MEDICAL DEVICES:

Report to Congressional Committees

September 2026

GAO-26-108499

United States Government Accountability Office

A report to congressional committees

Contact: John E. Dicken at dickenj@gao.gov

What GAO Found

The Food and Drug Administration’s (FDA) Center for Devices and Radiological Health (CDRH) administers the Third Party Review Program, a voluntary alternative review process for selected low-to-moderate risk medical devices, such as diagnostic ultrasound systems and surgical lasers. Under this program, which is intended to facilitate faster reviews, device sponsors can contract with FDA-accredited entities. These entities, known as Third Party Review Organizations (third parties), conduct the initial review of certain premarket applications, known as 510(k) submissions. These third party reviews occur prior to agency officials making the final decision about whether the device can be marketed.

According to FDA officials, the agency received approximately $8 million for Third Party Review Program operations in fiscal years 2023 through 2027. FDA’s administration of the program includes overseeing third parties’ accreditation and reaccreditation applications to ensure participation standards are met, and reviewing third parties’ recommendations on 510(k) submissions and making final decisions. From fiscal years 2018 through 2025, third parties provided FDA with 617 510(k) submission reviews and recommendations, which accounted for about 2 percent of CDRH’s 510(k) submission reviews annually.

	Fiscal Year
	2018	2019	2020	2021	2022	2023	2024	2025
Number of 510(k) submissions reviewed by CDRH only	3,276	3,464	3,504	3,731	3,554	3,684	3,461	3,476
Number of 510(k) submissions reviewed by Third Party Review Organizations and CDRH	75	78	85	90	77	77	68	67

Source: GAO analysis of Food and Drug Administration data. | GAO-26-108499

FDA is required to audit third parties periodically to ensure they remain in compliance with the standards for program participation. The agency conducted 25 periodic audits of third parties from 2000 to 2026, according to FDA officials. These audits were conducted in four phases: 13 audits from 2000 through 2003, five audits from 2011 through 2013, two audits in 2022, and five audits from 2025 to 2026. Results of these audits varied in terms of the deficiencies identified.

GAO found that FDA’s audit policies have gaps and are missing key details. For example, FDA has not established time frames specifying how long it should take the agency to complete an audit and communicate results to third parties. As a result, GAO identified several recent audits with findings of deficiencies, such as language in standard operating procedures being too vague, that took FDA more than 6 months to close. Ensuring the agency has detailed policies, such as time frames for completing audits and communicating results, would strengthen FDA’s efforts to ensure third parties meet program requirements and are therefore eligible to continue reviewing 510(k) submissions, which provide recommendations to FDA as to whether devices should be allowed on the market and thus available for patient use.

Why GAO Did This Study

FDA, within the Department of Health and Human Services (HHS), is responsible for ensuring that medical devices sold in the U.S. are regulated to provide reasonable assurance of safety and effectiveness. The review process FDA uses to make this determination represents a substantial investment of time and resources for both the agency and the device sponsor. The Food and Drug Administration Modernization Act of 1997 created the Third Party Review Program, which FDA oversees. Since program inception, FDA said it accredited 32 third parties to participate in the program; as of May 2026, there were nine third parties with active accreditations.

The Consolidated Appropriations Act, 2023, includes a provision for GAO to report on the Third Party Review Program. This report (1) describes FDA’s roles and responsibilities in administering the Third Party Review Program; and (2) examines the extent to which FDA audits third parties’ performance.

GAO reviewed the statute authorizing the Third Party Review Program and FDA’s related policy and guidance documents. GAO analyzed FDA third party performance metrics from fiscal years 2018 through 2025. GAO also reviewed documentation and internal communications from completed third party audits. GAO interviewed FDA officials and representatives from six third parties.

What GAO Recommends

GAO is making one recommendation to FDA to update its policies for the Third Party Review Program audit process to include, for example, target time frames for completing audits and communicating findings to third parties. HHS concurred with GAO’s recommendation.

