For overseas medical consumable distributors sourcing from manufacturers like SLK Medical, a supplier’s audit-readiness is not a checkbox—it’s a supply chain risk signal.
Key Takeaways
Audit survival starts with four pillars: process validation (IQ/OQ/PQ), a closed-loop CAPA system, structural traceability from raw material to distribution, and an active PMS/PSUR cycle.
FDA’s QMSR is now in effect (February 2, 2026): ISO 13485:2016 is incorporated by reference into 21 CFR Part 820. If you are ISO 13485-certified, you are already on the right structural foundation—but execution gaps still get flagged.
EU MDR mandates a documented PMS plan and PSUR for every Class IIa/IIb/III device, updated annually or biennially, depending on device class.
CAPA is the #1 FDA inspection finding. An incomplete root cause analysis or unverified effectiveness check is the fastest path to a Form 483 observation.
Traceability must be structural, not manual: disconnected PDFs are not acceptable under either QMSR or EU MDR audits. Bi-directional lot traceability is the standard expectation.
SLK Medical’s validation and CAPA infrastructure serves as a reference benchmark for what a distribution-ready OEM audit file looks like in practice.
Introduction: Why “We Have ISO 13485” Is Not Enough
Every year, notified bodies and FDA investigators walk into facilities that have ISO 13485 certificates on the wall—and still issue major findings.
The certificate says the system exists. The audit determines whether the system works.
For overseas medical consumable distributors operating in the US, EU, Middle East, or Latin America, this distinction is everything. Your hospital and procurement clients increasingly require not just a copy of a supplier’s certificate, but evidence that the underlying QMS—its validation records, CAPA files, traceability logs, and PMS outputs—can actually be presented under scrutiny without gaps.
This guide covers exactly that: the four audit-critical QMS components, what regulators look for in each, common failure patterns, and how a well-structured manufacturer positions itself to pass.
Part 1: The Regulatory Landscape in 2026
FDA QMSR: The Shift That Changes Everything
On February 2, 2026, the FDA finalized its Quality Management System Regulation (QMSR), replacing the legacy Quality System Regulation (QSR) and stopping use of its QSIT inspection technique. The new rule incorporates ISO 13485:2016 by reference into 21 CFR Part 820.
Practically, this means:
Management reviews and internal audits are now FDA-inspectable. Previously, FDA’s QSIT approach had limited visibility here. Under the updated Compliance Program 7382.850, investigators can now examine management review minutes, internal audit schedules, audit findings, and follow-up records.
QMS software validation is an explicit requirement. Any software used to manage documents, track CAPAs, handle complaints, or control training records must be validated.
There are no more categorical exemptions. Firms must demonstrate ISO 13485-aligned QMS compliance, and the FDA now expects to see live evidence, not just approved procedures.
EU MDR: Post-Market Surveillance as a Lifetime Obligation
Under Regulation (EU) 2017/745, post-market surveillance is not a one-time report. It is a continuous, documented system. For distributors sourcing CE-marked wound care dressings (typically Class IIb under MDR for products like silicone foam dressings), your supplier must maintain:
Document | Device Class | Update Frequency |
|---|---|---|
PMS Plan | All classes | Continuously updated |
PMS Report | Class I | Per Article 85 |
PSUR (Periodic Safety Update Report) | Class IIa, IIb, III | IIa: every 2 years; IIb/III: annually |
MDCG 2025-10, released in early 2025, reinforced that each device (or justified device group) must have its own PMS plan specifying data sources, analysis methods, performance thresholds, and how findings feed back into risk management and technical documentation.
Part 2: Process Validation — The Foundation Auditors Check First
What Validation Actually Covers
Validation is not a single activity. In a wound care manufacturing context, it encompasses:
Process validation: sterilization (EO, gamma, e-beam), packaging (ASTM F2097 or equivalent), coating processes (silicone application consistency), sealing (peel strength per ISO 11607)
Equipment qualification: IQ (Installation Qualification), OQ (Operational Qualification), PQ (Performance Qualification) for critical production equipment
Software validation: for any system that controls production parameters, manages quality records, or supports CAPA and complaint workflows
Revalidation: triggered by process changes, deviations, equipment replacements, or periodic review schedules
What an Auditor Expects to See
A complete validation file includes:
Validation Master Plan (VMP): scope, methodology, responsibilities, acceptance criteria
Individual validation protocols: each specifying what is being validated, how, and what constitutes pass/fail
Executed results and deviations: with deviation disposition and justification
Approved validation summary report: signed by qualified personnel
Change control linkage: any changes to a validated process must trigger documented impact assessment and revalidation decision
Common finding: Protocols are approved, but the executed results show deviations that were closed without proper disposition. Or revalidation was never triggered after a documented process change.
