ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 13485 gap analysis compares what your company does today with every requirement of ISO 13485:2016 and shows what is missing, weak or fine. It is the cheapest way to avoid a surprise at your stage 1 audit.
This guide walks through six steps, a simple scoring scale and the evidence to collect for clauses 4 to 8. It also explains how to convert the results into an implementation plan with owners and dates.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
A gap analysis is a structured self-assessment, or an assessment by a consultant, that measures your current practice against the standard. It produces a list of gaps, not a certificate.
It is not an internal audit. An internal audit tests a system that is already running and is required by clause 8.2.4. A gap analysis happens before or during build-out and guides what to create.
The exact requirements are in the standard, available through the ISO 13485:2016 page on iso.org.
Do it at the start of a project, before writing procedures. It tells you which parts of the system already exist, often more than founders expect, and which need building.
Repeat a shorter version about two months before the stage 1 audit to confirm closure. Many teams find late gaps in records, such as missing training evidence.
If you are still deciding whether to certify, read is ISO 13485 worth it before you spend effort.
Decide which devices, sites and activities are in scope and what role you hold: manufacturer, importer, distributor or authorized representative. Clause 4.1.1 requires you to document that role.
Scope drives applicability. If you do not design products, document why clause 7.3 does not apply, and confirm that regulations allow the exclusion.
Write the scope as one paragraph. You will reuse it in the quality manual and the audit application. Keep this in mind for every ISO 13485 gap analysis.
Break the standard into auditable requirements. Clause 4 covers the QMS and documentation, clause 5 management responsibility, clause 6 resources, clause 7 product realization and clause 8 measurement, analysis and improvement.
Add applicable regulatory requirements to the list, such as the FDA Quality Management System Regulation, effective 2 February 2026, and EU MDR obligations.
Our guide to QMSR vs ISO 13485 shows how the US rule maps onto the standard.
Keep the scale simple. Four levels work well: not started, partial, implemented but not evidenced, and fully implemented with records.
Score on evidence, not on belief. If the team says the process exists but nobody can show a record, it scores as not evidenced.
A consistent scale also lets you track progress month by month and report it to leadership in one chart. This is where a ISO 13485 gap analysis is won or lost.
For each requirement, ask who owns it, what document governs it and what records prove it. Sample real records instead of relying on descriptions.
Interview people who do the work. Operators often reveal informal practices that never reached a procedure, which is a gap in itself.
Note existing assets you can reuse, such as ISO 9001 documents, supplier lists and design reviews.
Not all gaps matter equally. A missing complaint procedure or absent design inputs creates more risk than an outdated form.
Rank each gap by potential effect on device safety, regulatory exposure and audit outcome. A three-level rating of high, medium and low is enough.
High-risk gaps go first in the project plan, because they also take the longest to close with real evidence. Auditors judge your ISO 13485 gap analysis on exactly this point.
Turn each ranked gap into a task with an owner, a due date and an output, such as a procedure, record or training. Group tasks by process so owners are not overloaded.
Check dependencies. Design controls need risk management inputs, supplier controls need an approved list, and CAPA needs a complaint intake path.
Review the plan monthly and report progress as percentage of high-risk gaps closed.
| Clause | Typical gap | Evidence to collect |
|---|---|---|
| 4 QMS | No quality manual or document control | Manual, document list, record rules |
| 5 Management | No management review or measurable objectives | Minutes, objectives, policy |
| 6 Resources | No competence records | Training records, maintenance plans |
| 7 Product realization | Incomplete design file or supplier approval | Design file, approved supplier list |
| 8 Measurement | No CAPA or complaint process | CAPA log, complaint records, audit reports |
Common clause 4 gaps are the missing quality manual, no document control, no record retention rule and unvalidated QMS software. Clause 4.1.6 requires validation of software used in the QMS.
Records must be kept for at least the lifetime of the device as you define it, and not less than two years from release, unless regulations say otherwise.
See our guides on the quality manual and mandatory documents. Treat it as a standing rule for your ISO 13485 gap analysis.
Clause 5 gaps include no documented quality policy, objectives that are not measurable and no management review. Top management must show commitment, not delegate it.
Clause 6 gaps include missing competence records, no infrastructure maintenance plan and no controls for work environment or contamination where relevant.
Use management review and training and competence guides to close these.
Clause 7 is the heaviest. Typical gaps are no design and development file, weak design verification and validation, unapproved suppliers and unvalidated production processes.
Also check traceability, identification, calibration of measuring equipment and handling of customer property.
Start with design controls, process validation and the purchasing guide.
Clause 8 gaps include no complaint handling procedure, no regulatory reporting process, no internal audits, weak nonconforming product control and no CAPA system.
Check feedback collection and post-production information too, because clause 8.2.1 expects it to feed risk management.
The CAPA, complaint handling and internal audit guides cover these.
A self-assessment is cheap and builds ownership, but teams can miss blind spots. A consultant brings experience with how certification bodies interpret the standard.
A hybrid works well: assess yourselves first, then ask an expert to review the results and sample records.
Whoever does it, keep the output as a controlled record so you can show progress later.
Frequent mistakes are scoring on opinion, skipping regulatory requirements, ignoring records and creating a long list with no ranking. Another is treating the result as a score to be proud of instead of a plan.
A third is repeating a generic checklist that does not reflect your scope. An ISO 13485 gap analysis should fit your devices and your role.
Keep the final list short enough that leadership will actually read it.
A gap analysis spreadsheet with clause, requirement, owner, evidence, score and action saves several hours. The ISO 13485 Toolkit includes a readiness checklist and documentation set to use alongside it.
Pair it with the ISO 13485 templates guide to see which documents to build first.
Whatever format you use, store it under document control and version each assessment.
Once the high-risk gaps close, you can plan the audit. The certification timeline shows typical phases and what must be in place before stage 1.
Costs depend on scope, size and certification body, so see ISO 13485 certification cost for the main drivers.
A good gap analysis makes both timeline and budget far more predictable.
Companies rarely start from zero. Existing ISO 9001 procedures, engineering change processes, supplier lists and inspection records often meet part of the requirements already.
Map each existing document to a clause during the assessment. You will usually need to extend rather than replace them, for example by adding risk-based supplier criteria or regulatory reporting steps.
That reuse shortens the project and keeps staff working in familiar ways, which helps adoption.
Summarize the assessment on one page: total requirements, percentage fully evidenced, number of high-risk gaps and the planned closure date.
Add a short list of resource requests, such as a regulatory hire or software validation support. Decisions made here become inputs to the first management review.
Update the same page monthly. Leaders respond better to a trend line than to a long gap list.
A small company can finish a first pass in a few days. Larger scopes take longer, mostly because of evidence sampling.
No, it is not required by the standard, but it is the most efficient way to plan the work.
A person who knows the standard and is not the owner of the processes being assessed, either internal or external.
Once at the start and once shortly before stage 1. After certification, your internal audits take over.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026