Guides / For Suppliers

What a First Customer Audit Looks Like From the Shop's Side

September 26, 2026

An audit is not a tidiness test. It is one person checking whether what your procedures say you do matches what your records show you actually did, on the parts that will end up in their device.

This article is built from what the clauses below require an auditor to look for, not from a client base. We are a matching service and we have never run a shop, so we are not going to tell you what happens on the floor. What we can do is read the requirement that the buyer’s own auditor is working from, which is public, and say plainly what it forces them to ask.

Who is actually coming

Usually one auditor from the device company’s quality group, sometimes with an engineer who owns the part. The quality person checks the system. The engineer checks whether you understood the drawing.

The reason they are there at all is that the device company carries the regulatory obligation for its suppliers. Under the QMSR the buyer has to establish and document requirements for suppliers and evaluate whether you meet them. That obligation cannot be delegated to you, to your certification body, or to anyone who matched you. It is why a current ISO 13485 certificate does not end the conversation, and why a buyer who skips the audit entirely is taking a risk on their own file, not yours.

The four documents to have out before they arrive

Your certificate and its scope statement. Not just the certificate. The scope, because that is the line that decides whether your system covers the process this part needs. Buyers get this wrong often enough that it has its own article.

The quality manual and the procedure list. They will ask for specific procedures by name. Having to search for them reads as a system nobody uses.

One complete lot history for a part like theirs. Order, drawing revision, material certificate, in-process records, inspection report, nonconformance if there was one, certificate of conformity, shipping record. One lot, complete, from order to despatch. This single folder answers more questions than any presentation.

Your last internal audit and management review. Both are required, both get asked for and both are where a system that exists only on paper becomes obvious.

What they open first

Traceability, on a real lot. An auditor picks a job you shipped and follows it backwards. The material certificate has to match the heat or lot number on the traveller, which has to match the part number and revision on the order, which has to match the inspection record, which has to match the certificate of conformity you sent.

If any link in that chain is reconstructed rather than recorded, it shows immediately, because reconstructed records are too clean and too consistent in their handwriting and timing.

Second, they check document control. Which drawing revision was on the floor when that lot ran, and how would an operator know it was the current one.

The findings the clauses make predictable

These are not observations about your shop. They are the places where the requirement is specific and the ordinary way of working in a commercial shop does not meet it.

Calibration records with gaps. Every gauge and instrument used to accept product needs identification, a calibration interval and traceable results. The common gap is not an uncalibrated micrometer. It is an operator’s own gauge used to accept a feature, with no record that it exists.

Training records that do not name the operation. “Trained on CNC” is not evidence of competence for a specific process. The record needs to connect a named person to the operation they are qualified to run.

Process validation missing where the result cannot be verified. Anything whose output you cannot fully verify by inspecting the part needs validation. Cleaning and passivation are the usual candidates in a machine shop. Measuring a dimension is verification. Proving a part is clean is not, so cleaning normally needs validation, and pointing at a supplier’s certificate does not remove your obligation to control the process you bought.

Nonconformance records with no cause and no closure. A form that records what happened, with nothing about why or what changed, is a log rather than a corrective action system. Auditors read the closure, not the description.

Change control that only covers drawings. A revision change gets handled. Switching a tool supplier, a coolant, a cleaning chemistry or a subcontractor often does not, and for a validated process that is the change that matters.

What to say when you cannot say yes

The worst answer is an improvised yes. An auditor who catches one unsupported claim starts verifying everything, and a one day audit becomes two.

Say what is true and what is scheduled. “We do not have that. Here is what we do instead, here is the gap, here is when it is planned.” A dated gap with an owner is an acceptable finding. A claim that collapses under a records check is a credibility problem, and credibility is the thing the audit is actually measuring.

If a requirement is genuinely outside your system, say so before the audit rather than during it. Losing a job in the desk review costs both sides a morning. Losing it on day two of an audit costs you the audit and the relationship.

What happens after

You get findings in writing, usually graded. You respond with a cause, a correction, a preventive action and a date. The buyer accepts or pushes back. Nothing is approved until the responses are accepted, so the speed of your reply is part of what you are being assessed on.

Then the part of this that costs money starts, which is that the quality agreement and the documentation regime the audit just confirmed have to be priced into the job. If you have not separated that from your machining rate, the documentation line is worth reading before you quote.

The buyer’s side of this audit is in the guide to medical device supplier qualification.

Where we fit

We match buyers to machining suppliers and the buyer pays us nothing. We check your certificate, its scope and what you tell us you run, and we say exactly what that check covers at how we vet. We do not audit you, we do not qualify you for the buyer and we could not, because that qualification belongs inside the device company’s own quality system.

If your shop is certified and ready for the audit described above, register it here.

See also: preparing for a notified body audit as a subcontractor, for the lot-trace visit that comes from the device maker’s notified body.

Sources

Standards and regulations change. Check the current text at the source before you rely on it in a submission.

Frequently asked questions

How long does a first customer audit take?

One or two days on site for a machining supplier is normal. A single day is common when the part is low risk and the buyer has already done a desk review of your certificate and procedures. Two days is more likely when the part is an implant, when process validation is in scope, or when the auditor wants to trace several lots end to end.

Is a customer audit the same as my certification audit?

No. Your certification body audits your quality system against ISO 13485 as a whole. A customer audits the part of your system that will touch their device, and they can ask for things the standard does not require, because their own regulatory obligation for supplier controls sits with them. Expect more part-specific tracing and fewer generic clause questions.

Can I fail an audit for having findings?

Findings are the normal output of an audit, not a verdict. What decides the outcome is whether the findings are systemic, whether you can show the cause and whether your corrective action is credible and dated. A shop with five minor findings and a working corrective action process usually clears. A shop with one finding and no evidence it ever closes anything usually does not.

Need a quote for this part?

Send the drawing. We match you with up to 3 medical machining suppliers and reply within 24 business hours.

Get matched with a medical machining supplier