Medical Devices: FDA Should Strengthen Policies Guiding Audits of Third Party Review Organizations

Overview

The GAO report highlights weaknesses in FDA’s Center for Devices and Radiological Health (CDRH) administration of the Third Party Review Program, a voluntary pathway that lets FDA‑accredited third parties perform initial reviews of certain 510(k) premarket submissions. Third parties provided 617 510(k) reviews from fiscal years 2018 through 2025 (about 2 percent of CDRH’s 510(k) reviews annually), and FDA received approximately $8 million for Third Party Review Program operations in fiscal years 2023 through 2027. FDA is required to audit third parties periodically and has conducted 25 periodic audits from 2000 through 2026, but GAO found gaps in FDA’s audit policies—most notably missing time frames for completing audits and communicating results—leading to some audit findings remaining open more than 6 months. For contractors (third parties, device sponsors, and firms supporting 510(k) work), this means an elevated risk environment: expect closer scrutiny, potential policy updates, and a need for faster, audit‑ready responses. Take immediate steps to tighten audit readiness, confirm accreditation evidence, and review quality‑system controls named in the event (for example, FDA 21 CFR Part 820, ISO 13485, and MDSAP).

See the Winning Federal Contracts Guide (/insights/winning-federal-contracts) for capture and compliance framing.

Immediate Actions (This Week)

• [ ] Inventory and secure accreditation and reaccreditation documents for participation in the Third Party Review Program (including any active accreditation evidence).
• [ ] Confirm where your organization’s 510(k) review work and records reside; snapshot and back up reviewer files, decision rationale, and supporting evidence for recent submissions.
• [ ] Assign a named audit response lead and escalation path (contracts/legal, quality director, and executive sponsor) with contact details and a 24–72 hour response SLA for audit requests.

Short-Term Actions (30 Days)

• [ ] Run an internal audit simulation focused on third‑party review practices and closing audit findings within defined time frames; document any process gaps and corrective actions.
• [ ] Update SOPs to include explicit time frames for audit activities (receiving, responding, corrective action implementation, and closure tracking) and publish an audit escalation matrix.

Long-Term Actions (90+ Days)

• [ ] Embed audit closure metrics into your quality management system (QMS) and management review process; report trends to leadership and use them as capture/contract performance criteria.
• [ ] Strengthen training, record retention, and traceability for 510(k) review workstreams; align QMS updates to FDA 21 CFR Part 820, ISO 13485, and MDSAP expectations and schedule periodic internal verifications.

Compliance Checklist

• [ ] Maintain documented compliance with FDA 21 CFR Part 820 (Quality System Regulation) where applicable.
• [ ] Maintain ISO 13485 conformance artifacts and audit reports relevant to device review activities.
• [ ] Maintain MDSAP-related records and evidence where your organization participates in or is assessed under MDSAP.
• [ ] Maintain complete accreditation/reaccreditation records for the Third Party Review Program and make them readily available for FDA audit.
• [ ] Documented SOPs that define time frames for audit response, corrective action implementation, and audit‑finding closure.
• [ ] Retention and traceability of 510(k) submission review materials and reviewer qualification records.
• [ ] Training records demonstrating personnel competency for conducting 510(k) reviews.

Compliance scope TBD — re‑evaluate when official guidance or updated FDA policy is published.

Resources

• [FDA — Medical Devices overview and regulation] (https://www.fda.gov/medical-devices)
• [eCFR: 21 CFR Part 820 — Quality System Regulation] (https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820)

Related reading:

• CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide)
• CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide)

How Cabrillo Club Automates This

• Cabrillo Signals War Room — Already detected this event and delivered this briefing within minutes. War Room continuously monitors regulatory changes, GAO reporting, and agency policy shifts so your team is alerted immediately when FDA or HHS publishes updates to the Third Party Review Program, audit guidance, or related notices. Use the War Room alert to trigger your internal audit playbook and notify the named audit response lead.
• Cabrillo Signals Match Engine — Automatically rescors your opportunity pipeline when events like this shift the competitive landscape. The Match Engine will reprioritize opportunities and flagged pursuits where audit‑readiness, QMS strength, or accreditation history materially affects your win probability, helping capture teams focus on best-fit pursuits.
• Cabrillo Signals Intelligence Hub — Tracks affected agencies, the relevant NAICS groupings, and contract vehicles. Configure saved searches and alerts to notify you when follow‑on solicitations, guidance documents, or FDA notices referencing the Third Party Review Program or 510(k) processes appear on public feeds and procurement portals. Use Intelligence Hub to maintain an audit‑ready library of accreditations and historical correspondence tied to specific opportunities.
• Proposal Studio (Proposal OS) — Generates compliance matrices and first‑draft technical approaches tailored to FDA/510(k) audit expectations using your past performance data. Proposal Studio can produce standard language for audit response plans, corrective action plans, and QMS descriptions that reference FDA 21 CFR Part 820, ISO 13485, and MDSAP practices where applicable, accelerating bid/no‑bid decisions and proposal production.
• Proposal Studio Workflow Tracker — Provides a 9‑gate capture management workflow from opportunity identification through post‑submission. Workflow Tracker automatically routes compliance and legal reviews, tracks supplier and reviewer certifications, and assembles audit‑ready documentation packages so you can respond to FDA audit requests within the time frames you define in your SOPs.

Take action: review the War Room alert, run a Match Engine reprioritization, and schedule a Proposal Studio draft to prepare audit‑ready documentation. For capture and compliance playbooks, see the Winning Federal Contracts Guide (/insights/winning-federal-contracts).