How OEMs Qualify a Medical Cable Supplier: The Audit Checklist
Quick Answer
A supplier qualification audit for a medical cable manufacturer examines five areas: the quality management system, regulatory standing, design and process controls, traceability and change control, and capacity and continuity. Most qualification failures are not caused by poor manufacturing. They are caused by missing documentation, unclear change notification, or a supplier who cannot demonstrate traceability back to raw material.
Who this is for
Quality, procurement and supplier development teams at medical device manufacturers who are evaluating or re-qualifying a cable and component supplier.
Why qualifying a cable supplier is not like qualifying other suppliers
A cable is often treated as a commodity component. In a medical device it is not.
Cables carry patient-contact materials. They sit inside the signal path, so their construction affects device performance. They are frequently sterilised and cleaned. And when a device manufacturer places its own name on a finished product, the regulatory responsibility for the components inside it does not transfer to the supplier.
That last point is what makes supplier qualification a quality activity rather than a purchasing one. A device manufacturer remains accountable for what its suppliers produce. An audit exists to establish that the supplier can be relied on to hold a specification, document what they did, and tell you when something changes.
The five areas an audit covers
Audit areas at a glance
| Area | What it establishes | Core evidence |
|---|---|---|
| Quality management system | That a documented, maintained system governs production | ISO 13485 certificate with scope; quality manual; internal audit and management review records |
| Regulatory standing | That the supplier's registrations match what they supply | FDA establishment registration; CE documentation; 510(k) numbers where clearance applies |
| Design and process controls | That production is controlled and repeatable | Process validation records; work instructions; inspection and test plans; equipment calibration |
| Traceability and change control | That any part can be traced and changes are notified | Lot traceability to raw material; change notification agreement; deviation and CAPA records |
| Capacity and continuity | That supply can be sustained | Capacity data; lead times; sub-supplier controls; business continuity planning |
1. Quality management system
Request the ISO 13485 certificate — and read the scope statement.
The scope is the part most often skipped and the part that matters most. A certificate covering "design and manufacture of medical cable assemblies" is materially different from one covering "distribution". Confirm that the scope covers the activity being purchased, that the certificate is current, and that the certification body is accredited. For why the certificate is more than paperwork, see ISO 13485 certification.
Also request:
- The quality manual, or its table of contents
- Evidence that internal audits are conducted and closed out
- Management review records showing the system is actively maintained
- The supplier's own approach to qualifying their suppliers
That last item is a strong predictor. A supplier who cannot describe how they qualify their own raw material sources is unlikely to hold specification consistently over years. Related reading on quality systems in cable manufacturing.
2. Regulatory standing
Confirm that regulatory registrations correspond to what will actually be supplied.
FDA establishment registration. Confirms the facility is registered with the FDA. Verifiable in the FDA's public database.
510(k) clearance, where it applies. Not every component requires clearance. Where a supplier holds one, request the K-number and confirm the cleared device matches what is being supplied. K-numbers are verifiable in the FDA's public 510(k) database — a supplier who is reluctant to provide one is telling you something.
CE marking and EU documentation, where the device will be placed on the European market. See 510(k) and CE marking compared.
A note on interpretation. A supplier stating that parts are "FDA compliant" is not the same as a manufacturer holding clearance for the specific device. Ask precisely: who is the legal manufacturer, and what is the regulatory status of the exact part being quoted? For broader context on regulatory risk across global markets, see our related guide.
3. Design and process controls
This is where an audit establishes whether output is repeatable or merely acceptable on the day.
Process validation. Which processes are validated, and what the validation covers. For cable assembly the critical ones are typically termination, overmoulding and any joining process — the operations where a defect is not visible on inspection.
Work instructions and operator training. Documented, current, and demonstrably in use at the workstation rather than filed centrally.
Inspection and test. What is inspected, at what frequency, against what acceptance criteria, and what happens to a non-conforming unit.
Calibration. Test and measurement equipment on a calibration schedule with traceable records.
Design capability, where relevant. If the supplier will contribute to design rather than build to a fixed drawing, establish what design controls they operate under and how design outputs are verified. See medical cable design controls and our process overview.
4. Traceability and change control
Traceability should run from finished assembly back to raw material lot. Ask the supplier to demonstrate it on a real historical order rather than describe it in principle. The demonstration takes minutes and tells you more than the procedure document.
Change control is where most supplier relationships actually fail, and it deserves more attention than it usually receives during qualification.
A supplier may substitute a material, change a sub-supplier, or modify a process for entirely legitimate reasons. If the device manufacturer is not notified, a validated device can change without anyone knowing — and it is typically discovered during an audit or a complaint investigation, long after the affected product has shipped.
