Supplier and Outsourcing Controls Under QMSR: The Audit Records Exemption Is Gone

Of all the changes QMSR introduced when it replaced the QSR on February 2, 2026, one procedural shift deserves more attention than it’s gotten: supplier audit records, which were explicitly exempt from FDA inspection under the old regulation, are no longer protected. For manufacturers whose supplier oversight has been thinner in practice than it looks on paper, that’s a significant and immediate exposure.

The Exemption That No Longer Exists

Under the prior QSR, 21 CFR 820.180(c) explicitly exempted supplier audit records from FDA inspection — a carve-out reinforced by QSIT inspection procedures. In practice, this meant a manufacturer’s internal assessment of its own suppliers was largely shielded from direct FDA scrutiny, even though the manufacturer remained accountable for supplier-related quality failures.

QMSR revised 820.180(c) to remove that exemption. Combined with QSIT’s official withdrawal, FDA inspectors can now review supplier audit records directly — alongside internal audit records and management review records, both previously treated with similar limitations. This is a structural expansion of what FDA can examine, not just a documentation formatting change, and it means the gap between what a manufacturer’s supplier program looks like on paper and how it actually operates is now directly visible to inspectors.

What ISO 13485 Clause 7.4 Actually Requires

QMSR incorporates ISO 13485 by reference, and Clause 7.4 governs purchasing and supplier controls specifically. The clause requires that supplier evaluation and control be proportionate to the risk associated with the medical device — a principle that sounds intuitive but demands systematic implementation to satisfy in practice. Concretely, this covers:

Supplier identification, selection, and evaluation. Assessing potential suppliers against technical specifications, regulatory and QMS compliance, and delivery reliability before formal approval — not simply defaulting to existing vendor relationships without documented evaluation criteria.

Formal supplier approval. Verifying that an approved supplier meets all relevant requirements — sample approval, technical specification conformance, regulatory certification — with that verification documented, not assumed.

Ongoing re-evaluation, not just initial qualification. This is a meaningful departure from the prior framework: QSR required initial supplier evaluation, but ISO 13485 explicitly requires ongoing re-evaluation on a defined cadence. A supplier approved three years ago without subsequent reassessment is a gap under QMSR that wasn't necessarily a gap under QSR.

Verification of purchased product. Confirming, through inspection, testing, or other verification methods, that purchased products actually meet specified requirements before use in production or delivery to customers — with records maintained demonstrating this was done.

Outsourced process oversight. For any process a manufacturer outsources that impacts requirements of the standard — contract manufacturing, sterilization, software validation, testing services — the manufacturer retains responsibility for monitoring and controlling that outsourced process, typically formalized through documented quality agreements defining roles and responsibilities.

A Practical Framework: Risk-Tiered Supplier Oversight

Because Clause 7.4 explicitly ties control intensity to risk, manufacturers building a defensible supplier program under QMSR benefit from a tiered classification approach rather than applying uniform oversight across every supplier:

Tier A (Critical). Suppliers whose products or services directly impact device safety, performance, or regulatory compliance — component manufacturers, sterilization providers, software validation partners. These warrant the most thorough audits, validation evidence, and continuous performance monitoring, and are the suppliers most likely to draw direct inspector attention now that audit records are reviewable.

Tier B (Major). Suppliers whose products or services significantly affect product quality or QMS effectiveness, without being directly safety-critical — meaningful oversight, but proportionately less intensive than Tier A.

Tier C (Minor) and Tier D (Indirect). Suppliers with minimal or indirect impact on device function, warranting lighter-touch monitoring proportionate to their actual risk contribution.

This proportionality isn't optional under the standard — it's the explicit mechanism by which Clause 7.4 expects manufacturers to allocate limited quality resources sensibly, rather than treating every vendor relationship identically.

Where Accountability Sits

QMSR reinforces a principle that was always technically true but is now more directly enforced: the manufacturer — the legal manufacturer of record — cannot delegate accountability for supplier-related quality failures to the supplier itself. Outsourcing a process doesn't outsource responsibility for it. This has a direct implication for management review: supplier risks and performance trends are expected to be reported into management review with documented actions taken, connecting supplier oversight to the same executive accountability structure QMSR expects for the rest of the quality system.

What Manufacturers Should Do Now

Audit your own supplier audit records as if FDA already can. Because they now can. Manufacturers should review their existing supplier audit documentation for the kind of gaps that used to be low-risk — thin evaluation criteria, missed re-evaluation cycles, undocumented rationale for supplier approval — and remediate before an inspector finds them first.

Build or formalize supplier risk tiering if it doesn't already exist. A defensible, documented risk classification is what allows a manufacturer to demonstrate proportionate — rather than arbitrary or inconsistent — oversight when questioned.

Ensure quality agreements with outsourced partners are current and specific. Especially for critical outsourced processes like sterilization or software validation, quality agreements should clearly define both parties' responsibilities, and manufacturers should periodically confirm those agreements reflect actual current practice, not a template signed years ago.

Connect supplier corrective action requests (SCARs) to the broader CAPA system. When a systemic supplier issue surfaces, it should trigger a supplier corrective action request that feeds into the manufacturer's own CAPA and risk management processes — not remain isolated as a supplier-side-only issue.

The removal of the supplier audit record exemption is, in a sense, the clearest single illustration of QMSR's broader philosophy: FDA's inspection authority now extends to the internal reasoning behind a quality system, not just its external outputs. For supplier management specifically, that means the documentation quality manufacturers have always been supposed to maintain now genuinely matters — because someone outside the organization can finally see it.

This article reflects FDA's QMSR, effective February 2, 2026, and its incorporation of ISO 13485:2016 Clause 7.4. It is intended for general regulatory and educational purposes and does not constitute regulatory or legal advice for a specific supplier program.