 

 

 

 

 

 

 

Abbreviations
CDRH	Center for Devices and Radiological Health
FDA	Food and Drug Administration
HHS	Department of Health and Human Services
MDUFA	Medical Device User Fee Amendments
OII	Office of Inspections and Investigations
ORP	Office of Regulatory Programs

September 21, 2026

The Honorable Bill Cassidy, M.D.
Chair
The Honorable Bernard Sanders
Ranking Member
Committee on Health, Education, Labor, and Pensions
United States Senate

The Honorable Brett Guthrie
Chairman
The Honorable Frank Pallone, Jr.
Ranking Member
Committee on Energy and Commerce
House of Representatives

The Food and Drug Administration (FDA), within the Department of Health and Human Services (HHS), is responsible for ensuring that medical devices sold in the United States are regulated to provide reasonable assurance of safety and effectiveness. The review process that FDA uses to make this determination prior to devices being marketed can represent a substantial investment of time and resources for both the agency and the device sponsor. For example, in fiscal year 2026, sponsors, which are generally manufacturers, paid FDA user fees of up to $580,000, depending on the device submission the agency was asked to review.[1] In 2025, FDA’s Center for Devices and Radiological Health (CDRH), which authorizes devices for the market, received more than 21,000 medical device submissions.[2]

In an effort to improve premarket review efficiency, the Food and Drug Administration Modernization Act of 1997 created the Third Party Review Program, a voluntary alternative review process for select low-to-moderate risk medical devices, such as diagnostic ultrasound systems and surgical lasers.[3] Under the program, device sponsors can contract with FDA-accredited entities, known as Third Party Review Organizations (third parties), to conduct the initial review of certain premarket applications, known as 510(k) submissions, prior to agency officials making the final decision about whether the device can be marketed. Device sponsors may also choose to use FDA’s standard premarket review process in which 510(k) submissions are only reviewed by agency scientific review staff. According to FDA, the program is intended to allow the agency to focus its resources on the review of higher risk devices while facilitating faster 510(k) submission decisions and preserving its oversight of lower risk devices eligible for third party review. Of the thousands of medical device submissions that FDA receives each year, approximately 4,000 are 510(k) submissions; FDA estimates that approximately half of these 510(k) submissions are eligible for the Third Party Review Program.

As of May 2026, there were nine accredited third parties participating in the program. FDA is statutorily required to audit third parties periodically to ensure they remain in compliance with the standards of accreditation that govern program participation.[4] These standards are established in statute and FDA policy, including a requirement that third parties have sufficient technical expertise and no financial conflicts of interest.[5]

The Consolidated Appropriations Act, 2023, includes a provision for us to report on the financial and staffing resources used to administer the Third Party Review Program and on FDA’s audits of third parties.[6] In this report, we

1.     describe FDA’s roles and responsibilities in administering the Third Party Review Program; and

2.     examine the extent to which FDA audits third parties’ performance.

To describe FDA’s roles and responsibilities in administering the program, we reviewed the authorizing statute, including the standards of accreditation for the program, which also serve as the criteria for program audits. We also reviewed FDA policy and guidance documents related to the administration of the program, including those describing the agency’s process for accrediting and reaccrediting third parties.[7] We reviewed Medical Device User Fee Amendments (MDUFA) commitment letters, which include a description of the program data FDA has made publicly available since fiscal year 2018.[8] We reviewed and analyzed these data, which are published quarterly on FDA’s Third Party Review Organization performance metrics website, to describe the final outcome of 510(k) submissions initially reviewed by third parties, including the number of third party submissions that FDA determined were substantially equivalent, not substantially equivalent, still pending a final decision, or withdrawn by the device sponsor from fiscal years 2018 through 2025.[9] We also reviewed and analyzed these data, when available, to describe the number and proportion of reviews conducted by individual third parties from fiscal years 2018 through 2025.[10] Finally, we reviewed and analyzed MDUFA performance reports from fiscal years 2018 through 2025 to describe the number of 510(k) submissions that were reviewed by FDA, the number of 510(k) submissions reviewed by third parties, and the proportion of total 510(k) reviews that third parties conducted over that period.[11] For all the data we reviewed, fiscal year 2025 data were the most recent available at the time of our review. To assess the reliability of these data, we reviewed relevant documentation and interviewed FDA officials about how the data are collected and any known limitations about the quality, timeliness, and usability of the data. We found this data to be sufficiently reliable for our reporting purposes.

