaced, but the documents are not always updated to match. For example:
Out-of-date quality certificates (an ISO 13485 certificate that has expired).
Incorrect supplier classification (according to the company's own procedure), which affects the level of controls required.
Missing quality documents that should have been part of the supplier evaluation, such as validations of critical processes, a COA or a COC.
An alternative supplier brought in because of a strategic change or supply problems, but who never went through a formal evaluation.
Supplier evaluation is not based on current data
Far too often, supplier evaluation relies on the supplier's history with the company instead of its current performance. For example:
A supplier that received a high rating two years ago, but whose performance has changed since then, with more delivery deviations, more quality problems or longer delivery times.
A supplier that changed ownership, or changed its manufacturing processes or production lines, but nobody rechecked whether it still meets the requirements.
A supplier that has to meet new regulatory requirements, for example keeping documentation for 10 years under the MDR, but nobody checked that it actually meets them.
Slipping standards in supplier audits
At first, every new supplier is carefully audited, but over time the frequency and quality of the audits drop, sometimes out of a sense of confidence that "we know this supplier." In an external audit, the auditor will want to see:
that the company maintains a high level of oversight, reviews its agreements with suppliers and does not relax its requirements;
that the supplier meets not only the regulatory requirements but also the quality requirements the company defined for it;
that recurring problems are not ignored because of a long-term relationship with the supplier. If there are more deviations, the audit frequency should go up, not down.
Insufficient incoming inspection
When materials or components arrive from suppliers, everyone expects them to meet the requirements, but in practice there is no orderly proof that the required quality checks were performed. For example:
Raw materials accepted without laboratory testing to verify that they meet the required standards.
Mechanical components inspected only on a sample that is too small, which increases the risk of production quality problems.
No tracking of supplier performance based on the quality of the materials received. For example, if several shipments had deviations, this must show up in the supplier evaluation system.
Agreements that do not cover the regulatory requirements
The manufacturer is always responsible for regulatory compliance, but supplier agreements should make sure suppliers support these requirements. In many cases this does not happen. For example:
The agreement does not include a commitment from the supplier to support external audits and provide documentation on request.
There is no clause requiring the supplier to notify you in advance of changes to manufacturing processes or to the source of materials.
The agreement does not include clear definitions for retaining quality records, availability of documentation and regulatory updates.
How do you avoid findings in an external audit?
Update the supplier list on an ongoing basis. Make sure someone owns the update process and that there is a clear, orderly mechanism ensuring every supplier change is documented and goes through an appropriate evaluation.
Evaluate suppliers based on current data. Review quality data, delivery times and actual performance, not just history.
Don't give up on periodic supplier audits. Even if a supplier has worked with you for several years, that does not mean there is no need to audit it in depth.
Make sure your incoming inspections are actually performed, and at an appropriate frequency, especially when the quality of the final product cannot be tested.
Make sure your supplier agreements cover all the requirements, so that the supplier is committed to providing everything needed from a regulatory and quality standpoint.
When an external audit comes, the auditor is not only looking for orderly documents. They want to see that your suppliers are truly under control, that your processes are controlled, and that you identify and manage risks in your supply chain. If you are not sure everything is in order, it is better to check now than to find out during an external audit.