The ten checks at a glance
| # | Check | Ask for | Satisfied when |
|---|---|---|---|
| 1 | QMS certificate and scope | ISO 13485 certificate + MDSAP report | Scope names the product family, not just "medical devices" |
| 2 | CE certificate | Certificate number, notified body, device list | Number is verifiable and covers your exact configuration |
| 3 | Registration portfolio | Certificate per target market | Each one names the product, not the company |
| 4 | Sterilisation | EO validation report, SAL, residuals | SAL 10⁻⁶ and residuals within ISO 10993-7 |
| 5 | Biocompatibility | ISO 10993-1 evaluation + test reports | Degradable-material endpoints addressed |
| 6 | Performance evidence | Bench, animal and clinical data | At least one clinical study on the finished device |
| 7 | Who makes the material | Process description, patents, equipment | Material conversion happens on their own site |
| 8 | Batch traceability | Lot genealogy, sterilisation load map | One lot number traces to one load and one release |
| 9 | Private-label responsibility | Signed responsibility matrix | Legal manufacturer is named, with the file holder |
| 10 | Complaints and adverse-event reporting | Trend data, FSCA procedure, recall drill | They can execute a field action, not just describe one |
Checks 1–4: the quality system is real, and its scope covers you
Each check gives you the question to ask, what a good answer looks like, and the red flag that should end the conversation. Where a claim can be evidenced, the evidence is listed; where it cannot, the check tells you how to test it during the audit.
1. QMS certificate and its scope
Ask for: the ISO 13485 certificate in full, plus the latest MDSAP audit report.
A good answer: the scope names the product family - absorbable hemostatic gauze, hemostatic particles - rather than the generic phrase "medical devices". The certificate is current, the issuing body is accredited, and the MDSAP report covers the markets you intend to sell into.
Red flag: a certificate scoped to "surgical instruments" or "dressings" while the product you are buying is an implantable, absorbable hemostat. The manufacturing controls differ, and the scope is what an auditor reads first.
What we can show: ISO 13485 with MDSAP certification, plus BGMP (Brazil) and KGMP (Korea) - the last two matter if your territory includes those markets, because they are audited separately.
2. CE certificate: number, notified body, device list
Ask for: the certificate number, the notified body that issued it, the device list attached to it, and its validity dates.
A good answer: the number can be checked against the notified body's own database, the device list includes your pack size and configuration, and the certificate is issued under MDR - not under the older MDD, whose certificates are no longer a basis for placing product on the EU market.
Red flag: "we are CE certified" with no number. A certificate number is a public fact; a supplier who will not put it in an email has not got one that covers you.
What we can show: MDR certificate 2292-2026/0023 for the absorbable ORC gauze, and CE certificate C637543 for the MPH hemostatic particles. Both are product-specific, which is the point of the check.
3. Registration portfolio, market by market
Ask for: the certificate for each market you sell into - not a list, the documents.
A good answer: every certificate names the product, not just the company, and every one is current. A supplier with eight registrations and a supplier with one are different businesses; the portfolio tells you how much regulatory work has already been done for you.
Red flag: "we can register it for you once you order". That usually means no approval exists, and the timeline becomes yours.
What we can show: NMPA, UK MHRA, TGA (390002), ANVISA, Saudi SFDA, Vietnam IMDA, Ecuador ARCSA, Philippines FDA and Morocco AMMPS, alongside the two CE certificates above.
4. Sterilisation: validation, SAL and residuals
Ask for: the EO sterilisation validation report, the SAL claim, and the residuals test.
A good answer: sterilisation per ISO 11135 with a SAL of 10⁻⁶, ethylene oxide residuals measured against ISO 10993-7, and a written list of what triggers revalidation - load pattern changes, packaging changes, a new product family in the same chamber.
Red flag: "sterilised by a partner". Subcontracted sterilisation is normal, but the validation, load mapping and release responsibility still have to live somewhere. Ask where.
What we can show: the MPH particle family is EO sterilised, with validation and release records held in the same quality system. For the gauze, ask which method applies to the configuration you are ordering.
Checks 5–8: the product evidence is real, and they generated it
5. Biocompatibility for an absorbable material
Ask for: the ISO 10993-1 evaluation report and the test reports behind it.
A good answer: the evaluation addresses what makes an absorbable hemostat different from a surface dressing - degradation products, local tissue response after implantation (ISO 10993-6), and genotoxicity, not just cytotoxicity.
Red flag: a file containing only ISO 10993-5 cytotoxicity. That is the cheapest test and the least informative for a material that is left inside the patient.
What we can show: a CE-marked absorbable device cannot be certified without an ISO 10993-1 evaluation, so the report exists in the technical file. Ask for the evaluation summary and the endpoint list; that is the part a distributor can actually review.
6. Performance evidence: bench, animal, clinical
Ask for: the bench data, the animal study, and - decisively - a clinical study on the finished device.
A good answer: three layers, in that order. Bench data proves the material absorbs and gels; an animal model proves it controls bleeding in living tissue; a clinical study proves it works in the hands of surgeons. A supplier with only the first layer is selling a material, not a device.
Red flag: clinical claims supported by literature about a competitor's product, or by a study on a different configuration.
What we can show: bench data including water absorption of 6.0 times its own weight and loss on drying of 8.0%; a rabbit liver injury model; a rabbit subcutaneous implantation study (n=21) followed by ultrasound and histopathology; and a randomised, parallel-controlled, non-inferiority clinical trial in breast surgery and gynaecological surgery.
