Preparation of an ISO 13485 audit
Domain 4 tests whether you can build an audit that is proportionate, risk-based and evidence-driven before you set foot on site.
Setting the frame
Objectives, scope and criteria are fixed before planning. Scope is expressed in terms of sites, processes, product families and clauses. Document review - quality manual, procedures, previous reports, regulatory registrations, recall and complaint history - informs the plan but must not pre-judge findings.
The audit plan
ISO 19011 expects a plan covering objectives, criteria, scope, dates, sites, team roles, time allocation and the sampling approach, agreed with the auditee. For certification, IAF MD 9 governs audit duration and team competence for medical device manufacturers, and initial certification is split into Stage 1 (readiness, documentation, scope, regulatory status) and Stage 2 (implementation and effectiveness).
Competence
The team needs ISO 13485 knowledge, device technology, regulatory knowledge for the markets in scope, risk management understanding and audit skills. Technical experts support the team but do not audit alone. Decide early whether sterilization, software (IEC 62304) or packaging needs a specialist.
Worked example
A 120-person manufacturer of Class IIb infusion pumps sterilizes in-house. Planning: derive audit days from IAF MD 9 effective personnel, add time for sterilization validation and device software, keep Stage 1 focused on readiness, and in Stage 2 weight sampling towards 7.3, 7.5.7, 8.2.2 and 8.5.2. Giving every clause equal minutes would be poor risk-based planning and would under-sample the highest-risk processes.
Traps that cost marks
Turning a checklist into a script; planning only from the quality manual; ignoring limits on remote or hybrid auditing; not agreeing scope and criteria in writing; allocating time without reference to audit-duration rules.