The SLK Medical Benchmark
SLK Medical’s manufacturing approach provides a practical reference for what a distributor should expect from a compliant OEM supplier. Their facility, operating under ISO 13485 certification audited by TÜV Rheinland, maintains documented validation for their silicone foam dressing production lines—including sterilization, packaging seal integrity, and silicone coating consistency.
When requesting a supplier’s qualification documents, the checklist should include:
Sterilization validation summary (method, dose, parameters, bioburden baseline)
Packaging validation report (seal strength, microbial barrier testing)
Process validation protocols for critical manufacturing steps
Change control records for any post-validation modifications
Revalidation evidence where changes occurred
Part 3: CAPA — The System That FDA Cites Most
Why CAPA Failures Dominate FDA Inspection Findings
CAPA (Corrective and Preventive Action) under 21 CFR 820.100 and ISO 13485 Clause 8.5 is consistently the most frequently cited area in FDA Form 483 observations and EU notified body findings. The reasons are structural:
Root cause analysis is not performed—or is superficial (e.g., “operator error” without systemic analysis)
Corrections are implemented but corrective actions are not distinguished from corrections
Effectiveness verification is documented as “planned” but never actually executed
CAPA records exist as static PDFs with no cross-links to the originating events (complaints, nonconformances, deviations)
A CAPA That Holds Up in an Audit
A defensible CAPA record contains:
Element | What Auditors Check |
|---|---|
Problem statement | Specific, measurable, tied to a real quality event |
Source linkage | Direct reference to NC ID, complaint number, audit finding |
Root cause analysis | Documented methodology (5-Why, Fishbone, FMEA), justified conclusion |
Correction | Immediate containment action with scope and disposition |
Corrective action | Systemic fix targeting root cause, with implementation evidence |
Preventive action | Proactive measure to prevent occurrence in similar processes |
Effectiveness check | Documented verification that the action worked, not just “completed” |
Management review | Escalation and sign-off where required by risk |
Related record links | Change controls, risk updates, SOP revisions tied back to the CAPA |
What “Good CAPA Metrics” Look Like
Distributors evaluating OEM partners should ask for CAPA performance data as part of supplier qualification. Key indicators include:
Average CAPA cycle time: from opening to effectiveness-verified closure
CAPA recurrence rate: percentage of CAPA root causes that reappear within 12 months
CAPA escape rate: issues identified externally (customer complaints, vigilance reports) that should have been caught internally
Overdue CAPA percentage: CAPAs past their committed closure date without approved extensions
SLK Medical maintains CAPA performance tracking as part of its management review process. Distributors requesting supplier qualification documents can include a summary CAPA performance report as a standard ask—any mature QMS should be able to provide aggregate trend data without exposing confidential investigation details.
Part 4: Traceability — From Raw Material to the Patient’s Bedside
The Traceability Standard Under ISO 13485 and EU MDR
ISO 13485 Clause 7.5.8 requires that manufacturers establish documented procedures for identification of product throughout production—and distribution traceability that can identify where product has been sent in the event of a recall.
Under EU MDR, bi-directional traceability is a hard requirement: forward (from raw material to finished device, to customer/hospital) and backward (from a recalled device lot back to components, in-process records, and batch release data).
The expectation has shifted from “we have records” to “our records are structurally linked.” Disconnected spreadsheets and paper binders fail in modern notified body audits because they cannot demonstrate the required linkage.
What a Distributors-Grade Traceability Audit File Looks Like
Traceability Layer | Document Type |
|---|---|
Raw material | Certificate of conformance, incoming inspection record, supplier lot |
In-process | Production batch record, in-process inspection, equipment calibration record |
Finished device | Device History Record (DHR), batch release record, sterility/product testing |
Labeling | Label review record, UDI assignment (where required), artwork approval |
Distribution | Customer shipment record, lot/serial breakdown by customer and date |
Post-market | Complaint log tied to lot, CAPA links, vigilance report references |
UDI and the EU MDR Registration Requirement
For products sold in the EU under MDR, UDI (Unique Device Identification) is now a mandatory traceability component for most device classes. Manufacturers must register UDIs in EUDAMED. Distributors should confirm that their supplier’s device UDI is registered, active, and matches the physical label.
