How to Update Your Supplier Quality System Audit Checklist When Travel First-Aid Kits Include Medical Devices

The FDA’s Quality Management System Regulation (QMSR) took effect on February 2, 2026. For companies sourcing travel first-aid kits that contain medical devices, the change is a timely reason to review how suppliers are qualified, how component changes are controlled, and whether quality records are sufficient to investigate problems.

The important question for a U.S. importer or distributor is not simply whether a supplier has a quality certificate. It is whether the supplier can demonstrate that the components, assembly process, labeling, and finished product meet the applicable requirements—and that deviations can be identified and addressed.

A travel first-aid kit may contain several different types of products. Their regulatory status can differ, and the responsibilities of the component manufacturer, kit assembler, brand owner, and importer may not be identical. The audit checklist should reflect those differences rather than treating every first-aid kit as a regulated medical device.

This guide explains how to review supplier quality controls and develop a practical audit checklist for medical-device-related components in travel first-aid kits.

1. Determine Which Products and Suppliers Fall Within Scope

Before revising an audit checklist, establish which components are medical devices and which regulatory requirements apply to the products and organizations involved.

For example, a travel first-aid kit might contain adhesive bandages, sterile gauze dressings, scissors, a thermometer, and other supplies. The regulatory classification and applicable requirements must be assessed for each relevant product based on its intended use and characteristics. The presence of a medical device in a kit does not automatically make every component subject to identical requirements.

The FDA’s Quality Management System Regulation guidance explains that QMSR applies to manufacturers of finished medical devices intended for commercial distribution, subject to applicable exemptions and other provisions.

The regulation amends 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, together with FDA-specific requirements. It also provides for a risk-informed approach to supplier controls.

For procurement teams, the first step is to map the supply chain.

Do not assume that every overseas supplier must hold ISO 13485 certification. Equally, do not assume that an importer or distributor has no relevant responsibilities simply because another company manufactures the product.

The appropriate audit scope should be established before the supplier is assessed.

2. Update the Supplier Quality Audit Checklist

Once the relevant products and supplier roles have been identified, review the existing checklist against the applicable regulatory requirements and the buyer’s own purchasing risks.

The following questions are a practical procurement framework, not a statement that every item is a separate legal requirement for every supplier.

A. Regulatory scope and product documentation

Start by asking the supplier to identify the components included in the proposed kit and provide the documentation relevant to their intended use and regulatory status.

Audit questions

• Is there an approved component list identifying each item, its specification, and its intended use?
• Has the regulatory status of relevant components been established?
• Are applicable product specifications, labeling, and instructions available?
• Can the supplier explain which organization is responsible for each regulated activity?
• Are regulatory documents current and linked to the correct product version?

Evidence to request: The controlled component list, relevant product specifications, applicable regulatory documentation, and approved labeling or instructions.

A document should not be accepted solely because it carries an FDA reference or a supplier’s logo. Check what product it covers, which organization it identifies, and whether it supports the claim being made.

B. Supplier qualification and purchasing controls

A supplier’s quality system is only one part of the assessment. The buyer also needs to understand how the supplier selects and controls the companies providing components.

Audit questions

• How are component manufacturers evaluated before approval?
• Are suppliers assessed according to the risks associated with their products and services?
• Are quality and technical requirements clearly communicated in purchase specifications?
• How are poor supplier performance and recurring defects addressed?
• Does the supplier reassess an approved source when its performance changes?

Evidence to request: Supplier qualification criteria, approved supplier records, purchasing specifications, supplier performance reviews, and relevant corrective-action records.

For medical-device manufacturers within QMSR scope, purchasing controls must reflect the applicable requirements, including risk-based supplier evaluation. A buyer’s audit can examine how these controls work in practice without assuming that every supplier follows an identical certification model.

C. Risk management and component acceptance

A component can be visually correct but still fail to meet the specification that matters for its intended use.

For example, a substitute dressing might differ in dimensions, material, packaging, or sterile status. Whether a difference is acceptable depends on the product requirements and its potential effect on safety, performance, and compliance.

Audit questions

• How are risks associated with components and suppliers evaluated?
• Are acceptance criteria defined before incoming inspection?
• What happens when a component fails inspection or arrives with incomplete documentation?
• Are inspection methods appropriate to the relevant product requirements?
• Can the supplier explain why a component is accepted, rejected, or placed on hold?

