FDA 483 Citation 21 CFR 820.50: Purchasing and Supplier Controls
Updated: 18 hours ago
Reviewed by Aaron Lyon, President of A.P. Lyon and former Director of Quality Assurance and International Regulatory, with more than 30 years in medical device quality. Last reviewed November 10, 2026.
"Procedures to ensure that all purchased or otherwise received product and services conform to specified requirements have not been [adequately] established." FDA investigators cited that observation under 21 CFR 820.50 115 times on system-generated Form FDA 483s in fiscal year 2025. Two closely related citations added more:
"Requirements that must be met by [suppliers] [contractors] [consultants] have not been [adequately] established," cited 27 times under 820.50(a)
"Records of acceptable [suppliers] [contractors] [consultants] have not been [adequately] established," cited 23 times under 820.50(a)(3)
Together, purchasing controls were among the five most cited areas for device manufacturers. That reflects how much of a modern device is made by someone else: components, sterilization, contract manufacturing, testing labs, software and consultants.
What the citations mean
Typical examples written after "Specifically" include:
No documented evaluation of a supplier before it was used
Critical suppliers, such as sterilizers or contract manufacturers, approved with nothing more than a questionnaire
No defined type and extent of control for each supplier based on risk
An approved supplier list that is missing, out of date or not used by purchasing
Purchase orders that do not state specifications, drawings or quality requirements
No agreement requiring suppliers to notify the manufacturer of changes
Consultants and service providers left out of the program entirely
What 21 CFR 820.50 required
Under the Quality System Regulation, section 820.50 required each manufacturer to establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements.
Under 820.50(a), Evaluation of suppliers, contractors and consultants, each manufacturer had to:
Evaluate and select potential suppliers, contractors and consultants on the basis of their ability to meet specified requirements, including quality requirements, and document the evaluation
Define the type and extent of control to be exercised over the product, services, suppliers, contractors and consultants, based on the evaluation results
Establish and maintain records of acceptable suppliers, contractors and consultants
Under 820.50(b), Purchasing data, the manufacturer had to keep data that clearly describe or reference the specified requirements, including quality requirements, for purchased product and services. Where possible, purchasing documents had to include an agreement that suppliers, contractors and consultants agree to notify the manufacturer of changes in the product or service, so the manufacturer can decide whether the changes affect the quality of the finished device.
What changed under QMSR
With QMSR in effect since February 2, 2026, purchasing requirements come from ISO 13485:2016 clause 7.4:
7.4.1 Purchasing process: documented procedures to ensure purchased product conforms to specified purchasing information. Criteria for evaluating and selecting suppliers must be based on the supplier's ability to provide product that meets requirements, its performance, the effect of the purchased product on the quality of the medical device and risk. The organization must plan the monitoring and re-evaluation of suppliers and keep records of evaluations, selection, monitoring, re-evaluation and any actions arising.
7.4.2 Purchasing information: product specifications, requirements for acceptance, procedures, processes and equipment, personnel qualification, quality management system requirements, and, as applicable, a written agreement that the supplier notifies the organization of changes before they are implemented.
7.4.3 Verification of purchased product: verification activities based on supplier evaluation and proportionate to risk, with action taken if changes to purchased product are found.
The ISO language is more explicit about risk-based control and ongoing monitoring than the old regulation, and change notification is stronger because notification must come before the change is implemented. Firms whose supplier program met 820.50 often need to add documented supplier re-evaluation and clear risk classification.
How to respond to the 483
FDA generally considers responses received within 15 business days of the close of the inspection before deciding on further action. Plan to meet that window.
Address the suppliers cited
For each supplier named in the observation, complete and document an evaluation. For critical suppliers this may require an audit, a quality agreement and objective evidence of their capability, such as certifications, process validation data or inspection history. If you cannot complete an audit within 15 business days, give the date it is scheduled.