Establish in writing, before the first order:
- What categories of change trigger notification
- How much notice is given
- Whether the OEM has approval rights or receives notification only
- How the agreement is documented
A written change notification agreement is inexpensive to put in place at qualification and very expensive to reconstruct after a problem. Related: post-market surveillance.
5. Capacity and continuity
Qualification usually happens at low volume. The relationship is usually judged at high volume.
- What is current utilisation, and what headroom exists?
- What are realistic lead times at the quantities being planned?
- Which sub-suppliers are single-sourced, and what happens if one fails?
- Is there a documented business continuity plan?
- Is production concentrated in one facility or one line?
The document request list
A single request covering everything a first-stage qualification requires:
Document request list
| # | Document | Area |
|---|---|---|
| 1 | ISO 13485 certificate, with scope statement | QMS |
| 2 | Quality manual or table of contents | QMS |
| 3 | Internal audit schedule and closure evidence | QMS |
| 4 | FDA establishment registration | Regulatory |
| 5 | 510(k) numbers, where clearance applies | Regulatory |
| 6 | CE documentation, where applicable | Regulatory |
| 7 | Process validation summary for critical processes | Process |
| 8 | Inspection and test plan with acceptance criteria | Process |
| 9 | Calibration programme summary | Process |
| 10 | Traceability demonstration on a historical lot | Traceability |
| 11 | Change notification agreement, draft or template | Change control |
| 12 | CAPA process summary and a redacted example | Change control |
| 13 | Capacity and lead time data | Continuity |
| 14 | Sub-supplier control procedure | Continuity |
| 15 | Business continuity plan summary | Continuity |
Most established manufacturers can supply items 1 to 9 immediately. Items 10 to 15 typically require a conversation, which is itself informative. Standard documentation may also be available in downloads.
What should give you pause
- A certificate whose scope does not match what you are buying. Common, and easy to miss if only the front page is read.
- Reluctance to provide a K-number. These are public. Hesitation suggests the clearance does not cover what is being quoted.
- Traceability described but not demonstrated. Ask to see it performed on a real lot.
- No formal change notification process. The single most consequential gap.
- Validation records that cannot be located during the audit. Whether they exist is less relevant than whether they are retrievable.
- Sub-suppliers who cannot be named. You are inheriting their risk regardless.
Where Orantech sits
Orantech manufactures medical cables and components for patient monitoring systems from an ISO 13485:2016-certified, FDA-registered, CE-marked facility in Shenzhen, and holds five FDA 510(k) clearances covering EtCO2 sensors, SpO2 sensors, temperature probes, reusable NIBP cuffs, and patient cables and leadwires.
The documentation listed above is available to OEM partners as part of qualification. Our lab capabilities and process overview pages describe testing and production in more detail, and standard documentation is available in downloads.
Beginning a qualification process? Contact us and we will provide the documentation set directly. Also useful: what to look for in a manufacturer and moving from supplier to strategic partner.
Frequently asked questions
What is supplier qualification in medical device manufacturing?
The process by which a device manufacturer establishes that a supplier can consistently meet specification, maintain a quality system, and provide the documentation the manufacturer needs to meet its own regulatory obligations.
Does a medical cable supplier need ISO 13485 certification?
Requirements depend on the component and the device manufacturer's own quality system. In practice most medical device OEMs require ISO 13485 certification from suppliers of patient-contact or signal-path components, and will check that the certificate scope covers the activity being purchased.
Does a cable supplier need its own 510(k)?
Not always. Clearance requirements depend on the device and its intended use. Where a supplier holds clearance, ask for the K-number and confirm the cleared device matches what is being supplied.
What is a change notification agreement?
A written agreement setting out which changes a supplier must notify before implementing — material substitutions, sub-supplier changes, process modifications — and how much notice is given. It is the most important document to establish before the first production order.
How long does supplier qualification usually take?
It varies with the device manufacturer's own procedures and the component's risk classification. Documentation review can typically begin immediately; on-site audits and validation activity extend the timeline.
Can qualification be completed without an on-site audit?
Many manufacturers complete initial documentation review remotely and conduct an on-site audit before production release. Practice varies, and remote or third-party audits are increasingly accepted for lower-risk components.
Key takeaways
- Five areas: quality system, regulatory standing, process controls, traceability, and capacity.
- Read the scope statement on the ISO 13485 certificate, not just the front page.
- K-numbers are public and verifiable. Reluctance to provide one is itself information.
- Change control is where supplier relationships most often fail. Establish it in writing before the first order.
- Ask for traceability to be demonstrated, not described.