China Medical Device Distributor and CSO Compliance Audit Checklist
Operational audit checklist for China medtech distributors, CSOs, and clinical application specialists to meet hospital reception and anti-bribery standards.
Executive Summary: Operationalizing Channel Compliance
For multinational medical device and in vitro diagnostics (IVD) manufacturers in China, commercial compliance is moving from high-level policies to the operational front line.
While the administrative filing requirements of China's new Medical Representative Management Measures (NMPA Announcement No. 42 of 2026) are currently limited to pharmaceuticals, the broader enforcement environment—led by the National Health Commission (NHC) and the State Administration for Market Regulation (SAMR)—applies directly to the medtech sector. Furthermore, provincial regulations in key markets like Fujian and Shanghai already subject medical device and IVD representatives to strict in-hospital registration and reception protocols.
Because most medtech manufacturers rely on third-party channels in China, the primary risk surface is the behavior of distributors, Contract Sales Organizations (CSOs), and in-hospital clinical application specialists. Under Chinese law, particularly the Supreme People's Court and Supreme People's Procuratorate's criminal Judicial Interpretation II (effective May 1, 2026), manufacturers face direct corporate liability for the bribery acts of their channel partners under the unit bribery (单位行贿) standard if they fail to implement active monitoring and compliance controls.
This guide provides a comprehensive, auditable operational checklist across five key compliance domains. Manufacturers, distributors, and compliance auditors should use this tool to evaluate, structure, and monitor field conduct and channel relationships in China.
Domain 1: In-Hospital Reception and Registration Controls
Hospital access is no longer a matter of informal department visits. Field representatives must strictly comply with the "Three-Fixed" hospital reception discipline that Chinese public hospitals increasingly require. Codified provincial versions range from "Three-Fixed, Two-Haved" (三定两有 — the version adopted by Fujian's 2024 rule) up to the stricter "Three-Fixed, Three-Haved" (三定三有) and even "Three-Fixed, Four-Haved" (三定四有) now applied by many hospitals. This checklist uses the Three-Haved tier as the conservative audit target, because a distributor or CSO that meets the stricter standard is automatically compliant with the lighter provincial versions.
Historically, sales representatives could walk directly into clinical departments, operating rooms, or individual physician offices. Under current rules, this behavior triggers severe penalties for both the representative and the hospital staff. The hospital audit must verify that every in-hospital visit is authorized, pre-scheduled, and recorded through official channels.
Audit Checklist: Hospital Reception
| Audit Ref | Control Activity | Verification Method | Pass/Fail Criteria |
|---|---|---|---|
| RC-01 | Unified Entry Point | Confirm that all representative visits enter the hospital via the designated management department (e.g., the Equipment, Audit, or Procurement Office) rather than directly into clinical departments. | Pass: Zero documented instances of direct clinical entry without registration. |
| RC-02 | "Three-Fixed" Compliance | Verify that academic activities are conducted only during Fixed Times (定时), in Fixed Places (定点), and with Fixed Persons (定人) present. | Pass: Schedule matches hospital-designated representative hours and locations. |
| RC-03 | "Three-Haved" Validation | Ensure each visit is backed by a pre-arranged Appointment (有预约), follows a documented Process (有流程), and results in a signed Record/Ledger (有记录). | Pass: Availability of physical or electronic hospital appointment confirmations. |
| RC-04 | Credential Matching | Check that representatives carry their physical ID, employer credentials, and product authorization letters during visits, matching the hospital’s system registry. | Pass: 100% match between active representatives and hospital-registered profiles. |
| RC-05 | Local Platform Registration | In provinces with online registration platforms (e.g., Fujian, Shanghai), verify that the representative has successfully uploaded their credentials and obtained an active status. | Pass: Valid registration screenshot or platform query result on file. |
Domain 2: Field Representative Authorization and Credentials
Under Article 8.2 of the 2026 framework, manufacturers cannot simply authorize a distributor or CSO company to promote their products; they must authorize the individual representatives who conduct the promotion.
Every field representative must carry an individual, scope-bounded authorization letter (授权书). The manufacturer is required to maintain an active registry of all authorized personnel, conduct initial and periodic due diligence on their employer, and verify that the authorization scope matches the representative's actual product responsibilities.
