Medical Device Inventory Management

Medical Device Inventory Management is the manufacturer’s control of what material exists, where it is, how it relates to a device, and whether it is eligible for the next operation. A correct quantity is not enough: stock can be physically present but rejected, expired, reserved, awaiting inspection, or affected by a quality hold. This guide covers components, work in process, finished devices, manufacturer dispatch, and manufacturer-controlled returns. It excludes hospital inventory, loaners, consignment, and outsourced fulfillment.

The useful operating question is specific: can this identified quantity move into this operation now? Answering it connects inventory records to specifications, inspection evidence, production history, and disposition authority. A planner may see 500 pieces on hand while production can legitimately consume only 320. Both numbers can be correct, provided their definitions and the reasons for the difference are visible.

The U.S. regulatory baseline changed on February 2, 2026, when the Quality Management System Regulation became effective. FDA explains that the QMSR incorporates ISO 13485:2016 by reference. Inventory procedures should therefore be evaluated against the current framework rather than treating historical Part 820 section numbers as the current rule structure.

Under 21 CFR 820.1, manufacturers subject to that provision must maintain a quality management system appropriate to their devices and comply with requirements applicable to their operations. The provision does not apply to manufacturers of components or parts of finished devices. That distinction does not make incoming components irrelevant to a finished-device manufacturer’s inventory controls; it distinguishes regulatory applicability from the practical scope of its manufacturing system.

As a design practice, separate item identity from the identity of the actual stock. The item master describes what can be purchased or made; a lot, serial, and handling-unit record identify what actually exists. Preserve supplier identity alongside internal identity instead of replacing the supplier’s lot with a warehouse-generated number that cannot be traced back.

A stock segment is a practical way to distinguish portions of the same lot that have different locations or decisions. For example, one supplier lot can occupy three containers, with one container held after damage. The shared lot remains a shared identity, but it does not force all three containers to have the same immediate eligibility.

For manufacturers subject to the applicable provisions, §820.10(b)(1) requires a documented UDI assignment system in accordance with Part 830, and §820.35(c) requires UDI recording for each medical device or batch. Operationally, connect the UDI record to internal inventory identity; do not use it as a substitute for component genealogy, quantity reconciliation, or disposition history.

Define uniqueness rules before migration. A supplier lot may need the supplier and item as part of its identifying context. A serial should be checked within its defined identity scope. Preserve leading zeros, distinguish pack quantities from individual units, and reject ambiguous barcode interpretations. Engineering should control revision applicability, including whether an older component revision remains usable for a particular build. A barcode scan confirms a read value, not compatibility or release.

A practical status model separates physical location, manufacturing progress, quality disposition, and allocation. Putting a container in a released-stock aisle does not itself approve it. Completing assembly does not necessarily release the device for dispatch. A reservation reduces unallocated quantity without changing whether the underlying stock meets the quality criteria for its intended use.

Define eligibility as a transaction-specific decision. Component issue can require accepted identity, a compatible revision, sufficient unallocated quantity, applicable date limits, and no active hold. Finished-device dispatch can require different evidence. Recheck at execution, not only when a pick list is created: an intervening hold should invalidate a previously permissible movement.

Use explicit transition permissions: who can place a hold, who can disposition material, and what evidence each change needs. Maintain the earlier state, effective time, reason, and affected quantity. A later release should not erase the fact that a lot was previously held. The audit trail should explain the decision sequence, not merely show the latest value.

Where several restrictions coexist, clearing one should not clear the others. Releasing an inspection hold, for example, should leave an independent recall or expiry restriction effective.

At receipt, a useful practice is to verify the physical delivery against the expected item, revision where relevant, supplier lot, quantity, and unit of measure. Record discrepancies rather than silently adjusting the purchase order to match the delivery. Associate supporting documents, such as a certificate of conformity, with the actual received identity; a document attached only to a supplier account is difficult to interpret later.

Place received material into a clearly defined initial state. Quarantine can combine physical segregation, conspicuous identification, and transaction restrictions according to the process. Record sampling withdrawals and whether sampled units are consumed, retained, or returned under an approved method. Otherwise, the first unexplained inventory variance may occur before production even begins. A missing document and a failed inspection can share a blocked state while retaining different reasons.

During putaway and internal movement, preserve the connection between the container and its contents. Splitting a container creates identified child quantities, not a new independent material history. Combining stock for convenience should not erase the contributing lots. Record the source and destination locations and confirm the movement physically; a successful transfer message does not prove that the container reached the intended bin.

For date-controlled materials, distinguish expiry, retest dates, and process-specific time limits. Configure each according to the approved material or device rules rather than treating every date as interchangeable. Define the date interpretation and time zone, including what happens at the cutoff. Once a container is opened or material enters a time-limited operation, an additional clock may matter independently of the original supplier date.

Apply first-expired, first-out only after eligibility filtering. The earliest-expiring stock may be unsuitable for a planned build or dispatch if insufficient remaining life is available. An excursion, damaged package, or uncertain storage history should trigger the relevant assessment rather than an automatic date extension. Preserve the original date and the authorization for any legitimate change. Moving stock to a new location, printing a new label, or receiving a return should never silently restart its clock.

