How to Audit an LED Beauty-Device Manufacturer: A Risk-Based Audit Plan

This page sets out a buyer’s audit framework. It is not a description of any single supplier’s internal audit programme.

Table of Contents

• 1. An Audit Is a Test, Not a Tour
• 2. Scope It, Then Ask for the Records in Advance
• 3. Follow One Product Through the System
• 4. Turn Findings Into Verified Closure
• 5. Decide on Residual Risk
• 6. Project-Specific Points to Add
• 7. Being Audited, and What We Prepare
• 8. References & External Links

---

1. An Audit Is a Test, Not a Tour

The difference between an audit and a visit is what you are trying to establish. A visit establishes impressions: the line is busy, the building is large, the people are welcoming. An audit establishes whether a specific process produced a specific outcome, and whether it will do so again next month without you there.

That distinction decides what you spend the day on. An impression-led tour goes where the supplier wants to show you. A test goes where your risks are — which may be a small station at the end of the line where the final check is signed.

The scope should be set before the invitation is accepted, and it should be proportionate. Four inputs decide it: the product’s risks, the processes that determine those risks, the regulatory expectations of your target market, and anything already observed in samples or previous orders. A supplier whose samples arrived late and inconsistent does not need a shorter audit; it needs a narrower one aimed at why.

---

2. Scope It, Then Ask for the Records in Advance

Name the site, the product families, the outsourced operations, the standards you are auditing against and the key risks. Then request procedures and selected records before you travel — not to read them all, but because the supplier’s ability to produce them on request is itself the first finding.

Pre-Read Request	What It Tells You	If It Cannot Be Produced
Incoming inspection procedure and recent records	Whether components are checked against criteria, or simply received.	The first control in the chain is absent, and every later claim becomes harder to hold.
Production travellers or batch records	That a unit can be tied to the operations, operators and parts it passed through.	Traceability is retrospective invention rather than a record.
Final test results with their criteria	Whether a result was judged against a limit, and who judged it.	Testing may be happening without a pass criterion, which is measurement without control.
Nonconformance log and corrective actions	Whether problems are captured and whether causes are addressed.	Either nothing goes wrong or nothing is recorded; both are worth investigating.
Equipment maintenance and calibration	Whether the instruments behind the results were trustworthy on the day.	Test data exists with no evidence that the instrument was accurate when it produced it.
Training records for critical stations	Whether the person performing a check was qualified to perform it.	Competence is assumed rather than demonstrated, and turnover silently changes the product.
Change control procedure and recent changes	Whether design and component changes are approved, recorded and re-tested.	You have no way of knowing whether the approved configuration is the one in production.
Outsourced process list and controls	Where your risk actually sits, and who is accountable for each step.	Subcontractors remain invisible until they cause a problem you cannot trace.

Agree confidentiality terms before any of this arrives. Commercially sensitive records are a legitimate reason to hesitate, and a supplier who is asked to hand over process detail without any protection is right to push back. The request should be specific enough to be answerable and narrow enough to be safe.

---

3. Follow One Product Through the System

The most productive hour of an audit is spent on a single unit. Choose a sample record and trace the item from incoming components through assembly, testing, release and shipment — in that order, without letting the route be rearranged.

• Does each record identify the revision? A record that cannot name the drawing revision cannot prove which product was built.
• Does each test show its criteria and its result? A number without a limit is a reading, not a decision.
• Is there an operator or a responsible role against each step? An unsigned record has no accountable person behind it.
• Where a unit failed, what happened to it? The disposition of a failed unit is the single most informative page in the file.
• How is an unapproved component or firmware change kept out of production? Ask for the mechanism, not the intention, and ask what happened the last time it triggered.
• Does the released unit match the sample you approved? Compare against the approved sample itself, not against a photograph of it.

A tip that saves an hour: ask for the file of a unit that failed, not one that passed. A passing record shows you the paperwork works; a failed record shows you the organisation works.

