Certified vs. Audit-Ready: RFQ Questions Medical Buyers Forget to Ask
Certification is only the starting point when evaluating a machining partner for regulated medical manufacturing. Learn what separates an ISO-certified supplier from one that’s truly audit-ready, and the questions buyers should ask before a program gets underway.
Every medical device RFQ asks some version of the same question: Are you ISO certified? The answer is almost always yes. Most capable suppliers hold the certification, run the inspections, and can point to a quality manual on request.
What fewer RFQs ask is the harder follow-up: Can you prove it, on demand, for this specific part, six months from now?
That gap — between holding a certification and operating one — is where most supplier surprises in regulated manufacturing actually live. A quality system that looks solid on a capabilities sheet can still fail the moment it’s tested by an audit, a field complaint, or a program that scales faster than expected.
A certification tells you that a supplier has built a quality system. It doesn’t tell you whether that system holds up under pressure.
What “ISO certified” tells you, and what it doesn’t
ISO 9001:2015 certification means a supplier has documented processes for quality management: inspection protocols, corrective action procedures, and a framework for consistency. It’s a real signal, and a supplier without it isn’t a viable option for regulated work — full stop.
But certification is a snapshot, not a guarantee. It confirms a system existed on the day of the audit. It doesn’t confirm the same rigor applies to a rush order, a design revision mid-program, or an operator running a part for the first time at 2 a.m. on second shift.
For medical device manufacturers, that distinction matters more than in almost any other area of machining. A missed non-conformance on an industrial bracket is a cost problem. A missed non-conformance on an implant or a surgical instrument is a patient-safety problem, and the buyer who sourced it is the one who has to explain that to their own quality team, their notified body, or the FDA.
What actually predicts reliability in a regulated supplier
Documentation quality isn’t one thing; it’s several, and each one fails independently:
- Document control — how does the supplier guarantee the machine is running from the current print, not a superseded revision?
- Non-conformance handling — when a part fails inspection, is there a documented root-cause and corrective-action process, or does it get reworked quietly and shipped?
- Material traceability — can the supplier trace a specific finished part back to its raw material heat or lot number, not just confirm “yes, we track that”?
- Certification access — can they produce material certs and biocompatibility documentation quickly, or does it take a week and a follow-up email?
- Process consistency — is quality dependent on one experienced machinist, or is it built into the process itself?
A supplier with real documentation infrastructure can answer all five with specifics. A supplier newer to regulated work tends to answer the first one or two well and get vague on the rest.
Five questions to add to every medical device RFQ
These go beyond “are you certified” to test whether the certification is actually operational. Each one is designed to reveal something specific, not just invite a sales pitch.
| Five questions to add to every medical device RFQ:
1. Walk me through your document control process. How do you prevent an outdated drawing revision from reaching the machine floor? 2. What happens when a part fails inspection? Ask to see the non-conformance and corrective action process, not just hear that it exists. 3. How is material traceability actually maintained? Can a finished part be traced back to its raw material heat or lot number, and how fast? 4. How quickly can you provide material certifications or biocompatibility documentation for the specific materials this program requires? 5. What changes between first-article approval and full production, and what’s built in to make sure nothing does, without you being told? |
Vague answers — “we’re very thorough,” “that’s never been an issue” — aren’t answers. They’re signals that the documentation exists on paper more than in practice.
Where this gap bites hardest
The distance between “certified” and “audit-ready” shows up most clearly in three situations:
- A design revision mid-program — without airtight document control, a revised print doesn’t always reach every operator, and the non-conformance isn’t caught until final inspection, if at all.
- A field complaint or regulatory inquiry — the moment a buyer needs their supplier’s traceability to work perfectly, under a deadline, with someone else’s compliance team watching.
- A volume ramp — documentation rigor that worked fine at low volume has to hold up across multiple shifts and machinists without drifting. This is where untested quality systems start to show cracks.
What a documentation-ready supplier actually looks like
You don’t have to take a supplier’s word for it. The difference shows up in how they answer, not just what they claim:
- They can produce a material traceability example on request, not just describe the concept
- Their non-conformance process has real, walkable examples, not just a flowchart in a quality manual
- Document control isn’t dependent on one person remembering to update a folder
- Certifications and material documentation are retrievable in days, not weeks
- Their answers get more specific the more detailed your question gets, not less
Certified is the starting point. Operational is what protects your program.
Every medical device manufacturer sourcing machined components should expect a supplier to hold ISO 9001:2015 certification, operate an FDA-registered facility, and run first-article and CMM validation on critical dimensions. That’s the baseline Path Machining + Automation’s medical capabilities are built on.
What separates a good RFQ from a great one is asking follow-up questions that test whether that foundation actually holds up in practice before a program is underway, not after an audit finding forces the conversation.
Send a drawing and talk through your project →
FREQUENTLY ASKED QUESTIONS
Common questions about evaluating medical machining supplier documentation
What documentation should a medical device manufacturer expect from a machining supplier?
At minimum: a documented quality management system (typically ISO 9001:2015), material certifications and traceability records for every lot, first-article inspection reports, and a documented non-conformance and corrective-action process. For higher-risk devices, expect the supplier to support your own Device History Record and Design History File requirements with the traceability data they generate.
Is ISO 9001 certification enough, or should I require ISO 13485?
It depends on the device classification and your own internal risk assessment — some OEMs require their machining suppliers to hold ISO 13485 directly, while others accept a strong ISO 9001:2015 quality system paired with documented medical-industry experience and traceability practices. Confirm your own regulatory requirements internally before finalizing supplier criteria, and ask any prospective supplier directly which standard they’re certified to.
How can I verify a supplier’s traceability system actually works, rather than just exists on paper?
Ask for a walkthrough of how they’d trace a specific finished part back to its raw material lot, and time how long it takes them to produce an example. A supplier with a functioning system can usually show you within days; a supplier where traceability is more theoretical than operational will hesitate or take considerably longer.
What’s the difference between a material certification and a certificate of conformance?
A material certification documents the properties and chain of custody of the raw material itself — alloy composition, mill source, heat, or lot number. A certificate of conformance documents that the finished part meets the specifications on the drawing. Regulated medical work typically requires both, and a supplier should be able to explain the distinction without prompting.
When should documentation and quality questions come into the RFQ process?
Before you commit to a supplier, not after. The best time to test a supplier’s documentation rigor is during evaluation, while they have every incentive to demonstrate it clearly. Discovering a documentation gap mid-program — or worse, during an audit — is a significantly more expensive lesson.
Where can I get a quote for medical CNC machining?
Contact Path Machining + Automation to share your project requirements, prints, and material needs. Our team will walk through documentation and traceability requirements alongside the quote itself, so there are no surprises once the program is underway.