Audit Checklist: Representative Authorization
| Audit Ref | Control Activity | Verification Method | Pass/Fail Criteria |
|---|---|---|---|
| AU-01 | CSO Capability Assessment | Inspect the compliance and operational due diligence file for every third-party CSO and distributor prior to contract execution or renewal. | Pass: Completed due diligence questionnaire, background checks, and sign-offs on file. |
| AU-02 | Written Management Agreement | Verify that a valid contract is in place with the distributor/CSO containing specific compliance covenants, audit rights, and breach-of-contract penalties. | Pass: Signed agreement containing the mandatory Article 8.2 compliance clauses. |
| AU-03 | Individual Authorization Letters | Check that every representative has a physical authorization letter issued directly by the manufacturer or authorized local entity. | Pass: Signed and stamped letter containing the representative's name, ID, and employer. |
| AU-04 | Product and Department Scope | Verify that the authorization letter explicitly limits the representative to specific NMPA registration certificates and designated hospital regions. | Pass: No representative found promoting products outside their authorized list. |
| AU-05 | Expiration and Renewal Tracking | Confirm there is a system to track authorization expiration dates and revoke letters immediately upon employee termination or agency change. | Pass: Master registry is updated within 48 hours of any representative status change. |
Domain 3: Segregation of Clinical/Academic Support from Commercial Sales
The core structural change demanded by modern Chinese compliance rules is the strict segregation of academic and technical support from commercial sales activities.
This is particularly challenging for medical device companies, where clinical application specialists (also known as clinical specialists or clinical support) must frequently enter operating rooms or laboratory departments to provide technical guidance on complex implants, surgical instruments, or IVD analyzers. Under Article 11 and Article 24 of the Measures, combining technical support with commercial sales tasks is a direct compliance violation.
To maintain compliance, manufacturers must align their in-hospital technical support with the institutional requirements of the National Health Commission's Medical Device Clinical Use Management Measures (Order No. 8, effective March 1, 2021). This order requires medical institutions to establish traceability and strict management of device clinical applications, creating a natural boundary for purely technical support.
Audit Checklist: Segregation of Duties
| Audit Ref | Control Activity | Verification Method | Pass/Fail Criteria |
|---|---|---|---|
| SD-01 | Job Description Isolation | Review the job descriptions, KPIs, and employment contracts for all clinical application specialists. | Pass: Zero mention of sales targets, revenue quotas, or payment collection metrics. |
| SD-02 | Payment Collection Ban | Verify that clinical application specialists are barred from handling purchase invoices, collecting payments, or participating in pricing negotiations. | Pass: Financial audits confirm no invoices or receipts were handled by technical staff. |
| SD-03 | Sales Target Segregation | Audit incentive compensation schemes to ensure technical support staff are paid based on training quality and technical competence rather than sales volume. | Pass: Compensation files show salary and bonuses are decoupled from sales performance. |
| SD-04 | In-OR Technical Protocols | Review the written operating procedures for clinical support in operating rooms or sterile zones. | Pass: Written protocols confirm the specialist acts only as a technical guide to HCPs. |
| SD-05 | Distributor Boundary Audit | Audit distributor-employed clinical specialists to ensure they are not acting as hidden sales agents who bypass hospital registration. | Pass: Distributor agreements contain clear, auditable roles for their clinical staff. |
For a broader perspective on distributor obligations, manufacturers can consult the EU MDR importer and distributor obligations guide. While the EU MDR focuses heavily on post-market regulatory traceability, the China framework focuses on behavioral and commercial boundaries, showing the need for a multi-layered compliance model for global channels.
Domain 4: Anti-Bribery and Conduct Controls
Enforcing behavioral compliance requires translating general anti-bribery policies into specific, auditable red lines for field operations.
The 2026 Measures, combined with SAMR’s healthcare commercial bribery guidelines, highlight several high-risk commercial practices. These include the tracking of individual physician prescription/usage volumes (known as Tong Fang), the use of conditional donations to lock in procurement, and the provision of kickbacks and personal benefits to hospital staff or their relatives.