To examine the extent to which FDA audits third parties’ performance, we compared FDA’s audit documentation to (1) the statutory requirement to audit third parties periodically, which has existed since the program’s inception; and (2) the policy requirement to audit third parties once every 3 years, which has existed since 2024.[12] We also assessed the agency’s audit policy and guidance documents implementing FDA’s statutory responsibility to audit and defining the frequency with which audits should take place against federal internal control standards.[13] Documents reviewed covered all phases of the audit process, including pre-audit, onsite audit, and post-audit stages. We also reviewed, as available, documentation and internal communications from completed audits. These included an audit report from 2022 that included information about audit findings, and three audit memos that summarized the onsite visits, including one audit memo from 2011 and two from 2022. Finally, we reviewed an FDA-produced list of all periodic audits of third parties, as well as documentation and information from FDA officials about the one “for cause” audit the agency conducted.[14]

To inform these two reporting objectives, we also interviewed and collected written responses from FDA officials within CDRH and the agency’s Office of Inspections and Investigations (OII) to discuss their respective roles in the administration of the Third Party Review Program and third party audits. According to FDA, due to the program’s age and the fact that it has changed FDA offices multiple times, some material from the program’s early years was not retained; in those instances, agency officials provided all available information and data about the Third Party Review Program. We contacted all seven of the third parties that were participating in the Third Party Review Program in August 2025. Six of the seven agreed to be interviewed about their experiences in the Third Party Review Program and with FDA oversight. We did not attempt to interview the two third parties that became accredited in 2026, because we determined they did not have sufficient time in the program to develop experience with its administration and oversight. Finally, we interviewed a nongeneralizable sample of academics, researchers, and other experts who were selected based on their expertise of premarket medical device review pathways and spoke with medical device associations to get their perspectives on the Third Party Review Program.

We conducted this performance audit from May 2025 to September 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

Medical Device Classification

Medical devices encompass a wide range of products—from bandages to ventilators. FDA classifies medical devices into one of three classes based on the level of risk they pose to the user, with class I being the lowest risk, and class III being the highest.[15] (See fig. 1.)

Premarket Review

Unless exempt under FDA regulations, medical devices are generally subject to one of two types of FDA premarket review before they may be legally marketed in the United States.[16] In general, most class I and II device types subject to premarket review are required to obtain FDA clearance through the 510(k) submission process, and most class III device types are required to obtain FDA approval through the more stringent premarket approval process. The device sponsor must pay a user fee to FDA to initiate a review of a device through either process.[17]

510(k) submission. The device sponsor must notify FDA 90 days before it intends to market a device and demonstrate that the new device is substantially equivalent to a legally marketed device that does not require premarket approval.[18] The legally marketed device—for example, a surgical suture—is referred to as a predicate device. To make this assessment, CDRH scientific review staff review each 510(k) submission to determine whether the device in question (1) has the same intended use as the predicate device; and (2) has the same technological characteristics as the predicate device, or has different technological characteristics and the sponsor submitted information that demonstrates that the device is as safe and effective as the marketed device and does not raise different questions of safety or effectiveness.

Premarket approval. The device sponsor must provide evidence, typically including clinical data, providing reasonable assurance that the new device is safe and effective. The premarket approval process is the most stringent type of premarket review because it is evaluating the safety and effectiveness of high-risk medical devices.

Third Party Review Program

According to FDA officials, different offices within CDRH have administered the Third Party Review Program since its inception in the late 1990s; since 2022, the Office of Regulatory Programs (ORP) has been responsible for the program.[19] Since the beginning of the program, FDA officials told us that the agency has accredited 32 third parties—ranging from state health departments to domestic and international private sector corporations. As of May 2026, there were nine third parties with active accreditations; some of these third parties have been in the Third Party Review Program for decades, while others became accredited as recently as 2026, according to FDA officials.