Fix the supplier program
Typical system fixes include:
A written procedure for supplier evaluation, selection, classification, monitoring and re-evaluation
A risk classification for every supplier, with the level of control (audit, quality agreement, incoming inspection, certificates) tied to the class
Quality agreements with critical suppliers, including change notification before implementation
An approved supplier list that purchasing must check before placing orders
Purchase order requirements that reference specifications, revision levels and quality requirements
Periodic supplier performance review using delivery, nonconformance and audit data
Review the whole supplier base
Do not stop at the suppliers the investigator sampled. Review every active supplier against the new procedure, classify them and close any gaps. Report the number reviewed and the results.
Train purchasing and quality staff
Train buyers, engineers and quality staff who select suppliers or place orders. Keep the records.
What a compliant purchasing procedure must contain
Scope covering products, services, contractors and consultants
Criteria for supplier evaluation and selection, including risk
Supplier classification and the matching level of control
Quality agreement and change notification requirements
Approved supplier list maintenance
Purchasing information required on orders
Verification of purchased product, linked to incoming inspection
Supplier monitoring, re-evaluation and corrective action requests
Records
Common mistakes in purchasing responses
Approving all suppliers again with a questionnaire and calling it an evaluation
Treating every supplier the same instead of controlling by risk
Forgetting service providers such as calibration labs, sterilizers and software developers
Writing quality agreements but never checking that suppliers follow them
Failing to connect supplier nonconformances to supplier re-evaluation and CAPA
Example: how one response section might read
This illustrates structure only; your response must describe your own suppliers and facts.
Observation 3: Procedures to ensure purchased product conforms to specified requirements have not been adequately established. Specifically, the contract sterilizer was not evaluated before use and no quality agreement was in place.
Response:
Correction: An on-site audit of the contract sterilizer was performed on a stated date. A quality agreement covering validation, routine processing records, change notification and nonconformance reporting was signed on a stated date.
Root cause: The supplier procedure did not classify suppliers by risk, so the sterilizer received the same questionnaire-only approval as a packaging distributor.
Corrective action: The procedure was revised to classify suppliers into three risk levels, each with defined controls. Critical suppliers now require an audit and a quality agreement before approval.
Retrospective review: All 64 active suppliers were classified. Eleven were critical; nine already met the new requirements, and audits for the remaining two are scheduled on stated dates.
Training: Purchasing, engineering and quality staff were trained.
Verification: Supplier controls will be included in the next internal audit.
Frequently asked questions
Do we need to audit every supplier?
No. The level of control should match the risk the supplier's product or service presents to the device. Low-risk suppliers may be controlled through certificates and incoming inspection; critical suppliers usually need audits and quality agreements.
Is ISO 13485 certification enough to approve a supplier?
It is useful evidence, but it does not by itself show the supplier can meet your specific requirements. Most firms combine certification with performance data, quality agreements and, for critical suppliers, their own audits.
Do consultants and service providers count as suppliers?
Yes. Both 21 CFR 820.50 and ISO 13485 clause 7.4 apply to purchased services, contractors and consultants, including testing labs, calibration services and software developers.
How A.P. Lyon documents help
A.P. Lyon's Supplier Management Procedure for ISO 13485 and FDA QMSR covers supplier evaluation, classification, approval, monitoring and re-evaluation, with forms for supplier surveys, audits and the approved supplier list. The companion Purchase Order Procedure defines the purchasing information each order must carry. For firms working to both ISO 9001 and ISO 13485, the dual-standard Supplier Management Procedure covers both standards.
All documents are editable Word and Excel files and must be adapted to your suppliers, products and organization. Staff must be trained and the procedure followed, because FDA evaluates the program you operate.
Next steps
List every supplier and example cited on the 483
Evaluate those suppliers first, then review the full supplier base
Revise the procedure, approved supplier list and purchase order requirements
Respond within 15 business days with dates for every action
To build a complete set of procedures at a volume discount, use Build Your QMS. For help with a 483 response, see A.P. Lyon consulting services.
Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.
Practice before the real inspection. Play Inspectle, a free daily game where you name the regulation behind a real FDA inspection finding, or try Inspection Ready, a free AI mock FDA inspection that shows where an investigator would write observations.
Comments