Audit Checklist: Anti-Bribery and Conduct
| Audit Ref | Control Activity | Verification Method | Pass/Fail Criteria |
|---|---|---|---|
| AB-01 | Tong Fang (统方) Ban | Audit representative communication logs, expense reports, and mobile device records for evidence of physician-specific usage data. | Pass: Zero records containing physician-specific consumable usage or prescription volumes. |
| AB-02 | Relative and Affiliate Auditing | Verify that no commercial benefits, sponsorships, or consulting fees are provided to hospital staff’s spouses, children, or related persons. | Pass: Compliance screening of consulting registries and event rosters. |
| AB-03 | Donation & Sponsorship Review | Inspect all charitable donations, academic conference sponsorships, and equipment loan agreements. | Pass: All donations are unilateral, unconditioned, and routed via the hospital’s public office. |
| AB-04 | Hospitality & Gift Limits | Review representative expense claims for gifts, personal hospitality, meals, entertainment, or travel benefits provided to HCPs. | Pass: Zero claims for personal entertainment or gifts; meals must meet the low-value cap. |
| AB-05 | Off-Label Promotion Audit | Review all presentation materials and academic brochures distributed by representatives in hospitals. | Pass: 100% of materials align with the NMPA-approved instructions for use (IFU). |
Domain 5: Audit Records, Activity Traceability, and Ledgers (台账)
A key finding in most regulatory investigations is the lack of documentation. "If it isn't documented, it didn't happen."
Manufacturers must mandate that their distributors and CSOs maintain a detailed compliance ledger (台账) of all academic and technical activities. This ledger must be auditable and reconciled against hospital registration logs. The ledger is the primary defense against unit bribery charges, proving that the corporate entity actively monitors and manages its field teams.
Audit Checklist: Traceability and Ledgers
| Audit Ref | Control Activity | Verification Method | Pass/Fail Criteria |
|---|---|---|---|
| TR-01 | Centralized Activity Ledger | Inspect the master activity ledger (台账) maintained by the manufacturer or CSO. | Pass: Ledger exists and contains date, location, presenter, topic, and HCP attendee count. |
| TR-02 | Document Retention Period | Verify that the distributor or CSO retains all compliance records (authorizations, ledgers, training certificates) for the required duration. | Pass: Retention policy and physical files cover at least five years of activity data. |
| TR-03 | Training Records Audit | Check that every representative has completed documented, role-based compliance training and passed a verified assessment. | Pass: Completed training logs, exam scores, and signed certificates for 100% of staff. |
| TR-04 | Event Reconciliation | Reconcile a sample of ledger entries against distributor expense reports and hospital registration logs. | Pass: Event dates, attendee numbers, and expenses match across all records. |
| TR-05 | Incident Reporting System | Verify there is a clear process for representatives or distributors to report hospital-side non-compliance or unusual requests. | Pass: Active hotline, compliance email, and documented investigation procedures. |
Channel Responsibility Allocation Matrix
Managing compliance across a multi-tiered channel network requires defining who is responsible for each operational control. The following matrix outlines the allocation of duties between the Manufacturer (MAH), the Distributor, the CSO (if used), and the in-hospital Clinical Application Specialist.
| Compliance Area | Manufacturer (MAH) | Distributor | CSO Partner | Clinical Specialist |
|---|---|---|---|---|
| Representative Filing | Monitors local rules; prepares future NMPA filing data. | Executes provincial online registration. | Executes provincial online registration. | Submits individual identity credentials. |
| Authorization Letters | Issues stamped authorization templates. | Collects and submits staff data; maintains files. | Collects and submits staff data; maintains files. | Carries physical letter during hospital visits. |
| "Three-Fixed" Rules | Sets standard policy and audits compliance. | Enforces schedule and monitors representative conduct. | Enforces schedule and monitors representative conduct. | Adheres to fixed time, place, and person rules. |
| Segregation of Duties | Audits distributor contract compliance. | Decouples technical support from commercial metrics. | Segregates commercial sales from technical activities. | Refuses sales tasks, invoice delivery, and payments. |
| Activity Ledgers | Conducts sample audits of channel records. | Maintains and updates the primary distributor ledger. | Maintains and updates the primary CSO ledger. | Signs and submits activity logs after every visit. |
| Compliance Training | Provides standard training content and exams. | Mandates 100% staff training; maintains records. | Mandates 100% staff training; maintains records. | Completes annual training and passes assessments. |
Actionable Step-by-Step Audit Protocol
To implement this checklist, manufacturers should establish a regular channel compliance audit protocol consisting of three phases.
| Phase | Participants | Key Audit Actions & Verification Points |
|---|---|---|
| Phase 1: Pre-Audit Planning | Auditor ➔ Channel Partner | • Request Master Representative Registry • Request Completed Compliance Training & Exam Records |
| Phase 2: On-site Execution | Auditor ➔ Channel Partner & Hospital Records | • Audit physical files of active representative Authorization Letters • Review expense reports and reconcile against Activity Ledgers (台账) • Reconcile random sample of reception logs at hospital records office |
| Phase 3: Reporting & Remediation | Auditor ➔ Channel Partner | • Issue formal audit findings and Corrective Action Plan (CAPA) requests • Review submitted evidence of remediation and track resolution |
Phase 1: Pre-Audit Planning
- Request the Registry: Obtain a master registry of all representatives, distributors, and CSOs active in the territory, along with their assigned hospitals.