The program allows device sponsors to contract directly with third parties to do the initial review of 510(k) submissions for select class I and class II devices for a negotiated fee instead of utilizing FDA’s standard review process and paying a user fee to the agency. FDA determines which of the eligible devices each third party is accredited to review and publishes that information on its website.[20] Device types that are not eligible for third party review include all class III devices; devices required to submit a de novo classification request; breakthrough devices; devices intended to be permanently implantable, life sustaining, or life supporting, unless otherwise determined and listed as eligible for review; and devices of a type specifically listed as not eligible for review.[21]

To assess a 510(k) submission, the third party uses the same statutory and regulatory criteria as FDA to determine whether a device is substantially equivalent to a predicate device and therefore should be allowed on the market. The third party is responsible for documenting its review, including whether it recommends the device be allowed on the market, and forwarding the 510(k) submission and documentation received from the device sponsor to CDRH. The submission is then assessed by CDRH scientific review staff, who make final determinations on the 510(k) submissions by accepting or changing the recommendation of the third party. (See fig. 2.)

FDA’s Administration of the Third Party Review Program Includes Reviewing 510(k) Submission Recommendations and Collecting Data

Third Party Review Program Funding A significant portion of the Food and Drug Administration’s (FDA) annual budget for medical device oversight activities consists of amounts derived from user fees paid by device sponsors. These fees are collected and available for obligation only to the extent and in the amount provided in advance in appropriations acts. FDA was first authorized to collect medical device user fees by the Medical Device User Fee and Modernization Act of 2002 (Pub. L. No. 107-250, tit. I, 116 Stat. 1588, 1589-1602), and the medical device user fee program has been reauthorized every 5 years since then. FDA officials told us the Third Party Review Program received a total of $14 million to support all staff, programs, and activities for fiscal years 2018 through 2022. According to officials, the program expended approximately $6 million from fiscal years 2018 through 2022; the remaining $8 million was carried over for program operations in fiscal years 2023 through 2027, with $1.6 million per year expended for each of fiscal years 2023 through 2025. Source: GAO analysis of FDA information. | GAO‑26‑108499

According to FDA officials, the Third Party Review Program is primarily administered by one official within CDRH who spends about 50 to 70 percent of their time on program activities. FDA officials told us other FDA staff who participate in the program include OII officials who conduct onsite audits of third parties, as well as scientific review staff in CDRH who make final determinations for 510(k) submission recommendations from third parties. These FDA officials perform the following tasks as part of their program administration responsibilities:

Reviewing third parties’ recommendations on 510(k) submissions and making final decisions. From fiscal years 2018 through 2025, third parties provided FDA with 617 510(k) submission reviews and recommendations, which accounted for about 2 percent of CDRH’s 510(k) submission reviews annually. (See table 1.) Despite the small percentage of total reviews, FDA officials told us that the program was helpful to them in that it resulted in reduced agency review time when 510(k) submissions were first reviewed by third parties.

	Fiscal Year
	2018	2019	2020	2021	2022	2023	2024	2025
Number of 510(k) submissions reviewed by CDRH only	3,276	3,464	3,504	3,731	3,554	3,684	3,461	3,476
Number of 510(k) submissions reviewed by Third Party Review Organizations and CDRH	75	78	85	90	77	77	68	67

Source: GAO analysis of Food and Drug Administration data. | GAO‑26‑108499

CDRH scientific review staff review the third parties’ recommendations about whether the devices are substantially equivalent to predicate devices and therefore should be allowed on the market. If needed, FDA staff request additional information from third parties about the 510(k) submissions to inform their decision. An FDA official told us that the need to request additional information is not necessarily indicative of a poor quality third party review. FDA has access to proprietary device data that third parties do not, and officials said changes in internal agency review trends may prompt additional questions the third party could not have anticipated.