Evidence to request: Relevant risk assessments, component specifications, incoming inspection procedures, inspection records, and nonconformance records.

The objective is not to demand unnecessary testing of every component. It is to establish whether the supplier’s controls are appropriate to the risks and whether acceptance decisions can be supported by evidence.

D. Traceability and batch records

Traceability becomes particularly important when a kit contains components sourced from different manufacturers.

If a defect is discovered after shipment, the buyer needs to determine which products may be affected, where they were shipped, and whether the issue is limited to one component batch or extends to multiple production runs.

Audit questions

• Are component lot or batch identifiers recorded where applicable?
• Can the supplier connect incoming components to the finished kits in which they were used?
• Are receiving, assembly, inspection, and shipment records linked sufficiently to investigate an issue?
• Can the supplier identify affected orders when a component supplier reports a defect?
• Are traceability arrangements appropriate to the product and applicable requirements?

Evidence to request: Sample receiving records, component batch records, assembly records, inspection records, and shipment documentation.

Ask the supplier to demonstrate traceability using a sample production batch. A clear explanation of the procedure is useful, but a successful record-tracing exercise provides stronger evidence that the process works.

E. Change control for components, packaging, and labels

An approved first-aid kit can gradually become a different product if components, quantities, packaging, or instructions change without proper review.

This is especially relevant to private-label programs, where the buyer may have approved a specific configuration for its customers.

Audit questions

• Who can authorize a component substitution?
• How are changes to specifications, suppliers, packaging, and labels reviewed?
• Is the buyer’s approval required for changes defined in the purchasing agreement?
• Are affected risk assessments and regulatory documents reviewed when necessary?
• Can the supplier identify which production batches used the previous and revised versions?

Evidence to request: Change-control procedures, change requests, approval records, revised specifications, and version histories.

The supplier should be able to show that changes are evaluated before implementation, with the appropriate approvals and regulatory assessments completed where required. A change that appears commercially minor may still affect product performance, labeling, or compliance.

F. Nonconformities and corrective action

A supplier’s ability to prevent a defect from recurring can be more important than the fact that it has encountered a defect.

Audit questions

• How are nonconforming components and finished kits identified and segregated?
• Who decides whether affected products can be reworked, accepted, or rejected?
• Are recurring problems investigated for their underlying causes?
• Are corrective actions assigned, documented, and verified?
• Is the effectiveness of corrective action checked rather than assumed?

Evidence to request: Nonconformance reports, investigation records, corrective-action plans, and evidence that completed actions resolved the identified problem.

A closed corrective-action record should explain what happened, why it happened, what changed, and how the supplier determined that the corrective action was effective.

G. Complaints and escalation

A complaint involving one component may reveal a wider problem affecting other products or production batches.

The buyer should understand how complaints are received, investigated, documented, and escalated to the organization responsible for the product.

Audit questions

• How are complaints recorded and assessed?
• Can the supplier link a complaint to the relevant product version or batch?
• How are complaints involving upstream components investigated?
• Are potentially serious incidents escalated to the responsible organization?
• Are applicable reporting obligations assessed and fulfilled by the party responsible for them?

Evidence to request: Complaint-handling procedures, sample investigation records where appropriately redacted, escalation procedures, and corrective-action records.

Do not assume that every complaint must be reported to the FDA. Reporting obligations depend on the product, the event, and the responsible organization’s regulatory role.

H. Quality records and audit readiness

The QMSR introduces an important change in FDA inspection access: the FDA may inspect management review records, quality audit records, and supplier audit reports that were previously exempt from review under the former regulation’s provisions.

The FDA explains this change in its QMSR Frequently Asked Questions.

For a regulated manufacturer, this makes the control and availability of relevant quality records particularly important.

Audit questions

• Are relevant procedures and records controlled and retrievable?
• Can the supplier demonstrate that its quality processes are being followed?
• Are audit findings documented and tracked through closure?
• Are management reviews and internal quality audits conducted as required?
• Can the supplier retrieve relevant records within a reasonable period when requested by an authorized reviewer?

Evidence to request: Applicable quality procedures, audit records, management review records, corrective-action tracking, and records-retention procedures.