- Request Training Records: Collect completed compliance training logs and exam scores for the preceding 12 months.
- Select a Sample: Choose a risk-based sample of representatives and target hospitals for detailed ledger and expense reconciliation.
Phase 2: On-site Execution
- Review Authorizations: Verify that the physical authorization letters carried by the sampled representatives match the records in the master registry.
- Audit the Ledgers: Reconcile the activities recorded in the distributor's ledger (台账) with corresponding travel expenses, hospitality receipts, and hospital registration records.
- Inspect Job Roles: Conduct interviews with a sample of clinical application specialists to verify that they do not bear sales quotas or participate in commercial activities.
Phase 3: Reporting and Remediation
- Identify Gaps: Classify any non-compliance findings as Critical, Major, or Minor. A representative entering a clinical department without registration is a Critical finding.
- Issue Corrective Actions (CAPA): Require the distributor or CSO to submit a formal Corrective and Preventive Action plan within 14 business days.
- Enforce Consequences: If the partner fails to remediate critical gaps, initiate contract suspension or termination procedures.
Actionable Remediation and Consequence Protocol
When a distributor, CSO, or representative fails to meet the compliance criteria outlined in the audit checklist, the manufacturer must deploy a structured remediation protocol. Under the 2026 enforcement environment, failing to document corrective actions when a violation is discovered is itself a compliance failure that indicates a lack of effective corporate oversight.
Classification of Findings
- Critical Findings: Direct commercial bribery, unauthorized access to clinical systems (Tong Fang), entry into clinical departments without registration, or representatives carrying sales targets while performing clinical application support.
- Major Findings: Expired representative authorization letters, missing training records for active field staff, or incomplete activity ledgers (台账) lacking physician signatures or registration department stamps.
- Minor Findings: Clerical discrepancies in registries, delayed updates of representative status (under 7 days), or minor deviations from designated reception hours.
Corrective and Preventive Action (CAPA) Timelines
Upon receiving an audit report containing compliance gaps, the channel partner must submit a CAPA plan within the following windows:
- Critical Gaps: Remediation plan required within 48 hours; full correction required within 7 business days. The representative involved must be suspended from all hospital activities immediately.
- Major Gaps: Remediation plan required within 5 business days; full correction required within 30 calendar days.
- Minor Gaps: Correction required before the next scheduled audit or within 60 calendar days.
If a channel partner fails to submit or execute their CAPA plan within these windows, the manufacturer must initiate commercial consequences. For Critical Gaps, this includes suspending product shipments to the distributor and disabling authorization letters. For repeated major violations, the manufacturer should terminate the distributor agreement.
Frequently Asked Questions
Do the 2026 Medical Representative Management Measures already require medical device distributors and CSOs to file representatives?
No. The national filing platform established under NMPA Announcement No. 42 of 2026 is designed exclusively for pharmaceutical representatives. Medical device and IVD representatives are currently carved out, as their specific management measures will be formulated separately. However, distributors and CSOs must comply with provincial filing and registration rules where they exist (e.g., Fujian, Shanghai, Guangdong, and Zhejiang).
What is the "three-fixed, three-haved" (三定三有) hospital reception standard for device representatives?
It is a widely adopted hospital reception standard for in-hospital promotion conduct, designed to eliminate informal or unrecorded interactions between industry representatives and healthcare professionals. It requires visits to occur at a Fixed Time (定时), in a Fixed Place (定点), and with a Fixed Person (定人) present. Additionally, each visit must be backed by a pre-arranged Appointment (有预约), follow a documented Process (有流程), and result in a signed Record/Ledger (有记录). Note that codified provincial rules vary: Fujian's 2024 rule uses the lighter "Three-Fixed, Two-Haved" (三定两有) version, while many individual hospitals now require the Three-Haved or Four-Haved tiers.
Can a device clinical application specialist also collect payment or handle purchase invoices under current rules?