Accrediting and reaccrediting third parties to review 510(k) submissions. Program administration includes accrediting new third parties wanting to join the program and reaccrediting participating third parties every 3 years. FDA officials review third parties’ accreditation and reaccreditation applications to ensure the standards of accreditation are met. The standards include requirements such as the third party maintaining records, having qualified personnel perform 510(k) submission reviews, and being free from conflicts of interest. As part of the accreditation process, FDA reviews the third party’s policies and procedures as a part of its accreditation application, which includes documentation of reviewers’ training, experience, and specialized education related to the device types the third party is seeking accreditation to review.

Auditing third parties. FDA is statutorily required to conduct periodic audits of all third parties.[22] In November 2024, the agency published guidance that defined “periodic” audits as occurring at least once every 3 years. [23] The guidance also stated FDA’s practice of conducting “for cause” audits outside of the periodic cycle. According to FDA officials, “for cause” audits assess alleged deficiencies, which are usually identified by device sponsors or prospective third party clients. The standards of accreditation for participation in the Third Party Review Program also serve as the criteria for program audits. FDA officials explained that audits of third parties should be conducted prior to reaccreditation, because audit results may factor into reaccreditation decisions. FDA officials also told us third parties are responsible for resolving issues identified during audits prior to reaccreditation.

According to FDA, the audit process begins with CDRH determining the need for an audit of a third party and drafting an assignment memo highlighting any particular areas of concern for the audit to investigate. According to FDA officials and agency guidance, OII, which performs audits for offices across FDA, uses the assignment memo to conduct the onsite audit of the third party, which includes personnel interviews, reviews of data and documentation, and analysis of past 510(k) submission reviews. OII documents the onsite visit in an audit memo, and according to FDA officials, CDRH uses it to make final decisions about audit findings. CDRH is responsible for communicating audit findings to the third party and overseeing its corrective actions to ensure a return to compliance with the standards of accreditation, according to FDA officials.

Providing training for third parties. FDA has provided training to third parties online and in person to help ensure efficient and effective review processes.

FDA provides CDRH Learn—a web-based educational tool with learning modules that describe aspects of medical device product regulations—for third parties and others. For example, one module provides guidance for third party reviewers in efficiently communicating with device sponsors when additional information is needed to provide a recommendation regarding substantial equivalence. According to FDA, this guidance can help improve the timeliness of the 510(k) submission review process by reducing the amount of communication needed to address a deficiency.

FDA is also creating an online library of example 510(k) submission review memos for frequently reviewed devices, such as surgical masks and vinyl patient examination gloves.

Collecting and publishing performance metrics. In fiscal year 2018, FDA began publishing quarterly metrics reflecting the performance of third parties with at least five completed 510(k) submission reviews. These metrics include the number of submissions FDA accepted and the number of final determinations that were substantially equivalent or not substantially equivalent to predicate devices. From fiscal years 2018 through 2025, 526 out of 617 third party 510(k) submissions were determined to be substantially equivalent to a predicate device. (See fig. 3.)

FDA’s metrics also show that from fiscal years 2018 through 2025, two third parties provided the vast majority (90 percent) of third party 510(k) submission reviews and recommendations. (See table 2.)

	Fiscal Year
Third Party Review Organization	2018	2019	2020	2021	2022	2023	2024	2025
Third party C	19	13	16	14	17	21	24	24
Third party F	49	56	49	57	60	54	40	41
Third party Ja	-	6	19	16	-	-	-	-
Third party Ka	7	-	-	-	-	-	-	-
Other third parties	0	3	1	3	1	2	4	2

Source: GAO analysis of Food and Drug Administration (FDA) data. | GAO‑26‑108499

Note: FDA reports on the performance of third parties with at least five completed 510(k) submission reviews. The third parties in this table meet that criterion and have been anonymized. They do not represent all third parties in the program as of April 2026.

^aThese third parties no longer participate in the Third Party Review Program.

According to these two third parties, their sole line of business is 510(k) submission reviews; the other four that we spoke with told us they have other lines of business.

