Medical Devices: FDA Should Strengthen Policies Guiding Audits of Third Party Review Organizations

TL;DR

GAO found that FDA’s Center for Devices and Radiological Health (CDRH) administers the Third Party Review Program for certain low‑to‑moderate risk medical devices but has gaps in its audit policies governing Third Party Review Organizations (third parties). The program is voluntary, has accredited 32 third parties since inception and had nine active accreditations as of May 2026; third parties provided 617 510(k) reviews from fiscal years 2018–2025, representing about 2% of CDRH’s annual 510(k) workload. FDA received approximately $8 million for program operations for fiscal years 2023–2027, and GAO’s review—mandated by the Consolidated Appropriations Act, 2023—found that audits have been irregular (25 audits from 2000–2026, conducted in multi‑year phases) and that FDA lacks key audit policy details such as time frames for completing audits and communicating results. GAO identified audits with deficiencies that took more than six months to close and recommends FDA strengthen policies to ensure third parties meet program requirements. Immediate implications for contractors: third‑party reviewers and device manufacturers should expect increased scrutiny, possible tighter audit schedules, and should prepare for faster evidence requests; capture and compliance teams should update risk assessments and monitoring activities now.

Key Points

• What happened: GAO reported that FDA’s CDRH oversees the Third Party Review Program but its audit policies contain gaps (for example, no defined time frames to complete audits and communicate results), and some audits took more than six months to close.
• Who is affected: Medical device and regulatory/compliance market segments, including the NAICS codes 339112, 339113, 541380, 541990, 621511, 621512; agencies HHS and FDA.
• Timeline: GAO analyzed program activity and audits across fiscal years 2018–2025 and audit activity from 2000–2026; FDA received approximately $8 million for program operations for fiscal years 2023–2027; GAO’s work was required by the Consolidated Appropriations Act, 2023.
• What contractors should do NOW: inventory exposure if you are a third‑party reviewer or supplier to 510(k) sponsors; validate audit-readiness evidence (procedures, SOP language, closing documentation) and accelerate corrective‑action timelines; update capture and risk registers to reflect potential policy tightening and increased audit cadence; configure Cabrillo Signals to flag follow‑on solicitations and regulatory updates.

Who Is Affected

Affected market segments include Medical Devices, Healthcare, Regulatory Compliance, Quality Assurance, and Third Party Testing and Certification. Specific NAICS codes and agencies identified in source material: 339112, 339113, 541380, 541990, 621511, 621512; HHS; FDA. Specific contract vehicles pending source review.

Frequently Asked Questions

Q: What did GAO find was deficient in FDA’s audit policies?

GAO found FDA’s audit policies lack key details—most notably defined time frames for completing audits and communicating results—which contributed to cases where audit findings (for example, vague SOP language) took more than six months to close.

Q: How large a role do third parties play in 510(k) reviews?

From fiscal years 2018 through 2025, third parties provided 617 510(k) submission reviews and recommendations, accounting for about 2 percent of CDRH’s annual 510(k) review workload, per GAO’s analysis.

Q: Will FDA increase audits or change funding?

GAO’s report recommends strengthening audit policies; FDA received approximately $8 million for Third Party Review Program operations for fiscal years 2023–2027. Any changes to audit frequency or funding allocations beyond what GAO reported are pending FDA action and further source review.

Definitions

• Third Party Review Program: A voluntary alternative review process administered by FDA’s CDRH that permits device sponsors to contract with FDA‑accredited entities to conduct initial reviews of selected low‑to‑moderate risk 510(k) submissions.
• Third Party Review Organizations (third parties): FDA‑accredited entities that perform initial reviews and provide recommendations on 510(k) submissions prior to FDA making final marketing decisions.
• 510(k) submission: A premarket submission that demonstrates a medical device is substantially equivalent to a legally marketed device for CDRH review.
• Center for Devices and Radiological Health (CDRH): The FDA center that administers device review programs, including the Third Party Review Program.

Intelligence Response

• Which Cabrillo products to leverage:
• Cabrillo Signals War Room — Already detected this GAO report and delivered this briefing. Use it to monitor subsequent FDA statements, audit announcements, and third‑party reaccreditation notices in real time.
• Cabrillo Signals Match Engine — Rescore your opportunity pipeline to reflect increased audit risk and potential program modifications that affect competitive posture.
• Cabrillo Signals Intelligence Hub — Track affected NAICS codes and monitor for follow‑on solicitations or agency notices; create saved searches that alert on SAM.gov (System for Award Management) postings tied to the program.
• Proposal Studio (Proposal OS) and Proposal Studio Workflow Tracker — Prepare bid materials and audit‑ready compliance matrices; employ the 9‑gate capture workflow to ensure evidence packages meet tightened audit expectations.
• Who to notify internally:
• Capture/Business Development lead — evaluate near‑term opportunities and bid/no‑bid decisions.
• Compliance/Quality Assurance lead — prioritize audit‑readiness of SOPs and corrective‑action documentation.
• Proposal Manager — ready compliance matrices and bid materials for any solicitations or participation opportunities.
• Executive Sponsor — align resource decisions and risk tolerance.
• First 48‑hour response playbook:
• Hour 0–4: Convene a cross‑functional standup (Capture, QA, Proposal, Legal). Pull current 510(k) engagement list and any third‑party accreditation documentation.
• Hour 4–12: Run Signals Match Engine rescore on active pursuits tied to NAICS codes in the segmentation and tag opportunities with “Regulatory Audit Risk.”
• Hour 12–24: Use Proposal Studio to assemble audit‑readiness checklists and gap analysis for SOPs and corrective action records; assign remediation owners.
• Hour 24–48: Configure Intelligence Hub saved searches for FDA audit notices and third‑party reaccreditation postings; schedule stakeholder updates and a 7‑day remediation sprint for priority items.

Primary reading and guidance: Winning Federal Contracts Guide (/insights/winning-federal-contracts). Related resources: CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide), CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide).