A supplier qualification audit for medical PCBA should generate verifiable process evidence — FMEA coverage, SPC discipline, inspection percentages, traceability granularity, rework records — not just a certificate scope statement. This framework gives procurement and quality engineers a checklist for auditing what actually predicts reliability at the PCBA process step.
What Should a Medical PCBA Supplier Audit Actually Verify?
A supplier audit is productive when it generates data the auditor can independently check, not claims the auditor has to take on faith. That means asking for records during the audit itself — a traceability pull, a rework log, an SPC chart — rather than a summary presented afterward.
For non-implantable instrumentation — diagnostic, monitoring, and laboratory equipment — the process evidence below is answerable through documentation and shop-floor observation, regardless of which certifications a supplier holds.
How a given process step maps to your device's classification and regulatory submission strategy is a determination for your own regulatory/quality function. Treat this framework as an engineering audit tool, not regulatory guidance.
What Process Evidence Predicts PCBA Reliability?
Four categories carry real predictive weight:
FMEA coverage. Has the supplier run a process FMEA against the specific board — not a generic template — identifying failure modes in placement, reflow, and inspection steps and the controls that catch them before shipment?
Statistical process control. Is SPC applied to variables that actually drift in SMT — solder paste volume, placement accuracy, reflow profile — with control limits tied to defect data, not just a paper policy?
Inspection coverage, not inspection presence. A supplier having AOI on the line is a different claim than AOI covering 100% of placements with defined defect libraries. The same distinction applies to X-ray coverage for BGA/QFN voiding — applied to every board with hidden joints, or only spot-checked.
Traceability granularity. Unit-level traceability is a materially different capability than lot-level or batch-level traceability. Granularity determines whether a field failure can be traced to a specific reel, machine run, and inspection record — or only to a production week. Smart MES architectures built for this level of resolution deliver full silicon-to-system traceability rather than aggregate batch logs.
Buyer's Audit Checklist
A procurement or quality engineer evaluating a PCBA supplier for a medical program should verify, not just ask about:
Equipment list, matched to the process step. Request specific model numbers, not a category list — for example, a selective wave soldering system with nitrogen protection (e.g., ZSWHPS-11-2), a jet printer/dispenser for fine-pitch paste and adhesive work, and a reflow oven with documented profile control (e.g., JTR-1200D-N). Confirm inspection equipment (SPI, AOI, X-ray) sits at the process steps where it's actually needed, not only at final QC.
Test coverage percentage. What fraction of boards go through ICT or flying probe versus functional test only? What's the X-ray sampling rate on BGA/QFN-populated boards — 100%, or a sample plan? Oblique-angle X-ray capability matters specifically for BGA/QFN void detection, since straight-angle imaging can miss voids hidden behind the ball array.
Warpage and fixture control. For thin or high-density boards, ask what fixturing controls warpage during reflow — a supplier using dedicated fixtures (e.g., synthetic stone) for this purpose is signaling a designed-in control rather than a reactive fix.
MES traceability depth. Does the unit ID resolve to component lot number and date code, or only to a work order? Can the supplier produce a traceability record for a single serial number on request, during the audit, not after?
Rework record retention. Are rework events logged per unit with root cause, or tracked only in aggregate yield numbers? Ask directly what retention period applies and get it confirmed in writing — don't assume a default. A supplier that can only produce rolled-up yield percentages, with no individual rework history, limits your own corrective-action capability later.
Change control on process parameters. Does the supplier notify you before changing reflow profile, paste supplier, or inspection algorithm on a running program, or only after a nonconformance surfaces?
Certification scope, as one line item among many. Ask what QMS certifications the supplier holds and what scope they cover — this is one input for your own supplier qualification record, not a pass/fail gate by itself.
Certified but Process-Weak vs. Uncertified but Process-Strong: How to Tell the Difference
A certificate on the wall answers "does a documented QMS exist." It doesn't answer "is this specific line under statistical control today." The differentiators show up in the audit itself, not the paperwork binder:
Weak-process signal: SPC charts exist but show no out-of-control action taken in recent records — a sign the charts are generated, not used.
Weak-process signal: Traceability records take an extended back-and-forth to retrieve, or require cross-referencing disconnected spreadsheets.
Strong-process signal: The supplier can pull a single serial number's full genealogy — component lots, inspection results, rework history — during the audit meeting itself, the same way component-level traceability matters as much as assembly precision on ESD-sensitive sensor board programs.
Strong-process signal: Process FMEA references have been updated after actual line events, not left static since initial qualification.
Certification scope is one input on the checklist above. The audit itself is about inspection architecture and process data.
A Note on Our Own Certification Scope
For transparency: PCBCart holds IATF 16949 certification and does not hold ISO 13485. We disclose this as one line item in supplier qualification records, consistent with the checklist above — a buyer's own supplier quality function determines what certification scope its program requires.
FAQ
What's the minimum traceability granularity to ask for in a PCBA audit?
Unit-level ID tied to component lot number and date code, retrievable on demand — not aggregate batch records.
How do I know if a supplier's inspection coverage is adequate, not just present?
Ask for the coverage percentage and sampling logic, not just the equipment list — e.g., 100% AOI on placements versus spot-check sampling, and full X-ray coverage on BGA/QFN boards versus a sample plan.
Should certification scope be a pass/fail gate in supplier qualification?
It's one input among the process evidence in this checklist — FMEA coverage, SPC discipline, inspection percentages, and traceability granularity carry more predictive weight for reliability at the assembly step.
Helpful Resources
● Managing Thermal Reliability in Diagnostic Instrument PCBA
● Why Precision Matters: Choosing PCBCart for Medical PCBA Services
● The Role of IPC Standards in PCB Quality Control
● PCB Assembly Services for MicroTech Medical Equipment
If you'd like to apply this checklist against your own BOM and process requirements, contact our engineering team to schedule a factory audit walkthrough.