FDA Has Conducted 25 Periodic Audits of Third Party Review Organizations, but Audit Policies Lack Specificity and Are Outdated

FDA has conducted 25 periodic audits of third parties since the program began in the late 1990s, according to agency officials. Results of these statutorily required audits varied, with audits having varying degrees of severity in the issues identified. We also found that FDA’s audit policies have gaps, contain outdated information, and lack the specificity needed to facilitate the timely oversight of third parties. For example, the policies do not document the agency’s stated criteria for prioritizing audits or establish time frames for how long it should take for FDA to complete an audit and communicate results to third parties.

FDA Has Conducted 25 Periodic Audits of Third Party Review Organizations Since the Program’s Inception

According to FDA officials, the agency conducted 25 periodic audits of third parties from 2000 to 2026. The frequency of these audits was consistent with the statutory requirement to audit third parties periodically.[24] The audits were conducted in four phases, including 13 audits from 2000 through 2003, five audits from 2011 through 2013, two audits in 2022, and five audits from 2025 to 2026. Most audits were conducted over a decade ago and were of third parties that no longer participate in the program. Specifically, only one of the 18 audits conducted in 2013 or earlier was of a third party with an active accreditation as of May 2026. Further, four of the seven audits conducted in 2022 or later were of third parties being audited for the first time. (See fig. 4.)

Since issuing guidance in 2024 that defined “periodic” audits as occurring at least once every 3 years, five of the nine third parties with an active accreditation had been audited, as of May 2026.[25] As of the same date, there were four third parties that were accredited, but had never been audited by FDA. According to FDA officials, two were accredited in 2026, and FDA’s guidance requires the agency to audit these third parties within the next 3 years. They added that the other two third parties were accredited in 2017 and 2020, but had not conducted any 510(k) reviews as of June 2026. FDA officials explained that auditing third parties that have not conducted any 510(k) reviews would not provide meaningful information about their performance.

Prior to the November 2024 guidance, audits were conducted less regularly. Officials from ORP noted that prior CDRH offices overseeing the program may have had other priorities or lacked resources to conduct audits on a more regular basis. In addition, they explained that ORP is the office within CDRH that has administered the program since 2022. The officials added that the COVID-19 pandemic also diverted resources from some audit activities across FDA, including audits of third parties.

Agency officials stated that FDA conducted one “for cause” audit in 2021. They also told us this audit found that a third party had falsified reviewer credentials and sent fraudulent documents to the agency; as a result, the third party’s accreditation was withdrawn.

Results of FDA Audits of Third Party Review Organizations Varied

The results of the 25 third party periodic audits varied. According to FDA officials, prior to 2017, FDA typically grouped audits of third parties into one of three classifications based on the severity of issues identified. They also explained that for audits between 2011 to 2017, OII would suggest an initial classification after conducting the onsite audit, but CDRH would make the final determination. The officials added that audits conducted prior to 2011 only received a classification from OII, which was considered final because agency procedures at the time did not require CDRH to make a final classification. The three audit classifications included the following:

·       No action indicated: No objectionable conditions found.

·       Voluntary action indicated: Objectionable conditions found that can be corrected with voluntary action. FDA officials noted that such a classification can include, for example, an out-of-date procedures document.

·       Official action indicated: Objectionable conditions found that require regulatory action. Officials explained that such a classification may include the identification of substantial conflicts of interest, the absence of recordkeeping, or data integrity issues.

FDA officials provided us with classifications for the 18 audits conducted prior to 2017. Specifically, of the five audits conducted from 2011 through 2013, two were classified by CDRH as voluntary action indicated, two were official action indicated, and one did not receive a classification because the third party withdrew from the program. Of the 13 audits conducted from 2000 through 2003, four were classified by OII as voluntary action indicated, three were no action indicated, one was official action indicated, and five had unknown classifications.[26] Of all audits conducted prior to 2017, only one involved a third party that participated in the program as of May 2026; this audit was classified as official action indicated.

In 2017, FDA went through a reorganization that resulted in changes to the Third Party Review Program audit process, including that the audits would no longer receive classifications, according to FDA officials. The agency provided us with results for six of the seven audits conducted after 2017. Five of these audits resulted in findings being communicated to the third party. For example, an audit in 2022 found that the third party was not using unique personnel to serve in the product specialist and final reviewer roles when reviewing 510(k) submissions. FDA officials said that the other four audits with findings identified minor issues, such as language in standard operating procedures being too vague or personnel training documentation being inadequate. One audit from 2025 was not final as of June 2026, according to officials. Thus, audit results were not available at the time of our review.

