Managing an ISO 13485 audit program
Domain 7 tests whether you can run audits as a managed programme rather than a calendar of events.
What a programme is
Under ISO 19011 clause 5 an audit programme is a set of audits planned for a time frame to meet a specific objective. The programme owner sets objectives, considers risks and opportunities, defines extent, responsibilities, resources and procedures, keeps records, then monitors, reviews and improves the programme. An audit plan is one audit; the programme is its governance.
Certification body obligations
ISO/IEC 17021-1 requires impartiality analysis, competence management, audit time per IAF MD 9, a two-stage initial audit, surveillance at least once each calendar year outside the recertification year, recertification before the three-year cycle expires, and special audits for complaints, significant changes or suspension. Multi-site sampling follows IAF MD 1.
Risk-based scheduling
Shorten intervals after a recall, a significant change (new product family, new site, new sterilization contractor) or rising complaint trends. Record the rationale in the programme review - adapting intervals is the programme working, not a deviation.
Worked example
An implantable hip stem manufacturer has a Class I recall in month 8 of its cycle. The programme owner brings forward the next surveillance, adds a sterilization technical expert, and expands sampling of 8.2.2, 8.2.3 and 7.5.9 traceability. The programme review records why the interval and team composition changed, which is exactly the risk-based approach ISO 19011 expects.
Traps that cost marks
Treating the published schedule as immutable; reusing audit durations that were never recalculated; failing to evidence auditor competence for the specific device technology; having no programme review records; missing impartiality threats arising from consultancy or training work.