Vendor Audit

According to the ISO 13485:2016, requirement 7.4.1 Purchasing process, it is not mandatory to audit vendors which are critical. 

This requirement states that organizations must establish criteria for the evaluation and selection of suppliers. These criteria must be based on the supplier’s ability to provide certain products; on the performance of the supplier (e.g. delivery date, minimum quantity for order and similar); and effect of the purchased product on the quality of the medical device. So, what that criteria will be it is up to the manufacturer to take into consideration the risk associated with the medical device. 

Also, this requirement state that organization must plan the monitoring and re-evaluation of suppliers. How often will it be done, will there be an audit or not, it is up to the manufacturer. 

For more information please read the following articles: 

How can ISO 13485 clause 7.4, Purchasing, enhance procurement? https://advisera.com/13485academy/blog/2018/04/18/how-can-iso-13485-clause-7-4-purchasing-enhance-procurement/

First-, Second- & Third-Party Audits for medical device manufacturers & suppliershttps://advisera.com/13485academy/knowledgebase/first-second-third-party-audits-for-medical-device-manufacturers-suppliers/