Medical Devices: FDA Should Strengthen Policies Guiding Audits of Third Party Review Organizations

Executive Summary

The GAO report finds that FDA’s Center for Devices and Radiological Health (CDRH) runs a voluntary Third Party Review Program for certain low-to-moderate risk medical device 510(k) submissions. Third parties performed 617 510(k) reviews from fiscal years 2018–2025 (about 2 percent of CDRH’s 510(k) workload annually). FDA received approximately $8 million for Third Party Review Program operations in fiscal years 2023 through 2027, and as of May 2026 there were nine third parties with active accreditations (32 accredited since program inception). GAO identified gaps in FDA’s audit policies (for example, missing time frames for completing audits and communicating results) and noted that FDA’s periodic audits (25 audits from 2000–2026, including audits in 2022 and 2025–2026) sometimes took more than six months to close findings.

Contractors in the named segments should pay attention now because GAO’s findings signal potential near‑term changes to program oversight and internal FDA audit practices, and because a relatively small but established third‑party review pipeline exists that directly affects market access timing for device sponsors. Firms with roles in manufacture, testing, regulatory support, and accreditation should prepare for heightened scrutiny of documentation, standard operating procedures, and audit-readiness as FDA considers strengthening audit policies and implementing GAO recommendations.

Impact Matrix

Medical Devices

• Risk Level: Critical
• Opportunity: Demand for regulatory support tied to 510(k) submissions and for remediation of audit findings. Specific NAICS codes from Tags: 339112, 339113, 621511, 621512. Specific opportunities TBD pending solicitation language.
• Timeline: Program funding noted for fiscal years 2023–2027; GAO analyzed 2018–2025 review activity; audit activity documented through 2026; as of May 2026 there were nine active accreditations.
• Action Required: Review and tighten device design and quality documentation, align SOP language to reduce vagueness, prepare to respond quickly to audit findings and close corrective actions within shorter time frames. Monitor FDA communications for any policy updates following GAO recommendations.
• Competitive Edge: Develop turnkey 510(k) and post‑market support packages that explicitly address third‑party review expectations and audit-readiness to shorten sponsor response cycles.

Healthcare

• Risk Level: High
• Opportunity: Support services for device sponsors (regulatory strategy, clinical/supporting evidence, readiness for market entry). Specific NAICS codes from Tags: 621511, 621512, 541380, 541990. Specific opportunities TBD pending solicitation language.
• Timeline: Relevant program and audit activity spans the fiscal years and audit years noted in the Summary (see funding FY2023–2027 and audit activity through 2026).
• Action Required: Ensure clinical and lab support documentation aligns with FDA and third‑party expectations; coordinate rapid responses for submissions that flow through third parties; validate evidence packages against QA/regulatory checklists referenced in program materials.
• Competitive Edge: Offer bundled clinical‑documentation and submission‑management services tailored to third‑party review workflows so sponsors can reduce time to decision.

Regulatory Compliance

• Risk Level: Critical
• Opportunity: Advisory and compliance remediation work as FDA strengthens audit policies and enforcement of participation standards. Specific NAICS codes from Tags: 541380, 541990. Specific opportunities TBD pending solicitation language. Compliance surfaces from Tags that are relevant: FDA 21 CFR Part 820, ISO 13485, FDA Quality System Regulation, Medical Device Single Audit Program (MDSAP).
• Timeline: GAO report tied to the Consolidated Appropriations Act, 2023 provision; audit records up through 2026; funding FY2023–2027.
• Action Required: Map clients’ procedures to the compliance surfaces named in Tags, conduct internal mock audits to find and remedy vague SOP language, and define measurable timelines for closing corrective actions in anticipation of tighter FDA audit expectations.
• Competitive Edge: Build and market a rapid‑response audit remediation service that documents closure steps against audit timelines and tracks CAPA completion to minimize program jeopardy for third parties and sponsors.

Quality Assurance

• Risk Level: High
• Opportunity: QA system design/improvement to reduce audit findings and speed closure of deficiencies. Specific NAICS codes from Tags: 339112, 339113, 541380. Specific opportunities TBD pending solicitation language. Relevant compliance surfaces: FDA 21 CFR Part 820, ISO 13485, FDA Quality System Regulation, MDSAP.
• Timeline: Audit history and funding timeline as noted in the Summary (audits through 2026; funding FY2023–2027).
• Action Required: Strengthen SOP clarity, implement measurable audit response timelines internally, and train staff on audit expectations to avoid prolonged deficiency closure (noting GAO found some closures took >6 months).
• Competitive Edge: Provide validated SOP templates and audit‑closure tracking tools aligned to the compliance surfaces listed in Tags to help clients reduce time‑to‑closure for audit findings.

Third Party Testing and Certification

• Risk Level: Critical
• Opportunity: Services to support accreditation, reaccreditation, and audit readiness for entities that seek to participate in or maintain status in the Third Party Review Program. Specific NAICS codes from Tags: 541380, 541990. Specific opportunities TBD pending solicitation language.
• Timeline: FDA conducted 25 periodic audits from 2000–2026 with recent audits in 2022 and 2025–2026; as of May 2026 nine third parties had active accreditations. Funding for program operations documented for FY2023–2027.
• Action Required: For accredited or aspiring third parties, perform gap assessments against FDA participation standards, prepare accreditation/reaccreditation materials, and adopt internal audit timelines that meet or beat likely FDA expectations. Anticipate stricter FDA audit policies following GAO recommendations.
• Competitive Edge: Specialize in third‑party accreditation consulting—offer pre‑audit services, mock FDA audits, and CAPA management that explicitly target the program’s known pain points (e.g., ambiguous SOP language, slow closure of findings).

Cross-Segment Implications

• Third Party Testing and Certification, Regulatory Compliance, and Quality Assurance are tightly coupled: weaknesses or delays in one area (for example, vague SOPs discovered during an audit) can force remediation work from QA and compliance contractors and slow device market entry (affecting Medical Devices and Healthcare segments).
• The program’s small but consistent share of 510(k) workload (~2 percent annually for 2018–2025) means changes in FDA audit policy or third‑party participation standards could have outsized effects on sponsors who rely on the third‑party pathway; thus regulatory advisory and submission‑support firms may see increased demand.
• GAO-identified audit process gaps (missing time frames, lengthy closure of findings) create opportunities for contractors that can deliver faster corrective‑action closure, more precise SOP language, and better audit‑management tooling across all named segments.