FDA’s Policies for Auditing Third Parties Lack Specificity and Are Outdated

FDA audits of third parties involve multiple stages managed by different offices and guided by different policies. Specifically, CDRH officials are responsible for initiating audits, while OII is responsible for performing the onsite audit and formulating proposed findings for CDRH to finalize, according to FDA officials. We found that some stages of the audit process, such as the onsite audit, are guided by detailed policies, while others, such as the post-audit process, have policies that lack the specificity needed to facilitate the timely oversight of third parties and contain outdated information.

Pre-audit. FDA’s pre-audit policy does not include key details about certain aspects of the process. For example, the policy notes the frequency with which audits will be conducted, but it does not include the selection criteria that FDA officials said they utilize when selecting third parties for audits. In particular, agency officials said audits of third parties that are nearing their reaccreditation date may be prioritized to ensure audit findings can inform reaccreditation decisions. Additionally, they said CDRH prioritizes audits of third parties that are actively reviewing 510(k) submissions, explaining that auditing a third party that has not reviewed a 510(k) submission in the current accreditation cycle would not yield any new information over the accreditation and reaccreditation processes. Neither criterion is documented in policy, though officials told us the criterion of prioritizing active third parties was used for audit selection during the most recent audit phase, which was the first conducted under the 2024 pre-audit policy.

Since its inception, the Third Party Review Program has undergone multiple transitions. Specifically, it has been overseen by three offices within CDRH, according to FDA officials.[27] As previously stated, FDA officials told us that the program is primarily administered by one official. Thus, institutional knowledge is concentrated among the program’s limited staff, adding to the risk that undocumented practices may be lost during transitions. For example, officials from ORP, which has overseen the program since 2022, noted that they could not provide detailed information about findings of audits conducted prior to their tenure because the officials who oversaw those audits are no longer at the agency. Federal internal control standards state that agencies should develop and maintain documentation of their internal control system to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel.[28] Without documenting selection criteria in policy, audit selection practices may be lost during office or staff transitions.

Onsite audit. OII’s onsite audit policy instructs officials on how to conduct a third party audit. Specifically, it includes instructions to review the third party’s personnel qualifications, conflict of interest policies, recordkeeping practices, and facilities, among other items. It also instructs officials to interview third party personnel and review one or more completed 510(k) submission reviews. Representatives from two third parties we spoke to that were audited by FDA in 2022 stated that the onsite audit process was straightforward and reasonable.[29]

Post-audit. CDRH’s post-audit policies contain outdated information that no longer accurately reflects its process. Specifically, FDA officials explained that OII prepares an audit memo after completing an onsite audit, which CDRH uses to make a final determination on the audit’s findings. One of CDRH’s post-audit policies instructs officials on how to review these audit memos. However, the policy applies broadly to audits conducted by OII for CDRH offices and is not specific to the Third Party Review Program. For example, it mentions the use of audit classifications, which FDA officials noted are no longer used for Third Party Review Program audits.

Another post-audit policy is specific to the Third Party Review Program, but it was in draft form at the time of our review and includes outdated information. For example, the draft policy provides an internal template to complete after reviewing an audit memo from OII. The template includes sections on the third party’s regulatory history and remediation plan, but also requires the input of an audit classification, which is no longer used for third party audits. FDA officials confirmed that the draft, which has an effective date of May 2021, is the most updated version of the policy. While officials did not have a timeline for finalizing the draft, they said that amending FDA’s policies to ensure they reflect current practices was something they had previously considered.

Federal internal control standards state that management should communicate quality information internally to enable personnel to understand and perform key roles in achieving agency objectives and supporting the internal control system.[30] Without revising and updating its post-audit policies to reflect the internal changes that have occurred over time, FDA cannot ensure that officials are following the most current agency practices when processing audit results.