7. Who actually makes the material
Ask for: a description of the conversion process, the equipment, and the patents behind it.
A good answer: the supplier converts the raw material into finished device on its own equipment, under its own process validation. Ask specifically whether they buy in bulk hemostatic gauze or powder and repackage it - a trading office can pass nine of these ten checks and fail this one.
Red flag: vague answers about "our partner factory", or a patent list that belongs to a third party.
What we can show: four patents on the gauze side covering the material and the equipment - 201010591005.8 (method for preparing an oxidized cellulose hemostatic product), 201611223934.7 (novel method for preparing oxidized cellulose), 202021550646.4 (drying oven) and 201821662177.8 (reaction-and-washing apparatus) - plus, for the particles, an invention patent on the hemostatic particles and their preparation method and a utility model on the spray control device.
8. Batch traceability and sterilisation load records
Ask for: one lot number you already hold in stock, traced back to its production batch and its sterilisation load, together with the release record for that load.
A good answer: a chain you can follow without assistance - raw material batch, production batch, sterilisation load and release, ending at the carton in your warehouse. If the chain breaks anywhere, it breaks for a recall in exactly the same place.
Red flag: traceability that exists only at carton level, or a lot number the person in front of you has to go and ask someone else about.
How to test it: treat this as the item to test with a live request rather than a presentation. Judge the answer by whether it arrives complete, not by how fast it arrives.
Checks 9–10: responsibility after the goods leave
9. Private-label responsibility split
Ask for: a signed responsibility matrix naming the legal manufacturer, the technical documentation holder, and who files the registration.
A good answer: one page, unambiguous. Under EU MDR Article 16, placing a device on the market under your own name can make you the manufacturer, with the obligations that follow - including the technical documentation. Decide deliberately whether you want that, rather than discovering it at an authority inspection.
Red flag: a private-label offer with no discussion of who holds the file.
What we can show: private-label scope limited to brand and packaging, plus a written statement of who holds which document in each market - because that answer decides who carries the file.
10. Complaints, adverse-event reporting and recall capability
Ask for: the complaint trend over the last few years, the field safety corrective action procedure, and evidence that a recall drill has been run.
A good answer: a field action that has actually been rehearsed - who calls whom, how stock is located in a distributor's warehouse, how the authority is notified. A procedure nobody has run is not a capability.
Red flag: "we have never had a complaint". For a device in routine surgical use, that usually means the intake is not working rather than that nothing happened.
What we can show: complaint handling and adverse-event reporting are two of the processes the MDSAP audit approach covers, so they are audited by an external auditor rather than self-declared. What MDSAP does not do is discharge your own EU vigilance obligation - if your name is on the label, that sits with you.
How to test it: at the audit, ask for the current complaint trend summary and for the list of regulator reports filed in the past year.
How to score the ten
Score each item 0, 1 or 2, and write the evidence next to the score - an audit without the document reference is an opinion.
| Score | Meaning |
|---|---|
| 2 | Evidence seen, current, and covering your exact product and configuration |
| 1 | Claimed but not yet shown, or shown for a different configuration |
| 0 | Absent, expired, or out of scope |
| Total (of 20) | Reading |
|---|---|
| 18–20 | Qualify for registration-dependent business |
| 15–17 | Qualify for supply, with the gaps closed in writing before the second order |
| 10–14 | Samples and evaluation only |
| Below 10 | Walk away |
The five answers that decide it in thirty minutes
If you only have half an hour, ask these five and stop:
"What is your CE certificate number, and which notified body issued it?" A number is verifiable in two minutes; a paragraph of certification claims is not.
"Which markets have you registered this exact product in?" Documents, not a list.
"Do you convert the material, or buy it in?" The single question that separates manufacturers from trading offices.
"Show me one lot number traced to its sterilisation load." Tests whether traceability exists or is narrated.
"If I private label, who is the legal manufacturer?" The answer that determines what you are really buying.
Red flags that end the conversation
No certificate numbers anywhere in the quotation pack.
"FDA approved" used loosely, with no clearance or approval number behind it.
A registration list containing markets where the product class does not exist.
Clinical claims resting on another company's published study.
A private-label offer with no written statement of who holds the technical file.
FAQ for distributors and procurement teams
How many points should a supplier audit have? Ten to fifteen. Below ten you miss a category; above fifteen the items start overlapping and the audit becomes a document-collection exercise rather than a decision.
Is an ISO 13485 certificate enough on its own? No. It tells you a quality system exists. The CE certificate, the registration portfolio and the product evidence tell you whether the device can actually be sold in your market.
Can a distributor audit a hemostatic device manufacturer remotely? Yes for the documentary checks - items 1 to 6, 9 and 10. Items 7 and 8 need a site visit, or a live video walkthrough where someone opens a batch record for the lot being shipped.
What if the supplier only holds an NMPA registration? Then you are buying a device registered in one market and carrying the registration work elsewhere yourself. That is a legitimate model - price it, and schedule it, accordingly.
Does a CE certificate cover every pack size? Only the configurations on its device list. Check the 0.5 g and 5 g formats explicitly if both are in your range.
How often should the audit be repeated? Set the cadence to your own risk: a full audit at onboarding and every few years after, a documentary re-check annually, and a targeted review after any change notification.