ISO 13485 Requirements: Audit Evidence, Common Gaps and Implementation Guide
1000+
Successful Projects
10+ Years
Industry Experience
Worldwide
Certification Services
24/7 Support
Expert Consultation
For medical device businesses, the difficult part of ISO 13485 is rarely knowing that procedures and records are needed. The real work is making sure the quality management system reflects how the business operates, controls risk, meets applicable requirements and produces reliable evidence when a customer or auditor asks for it.
The medical device industry is one of the most highly regulated sectors in the world. Whether you manufacture surgical instruments, diagnostic equipment, implants, medical software or sterile products, maintaining consistent quality is essential. Even small quality issues can affect patient safety, lead to product recalls and damage a company’s reputation.
This guide focuses on practical questions that quality, regulatory, operations and supplier-management teams need to resolve: what evidence may support an audit, where common gaps appear, and how to check whether controls work in practice. Examples are illustrative, not a universal list of mandatory documents. Confirm requirements against the current standard, your activities and the regulations that apply to your products and markets.
Table of Contents
ISO 13485 Clauses 4–8: Requirements, Audit Evidence and Common Gaps
Clause | Main requirement | Examples of evidence an auditor may sample | Common gap to check |
4 Quality management system | Define and control QMS processes, their interactions, documentation and relevant outsourced activities. | QMS scope; process map; quality manual where used; procedures; medical device files; document approvals; retained records; outsourced-process controls. | Procedures do not match day-to-day practice, or responsibilities for outsourced processes are unclear. |
5 Management responsibility | Set quality policy and objectives, assign responsibilities, provide resources and review QMS performance. | Quality policy; measurable objectives; role and authority records; management-review inputs, decisions and actions. | Review meetings identify issues but do not assign owners, deadlines or follow-up checks. |
6 Resource management | Provide competent people, suitable infrastructure and a work environment appropriate to the work. | Competence criteria; training and effectiveness records; maintenance logs; environmental or contamination controls where relevant. | Training attendance is recorded, but competence to perform the task is not evaluated. |
7 Product realization | Plan and control applicable design, purchasing, production, servicing, identification, traceability and acceptance activities. | Product requirements; risk-management records; supplier evaluations; design files; validation reports; production and inspection records; release evidence. | Records do not demonstrate that product requirements were met or that required approvals took place. |
8 Measurement, analysis and improvement | Monitor performance, review feedback, control nonconformities, analyze data and take effective corrective action. | Complaints; internal audit reports; nonconformity records; data analysis; CAPA investigations; implementation and effectiveness checks. | Actions are closed without evidence that the cause was addressed or the problem did not recur. |
Trending Posts
Get Free Consultation
Our Clients
Projects
Our Happy Clients
⭐⭐⭐⭐⭐
“PopularCert made our ISO certification process smooth and professional.”
— Manufacturing Client, Oman
⭐⭐⭐⭐⭐
“Excellent support and documentation guidance.”
— Healthcare Client, Saudi Arabia
⭐⭐⭐⭐⭐
“PopularCert simplified our ISO certification process with professional guidance and fast support.”
— Manufacturing Client, Saudi Arabia
The summaries reflect the standard’s structure and the process-based evidence examined in the Medical Device Single Audit Program audit approach
Clause 4: Make the QMS Match Actual Work
Clause 4 establishes the structure of the QMS. The documented system should describe the processes the organization actually uses, how those processes interact, and how their outputs are controlled. Outsourced activities that can affect product conformity still need appropriate controls.
Questions to ask during a gap assessment
- Does the QMS scope accurately describe the sites, activities and product-related services covered?
- Can employees find the current approved version of a procedure at the point of use?
- Can the team retrieve complete records showing that required work was done and reviewed?
- Are outsourced processes, responsibilities, acceptance criteria and change notifications defined?
- Where software is used in the QMS, has its application been validated for the intended use when required?
Practical check
Select one completed activity. Start with the approved procedure, then trace the work through the actual record, review or approval, and final result. Record any mismatch between the documented process and what staff really do. A document update alone may not fix a process that is poorly understood or difficult to follow.3
Clause 5: Turn Management Review into Decisions and Follow-up
Management review should show that leadership has evaluated QMS performance and made decisions about actions, resources and improvement. A meeting record by itself is weak evidence if unresolved issues disappear from the agenda or actions are never checked.
Questions to ask
- Are quality objectives measurable and reviewed at planned intervals?
- Does each action have a named owner and due date?
- Are overdue actions, recurring issues and negative trends brought back for review?
- Are resource needs and changes that may affect the QMS considered?
- Can the organization show whether completed actions achieved the intended result?
Practical check
Choose one action from the previous management review. Follow it from the original issue to the assigned owner, completion evidence and outcome. If the action was marked complete, check whether the result was measured rather than assumed.
Clause 6: Verify Competence, Not Just Training Attendance
Training records can show that a person attended a session, but they do not always show that the person can perform a quality-critical task correctly. Competence criteria and evaluation methods should reflect the role and the effect the work may have on product quality.
