ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The ISO 13485 stage 1 audit is the first part of certification, where the auditor reviews your documented system, confirms you are ready and plans the stage 2 audit. It is a readiness check, and most delays in certification trace back to weak preparation here.
This guide explains what the stage 1 audit covers, offers a ten-point readiness checklist, lists common findings and shows how to move on to stage 2. It follows the same process described in the certification timeline.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
Certification bodies audit management systems in stages. Stage 1 reviews documentation and readiness. Stage 2 assesses implementation and effectiveness. After a positive decision, the certificate usually runs on a three-year cycle with surveillance audits in between.
This structure follows the requirements for certification bodies in ISO/IEC 17021-1. Your chosen body will explain its own rules and schedule.
The standard you are audited against is ISO 13485:2016, available at the ISO 13485:2016 page on iso.org.
The auditor reviews your documentation against the standard, confirms scope, checks that you understand the requirements and evaluates site conditions. They also decide whether you are ready for stage 2 and plan the audit.
The audit may be on site or partly remote, depending on the certification body and your scope. Findings are reported as areas of concern that must be resolved before stage 2.
Treat it as a practice run with a real examiner. It is the cheapest time to find gaps.
Expect a review of the quality manual, scope and exclusions, quality policy and objectives, procedures for each required process and a sample of records. The auditor also looks at the regulatory role you declared.
They will check whether an internal audit cycle and a management review have been performed, since both are required system outputs.
Be ready to explain your processes and show how they connect, using your process map. Keep this in mind for every ISO 13485 stage 1 audit.
Use this list before booking the audit: a defined scope and regulatory role; an approved quality manual; a quality policy and measurable objectives; core procedures approved and in use; a completed internal audit; a management review held; training records; a supplier evaluation process; a design file for a current project; and a complaint and CAPA process.
Check each item for evidence, not just a document. An approved procedure with no records suggests the process has not run.
Our gap analysis guide shows how to score these items.
Prepare a document list with numbers and revisions, a process map, the quality manual, procedures, an organization chart with responsibilities and a list of devices and sites in scope.
Add a list of regulatory requirements that apply, such as the FDA Quality Management System Regulation, effective 2 February 2026, and EU MDR obligations.
See the quality manual guide and mandatory documents guide for details. This is where a ISO 13485 stage 1 audit is won or lost.
Collect examples: training records, supplier evaluations, a design review, a validation report, an internal audit report with closed actions, management review minutes, calibration records and a CAPA.
Choose records from different processes. A broad sample shows the system is real rather than built for the audit.
If a process has not produced records yet, say so and explain the plan. Honesty is better than inventing records.
| Stage 1 focus | What the auditor checks | Evidence to show |
|---|---|---|
| Scope | Devices, sites, role, exclusions | Quality manual, justification |
| Documented system | Procedures cover required processes | Document list, procedures |
| Internal audit | Cycle performed, actions tracked | Reports, action log |
| Management review | Required inputs and outputs | Minutes, data pack |
| Readiness for stage 2 | Records show system running | Sample records across processes |
Most certification bodies expect at least one internal audit cycle and a management review before stage 2, and many want evidence at stage 1. Check your body’s rule early.
Run the internal audit on every process in scope and hold the management review with real data and actions.
Closing the findings before the auditor arrives shows the system corrects itself. Auditors judge your ISO 13485 stage 1 audit on exactly this point.
Plan the agenda with the auditor. Typically it includes an opening meeting, document review, interviews with management and process owners, a short facility tour and a closing meeting.
Nominate a guide who knows where records are. Keep answers short, factual and backed by evidence.
Take notes on every question and comment. They feed your preparation for stage 2.
Typical areas of concern are an unclear scope, exclusions without justification, missing records, no internal audit, no management review and procedures that do not match practice.
Others include unapproved suppliers, no complaint procedure and design controls that exist only on paper. The auditor will state them as items to fix.
Fix them in the order of risk and track each in a short action list. Treat it as a standing rule for your ISO 13485 stage 1 audit.
Booking too early, treating documents as the whole system, skipping the internal audit and ignoring regulatory requirements are the top four. Another is failing to brief staff, who then contradict the documents in interviews.
A good ISO 13485 stage 1 audit outcome comes from steady preparation over several months, not a last-minute rush.
Brief every interviewee on their processes and where their records live.
Certification bodies set limits for the gap between stages, and many expect stage 2 within a few months. Confirm the rule with yours.
Use the time to close concerns, run a second mini-audit and gather more records. Do not stretch the gap, because findings can become outdated.
If major changes happen, tell the body, as they may affect the plan.
Pick a body accredited for medical devices under a recognized accreditation arrangement. Check that it covers your device types and, if needed, MDSAP or EU notified body activities.
Ask about audit duration, report timing, treatment of nonconformities and surveillance schedule. Request quotes from at least two.
See ISO 13485 certification cost for the factors that drive price.
Run short interview rehearsals. Ask process owners the questions an auditor would ask, such as how a complaint flows and where the validation records are.
People do not need to recite the standard. They need to describe what they do and show the evidence.
Keep competence records up to date, since the auditor may ask for them. The training and competence guide explains what to keep.
Many certification bodies conduct part of stage 1 remotely, reviewing documents via screen share and then visiting on site for stage 2. Confirm what your body allows.
Prepare a clean electronic folder structure, test your connection and make sure the right people are available for interviews.
A tidy electronic index of documents and records makes remote review smoother and faster.
You receive a report listing findings and the plan for stage 2. Respond to each item with evidence of closure where possible.
Use the quiet period to run another internal check on high-risk areas such as design controls and process validation.
Confirm dates, audit team and scope with the certification body.
A readiness checklist, document list, interview guide and action tracker keep preparation organized. The ISO 13485 Toolkit includes templates to help you assemble the system and evidence.
Link your preparation to the implementation guide so tasks follow a clear order.
If certification is still a decision, read is ISO 13485 worth it.
Whatever the outcome, treat the audit as feedback on the system. Findings show where your documents and your practice differ, which is the information you need to improve.
Add the findings to your management review inputs. They show leadership how ready the company is.
A calm, factual response to every point builds trust with the audit team for the later stages.
Eight weeks before the audit, finish the gap analysis and fix the high-risk items. Six weeks before, complete the internal audit and close actions. Four weeks before, hold the management review.
Two weeks before, assemble the document list and sample records and rehearse interviews. In the final week, check that every approved document is the current revision.
This schedule is a guide, not a rule, but it shows that preparation is a sequence of small checks rather than a single event.
It depends on scope, company size and the certification body’s calculation. Small companies often need a short visit, but ask for the planned audit days in your quote.
Rarely. Most certification bodies keep them separate so you have time to fix concerns. Ask your body about its policy.
You fix them and provide evidence before stage 2 proceeds, and the body may adjust the date.
Many certification bodies expect it before stage 2 and some want evidence at stage 1, so complete it early.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026