No. Even without device-specific filing rules, combining technical support with commercial collections or invoice handling creates significant compliance risks. This combination is a primary target of hospital anti-corruption audits and is prohibited under SAMR commercial-bribery guidelines. Clinical specialists must focus entirely on technical support and be insulated from commercial negotiations, payments, and invoices.
What records should a device manufacturer keep to prove its distributor and CSO field activity is compliant?
The manufacturer should maintain:
- Completed compliance due diligence questionnaires and background check files for all CSOs and distributors.
- Executed management agreements containing specific anti-bribery and representative monitoring covenants.
- Copies of all issued representative authorization letters, showing their validity period and product scope.
- Periodic activity ledgers (台账) submitted by channel partners, showing dates, times, and content of hospital visits.
- Documented compliance training logs, exam scores, and signed code of conduct certificates for 100% of field staff.
How does the Supreme People's Court Judicial Interpretation II affect distributor management?
The Judicial Interpretation II on bribery crimes (effective May 1, 2026) makes it easier for Chinese authorities to prosecute unit bribery (单位行贿). If a distributor or CSO offers bribes to secure sales of a manufacturer's products, and the manufacturer has not implemented active compliance monitoring (such as due diligence, auditing, and ledger tracking), the manufacturer can be prosecuted as a corporate entity. The "rogue distributor" defense is no longer viable without documented compliance oversight.
What should a manufacturer do if a hospital refuses to register a device representative because no national platform exists?
If a hospital's registration system is strictly pharmaceutical-only and does not accept device representatives, the representative must not bypass the rules by entering clinical departments informally. Instead, the distributor must request a written or email clarification from the hospital's equipment or audit department. The representative should only enter the hospital for technical support when a specific written appointment or invitation from a clinical department head is approved by the hospital administration.
Conclusion: Building a Defensible Commercial Model
In China's current regulatory climate, compliance is no longer an optional commercial overlay—it is a baseline requirement for market access. By establishing a rigorous, auditable operational checklist across their distribution channels, medical device and IVD manufacturers can significantly mitigate anti-bribery risks and protect their brand reputation.
Rather than waiting for the NMPA to publish its final medical device representative rules, proactive manufacturers should deploy these audit tools today. Aligning distributor networks, securing representative authorizations, and segregating technical support from commercial sales is a low-regret strategy that will pay significant dividends when the final regulations arrive.
For a comparative look at pre-market distributor controls in other jurisdictions, manufacturers should review the ASEAN distributor qualification and test report reuse matrix, which outlines how pre-market regulatory responsibilities are distributed across regional partners.
Sources
Last reviewed 2026-06-30 against NMPA Announcement No. 42 of 2026, the NHC Medical Device Clinical Use Management Measures (Order No. 8), and Fujian/SAMR anti-bribery guidance. The Measures are effective 2026-08-01 and carve out device-specific representative rules.
- NMPA Announcement No. 42 of 2026 (Official text)
National Medical Products Administration
https://www.nmpa.gov.cn/xxgk/fgwj/xzhgfxwj/20260507180422166.html - Policy Interpretation of the Medical Representative Management Measures
National Medical Products Administration
https://www.nmpa.gov.cn/xxgk/zhcjd/zhcjdyp/20260507174122178.html - NHC Medical Device Clinical Use Management Measures (Order No. 8)
National Health Commission
https://www.moj.gov.cn/pub/sfbgw/flfggz/flfggzbmgz/202103/t20210309_350144.html - Fujian SAMR Compliance Guidance for Healthcare Companies to Prevent Commercial Bribery Risks
Fujian Administration for Market Regulation
https://scjgj.fujian.gov.cn/zt/gphgzy/jzhgzn/202501/P020250127554826925468.pdf - Fujian Public Medical Institutions Staff Reception of Medical Representatives Interim Provisions (闽卫规〔2024〕No. 2, effective 2024-03-01)
Fujian Provincial Health Commission & Fujian Provincial Medical Products Administration
https://wjw.fujian.gov.cn/xxgk/zfxxgkzl/zc/bwgfxwj/202402/t20240207_6394215.htm - Han Kun operational analysis: how the Measures regulate academic promotion and hospital reception
Han Kun Law Offices
https://www.hankunlaw.com/portal/article/index/cid/6/id/16578.html - Junhe analysis: impact of the new measures on distribution and promotion entities
Junhe Law Offices
https://www.junhe.com/legal-updates/2988 - Allbright analysis: compliance transition and real challenges
Allbright Law Offices
https://www.allbrightlaw.com/CN/10475/d12fd5f94462e747.aspx