Questions to ask
- Are competence requirements defined for roles that affect product quality or regulatory compliance?
- How is training effectiveness checked—for example, through observation, a task demonstration or review of work?
- Are equipment maintenance and calibration activities planned and recorded where applicable?
- Are environmental, cleanliness or contamination controls appropriate to the work being performed?
Practical check
Choose a quality-critical task and compare its competence requirements with the evidence for the person performing it. Where a gap exists, define the support or reassessment needed and keep evidence of the result.
Clause 7: Control Product Realization from Requirements to Release
Clause 7 covers the processes used to deliver products that meet specified requirements. Depending on the organization’s activities, this can include customer and regulatory requirements, design and development, purchasing, production, servicing, identification, traceability, preservation, and monitoring and measuring equipment. Risk management should inform planning and controls across relevant stages.
Questions to ask
- Are product and customer requirements reviewed before work is accepted or started?
- Are supplier controls proportionate to the risk of the purchased product or service?
- Are design activities and changes reviewed, verified or validated as applicable?
- Are processes that cannot be fully verified by later inspection identified and validated when required?
- Can acceptance and release decisions be traced to defined criteria and authorized personnel?
- Are identification, traceability, storage and preservation controls appropriate to the product?
Practical check
Trace one product, batch or order from the applicable requirements through purchasing, production, inspection and release. Look for missing approvals, unclear acceptance criteria, incomplete traceability or records created after the fact.
Design Controls: The Evidence Chain Auditors Follow
For organizations responsible for design and development, the important question is whether each stage links logically to the next. The exact records depend on the product and design process, but the rationale and decisions should be clear.
Design Stage | Key Evidence | Common Gap |
Inputs | Safety, performance and regulatory requirements | Unclear requirements |
Outputs | Specifications, drawings and acceptance criteria | Missing requirements |
Design Reviews | Review records and action items | Unresolved actions |
Verification | Test plans and results | Missing test evidence |
Validation | Reports confirming user needs are met | Tests do not reflect intended use |
Design Transfer | Production specifications and transfer records | Incomplete transfer records |
Design Changes | Change assessments and approvals | Risks not assessed |
Design File | Complete design records | Missing or outdated records |
Free ISO 13485 Checklist
Assess compliance, reduce risks, and strengthen your medical device quality practices.
- Practical & Audit-Ready
- Save Time & Effort
- No Registration Required
Nonconforming Product: Common Traps to Avoid
- Repeated “use as is” decisions: repeated concessions may point to a deeper problem with requirements, process capability or controls. Review the pattern rather than treating every case in isolation.
- Uncontrolled rework: use approved instructions where required, assess potential adverse effects, and retain evidence of re-verification or revalidation as applicable.
- Unclear concession authority: document the decision, its justification and the authorized approver. Assess whether customer or regulatory notification is required.
- Weak segregation or status identification: make sure nonconforming product cannot be mistakenly used or released.
- Closure without learning: review trends to determine whether the issue requires corrective action beyond the individual product or batch.
Supplier Control: Set the Level of Control by Risk
Supplier controls should reflect the effect a supplied product or service may have on product conformity. A tiered approach can help teams apply controls consistently, provided the organization documents its rationale and reviews supplier performance.
Illustrative risk tier | Examples | Possible controls |
High | Contract manufacturer, sterilization provider, critical component supplier. | Qualification and audit or equivalent evidence; quality agreement; change notification; risk-based incoming checks; scheduled performance review; supplier corrective action when needed. |
Medium | Standard components or calibration services where failures could affect product or measurement results. | Questionnaire or certificate review; defined specifications; sample checks; review of performance and nonconformities. |
Low | Non-critical commodities with limited effect on product conformity. | Approved supplier listing, receiving checks where appropriate, and review when complaints or issues arise. |
These tiers are an example, not a requirement prescribed by ISO 13485. Define the criteria used to assign risk and reassess the supplier when performance, product risk or the scope of supply changes.
Paper Records, Spreadsheets or eQMS: What Matters in an Audit?
ISO 13485 does not require every organization to buy an electronic quality management system. The organization must control its documented information and validate applicable software used in the QMS for its intended use, as required by the standard. The tool should fit the process and the level of risk.
- Paper, Word, Excel or Shared Drive
- Controls to consider: Document approval, version control, access permissions, record protection, backups and easy retrieval.
- Common weakness: Multiple uncontrolled versions, spreadsheet formulas changed without review, or unclear records of who made changes.
- Configurable General-Purpose System
- Controls to consider: Configure the system to match procedures, validate it based on risk and intended use, control access, and assess changes after updates.
- Common weakness: The initial setup is validated, but later changes are not assessed.
- Purpose-Built Electronic Quality Management System (eQMS)
- Controls to consider: Review supplier information, validate the system for its intended use, control configurations and manage the vendor appropriately.
