ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 13485 quality manual is the top-level document that describes your quality management system, its scope and how its processes fit together. Clause 4.2.2 requires one, and it is usually the first document a certification auditor reads.
This guide lists the four things the manual must contain, offers a section-by-section outline and explains how to justify exclusions. It also shows how the manual connects to the mandatory documents and the wider documentation set.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
Clause 4.2.2 says you must document a quality manual that includes the scope of the QMS, including details of and justification for any exclusion or non-application. It must include the documented procedures or a reference to them.
It must also describe the interaction between the processes of the QMS and outline the structure of the documentation used in the system.
Those four contents are the minimum. Read the clause in the ISO 13485:2016 page on iso.org and keep your headings close to its language.
Clause 4.2.1 lists the documentation the QMS must include: the quality policy and objectives, the quality manual, documented procedures and records required by the standard, and documents needed for effective planning and control of processes.
It also includes records required by applicable regulatory requirements and other documentation those requirements specify. The manual sits at the top and points downward.
A clean hierarchy helps everyone. Manual, procedures, work instructions and records should each have a clear job.
Clause 4.1.1 requires you to document your role under applicable regulatory requirements, for example manufacturer, authorized representative, importer or distributor. That role shapes which clauses apply.
State the scope in plain words: which devices or device families, which sites, which lifecycle stages such as design, production, distribution or servicing, and which markets.
A vague scope such as medical device quality is not enough. Certificates carry the scope wording, so be precise. Keep this in mind for every ISO 13485 quality manual.
The standard allows you to leave out requirements in clauses 6, 7 or 8 that are not applicable because of the activities you perform or the nature of the device. You must record that and justify it in the manual.
If you do not sterilize, say so and point to why clause 7.5.5 and 7.5.7 do not apply. If you buy a finished design from a partner, explain who holds design responsibility.
Be cautious with design controls. Applicable regulations often require them, so excluding clause 7.3 needs a firm regulatory basis.
The manual must include the procedures or reference them. Almost every company chooses to reference, which keeps the manual short and stable.
A table that lists each clause, the controlling procedure and its number works well. The auditor can then trace any clause to its procedure in seconds.
Update the table whenever a procedure is added or renumbered. Stale references are a frequent minor finding. This is where a ISO 13485 quality manual is won or lost.
Clause 4.1.2 requires processes needed for the QMS to be identified, sequenced and interaction determined. The manual is the natural place to show this.
A single process map is usually enough: management, product realization, supporting processes and measurement and improvement, with arrows for inputs and outputs.
Keep the diagram readable. A map that tries to show every record will be ignored, while a simple one will be quoted by your staff.
| Required content | Clause | How to show it |
|---|---|---|
| Scope and exclusions | 4.2.2 a | Defined scope, justified non-applications |
| Procedures or references | 4.2.2 b | Clause-to-procedure table |
| Process interaction | 4.2.2 c | One-page process map |
| Documentation structure | 4.2.2 d | Hierarchy and document control summary |
| Regulatory role | 4.1.1 | Manufacturer, importer or other role |
The last required content is an outline of the documentation structure. Describe the levels, such as manual, procedures, work instructions, forms and records, and how documents are identified and controlled.
Mention the document control system and where the controlled copies live. This links to clause 4.2.4 on document control.
If you use electronic systems, note that their validation falls under clause 4.1.6, which our software validation guide explains. Auditors judge your ISO 13485 quality manual on exactly this point.
A practical outline has ten parts: introduction and company profile, scope and exclusions, regulatory role, definitions, process map, QMS processes by clause, documentation structure, quality policy, quality objectives and revision history.
Keep each part to a page or less. The whole manual can be twelve to twenty pages for a small manufacturer.
Include the quality policy and objectives or reference where they are controlled, because clause 5.3 and 5.4.1 require them.
Write in direct, present-tense sentences. We control documents using procedure QP-01 is better than Documents shall be controlled in accordance with the requirements of a documented process.
Avoid copying the standard’s text clause by clause. An ISO 13485 quality manual that merely restates the standard proves nothing about your company.
Name roles, not people, so the manual survives staff changes. Treat it as a standing rule for your ISO 13485 quality manual.
Frequent errors are a vague scope, exclusions without reasons, outdated procedure lists, no process map and a copy of another company’s manual. Auditors recognize borrowed text immediately.
Another is writing the manual for the audit, with promises the company does not keep. If the manual says monthly reviews and your minutes show annual ones, you have a finding.
Keep it accurate first and short second.
The manual is a controlled document. It needs approval before issue, a revision history and a review schedule. Top management usually approves it.
Review it at least when the scope, processes or regulatory role change, and as an input to management review.
Retain obsolete versions according to your record retention rules so you can show what applied at any past date.
Drafting the manual forces decisions about scope, exclusions and process ownership. Many teams find real gaps while writing it, such as a missing supplier evaluation process.
Use the draft to start a gap analysis and to plan which procedures to write first. It is a roadmap as well as a document.
Our ISO 13485 implementation guide shows a sensible order of work.
The FDA’s Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. Your manual should reflect the US manufacturer role where relevant.
Read QMSR vs ISO 13485 for the differences, and note any US-specific records you keep.
If you sell in both the US and EU, one manual can cover both with a short section on each regulation.
A template saves time on structure, but the content must reflect your company. The ISO 13485 Toolkit includes a quality manual template, process map and procedure index to adapt.
Replace every placeholder, delete sections that do not apply and add the justification for each exclusion. A manual with leftover brackets does not inspire trust.
Have someone outside the project read it and describe your business from the manual alone.
Certification bodies review the manual during the stage 1 audit to confirm readiness. The certification timeline shows when to finish it.
If you are weighing the effort, is ISO 13485 worth it covers the business case.
A concise, accurate manual shortens audit time because auditors spend less time asking how things fit together.
A manual that is written once and forgotten drifts away from reality within a year. Set a review trigger for every change in scope, site, regulatory role or major process.
Ask process owners to confirm their section at each annual review. Two minutes of confirmation per owner catches most drift early.
Record the result in the revision history, even when the answer is no change. That sentence proves the review happened.
A weak scope says medical devices. A stronger one says design, manufacture and distribution of Class IIa non-sterile wound dressings at the Boston site, supplied to EU and US markets.
The second version tells the auditor which clauses apply, which sites to visit and which regulations to check. It also prevents arguments at certificate issue.
Test your own scope by asking whether a stranger could tell what the company does and where. If not, rewrite it before anything else in the ISO 13485 quality manual.
Staff do not need to memorize the manual, but they should know where it is, what the quality policy says and how their work fits the process map.
A short induction slide using the process map works well. Keep a training record, since clause 6.2 expects awareness and competence to be demonstrable.
Auditors often ask operators about the quality policy. A confident, simple answer is a better sign than a perfect quotation.
Yes. Clause 4.2.2 requires a documented quality manual with defined contents.
There is no length rule. Small manufacturers often write twelve to twenty pages that reference procedures instead of copying them.
Only if you do not design and develop, and applicable regulations allow it. Record the justification in the manual.
Top management usually approves it, as part of document control under clause 4.2.4.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026