For wound care dressings sold in the US, FDA requires UDI on device labels and in GUDID (Global Unique Device Identification Database) for Class II and Class III devices.
Part 5: Post-Market Surveillance — The Closed Loop That Regulators Now Audit Actively
Why PMS Is No Longer a Background Activity
Under both EU MDR and the FDA’s updated inspection approach, PMS is actively reviewed. Notified bodies examine PMS plans, PMS reports, and PSURs as part of conformity assessment and surveillance audits. FDA investigators can now review complaint trending, adverse event reporting, and management review outputs.
The key shift: PMS data must visibly feed back into the QMS. If complaint trending shows an increase in product-specific adhesion failures but there is no linked CAPA, risk file update, or design change evaluation—that is a finding.
Building an Audit-Ready PMS System
An effective PMS system for a wound care manufacturer operating under EU MDR and US FDA should contain:
Data Sources
Customer complaint records, including distributor-reported issues
Post-market clinical follow-up (PMCF) data or literature-based clinical surveillance
Adverse event / Medical Device Reporting (MDR) submissions and outcomes
Sales volume and usage trends (needed for benefit-risk contextualization)
Field action records, corrections, removals
Analysis and Output
Trend analysis against pre-defined performance thresholds
Benefit-risk assessment update
Preventive or corrective actions triggered by trend analysis
Input to management review
Reporting
For Class I MDR devices: PMS Report (Article 85)
For Class IIa, IIb, III MDR devices: PSUR (Article 86), updated on the required cycle
Vigilance reports for serious incidents submitted to competent authorities
PSUR: What It Must Contain
A PSUR is not simply a complaint summary. MDCG 2022-21 guidance specifies it should include:
Scope and summary of covered devices
Results and conclusions of PMS data analysis
Benefit-risk assessment with current clinical evidence
Volume/usage data for contextualization
Preventive and corrective actions taken or planned
Reference to post-market clinical follow-up outputs
For distributors, the practical ask is straightforward: request a PSUR summary or a confirmed PSUR schedule from your OEM supplier. Any manufacturer selling Class IIb wound care dressings into the EU should have an annual PSUR cycle already in motion.
Part 6: The Audit-Ready Document Pack — What to Have Ready Before the Auditor Arrives
Whether facing a notified body surveillance visit, an FDA inspection, or a hospital procurement audit, the following document pack should be maintainable and retrievable within 24 hours:
QMS Core Documents
Quality Manual and quality policy
Process map / turtle diagrams or equivalent
List of controlled procedures with current revision status
Management review minutes (most recent two cycles)
Validation Evidence Pack
Validation Master Plan
Validation reports: sterilization, packaging, process, software
Calibration records for critical measurement equipment
Revalidation decisions for any post-validation changes
CAPA File Set
CAPA procedure with defined source inputs
Open CAPA list with status, responsible owner, due date
Closed CAPAs (recent 12–24 months) with effectiveness evidence
CAPA trend summary for management review
Traceability and DHR
Sample Device History Records for recent production lots
Lot-to-customer distribution map for recent batches
UDI records and EUDAMED / GUDID registration confirmation
Supplier qualification records and re-evaluation schedule
PMS and Complaint Records
PMS plan (current version)
PMS report or PSUR (most recent)
Complaint log (last 12 months) with triage and investigation status
MDR / vigilance reporting log with submission confirmations
Internal audit schedule and completed audit reports
Part 7: Evaluating Your Supplier’s QMS Maturity — A Distributor’s Framework
For overseas medical consumable distributors, supplier QMS maturity is a procurement risk factor, not just a compliance checkbox. A supplier whose QMS cannot withstand an audit exposes your distribution contracts to disruption.
Tier 1: Certificate Verification
ISO 13485 certificate with clear scope (confirm it covers design and manufacture, not just manufacture)
CE MDR notified body certificate or transition evidence (Article 120 / Regulation (EU) 2023/607)
FDA Establishment Registration and Device Listing for applicable products
Tier 2: Document Spot-Check
Request a sample DHR for a recent lot. A mature QMS supplier will provide it promptly. Look for:
Lot number, raw material lot references, production records
In-process inspection results
Batch release signoff
Sterility/testing results
Tier 3: CAPA and Complaint Performance Data
Request aggregate performance data:
Number of open CAPAs and average age
CAPA recurrence rate over the past 12 months
Customer complaint rate (by unit shipped), and trend direction
Tier 4: PMS Documentation
Confirm PSUR update cycle is being met
Request a PSUR summary or Table of Contents to confirm scope
Ask whether clinical literature surveillance is active and when it was last updated
SLK Medical’s compliance infrastructure—ISO 13485 certification by TÜV Rheinland, CE MDR-aligned technical documentation, FDA establishment registration, and active CAPA management—is designed to support distributors operating in regulated markets where audit readiness is a baseline expectation. Request the SLK Medical compliance documentation pack as a starting point for supplier due diligence.
