An ISO 13485 supplier audit should first establish who performs which work at which site, then sample records for the current project. A certificate is management-system evidence; alone it does not establish a board's function, safety, or market-entry conditions. If contracting entity, certificate holder, and actual factory differ, clarify their relationships and scope before judging project suitability from a certificate cover page.
How ISO 13485 relates to PCB assembly projects
ISO's public overview identifies ISO 13485 as a medical-device-related quality management system for organizations involved in design, production, installation, servicing, and other activities, also usable for audits. It lists ISO 13485:2016 and states that ISO itself does not certify companies. This article uses the overview to explain audit boundaries, not conduct a full clause review or claim unconfirmed certification for this site's company.
For a supplier performing only board assembly, focus on actual processes, purchasing responsibilities, traceability interfaces, and delivery records. The complete-product manufacturer or product-responsible party still defines intended use, risks, applicable regulations, and verification requirements. A supplier's system certificate does not waive board-performance verification or extend coverage to unlisted addresses or activities.
Master and scope checklist
| Verification Object | Reference Documentation | Differences Requiring Clarification |
|---|---|---|
| Certificate holder | Full certificate title, number, contracting entity, and invoicing entity | Whether group names, brands, and legal entities are conflated |
| Manufacturing Site | Certificate attachments, factory addresses, and actual production route | Whether new sites, branches, warehouses, or outsourced locations are covered |
| Scope of Business | Scope text on certificates and proposed work | Whether assembly, design, procurement, and services fall within their respective boundaries |
| Certificate Status | Issuer, validity period, and verifiable records | Suspension, changes, expiration, and missing attachments |
Retain verification dates and retrieved status so historically valid screenshots are not treated as current evidence. Abbreviations, translated addresses, or changed street numbers do not necessarily invalidate certificates, but differences need explanation and support. Do not immediately infer fraud or assume validity without clarification. Obtain the complete certificate, attachments, and applicability statement before reaching a project conclusion.
record sampling along a single order
Rather than requesting many blank procedures, select an actual work order that can be redacted and trace inputs, purchasing, production, inspection, and delivery. Check whether BOM revisions link to material lots, lots to boards or production batches, and test results to delivery identifiers. Determine traceability depth by product risk; do not require identical serialization for all projects.
Distinguish having a procedure from executing it. If substitutions require approval, the sample should include the request, technical evaluation, approver, and actual use lot. If no substitution occurred, sample a change or anomaly instead; blank forms do not establish execution. Redact confidential information while retaining times, objects, and linking logic.
| Process | Records Suggested for Review | Questions the audit must answer |
|---|---|---|
| Technical Input | Document list, versions, reviews, and distribution | Whether the production floor uses the same approved file set |
| Material Control | Procurement sources, receiving, lots, and substitution approvals | Traceability of source and usage destination |
| Process and Inspection | First articles, critical processes, tests, and measuring-equipment status | how requirements convert to actual inspection |
| Non-Conformance Handling | Isolation, disposition, rework, and re-inspection | Whether anomalies are controlled and verified closed |
| Delivery and Change | Release, packaging, change notices, and traceability | Whether the configuration received by the customer can be reproduced |
Determine audit focus based on project risk
A board in an auxiliary display and one performing critical measurement or control can have different failure consequences. The product-responsible party should translate safety/performance impacts into actionable supplier requirements, such as critical-component substitution approval, calibration-data control, programming verification, and final test conditions. Audit beyond page counts: ask how critical failures are prevented, detected, and traced.
Outsourced purchasing, cleaning, coating, or testing adds interfaces. Define who approves subcontractors, when changes are reported, who keeps records, and how anomalies return. Reports must state the actual observed scope; unvisited outsourced processes cannot be described as site-audited. For specialist tests, confirm methods, objects, personnel, and equipment instead of using an unrelated report for every product.
Use changes and nonconformities to assess system execution
Common repeat-order changes include obsolescence substitutions, part-number suffixes, firmware revisions, process sites, and fixtures. Request one complete change record: originator, evaluated impacts, approval time, changeover lot, and old-stock disposition. Approving substitute purchasing differs from approving product use; placing an order does not complete technical review.
For nonconformity samples, check evidence-based quarantine scope, controlled repair, impact-based reinspection, and verified corrective-action effectiveness. “More training” may not fix wrong revision distribution or inadequate test coverage. Findings should state verifiable facts, requirement sources, and impacts rather than vague “weak management,” so suppliers know which records or interfaces need correction.
Example handling of differing contract and manufacturing addresses
Engineering audit example: purchasing contracts with company A, receives company B's certificate, and plans prototype fabrication at another address. Map contracting, order receipt, purchasing, manufacturing, and release responsibilities; request legal-entity relationships, site coverage, and outsourcing arrangements. If evidence covers only assembly at one company B site, do not claim equivalent coverage for all company A sites. Based on project requirements, restrict locations, supplement audits, or adjust cooperation scope.
At prototype stage, use controlled BOMs, first articles, programming, and functional results to verify delivery interfaces, plus one material-to-board traceability exercise. Separate confirmed facts, missing evidence, and closure items, assigning owners and closure evidence. Passing prototypes do not automatically authorize production site or critical-process changes; later changes remain controlled by agreement. Record requirements can align with Inspection and Factory Records Define Together.
common boundary issues during audit
Can a management-system certificate replace product registration or performance tests?
No. Management systems, product performance, and market access are separate matters; the product-responsible party determines applicable project requirements. This page provides only a supplier-audit method.
is remote audit always insufficient
Assess whether risk and evidence are sufficient. Documents and traceability records can be reviewed remotely, while site layout, actual operations, or critical environments may need additional observation. Clearly state the method and uncovered scope in the report.
How audit findings become closable items
Each finding should identify the observed object, facts, applicable requirement source, impact, and closure evidence. “The floor BOM revision for a work order differs from the issued-file list” is more verifiable than “inadequate document management.” Closure requires more than supplying the correct BOM: explain how the old revision entered use, how affected orders were checked, and whether new controls operate. If documentation is merely unavailable, record an evidence gap rather than inventing a site nonconformity. Select document review, additional sampling, or renewed observation according to risk, retaining dates and conclusions. Supplier self-reported completion is not auditor-confirmed effectiveness. Contracts may define retention, change notifications, complaints, and recall interfaces; product requirements and agreements determine periods and responsibilities, not the system's name. Reports should also separate observed conclusions from cooperation decisions. Missing evidence may permit limited pilot work or block critical release, depending on project requirements. Audit outputs are traceable conclusions, not a universal commitment for every product.
Source material and applicable scope
- ISO, “ISO 13485 — Medical devices”; public overview lists ISO 13485:2016; checked on 2026-10-17; sections: applicable organizations, certification explanation, and revision background. Supports system purposes and certification boundaries, without the paid standard's full text or specific-market regulatory determinations.
