ISO 13485 LA cheat sheet

ISO 13485 is a standalone QMS standard for organizations in the medical device lifecycle; it is not a product standard and does not prescribe specific device technology requirements.

The process approach underlies the standard: processes are identified, their sequence and interaction determined, and their effectiveness measured and improved.

Risk-based thinking applies to product realization and to the QMS itself; risk management outputs (ISO 14971) feed design, purchasing, production, and post-market activities.

The standard is built on seven quality management principles, with 'process approach' and 'evidence-based decision making' most directly tested in audit scenarios.

Regulatory requirements take precedence: the organization must identify applicable jurisdictions and incorporate their requirements into the QMS.

Validation and verification are distinct: verification confirms requirements were met at each stage, validation confirms the device meets user needs and intended use.

A 'medical device' under ISO 13485 includes IVDs, software, and accessories; the standard applies to any organization in the lifecycle, including suppliers and service providers.

Documented information replaces the older 'documents and records' terminology; it covers both procedures and retained evidence of results.

Clause 4 covers general QMS requirements, documentation, and the medical device file; the device file is required for each device or device family.

Clause 5 covers management responsibility: quality policy, management review inputs/outputs, and management representative responsibilities.

Clause 6 covers resource management: infrastructure, work environment, contamination control, and competence/training evidence.

Clause 7 covers product realization: planning, customer-related processes, design, purchasing, production, and monitoring/measuring equipment control.

Clause 8 covers measurement, analysis, and improvement: internal audit, nonconforming product, CAPA, and data analysis.

Management review inputs include audit results, feedback, complaints, CAPA status, and regulatory actions; outputs must include actions to improve and resource needs.

Design and development controls require design inputs, outputs, review, verification, validation, and transfer; records must show traceability from inputs to outputs.

Purchasing controls require supplier evaluation and selection criteria, monitoring of supplier performance, and verification of purchased product.

ISO 19011 defines audit principles: integrity, fair presentation, due professional care, confidentiality, independence, and an evidence-based approach.

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it against audit criteria.

Audit types include internal (first party), supplier (second party), and certification/surveillance (third party); the criteria and scope differ for each.

Objective evidence includes records, statements of fact, observations, and test results; it must be verifiable, not merely an auditor's opinion.

An audit finding is classified as major, minor, or observation; a major nonconformity indicates a systemic failure or absence of a required control.

Sampling is inherent in auditing; the auditor must document the sampling rationale and recognize that absence of a finding is not proof of conformity.

Auditor competence includes education, training, experience, and personal attributes; competence must be maintained and evaluated.

Audit independence means auditors must not audit their own work; for internal audits, this requires separation of functions.

Audit planning starts with the audit objectives, scope, criteria, and the auditee's context, including prior audit history and regulatory status.

Document review before the audit includes the quality manual, procedures, device files, and previous audit reports and CAPA records.

The audit plan should address process sequence, allocation of auditor time, and interfaces between processes; it must be communicated to the auditee.

Checklists should be derived from the audit criteria (ISO 13485 clauses, applicable regulations, and the organization's own procedures), not copied from a template without tailoring.

The opening meeting confirms scope, criteria, schedule, and communication channels, and gives the auditee an opportunity to ask questions.

Sampling strategy should consider process criticality, risk, volume, and prior nonconformities; document which records were sampled.

Audit team selection must consider competence in the relevant device technology, manufacturing process, and regulatory requirements.

Preparation includes identifying applicable regulatory requirements (e.g., FDA 21 CFR 820, EU MDR) in addition to ISO 13485 clauses.

Evidence gathering uses interviews, observation of activities, and review of documented information; triangulate across sources to confirm findings.

Auditors should follow the process trail: from design inputs through production, inspection, and post-market feedback, verifying traceability at each step.

Nonconformity statements must include the requirement, the objective evidence, and the specific location or record; avoid vague or opinion-based language.

Auditors should verify effectiveness of corrective actions from prior audits, not merely their closure status.

Interview technique: ask open questions, follow up with probing questions, and avoid leading questions that suggest the expected answer.

Observation of the work environment includes contamination control, equipment calibration status, and identification/status of product.

When a nonconformity is identified, the auditor should confirm the facts with the auditee before recording it to ensure accuracy.

Audit time management: keep to the plan but allow flexibility to pursue significant findings; document deviations from the plan.

The closing meeting presents findings, conclusions, and recommendations; the auditee should acknowledge the findings and agree on corrective action timelines.

The audit report must include scope, criteria, findings, conclusions on conformity, and any areas of concern or opportunities for improvement.

Nonconformity reports should be issued promptly and require the auditee to perform root cause analysis and define corrective actions.

Corrective action verification may be performed through document review or a follow-up audit, depending on the severity of the finding.

The audit is not closed until corrective actions are verified as effective; closure should be documented with objective evidence.

Confidentiality obligations continue after the audit; the report should be distributed only to authorized parties.

Findings should be classified consistently; a major nonconformity may require a follow-up audit within a defined timeframe.

The audit report should record any limitations encountered (e.g., unavailable records, restricted access) that affect conclusions.

An audit program is a set of one or more audits planned for a specific timeframe and purpose; it is managed by a program manager with defined authority.

Program planning considers risk, audit frequency, scope, and resource allocation; high-risk processes warrant more frequent audits.

ISO 19011 provides guidance on managing audit programs, including establishing objectives, implementing, monitoring, and reviewing the program.

The program should cover all QMS processes and clauses over a defined cycle (typically a multi-year cycle), with internal audits at planned intervals.

Program performance should be monitored through metrics such as audit completion rate, nonconformity trends, and corrective action effectiveness.

Auditor competence records must be maintained, including training, qualifications, and audit experience.

The program must ensure auditor independence and rotation to avoid familiarity bias.

Program review should consider changes in the organization, regulatory requirements, and prior audit results to adjust the plan.