Supplier Audit Checklist for LED Therapy Device Wholesalers
A checklist is only worth the decisions it forces. Every question below names a document or an observation, separates a mandatory gate from a preference, and leaves a place to record the gap and the follow-up. A completed checklist should let someone who was not in the room understand both the decision and the risks still attached to it.
This page is the checklist itself. For how to plan and run the audit that uses it, see our companion article on risk-based audit planning.
Table of Contents
- 1. What Makes a Checklist Useful
- 2. Supplier Identity and Scope
- 3. Product and Quality Evidence
- 4. Commercial and Continuity Terms
- 5. Make the Decision Traceable
- 6. Fields Specific to Rainbowdo
- 7. What We Would Fill In
- 8. References & External Links
1. What Makes a Checklist Useful
Most supplier checklists are lists of nouns: certificates, test reports, warranties. They can be ticked without anyone learning anything, which is why a completed one often looks thorough and answers nothing. A workbook for a wholesaler has a different job — it has to survive being read by a colleague six months later, when the supplier has changed account manager and the price has moved.
Three conventions run through every table below. Each row asks for a document or an observation, not an assurance. Each row is marked as a gate or a preference in your own working copy. And each row has a column for what you record, because the value of the exercise is in that column rather than in the ticks.
One note for wholesalers specifically: you are usually buying information at second hand. The brand or the trading company may be describing a factory they do not own, and the documents may have travelled through two intermediaries before reaching you. The identity section is therefore the first section, not a formality.
2. Supplier Identity and Scope
| Check | Evidence to Ask For | What to Record |
|---|---|---|
| Contracting entity, manufacturing site and invoicing party | Company registration details, the site address on the quality certificate, and the entity named on a sample invoice. | Whether the three match — and if they do not, who is accountable for what. |
| Processes performed in-house versus subcontracted | A process list showing which site performs each step. | The exact steps where your control stops. |
| Who controls design changes, product records and corrective action | A named role per responsibility, plus one recent example of each. | Names rather than departments — a department cannot be escalated to. |
| Quoted products match the models and revisions in the documents | The model number and revision on each report, set beside the quotation. | Any mismatch, recorded before it becomes an order rather than after. |
3. Product and Quality Evidence
| Check | Evidence to Ask For | What to Record |
|---|---|---|
| Specifications with units and measurement conditions | A specification sheet stating distance, operating mode and instrument for each optical figure. | Whether each figure is comparable with the next supplier’s — or merely present. |
| Safety and performance reports, and their scope | The reports themselves, including the scope page and the model list. | The scope read against your configuration, not the cover page. |
| Incoming, in-process and final inspection records | Sample records where relevant to the product, with the criteria they were judged against. | Whether criteria exist, not merely signatures. A signed record with no criteria is a form. |
| How nonconformities, complaints and recurring defects are investigated | The nonconformity and corrective-action process, plus one real case with its outcome. | What changed as a result. A defect fixed is not the same as a cause addressed. |
| Document revision control and traceability appropriate to the project | A revision history, and one example showing a finished unit linked to its component lots. | Whether a shipped unit can be bounded. If it cannot, every future complaint is a search[1]. |
4. Commercial and Continuity Terms
| Check | Evidence to Ask For | What to Record |
|---|---|---|
| MOQ assumptions, unit price basis, one-time charges and exclusions | A written quotation stating its assumptions and what it does not cover. | Which figures apply per model and which per configuration. The two are not the same commitment. |
| Tooling ownership, IP terms, sample acceptance and change approval | A written schedule rather than a paragraph in a covering email. | What you own if the relationship ends — including the mould. |
| Delivery assumptions, spare parts, warranty and escalation contacts | Written terms stating a period, a named role and the dependencies behind the date. | Whether the lead time has anything underneath it, and who answers at 11pm. |
| Conditions that must be met before production release | A release checklist with an approver named against it. | Who signs, against what criteria, and what happens when a criterion fails. |
5. Make the Decision Traceable
Every row gets one of four marks, plus the supporting file reference and the date you reviewed it. The fourth state — not applicable — is included deliberately, because a checklist that forces every row to resolve will be resolved dishonestly.
| Mark | What It Means | What It Obliges You to Do |
|---|---|---|
| Verified | You have seen the document and confirmed it covers this entity, site, model and configuration. | Attach it. A verification that cannot be produced later is an opinion. |
| Partially verified | Something exists but covers a sibling model, an earlier revision or a wider scope. | Name the gap precisely, and decide whether the gate opens with it. |
| Not provided | Requested and not supplied. | Record the date of the request. A pattern of these is the finding. |
| Not applicable | The row does not apply to this product or project. | Write one clause explaining why, so the omission is a decision rather than an oversight. |
Two rules complete the system. Use pass/fail gates for the critical requirements — safety, product documentation and basic function — so that they cannot be averaged away. And never let a strong commercial score offset a missing safety-critical record without a documented risk review that names the person who accepted the risk[2].
6. Fields Specific to Rainbowdo
If you are running this checklist against us, three rows need a specific answer rather than a general one.
- Commercial figures. Record the company-stated starting MOQ of 500 units and monthly production capacity of 100,000 units — then request written definitions and confirmation for your specific project, because a stated baseline is not an allocation.
- US regulatory records, by model. The FDA’s public records tie K243423 and K253712 to specific LED mask model lists. Use those model lists in the checklist rather than a broad claim that the catalogue is cleared.
- The record that is not yet searchable. Rainbow reports a K263313 SE Letter covering six hair-cap models. The public entry was not independently retrievable when this page was prepared, so mark that row as partially verified — verify the letter itself, and update the mark once the database entry appears.
Marking that last row honestly is the test of the whole system. A checklist that only records what is easy to confirm is a record of your own confidence, not of the supplier.
Running this checklist against a shortlisted supplier? Visit our
Custom Light Therapy Manufacturing Page.
7. What We Would Fill In
Rainbow Technology runs ODM and OEM programmes from our Shenzhen facility. Send the checklist in your own format and we will complete it row by row, including the rows where the honest mark is not “verified”:
- The identity block completed in full — contracting entity, production site and invoicing party stated together, with the outsourced steps named.
- Model-specific reports with their scope pages, so the “matches the quoted revision” row can be checked rather than assumed.
- A real record on request — one inspection sheet, one nonconformity, one change approval — rather than a folder of templates.
- Commercial terms with assumptions and exclusions, separated into one-time and recurring lines.
- Sample and small-batch production from 500 units, with a stated capacity of 100,000 units per month; both figures depend on model, configuration, packaging and schedule, and are confirmed in a formal quotation.
- Compliance documentation matched to the exact model for your target market. Where a model holds a 510(k) record we provide the K-number so you can check its scope in the FDA’s public database; clearance is not the same as FDA approval, and the scope differs from model to model.
8. References & External Links
[1] International Organization for Standardization.
ISO 13485:2016 Medical devices — Quality management systems — Requirements for regulatory purposes. The document-control and traceability requirements behind the records requested in sections 2 to 4; incorporated by reference in the FDA Quality Management System Regulation that took effect on 2 February 2026.
[2] International Organization for Standardization.
ISO 14971:2019 Medical devices — Application of risk management to medical devices. The basis for treating a missing safety-critical record as a risk with a named owner, rather than as a low score.
