Conducting an ISO 13485 audit
Domain 5 tests execution: how you open an audit, gather and verify evidence, follow trails, and turn what you see into defensible findings.
Opening meeting
Confirm scope, criteria, schedule, sampling approach, confidentiality, how findings will be reported, and access and safety arrangements. Invite the auditee to flag anything that would change the plan.
Collecting evidence
Use audit trails: pick a device serial, a complaint or a CAPA, then trace forward and backward through the QMS. Sample across shifts, lines and time. Combine interview, observation and record review, and corroborate verbal claims with records. Note evidence precisely - document ID, revision, date, person, location.
Writing findings
Each nonconformity needs three elements: the requirement (clause, regulation or procedure), the objective evidence, and a statement of the nonconformity. A major nonconformity is a systemic breakdown or a situation that raises significant doubt about the QMS capability; a minor is an isolated lapse. Where a scheme uses a critical category for regulatory breaches, apply that scheme's definitions.
Worked example
At the packaging line an operator seals pouches with a machine whose validation report covers one pouch size; two other sizes are in routine production with no validation. Evidence: batch records showing all three sizes and the single validation report. Requirement: 7.5.7. The finding is major - the process is not validated for all configurations, and passing finished-product tests does not substitute for process validation.
Traps that cost marks
Writing procedure not followed without citing the procedure identifier and the requirement; accepting undocumented assurances; drifting outside the agreed scope; interviewing only management; recording conclusions instead of the evidence behind them.