Furthermore, we found FDA’s post-audit policies lack the specificity needed to facilitate the timely oversight of third parties because they do not establish time frames for how long it should take FDA to complete an audit and communicate results to third parties. Officials told us that there is no set timeline for the review of audit memos that do not indicate potential violations, but CDRH generally strives to review audit memos in a timely manner when violations of regulatory significance are noted. Documentation we reviewed and discussion with FDA officials indicate that it has taken 6 months or more for some audits with deficiencies, such as language in standard operating procedures being too vague, to be resolved. For example, post-audit communication from a 2022 audit revealed that it took CDRH 5 months to relay formal findings to the third party and request that corrective action be implemented over the next month. Consequently, the third party could have continued operating while not in compliance with program standards, which included a product specialist conducting the initial and final reviews of the same 510(k) submissions, for the 5 months in which it was waiting for audit results from FDA. Additionally, according to FDA officials, two out of three audits conducted in 2025 were closed in June 2026; one audit remains open. Thus, more recently some audits continue to take more than 6 months to be resolved.

Federal internal control standards state that agencies should (1) document in policies what is expected and in procedures specific actions that implement policies; and (2) remediate internal control deficiencies, including those reported from internal audits, on a timely basis.[31] Without target time frames for completing audits and communicating results, FDA runs the risk of third parties reviewing 510(k) submissions while not being in compliance with program standards for an extended period of time while FDA finalizes the audit findings.

More broadly, updating policies to guide the oversight of the Third Party Review Program audit process to include existing audit selection criteria, current post-audit practices, and target time frames for completing an audit and communicating findings to the Third Party Review Organizations would help FDA better ensure third parties continue to meet the standards of accreditation, in accordance with its statutory responsibility.

Conclusions

FDA is responsible for ensuring that medical devices sold in the United States are regulated to provide reasonable assurance of safety and effectiveness. FDA’s Third Party Review Program is intended to help the agency manage a large volume of medical device reviews by allowing accredited outside entities to conduct the initial reviews of selected lower-risk devices. To ensure that these third party entities are qualified to perform 510(k) submission reviews—which provide recommendations to FDA as to whether devices should be allowed on the market and thus available for patient use—there are established standards that all third parties must meet. One of the ways that FDA ensures these standards are met is through periodic audits of the third parties that are to occur every 3 years since the agency’s new policy was introduced in 2024. However, these audits are guided by policies that are outdated and lack specificity and can take more than 6 months to resolve. Specifically, FDA’s policies do not include the audit selection criteria that it informally employs, its post-audit policies contain outdated information, and there are no time frames specifying the maximum amount of time it should take FDA to complete an audit and communicate findings to third parties. Addressing these gaps would strengthen FDA’s oversight of third parties and help ensure that third parties are meeting accreditation standards and therefore eligible to continue reviewing 510(k) submissions.

Recommendation for Executive Action

We are making the following recommendation to FDA:

The FDA Commissioner should update the agency’s policies for the Third Party Review Program audit process to include existing criteria for selecting third parties for audits; reflect current post-audit practices; and target time frames for completing audits and communicating findings to Third Party Review Organizations. (Recommendation 1)

Agency Comments

We provided a draft of this report to HHS for review and comment. HHS provided written comments which are reproduced in appendix I. In its written comments, FDA concurred with our recommendation.

In concurring with our recommendation, HHS stated that it would update its policies to provide staff with clear guidance regarding the selection of third parties for audit and to clarify procedures and time frames for audit review and closure.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and other interested parties. In addition, the report will be available at no charge on GAO’s website at https://www.gao.gov.  

If you or your staff have any questions about this report, please contact me at DickenJ@gao.gov. Contact points for our Offices of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II.

John E. Dicken
Director, Health Care

GAO Contact

John E. Dicken at DickenJ@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Raymond Sendejas (Assistant Director), Amanda Cherrin (Analyst-in-Charge), Kevin Dong, Kaitlin Farquharson, Hayden Huang, David Jones, Jennel Lockley, Drew Long, and Brian Schmidt-Meyer made key contributions to this report.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us