Case study
Supplier due diligence case study: do you know who owns your critical suppliers?
A medical device manufacturer was re-approving the overseas supplier of a critical component. The certificates were valid, the declarations were signed and the qualification file was complete.
An independent ownership check still changed the terms of approval. The supplier kept its approval, but on conditions the quality file alone would never have produced.
Why do medical device manufacturers need supplier due diligence?
Supplier due diligence shows who owns and controls a supplier, and whether its owners, directors or connected parties carry sanctions, legal or reputational risk. Quality qualification shows the supplier can make the part. For a critical component, both sit inside the supplier risk you are expected to control.
Certificates, declarations and qualification records test whether a supplier can make the part to specification. Four gaps around ownership and control sit outside them. A supplier names its parent company. That parent can sit under a holding company in another jurisdiction, and the declaration has no reason to mention it. Owners and boards change after onboarding. Many supplier agreements never require the supplier to report it, so the file stays as it was on the day of approval. Owners and directors can appear in sanctions lists, court records or local-language press. A quality audit has no reason to read any of them. ISO 13485 clause 7.4.1 ties supplier evaluation and monitoring to the risk of what the supplier provides. Since 2 February 2026, the FDA Quality Management System Regulation has applied that clause to US manufacturers through 21 CFR Part 820. Our guide to supplier controls under FDA QMSR covers what changed.
What does a supplier quality file leave out?
Ownership stops at the declared parent
Declarations go out of date
Connected parties go unscreened
Regulators expect proportionate control
Six steps close the ownership gap. The case study shows each one in use, with the evidence it produced. Neotas analysts work in 30+ languages, so local court records and press are read as written. See how enhanced due diligence covers owners and directors.
What should you do before re-approving a critical supplier?
The case study runs to two pages and is written for the quality, regulatory and compliance teams who sign off critical suppliers. It covers: Each finding carries a certainty label:
What does the supplier due diligence case study cover?
Supplier due diligence is the independent check of a supplier’s identity, ownership, control and connected parties, with screening for sanctions, politically exposed persons, adverse media and court records. It runs alongside quality qualification for suppliers that carry higher risk. Supplier qualification checks capability: certifications, process controls and product quality. Supplier due diligence checks who owns and controls the business, and what risk those people carry. ISO 13485 does not name ownership checks. Clause 7.4.1 requires supplier evaluation and monitoring in proportion to the risk of the purchased product. For a critical component, unknown ownership and control are part of that risk. Since 2 February 2026, the FDA Quality Management System Regulation incorporates ISO 13485:2016 by reference into 21 CFR Part 820. Supplier controls now follow ISO 13485 clause 7.4. Confirm the supplier’s legal identity, then trace each layer of ownership through company registries in every jurisdiction involved. Compare current filings with historical records, and screen every owner and director you find. Monitor critical suppliers continuously for ownership changes, director changes and new adverse media, and run a full review at each re-approval. Add a contract clause that requires the supplier to report changes.
Frequently asked questions about supplier due diligence
What is supplier due diligence?
What is the difference between supplier qualification and supplier due diligence?
Does ISO 13485 require supplier ownership checks?
What does FDA QMSR require for supplier controls?
How do you verify who owns a supplier?
How often should critical suppliers be re-screened?
Neotas combines automated screening with analyst investigation to show who owns and controls your critical suppliers. Download the case study, or tell us about the supplier and we will scope the check.
Make your next supplier approval on evidence