Part 8: Common Audit Failure Patterns and How to Avoid Them
Failure Pattern 1: The “We Have a Procedure” Defense
Auditors do not accept documented procedures as evidence of implementation. They ask to see executed records, completed checklists, and system outputs. If your CAPA procedure is excellent but your last five CAPAs lack documented effectiveness checks—you will receive a finding.
Fix: Conduct pre-audit internal walkthroughs. For each CAPA opened in the last 24 months, verify that effectiveness evidence is present and attached.
Failure Pattern 2: Traceability Chains That Break at Distribution
Manufacturers often have good production-level traceability but weak distribution traceability. Auditors increasingly ask: if we identify a problem with Lot X, can you tell us which customers received it within 24 hours?
Fix: Ensure your distribution records include lot-level customer allocation, not just order-level data. Test your recall simulation annually and document the result.
Failure Pattern 3: PMS That Is Not Feeding Back Into the QMS
The PMS plan exists. The complaint log is maintained. But there is no evidence that PMS findings have updated the risk file, the PMCF plan, or triggered a CAPA in the past 18 months—even as complaints show a pattern.
Fix: Add a formal PMS-to-QMS feedback review as a standing agenda item in management review. Document the analysis and any triggered actions.
Failure Pattern 4: Software Validation Gaps Under QMSR
With FDA’s QMSR now explicit about software validation, firms using eQMS platforms, complaint management systems, or document control software without documented validation are exposed.
Fix: Validate any software that supports regulated processes. For commercial platforms, combine vendor IQ/OQ documentation with your own user acceptance testing. Record the validation and maintain revalidation plans for updates.
Conclusion: Compliance That Withstands Audits Is Operational, Not Documented
The gap between compliance on paper and compliance in practice is where most audit findings live.
A QMS that can survive a notified body surveillance visit, an FDA inspection, or a hospital procurement audit shares common traits: validation evidence is current and linked to process changes; CAPA records show real root cause investigation and verified effectiveness; traceability is bi-directional and retrievable at lot level; PMS outputs are actively feeding back into risk management and design documentation.
For distributors, this means that supplier selection must include QMS maturity assessment—not just certificate collection. The cost of a supplier’s audit failure lands on your supply chain, your contracts, and your market access.
SLK Medical’s integrated compliance approach—validated production processes, structured CAPA management, ISO 13485 / CE MDR / FDA-aligned documentation, and active PMS—is designed to support distributors operating in regulated markets where audit readiness is a baseline expectation.
To request SLK Medical’s technical documentation package, compliance certification summaries, or OEM/private-label qualification support, visit slkmedical.com or contact the team directly to begin supplier qualification.
Frequently Asked Questions
Q: What is the difference between a correction and a corrective action in CAPA? A correction is an immediate action to address a nonconforming product or situation—containment, rework, or disposal. A corrective action targets the root cause to prevent recurrence. Both must be documented, but they serve different purposes and must not be conflated in the CAPA record.
Q: How often does a PSUR need to be updated under EU MDR? Class IIa devices: at least every two years. Class IIb and Class III devices: at least annually. The PSUR cycle runs for the device’s entire market lifetime.
Q: Does FDA QMSR require separate validation for cloud-based QMS software? Yes. FDA’s QMSR and the updated inspection compliance program make software validation explicit. If you use a cloud-based eQMS, CAPA system, or document control platform, you must validate it for its intended regulated use—proportionate to the risk it poses.
Q: What does “bi-directional traceability” mean in practice? It means you can trace forward (from raw material lot to finished device to customer) and backward (from a specific customer shipment back to the production lot, in-process records, and raw material certificates). Both directions must be demonstrable in a reasonable timeframe for audit and recall purposes.
Q: How should a distributor evaluate an OEM supplier’s CAPA system without auditing them directly? Request aggregate CAPA performance data (open/closed count, average cycle time, recurrence rate), a sample of closed CAPA records (redacted for confidentiality if needed), and a CAPA procedure. Ask specifically whether effectiveness verification is documented before closure—and ask to see one example.