For work in process, inventory control becomes a relationship problem. The planned bill of materials says what a build was expected to consume; genealogy records what it actually consumed. Record substitutions, partial issues, unused returns, scrap, and rework against identified inputs and outputs. Backflushing a standard quantity without resolving actual lot usage can leave a plausible balance but an unreliable trace.

Record consumption at a level that supports the intended trace. If one assembly serial receives parts from two component lots, both relationships belong in its history. If the process records only build-lot consumption, do not later present that history as exact unit-level attribution. The uncertainty should remain visible when assessing affected devices.

Rework should add history rather than replace it. Preserve removed component identity where relevant, replacement identity, the authorizing instruction, and subsequent verification. The production record and inventory ledger serve related but different purposes: one explains execution, while the other reconciles physical quantities and states. Link them through stable event references. Test backward tracing from a device and forward tracing from a component, including splits and reversals, before relying on either report.

Finished-device identity does not mean release eligibility. Under §820.3, a finished device is suitable for use or capable of functioning whether or not packaged, labeled, or sterilized. As an implementation practice, retain separate milestones for assembly completion, packaging completion, applicable processing, evidence review, and authorization for dispatch. This avoids treating a production completion transaction as a quality decision.

Section 820.45 requires documented labeling and packaging procedures covering integrity, inspection, storage, and operations under the specified conditions. It also requires examination for accuracy before release or storage where applicable, including device identification, expiration date, storage instructions, handling instructions, and additional processing instructions. The regulation separately requires documentation of labeling release and labeling inspection results. Configure the inventory gate around the evidence applicable to the device, rather than a generic completed checkbox.

FDA’s sterility information guidance for 510(k) submissions is nonbinding guidance, not an inventory procedure. Within its scope, it recommends describing the sterile barrier packaging, how it maintains sterility, and package test methods. That submission context should not be confused with an automatic rule that a particular warehouse status proves a particular load or package is acceptable.

For a terminally sterilized device, a practical evidence structure can connect the output lot to packaging records, the applicable processing load, relevant results, and the release decision. Use the manufacturer’s approved acceptance criteria. A record that processing occurred and a decision that the resulting product is acceptable are separate facts; neither should be inferred merely from the device’s location.

Control partial release at the same identity level used physically. If only some containers or serials are approved, the release scope should identify them unambiguously. Before dispatch, recheck active restrictions and applicable remaining-life rules. Preserve the released label configuration and evidence references so a later investigation can reconstruct what was authorized, not only what the current master data says.

Example: a manufacturer receives 1,200 connectors from supplier lot S2610 under internal lot C261017. Every connector is initially non-issuable. Inspection and the authorized disposition accept 1,080 connectors and reject 120. The accepted and rejected portions are placed in separately identified containers. This example assumes the disposition supports separating the portions; finding 120 defective pieces alone would not justify accepting the remainder.

The rejection rate is 120 ÷ 1,200 × 100 = 10%. Accepted quantity is 90% of the receipt. A work order requires two connectors per device and receives 900 accepted connectors for a planned 450 devices. Production records 860 connectors incorporated into 430 devices, 20 connectors scrapped, and 20 unused connectors returned to accepted stock after the defined verification. Issue reconciliation is 900 = 860 + 20 + 20.

The 430 finished devices are not added to the connector balance: they are a different item and unit of accounting. Their release remains a separate decision. Before production, the accepted connectors supported at most 1,080 ÷ 2 = 540 devices, not the 600 suggested by gross receipt quantity. After production scrap, the 430 completed devices plus the remaining 200 ÷ 2 = 100 device-equivalents total 530, assuming all other constraints are satisfied.

Do not delete the 120 rejected connectors from physical inventory when a supplier credit arrives. They remain onsite until a recorded return, destruction, or other authorized disposition occurs. Likewise, returning the unused 20 connectors should preserve their original genealogy and handling history. This yield reconciliation makes the shortfall explainable: rejection accounts for 60 device-equivalents and production scrap for another 10. It does not convert component availability into a promise of finished-device output.

A manufacturer return should begin as a new receipt event linked to the original device identity and dispatch, not as a reversal that makes the device immediately available. As a practical control, assign a return identifier, record the received quantity and condition, and route the material into return quarantine. Preserve uncertainty when the identity cannot initially be confirmed.

Separate commercial authorization from quality disposition. A credit, warranty agreement, or unopened carton does not answer whether the device remains suitable for its intended next use. Review the applicable storage history, package condition, age, configuration, and reason for return. Record the authorized outcome and its evidence. Returned items awaiting investigation, approved for a defined rework route, or designated for destruction should not share an undifferentiated available balance.

For recall readiness, connect suspect component lots to affected WIP, finished devices, and manufacturer dispatch records. Apply holds to the defined identities and their relevant descendants while the assessment proceeds. Include reserved stock, staged devices, partially completed work orders, and returned units. A stock query that checks only warehouse bins can miss material already issued to production or waiting at a dispatch station.