The buyer should distinguish between records legally required for the supplier’s regulatory role and additional documents requested as part of its own supplier-qualification process.

3. Test the Checklist Against Real Procurement Failures

A checklist becomes useful when it reveals how a supplier actually handles a problem. Three scenarios illustrate how procurement teams can apply the controls above.

Scenario 1: An approved component is substituted

A supplier discovers that its usual dressing is unavailable and proposes a visually similar alternative to avoid delaying the shipment.

The purchasing team should not decide based on appearance or price alone. It should determine whether the alternative meets the approved specification and whether the substitution requires technical evaluation, risk review, labeling changes, regulatory assessment, or customer approval.

What the audit should establish

• The original and proposed components are clearly identified.
• The differences between their specifications are documented.
• The responsible parties review the change before implementation.
• Required approvals are recorded.
• Affected production batches can be identified.

A supplier that routinely substitutes components without authorization presents a significant purchasing risk, even if the products appear acceptable during a brief visual inspection.

Scenario 2: A complaint cannot be traced to a production batch

A distributor receives a complaint about an item in a travel first-aid kit. The supplier can identify the kit’s shipping date but cannot determine which component batch was used.

This limits the buyer’s ability to investigate the problem and assess the potential scope of affected products.

The audit should test whether component receiving records, assembly records, and shipment records can be connected sufficiently to support an investigation. It should also establish how the supplier handles potentially affected inventory and communicates findings to relevant parties.

The appropriate traceability requirements depend on the product and applicable regulations. Even where a particular record linkage is not expressly mandated for every item, the buyer may reasonably require it as a purchasing control.

Scenario 3: Private-label packaging changes without approval

A supplier updates the printed instructions or product label to accommodate a new component configuration. The buyer receives the shipment and discovers that the artwork differs from the approved version.

The audit should examine whether packaging and labeling are subject to document control, whether changes trigger the appropriate review, and whether obsolete versions are prevented from being used.

For regulated devices, labeling is not simply a branding issue. It can affect product identification, instructions for use, and compliance. The supplier’s change-control process should therefore reflect the actual regulatory and product requirements.

4. Decide Whether the Supplier Is Ready for Approval

After the audit, findings should be prioritized according to their significance rather than counted as though every gap carries the same risk.

A missing record that does not affect a product requirement is different from an uncontrolled component substitution that could affect product safety or regulatory compliance.

For each finding, document:

• The requirement or purchasing expectation: What should have been controlled?
• The evidence: What did the audit actually establish?
• The risk: What could happen if the gap remains unresolved?
• The corrective action: What must the supplier change?
• The verification method: What evidence will demonstrate that the action worked?
• The approval decision: Can the supplier be approved, conditionally approved where appropriate, or should approval be withheld?

Do not close a finding merely because a supplier promises to improve. Verify the relevant corrective action and its effectiveness before treating the issue as resolved.

The decision should also account for the supplier’s role. A supplier manufacturing a regulated finished device may have obligations that do not apply in the same way to a company providing a non-device carrying case or other accessory.

5. What the QMSR Means for First-Aid Kit Sourcing

The QMSR is not a blanket requirement for every first-aid kit supplier to obtain an ISO 13485 certificate. Nor does it mean that every item in a multi-component kit is regulated in the same way.

It does mean that buyers sourcing medical-device-related products should understand the applicable regulatory scope and assess whether their suppliers have appropriate controls for the products and activities involved.

For importers, distributors, and private-label brands, a well-designed supplier audit checklist should help answer three questions:

1. Is the supplier’s role and regulatory scope understood?
2. Can the supplier demonstrate effective controls over relevant components, changes, records, and product problems?
3. Can the buyer verify that significant audit findings have been resolved before relying on the supplier for future orders?

For customized travel first-aid kits, these questions should be addressed before the approved configuration moves into repeat production. The component list, specifications, labeling, packaging, and change-approval arrangements should be sufficiently clear for both the buyer and supplier to work from the same requirements.

The FDA’s QMSR guidance and QMSR FAQ are the appropriate starting points for determining the requirements that apply. Buyers should consult qualified regulatory professionals when product classification or the responsibilities of particular organizations are uncertain.

For procurement teams, the practical next step is to review the existing supplier audit checklist, map the relevant products and supplier roles, and close any gaps that could prevent reliable qualification, traceability, or control of product changes.