Written and maintained by CASRAI Editorial Board
Last updated
Short answer
A factory audit is a buyer’s on-site examination of the place where a product is made, usually an overseas plant supplying medical or laboratory products. Before you book travel, ask the manufacturer for its ISO 13485 certificate and any Medical Device Single Audit Program (MDSAP) audit report, because a recent regulator-recognised audit may already answer part of what you would otherwise inspect. This page is general information, not regulatory or legal advice.
What a factory audit is, and how it differs from a supplier audit
The two terms overlap. A supplier audit is the wider exercise: it can be done on paper, by questionnaire or on site, and it covers the supplier as a business. A factory audit is the on-site part, carried out where production happens. The rest of this page covers only what is specific to an overseas factory making medical or lab supplies, so read the supplier audit guide for audit types, report structure and re-audit frequency.
How to conduct a factory audit of an overseas medical or lab supplier
The order below is an editorial workflow built around the regulatory facts in the next sections. It is not a method prescribed by any regulator.
1. Decide what the product’s regulatory status is
Establish whether the maker sells the product as a medical device in the market you supply. If it does, the quality-system rules for that market define what a conforming factory should be able to show you. If it does not, the regulatory sections below do not apply and your questionnaire has to carry the whole load.
2. Request documents before you travel
Ask for the quality-system certificate, the issuing body’s name, and any single-audit report the manufacturer holds (see the table below). Pair this with a supplier risk assessment so the visit targets the risks that matter for the product.
3. Decide whether you still need to travel
If a recognised audit report covers the site and product line, you may be able to narrow the scope of your own visit to the points the report does not address, such as your own specifications and packaging requirements. That is a buyer’s judgement, not a rule.
4. Audit on site against your agreed scope
Take the questionnaire and checklist you sent in advance and compare what the factory documented with what you see being done. Keep the report factual and send findings to the supplier in writing.
5. Confirm what arrives
An audit approves a site at a point in time; it does not inspect your shipment. Pair it with incoming inspection sampling and check the certificate of conformity that accompanies each lot.
Factory audit checklist, supplier audit checklist and questionnaire: which is which
These are three different documents that searchers often treat as one. A questionnaire is sent to the supplier before the visit and answered in writing. A supplier audit checklist is the broader list used across the whole supplier relationship. A factory audit checklist is the working list you carry on the production floor. The same underlying questions can feed all three; keep one master list and cut it down for each use. For a ready list of topics, see the checklist section of the supplier audit guide.
Where regulator-recognised evidence can reduce what you audit
Three sources, each checked on 2026-11-01, give a buyer concrete things to ask a device manufacturer for.
- US Quality Management System Regulation (QMSR). The US Food and Drug Administration (FDA) states that the rule is effective February 2, 2026, and that it incorporates ISO 13485:2016 and clause 3 of ISO 9000:2015 by reference. If an ISO 13485 clause conflicts with the Federal Food, Drug, and Cosmetic Act or its regulations, the statute and regulations prevail. FDA also says it began using the inspection process in Compliance Program 7382.850, “Inspection of Medical Device Manufacturers”, on February 2, 2026. Source: FDA, eCFR, 21 CFR 820.10, version dated 2026-03-01.
- MDSAP. The program allows an MDSAP-recognised Auditing Organization to conduct a single regulatory audit of a device manufacturer, and the audit satisfies the relevant requirements of the participating regulatory authorities. FDA says it may continue to accept MDSAP audit reports as a substitute for routine agency inspections. Source: FDA, MDSAP guide and the ISO 13485 certification guide.
Documents to request before you travel versus what to look at on site
Stage Ask for or check Why, from the sources Before travel The manufacturer’s ISO 13485 certificate and the body that issued it 21 CFR 820.10 requires a documented quality management system that complies with ISO 13485 requirements; the QMSR incorporates ISO 13485:2016 (FDA, effective 2026-02-02). Before travel Whether the site has an MDSAP audit report, and which authorities participate MDSAP participants: Australia TGA, Brazil ANVISA, Health Canada, Japan MHLW and PMDA, US FDA. FDA may accept MDSAP reports in place of routine inspections. Before travel How the maker handles reporting, UDI, traceability and advisory notices for US-marketed devices 21 CFR 820.10(b) lists parts 803, 830, 821 and 806 as applicable requirements “as appropriate”. On site That the documented quality system is the one in use on the floor (editorial) 820.10(a) requires the system to be documented; seeing it operate is the point of a visit. This is the buyer’s check, not an FDA instruction. MDSAP observer and affiliate programs also exist (observers include the EU, Singapore HSA, UK MHRA and the WHO Prequalification of IVDs; affiliates include Argentina, Israel, Kenya, Korea, Mexico, South Africa and Taiwan). Confirm which authority matters for your market.
Common misunderstandings
- “ISO 13485 certified means audited by my regulator.” A certificate and a regulator’s MDSAP audit are separate things; see the MDSAP guide linked above.
- “An MDSAP report replaces my audit.” FDA’s wording concerns FDA’s own routine inspections. Whether it satisfies a buyer’s requirements is not something FDA’s page addresses.
- “A factory audit approves the product.” It looks at a site and its system. Product conformity for each lot is a separate question.
- “The FDA rule tells buyers how to audit suppliers.” The QMSR page is about manufacturers’ quality systems and FDA inspections, not buyer audits.
Frequently asked questions
How do you conduct a factory audit?
Confirm the product’s regulatory status, request the quality-system certificate and any MDSAP report, define a scope from what those documents leave open, then visit and compare documented procedures with practice, and report findings in writing. The audit types and report format are in the supplier audit guide; for contract makers, also see contract manufacturing for medical devices.
What should be on a factory audit checklist?
For a medical or lab supplier, start with the evidence above: the ISO 13485 certificate, the issuing body, any MDSAP report, and how the maker handles reporting, traceability and unique device identification. Add your own product specifications and packaging requirements.
What is the difference between a factory audit and a supplier audit?
A supplier audit looks at the supplier as a whole and can be remote; a factory audit is the on-site examination of the production site.
Can an MDSAP report stand in for my own audit?
FDA says it may accept MDSAP reports as a substitute for its own routine inspections. Whether you accept one in place of a buyer’s audit is your own decision based on scope and date.
Sources
- FDA, Quality Management System Regulation (QMSR), content current as of 2026-02-02, checked 2026-11-01. https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr
- FDA, Medical Device Single Audit Program (MDSAP), current as of 2025-12-19, checked 2026-11-01. https://www.fda.gov/medical-devices/cdrh-international-affairs/medical-device-single-audit-program-mdsap
- eCFR, 21 CFR 820.10, version 2026-03-01, checked 2026-11-01. https://www.ecfr.gov/current/title-21/part-820/section-820.10