Regulatory assessment is a separate workstream. Section 820.10(b) requires notification to FDA of complaints meeting Part 803 reporting criteria and handling advisory notices in accordance with Part 806. Inventory personnel should escalate relevant facts to the designated quality and regulatory owners rather than treating a warehouse return code as the reporting determination.

In a practice mock recall, establish an as-of time and a defined affected population. Reconcile current onsite quantities, quantities dispatched and not returned, received returns, and documented destruction without counting the same device twice. Preserve the original shipment as an event even when its device later returns. Record unresolved identities explicitly, assign an owner to each discrepancy, and distinguish confirmed scope from conservative provisional scope. The exercise should demonstrate both effective blocking and a reproducible explanation of the population.

Interface design is an operating-responsibility problem before it is a messaging problem. The following is an example ownership model, not a required architecture. One platform may perform several roles, but each authoritative fact still needs a defined owner and an agreed method for correcting errors.

Define the transaction contract for every handoff: identity keys, quantity and unit, event identifier, effective time, sequence or version, acknowledgment, and failure behavior. Duplicate messages should not duplicate receipts or consumption. An older release message arriving after a newer hold should not restore availability. Corrections should reference the original event rather than overwrite history across systems independently.

Design the failure state deliberately. If current disposition cannot be established, pause the affected transaction or use a specifically authorized contingency process. Do not quietly rely on yesterday’s released status. Assign an owner to the failed-message queue and require business reconciliation after recovery, including events that succeeded in one system but not another. Technical delivery success and correct inventory posting are different checks.

When evaluating medical-device manufacturing software, ask for demonstrations against your transaction scenarios rather than accepting feature labels. Can a hold block an already staged issue? Can partial rejection survive a split and a retry? Can a trace show actual consumption and its correction? Can a reviewer reconstruct the release evidence that existed at dispatch? Clarify responsibilities, then assess the proposed configuration and intended use without assuming that a software category establishes suitability.

Start with one representative product family and map its real exceptions before configuring screens. Include an incoming discrepancy, a split lot, a component substitution, a partial rejection, an expired container, a production return, and a finished-device hold. Identify the people who authorize decisions and the people who execute movements. Those roles may collaborate, but their responsibilities should not disappear inside a shared login or generic approval.

Write measurable acceptance criteria in the user requirements specification. For example: a hold entered after reservation but before component issue prevents that issue; replaying a receipt event does not increase stock twice; a split preserves the supplier lot on every child segment. These criteria are stronger than statements such as supports traceability because the intended behavior and failure condition are observable.

During migration, reconcile more than total quantity. Compare identity, location, unit, status, allocation, expiry, and the links to supporting records. Preserve access to relevant historical events and explain any transformed identifiers. Do not convert an unknown legacy state into released simply because the new system requires a value. Resolve the uncertainty or migrate it into an explicitly restricted state with an assigned assessment owner.

Before cutover, rehearse label reprinting, scanner failure, unavailable interfaces, manual contingency recording, and recovery reconciliation. Use a documented, risk-based approach to assurance for the intended use. Approve the operating procedures and train staff on exceptions as well as normal transactions. Close the pilot only when physical stock, electronic balances, and quality decisions tell the same story.

Routine oversight should test the relationship between quantities, identities, and decisions. A useful cycle count checks item, lot or serial, location, unit, and status, not only the number of pieces. Finding the right quantity of the wrong revision is not an accurate count for production purposes. Investigate the cause before posting an adjustment that would conceal an unrecorded transfer or consumption event.

Use separate measures for different questions. Quantity accuracy measures agreement with physical count. Identity accuracy measures whether the correct material occupies the recorded location. Eligibility accuracy measures whether the allowed transaction matches the current decision and restrictions. Report held stock separately from released but allocated stock. A single availability percentage can hide whether the constraint is quality, planning, missing evidence, or a failing interface.

Define every metric’s denominator and time basis. For example, discrepancy rate can be counted lines with a discrepancy divided by all lines counted during the period. A 12-discrepancy result from 300 counted lines is 4%, not a statement that 4% of all inventory units are wrong. Track open hold age, unresolved interface events, unexplained adjustments, and genealogy gaps as distinct operating signals, with owners and escalation criteria.

Review repeated workarounds. Frequent manual releases, relabeling, unit conversions, and emergency issues may indicate that the process model does not match actual work. Investigate through the appropriate nonconformance or improvement process rather than normalizing the workaround. Periodically challenge the controls with an expired-stock issue attempt, a late hold, and a trace through rework. Test restoration and record access as well as the normal user interface.

Finally, review the evidence behind exceptions, not merely whether a dashboard is green. A closed discrepancy should explain the physical event, the corrected records, and whether other lots or devices could be affected. An inventory system is useful when it can answer four connected questions consistently: what exists, where it came from, what happened to it, and why its next movement is authorized. Maintaining that consistency is an ongoing manufacturing discipline, not a one-time installation milestone.