---

4. Turn Findings Into Verified Closure

Classify findings by risk and by evidence, not by how impressive or how uncomfortable the observation felt. The two most common audit failures are a trivial point escalated because the auditor was annoyed, and a significant gap softened because the host was helpful.

• State the requirement. The clause, the procedure or the agreed specification that applies — not a general principle.
• State the objective evidence. What you saw, where, and which record it was. “The final check on line 2 was signed before the test was run” is evidence; “the process seemed rushed” is not.
• State the risk. What could reach a customer as a result, and how bad that would be.
• State the expected corrective action, with an owner and a due date.
• Verify completion. A promised action is not a closed finding. Close it when you have seen the evidence, not when you have received the email^[2].

---

5. Decide on Residual Risk

Five outcomes are available, and choosing between them is the audit’s actual deliverable. Whichever you choose, record why — a decision without a rationale is re-argued from scratch the next time someone new joins the project.

Outcome	Appropriate When	What Must Accompany It
Approval	Critical requirements are met and no significant finding remains open.	The evidence log and a scheduled next review — an audit is a snapshot, not a status.
Conditional approval	Minor findings or open items that do not affect product conformity if managed.	Named actions, owners and dates; release may be gated on closure.
Further evidence required	The gap is documentary and can be closed without a second visit.	A specific list of documents and a deadline, not a general request to send more.
Corrective action before production	A significant finding that affects whether the product conforms.	Verified closure before release — not a plan, and not a promise.
Do not proceed	A critical finding, or an unwillingness to address a significant one.	The rationale, recorded, because this decision will be questioned.

Whatever the outcome, combine it with what happens afterwards: ongoing supplier performance, your own incoming inspection, and the pattern of issues in the field. An audit tells you what a system looked like on a Tuesday. Those three tell you whether it stayed that way.

---

6. Project-Specific Points to Add

Three points belong in an audit plan for a Rainbowdo project, and they are the same three any buyer should add for any supplier whose numbers appear on a website.

• Take the capacity and MOQ figures as claims to verify. Rainbowdo reports a monthly production capacity of 100,000 units and a starting MOQ of 500 units. Record both, then verify their definitions and their applicability to your project — and compare the line allocation and committed delivery plan against the overall capacity statement. Total capacity is not a schedule.
• Match each finished model to its own record. For US device records, check the model you are buying against the cleared-model list and the applicable indications for use. Public records exist for K243423 and K253712.
• Treat an unreleased record as unreleased. Rainbow reports that K263313 was cleared for the Red Light Therapy Hair Growth Cap in models RB-009, RB-011, RB-012, RB-088, RB-089 and RB-092. At the time of drafting, the public entry had not been independently retrieved — so audit the SE letter itself, and add the official link only once it is available.

That last point is the discipline in miniature. A record that has been reported is not a record that has been verified, and an audit plan that treats the two as the same is not an audit plan.

Preparing a supplier audit? Visit our
Custom Light Therapy Manufacturing Page.

---

7. Being Audited, and What We Prepare

Rainbow Technology runs ODM and OEM programmes from our Shenzhen facility. We would rather be audited against a plan like this one than toured, so the following is prepared in advance rather than located while you wait:

• A product to walk through — a real unit traced from incoming components to shipment, including its traveller, test results and release record.
• A failed record as well as a passing one, with its disposition and whatever corrective action followed.
• The outsourced process list, so the boundary of our own control is explicit before rather than after a problem.
• Confidentiality terms offered up front for anything you consider commercially sensitive, including a controlled-review alternative to sending files.
• Sample and small-batch production from 500 units, with a stated capacity of 100,000 units per month; both figures depend on model, configuration, packaging and schedule, and are confirmed in a formal quotation.
• Compliance documentation matched to the exact model for your target market. Where a model holds a 510(k) record we provide the K-number so you can check its scope in the FDA’s public database; clearance is not the same as FDA approval, and the scope differs from model to model.

---

8. References & External Links