ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 13485 internal audit is the planned, documented check that your quality management system does what your procedures say and what ISO 13485:2016 requires. Clause 8.2.4 makes it mandatory, and certification auditors read your audit records before almost anything else.
This guide covers the audit programme, auditor independence, a seven-step method, how to grade findings and how results feed management review and CAPA. It is written for small and mid-sized device makers building their first system.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
Clause 8.2.4 requires audits at planned intervals to confirm that the QMS conforms to your planned arrangements, to ISO 13485, to your own QMS requirements and to applicable regulatory requirements. It also requires that the system is effectively implemented and maintained.
A documented procedure must describe responsibilities and requirements for planning and conducting audits, creating records and reporting results. The audit criteria, scope, interval and methods must be defined and recorded.
The official wording is in the standard itself, so buy the text from the ISO 13485:2016 page on iso.org rather than relying on summaries, including this one.
The standard says auditor selection and audit conduct must ensure objectivity and impartiality, and auditors shall not audit their own work. That one sentence drives most staffing decisions in small companies.
If your regulatory lead wrote the complaint procedure, someone else audits complaint handling. A second company, a consultant or a trained colleague from another function can all fill the gap.
Competence still matters. Clause 6.2 expects people to be trained for their tasks, so keep records showing each auditor learned the standard and audit technique.
The programme must consider the status and importance of the processes being audited, plus results of previous audits. In plain terms, risky processes and areas with past problems get audited more often.
Start with a process list: design, purchasing, production, sterilization if relevant, complaints, CAPA and so on. Rate each by risk to product safety and by audit history, then set intervals.
Record the programme as a simple schedule with auditor, scope, criteria and date. Your certification body will ask to see it at every visit. Keep this in mind for every ISO 13485 internal audit.
The standard says planned intervals, not annual. Most small manufacturers cover every clause and every process at least once a year, spreading audits across the months instead of one big event.
High-risk areas such as design transfer, process validation or sterile barrier steps often deserve two looks a year. A recent nonconformity or customer complaint trend is a good reason to add one.
Certification auditors expect a completed full cycle, with management review reviewing results, before the stage 2 visit.
Auditing clause by clause is easy to schedule but misses handoffs. Auditing by process follows a real trail, for example a complaint from intake to investigation to CAPA to regulatory reporting.
A hybrid works well. Use a clause matrix to prove every requirement was covered during the cycle, then audit through processes so interfaces between departments get tested.
Document exclusions carefully. If clause 7.3 does not apply because you do not design, the quality manual must justify it, and the auditor should check that logic still holds. This is where a ISO 13485 internal audit is won or lost.
Step 1 is confirming scope, criteria and the audit team. Step 2 is notifying the area owner with a date and a list of records you will sample. Step 3 is building a checklist from the procedure, the clause and prior findings.
Good checklists ask for evidence, not yes or no answers. Instead of asking whether supplier evaluations exist, ask to see three evaluations and the re-evaluation records for the highest-risk supplier.
Read the last audit report and open CAPAs first. Nothing damages credibility faster than repeating a finding that was supposedly closed.
| Audit element | What ISO 13485:2016 expects | Typical evidence |
|---|---|---|
| Programme | Planned considering process status, importance and past results | Schedule with scope, criteria, interval |
| Procedure | Documented responsibilities, planning, records and reporting | Approved audit procedure |
| Auditor | Objective, impartial, not auditing own work | Auditor training and assignment record |
| Findings | Corrections and corrective actions without undue delay | Report, CAPA reference, due dates |
| Follow-up | Verification of actions and reporting of results | Verification note and closure record |
Step 4 is the opening meeting, kept short: purpose, scope, how findings will be graded and when the closing meeting will happen. Step 5 is evidence collection by interview, observation and record review.
Sample records rather than reading everything. Pick a device family, follow one batch from order to shipment and check that each record exists, is signed, is controlled and matches the current procedure.
Write down what you saw, with record numbers and dates. An audit note that says all good has no value six months later. Auditors judge your ISO 13485 internal audit on exactly this point.
Use a small, consistent scale. A major nonconformity is a missing or failed requirement with a real risk to product or compliance. A minor is an isolated lapse. An observation is a weak spot that has not yet failed.
Every finding needs the requirement, the evidence and the gap. A finding that says the procedure is not followed is useless; one that cites clause 7.5.9 and three shipped lots without traceability records is actionable.
Match your scale to your certification body and keep it stable, so trend data across audits actually means something.
The audit report goes to the management responsible for the audited area. They must make sure corrections and corrective actions happen without undue delay, and the standard requires follow-up that verifies the actions and reports the result.
Open a CAPA for anything beyond a one-off correction. Link the report, the CAPA and the verification so an auditor can follow the whole thread in minutes. See the ISO 13485 CAPA guide for the investigation structure.
Close only when effectiveness is shown, not when the action is merely finished. Treat it as a standing rule for your ISO 13485 internal audit.
Audit results are a required input to management review under clause 5.6.2. Summarize the number and grade of findings, repeat issues, overdue actions and areas not yet audited.
Management then decides what resources and changes are needed. That decision, recorded in the minutes, is the evidence that top management is actually running the system.
Our guide to ISO 13485 management review shows a ready input list built from the clause.
The usual failures are auditing your own work, skipping interfaces, writing vague findings, and letting actions drift past their due dates. Another is auditing only documents without watching the work.
A second pattern is running the whole cycle the month before certification. Auditors see this from the dates, and it signals a system that is performed for the audit, not for the business.
Avoid copying a generic checklist unchanged. If it references processes you do not have, the auditor will conclude nobody read it.
Outsourced processes stay your responsibility under clause 4.1.5, so audit how you control them. Review supplier evaluations, quality agreements and incoming inspection as part of the purchasing process.
Software used in the QMS or in production must be validated before use, so include a sample of validation records. Our software validation guide explains the expected evidence.
If you sterilize or rely on cleanroom conditions, add process validation and environmental monitoring to the programme using process validation as a reference.
The FDA’s Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. For US makers, clause 8.2.4 is therefore the working audit requirement.
That raises the stakes for audit quality, since the same procedure now serves both your certificate and your US compliance. Read the QMSR internal audit guide for the regulatory angle.
Check how your records are presented if FDA inspects. Our note on QMSR inspections covers what to expect. Pair this guide with the ISO 13485 internal audit checklist for question prompts.
A procedure, programme schedule, checklist, report and finding log are the five documents every audit cycle needs. Building them from scratch usually costs a week of effort the first time.
The ISO 13485 Toolkit includes an internal audit procedure, schedule and report forms aligned to the standard, so you can adapt them instead of drafting from a blank page.
Whatever you use, tailor it to your actual processes, and then run a pilot audit on one process before the full cycle.
An ISO 13485 internal audit sits beside design controls, supplier management and post-market feedback. Findings should flow into the same CAPA system your complaints use, so there is one place to see all quality problems.
If your path to a certificate is still being planned, the certification timeline shows when the first full audit cycle must finish.
Still weighing the investment? Is ISO 13485 worth it lays out the business case.
At planned intervals set by you, based on process risk and audit history. Most small manufacturers cover the full system at least once a year.
Not their own work. Auditors must be objective and impartial and must not audit their own work, so use another person or an external auditor for those areas.
No, the standard does not require one. A trained internal person who is independent of the area is acceptable, though many startups hire outside help.
The procedure, programme, checklists, reports, findings and the verification that corrective actions worked, plus the management review input.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026