ISO 13485 LA common mistakes
ISO 13485 LA · Understand the traps and how to avoid them.
Treating ISO 13485 as a clone of ISO 9001 and answering questions about customer satisfaction, continual improvement of the QMS as a whole, or risk-based thinking from ISO 9001:2015, instead of the device-specific requirements the standard actually states.
Candidates often study ISO 13485 immediately after ISO 9001 and carry over remembered clause structures and philosophies; ISO 13485 is a standalone standard with its own clause order, its own emphasis on regulatory requirements, and explicit statements that it does not require a full ISO 9001-style improvement loop.
What to do instead
Build a clause-by-clause map of ISO 13485:2016 (clauses 4 to 8, plus the 7.3 design controls and 7.5.5 particular requirements) and, for each clause, write one sentence on how it differs from the ISO 9001 equivalent. Practise explaining why 'customer satisfaction monitoring' is not a stated requirement of ISO 13485 while complaint handling and regulatory reporting are.
Confusing the roles of the standard, the regulatory authority, and the auditor: for example, claiming ISO 13485 certification authorises placing a device on the market, or that an auditor must verify compliance with FDA 21 CFR Part 820 rather than the organisation's declared regulatory requirements.
The boundary between voluntary certification and legal market access is a common conceptual gap, and candidates blur 'regulatory requirements' as a clause 4.2.2 input with the auditor's actual scope, which is conformity to ISO 13485 and the organisation's own documented requirements.
What to do instead
Write a one-page distinction sheet: what ISO 13485 requires (a QMS that meets the standard and applicable regulatory requirements the organisation has identified), what the regulator requires (market authorisation, registration, reporting), and what the auditor verifies (objective evidence of conformity to the audit criteria). Test yourself by explaining who can lawfully stop a shipment.
Answering audit-programme questions (clause 8.2.2) by describing audit scheduling, checklists, and sampling as if they were part of an individual audit, rather than the programme-level elements: audit criteria, scope, frequency, methods, auditor competence, selection of auditors, and records of the programme.
The standard separates the audit programme from the audit itself, and candidates who have only performed audits, never managed a programme, collapse the two concepts and lose the programme-level language the exam expects.
What to do instead
Memorise the clause 8.2.2 list of programme considerations and the requirement that auditors not audit their own work. Then practise separating statements: 'the audit was scheduled for March' is programme level; 'the auditor sampled five complaint files' is audit level. Sort twenty such statements into the two categories.
Describing audit evidence as 'looking at documents' and missing that evidence includes interviews, observation of activities and conditions, and records, and that findings must be evaluated against audit criteria before being written up.
Candidates with a documentation-review background default to record checking, and they skip the step of comparing the evidence to the criterion, jumping straight from observation to nonconformity wording.
What to do instead
For each practice scenario, write the evidence source explicitly (interview, observation, record), then write the criterion it is measured against, then the finding. Practise phrasing 'the observation is X; the requirement in procedure Y clause Z is W; therefore the finding is...' until the three-part structure is automatic.
Misclassifying findings: raising a major nonconformity for a single isolated documentation slip, or downgrading a systemic breakdown of a required process (for example, no design validation records for any device) to an observation or minor finding.
Candidates either over-escalate to look rigorous or under-escalate to avoid conflict, and they do not apply a consistent test of whether the QMS requirement is effectively implemented and whether the failure is systemic or isolated.
What to do instead
Adopt and rehearse a written decision rule: does the evidence show the requirement is not implemented at all or the system has failed to ensure device safety or regulatory compliance (major), or is it a single lapse within an otherwise effective process (minor)? Apply the rule to ten short scenarios and defend each classification in two sentences.
Writing nonconformity statements that describe the fix or the cause ('the company should retrain staff on complaint handling') instead of stating the requirement and the objective evidence of the gap.
Auditors who come from operations instinctively offer solutions, and the standard's corrective action process belongs to the auditee; the finding must be a factual statement of nonconformity that the auditee can respond to.
What to do instead
Practise the three-element formula: requirement (standard clause or procedure reference), evidence (what was seen, where, when, how many), and the gap (what was missing). Delete any sentence containing 'should', 'must', 'recommend', or 'because' from your draft findings, then read them back to check they are factual and traceable.
Skipping or superficially covering design controls (clause 7.3), purchasing controls (7.4), and process validation (7.5.6) because they are technical, and focusing preparation on document control and records.
These clauses carry a large share of device-specific risk and exam weight, but they are harder to revise from memory, so candidates gravitate to the easy administrative clauses and arrive underprepared on design inputs and outputs, design transfer, design verification and validation, and supplier evaluation.
What to do instead
Allocate preparation time in proportion to clause risk, not clause familiarity. Write out the design control sequence from 7.3.2 to 7.3.10 with the required records for each step, and the supplier controls in 7.4.1 to 7.4.3 including the criteria for evaluation and re-evaluation. Self-test by naming the record that proves each step happened.
Treating the opening meeting and closing meeting as formalities: listing agenda items without confirming audit scope, criteria, and sampling limitations at the start, or failing to state that findings are based on sampling and to agree follow-up responsibilities at the close.
Candidates memorise meeting agendas as checklists and lose the purpose of each meeting, so they cannot answer questions about what must be communicated, to whom, and what happens if the auditee disagrees with a finding.
What to do instead
Write the purpose of each meeting in one sentence (opening: confirm and agree scope, criteria, plan, and communication; closing: present findings, explain sampling and classification, agree timelines and any appeals route). Rehearse a two-minute opening and a three-minute closing out loud, then check them against the standard and your audit plan.
Planning an audit by copying the previous audit's checklist and scope without a documented review of the organisation's context: its processes, previous findings, complaint and recall history, regulatory changes, and the status and importance of the activities.
Reusing last year's plan is efficient and tempting, but the audit programme requires planning based on the status and importance of the processes and areas to be audited, and the exam tests whether the candidate can justify scope and emphasis.
What to do instead
For every practice case, produce a short planning note before the checklist: inputs reviewed (previous audits, complaints, CAPA trends, regulatory changes, process performance), resulting areas of emphasis, and the sampling rationale. Keep the note to one page and make sure each checklist item traces back to a stated input.
Leaving corrective action follow-up vague: accepting 'we will fix it' at the closing meeting, or failing to verify that the auditee's correction and corrective action were implemented and effective, and to close out the audit record.
Candidates treat the closing meeting as the end of the audit, and they confuse the auditee's corrective action process with the auditor's verification, so they cannot describe what evidence of effectiveness looks like or who owns the closure.
What to do instead
Build a follow-up template: finding reference, agreed correction, agreed corrective action and root cause, responsible person, target date, evidence to be submitted, verification method, and closure decision. For two sample findings, write what evidence would convince you the action was effective, and state clearly that the auditee proposes actions while the auditor verifies and records closure.