- Common weakness: Assuming the vendor’s validation automatically proves the system is suitable for your organization’s needs.
ISO 13485 and Regulatory Requirements: Keep Them Separate
Certification to ISO 13485 can support a quality management system, but it does not by itself prove that every product or organization meets all legal requirements in every market. Regulatory obligations depend on the product, role in the supply chain and destination market.
Market or framework | How ISO 13485 may help | What it does not replace |
United States | Provides a QMS framework aligned with ISO 13485:2016, which is incorporated by reference in FDA’s Quality Management System Regulation (QMSR). | Applicable FDA registration/listing, premarket requirements, FDA-specific provisions and inspection readiness. FDA does not require an ISO 13485 certificate. |
European Union | Can support QMS arrangements relevant to the Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR). | Applicable notified body assessment, technical documentation, clinical/performance evidence, post-market obligations and other legal requirements. |
MDSAP participating markets | An MDSAP audit can be used by participating regulators under the programme’s rules. | Each market’s applicable licensing, product authorization and legal obligations. |
India and other markets | May support customer, tender or supply-chain expectations for a controlled QMS. | National registration, licensing and other requirements. In India, confirm the applicable requirements with CDSCO and relevant rules. |
A Practical ISO 13485 Audit-Readiness Roadmap
Stage 1: Gap Assessment
- Confirm the QMS scope, sites, product families, target markets and outsourced activities.
- Review existing records against applicable ISO 13485 requirements.
- Evidence of readiness: Documented gaps with assigned owners, priorities, corrective actions and target dates.
- Who is involved: Quality and regulatory teams; a consultant, if needed.
Stage 2: QMS Documentation
- Update procedures, process responsibilities, medical device file structures, and document and record controls to reflect actual operations.
- Ensure employees can access and understand approved documents.
- Evidence of readiness: Approved, accessible documentation that reflects actual working practices.
- Who is involved: Process owners and the quality team.
Stage 3: Implementation
- Put documented procedures into practice, train personnel and generate records through routine operations.
- Verify that required controls operate consistently.
- Evidence of readiness: Records demonstrating that key QMS processes are implemented and operating effectively.
- Who is involved: Relevant departments, employees and managers.
Stage 4: Internal Audit and Management Review
- Audit QMS implementation, address identified findings and review quality performance.
- Track corrective actions and management decisions through completion.
- Evidence of readiness: Documented audit findings, corrective-action evidence, management-review decisions and follow-up records.
- Who is involved: Competent internal auditors, process owners and top management.
Stage 5: Certification Audit
- Agree on the audit scope and schedule with an independent certification body.
- Prepare for Stage 1, which generally reviews readiness and documented arrangements, and Stage 2, which evaluates implementation and effectiveness.
- Evidence of readiness: Relevant QMS records, audit evidence and responses to findings within the certification body’s timelines.
- Who is involved: The organization’s quality team, relevant process owners and the independent certification body.
How PopularCert Can Support Your ISO 13485 Project
PopularCert supports businesses that need help assessing their current QMS, planning implementation and preparing for certification. Depending on your requirements, support may include gap assessment, QMS documentation, implementation guidance, staff training, internal audit support and certification-audit preparation.
The right starting point is to understand your organization’s activities, sites, product scope, markets, current controls and main gaps. This helps create a practical work plan based on what is already in place rather than starting from generic templates.
Need Help Assessing Your ISO 13485 Gaps?
Discuss your scope, current QMS and audit-readiness priorities with our team. We can help you identify the work that needs attention and plan suitable next steps.
Request quotes on the same scope, and separate certification body fees from consulting, training, validation, calibration and internal staff costs. Use our free cost calculator as a starting point and confirm assumptions with providers. Employee count alone rarely predicts true cost. Contact PopularCert
FAQ
Does every organization need the same ISO 13485 documents?
No. Documentation depends on the standard’s requirements, applicable regulations, the organization’s activities and the complexity of its processes. Use examples as prompts for assessment, not as a universal list.
Can an organization decide that a requirement is not applicable?
Non-applicability must be assessed against the standard’s provisions and justified for the organization’s activities. It should not be used simply to avoid a difficult requirement. Confirm the relevant provisions in the current standard before making the decision.
What is the difference between a document and a record?
A document explains or defines what should be done, such as a procedure or work instruction. A record provides evidence of what was done or what result was obtained. Both need suitable controls.
Does outsourcing remove the organization’s responsibility?
No. Processes affecting product conformity need appropriate control even when an external provider performs them. Define responsibilities, criteria, monitoring and change communication based on the risk and nature of the outsourced activity.
Why should I hire an ISO 13485 consultant?
A consultant simplifies implementation, ensures compliance and helps achieve certification faster with fewer challenges.
- Join 1000+ Certified Companies
Ready to Get Certified for Your Next Project?
- Free Consultation
- Expert Guidance
- Fast Turnaround
Reach Us Now