ISO 13485 LI common mistakes
ISO 13485 LI · Understand the traps and how to avoid them.
Answering questions about ISO 13485 clause requirements from memory of ISO 9001, assuming clauses such as 'customer property', 'preventive action' or 'management representative' work the same way, instead of recalling the 13485-specific text.
Most candidates study ISO 9001 first or work in a 9001-certified organisation, so the 9001 structure (Annex SL, 10 clauses, risk-based thinking, no requirement for a management representative) feels familiar and gets substituted for the 13485 structure (8 clauses, explicit management representative, no separate preventive action clause, prescriptive documentation requirements).
What to do instead
Build a side-by-side comparison table of the clauses where the two standards diverge (4.1.1, 5.5.2, 6.4.1, 7.3, 8.2.1, 8.5.2, 8.5.3) and drill the 13485 wording specifically. When a question feels 'obvious', check whether the obvious answer is the 9001 answer.
Treating the standard's documentation requirements as a generic 'documented information' concept and failing to distinguish quality manual, documented procedure, medical device file, record and 'documented requirement' as separate, clause-specific obligations.
Candidates who learned the 2015-era 'documented information' terminology collapse all document types into one bucket and then cannot answer questions about which specific documents ISO 13485 mandates (quality manual per 4.2.2, procedures per 4.2.4, medical device file per 4.2.3) or which records must be retained and for how long (4.2.5).
What to do instead
Memorise the short list of explicitly required documented procedures (4.2.4 a–d plus the clauses that call for a documented procedure, e.g. 7.3.10, 7.4.1, 7.5.1, 8.2.1, 8.2.2, 8.2.3, 8.3, 8.5.2, 8.5.3) and the record-retention rule in 4.2.5 tied to the device lifetime and regulatory requirements.
Confusing risk management (product risk, ISO 14971, clause 7.1) with risk-based approach to the QMS (clause 4.1.2 b) and with the risk-based decisions required in specific clauses such as 7.1, 7.3.3, 7.5.6 and 8.2.1.
The word 'risk' appears in several places and candidates map it to whichever clause they studied most recently, usually 7.1. They then miss questions that ask where the QMS itself must apply a risk-based approach or where risk management outputs must be an input to design and process decisions.
What to do instead
Create a map of every clause that mentions risk: 4.1.2 b (QMS processes), 7.1 (risk management throughout product realisation, with proportionate controls), 7.3.3 (design inputs include risk management outputs), 7.5.6 (process validation based on risk), 8.2.1 (feedback includes risk-based input). Learn what each one actually requires, not just that 'risk is involved'.
Answering planning questions with a generic project plan (Gantt chart, training schedule) and omitting the ISO 13485-specific planning elements: scope definition with exclusions and justification (1, 4.2.2), process identification and interaction, regulatory requirements per market, resource and infrastructure needs, and the sequence of document development.
Candidates with project-management backgrounds default to scheduling language, and candidates with quality backgrounds default to document writing. Neither addresses the standard's requirement that the QMS be planned as an integrated system of processes with defined sequence and interaction, and that the quality manual justify any non-applicable clause.
What to do instead
Structure planning answers around four explicit deliverables: scope and justified exclusions, process map with sequence and interaction, regulatory and applicable-requirement register, and a documentation/implementation roadmap showing what must exist before what. Use the clause 4.1 process approach as the backbone of any planning answer.
Describing implementation as 'write the SOPs and train people' and failing to address the prerequisites that ISO 13485 implementation actually depends on: top management commitment and quality policy/objectives, management representative appointment, infrastructure and work environment, competence and training records, and the medical device file for each device family.
Documentation is visible and easy to talk about, while the organisational prerequisites feel abstract. Candidates therefore produce answers that would pass a documentation review but fail an implementation review, and they lose marks on questions about sequence and dependency.
What to do instead
For any implementation question, run through the clause sequence 4 → 5 → 6 → 7 → 8 and name at least one concrete output per clause: quality manual and process map (4), quality policy and management representative (5), competence records and infrastructure qualification (6), device files and design/process records (7), and measurement and feedback mechanisms (8).
Mixing up the measurement, analysis and improvement clauses: treating internal audit (8.2.2), process monitoring and measurement (8.2.3), product monitoring and measurement (8.2.4/8.2.5), feedback (8.2.1) and complaint handling (8.2.2 in the 2016 numbering) as interchangeable 'monitoring' activities.
All of these live in clause 8.2 and all involve 'checking', so candidates answer with whichever one they remember. The distinguishing details - who performs the audit, what must be recorded, what triggers a CAPA, what counts as a complaint - are exactly what the exam tests.
What to do instead
For each clause, memorise three things: the object being measured (process, product, system, customer perception), the required record or output, and the trigger for escalation to corrective action. Build a one-page table and test yourself by covering the columns.
Choosing 'retrain the operator' or 'revise the procedure' as the corrective action in scenario questions without first establishing containment, root cause analysis and an evaluation of the need for action to eliminate the cause.
Training and documentation changes are the most common real-world responses, so they feel correct. But ISO 13485 clause 8.5.2 requires reviewing nonconformity, determining causes, evaluating the need for action, implementing it, recording results and reviewing effectiveness; a training action without a demonstrated root cause is a guess, and exam scenarios are designed to reward the sequence.
What to do instead
Answer CAPA questions by explicitly walking the 8.5.2 a–f sequence, and separate correction/containment (8.3) from corrective action (8.5.2). If an option jumps straight to a solution, it is usually wrong; prefer the option that establishes cause first.
Confusing nonconformity control (8.3) with complaint handling and advisory notices (8.2.2/8.2.3), and failing to state that nonconforming product must be identified and segregated, evaluated, dispositioned by authorised personnel, and that records of the nature of the nonconformity and subsequent actions must be maintained.
Both involve 'something went wrong with a device', and candidates conflate the internal quality event with the post-market regulatory event. They then miss questions about concession/authorisation, rework (which must follow a documented procedure with re-verification), and the requirement to notify regulatory authorities where applicable.
What to do instead
Learn 8.3 as a five-step flow (identify and segregate → evaluate → disposition including concession and rework → re-verify → record) and learn 8.2.2/8.2.3 as the post-market flow (receive, evaluate, investigate, determine reportability, feed into risk management and CAPA). Keep the two flows visually separate in your notes.
Approaching continual improvement as 'do a CAPA' and ignoring the improvement inputs the standard actually names: quality policy and objectives, audit results, data analysis, corrective and preventive action, management review, and the use of feedback and post-market surveillance data to update risk management.
Improvement is often taught as a synonym for corrective action, so candidates never learn the clause 8.5.1 requirement to identify and implement changes needed to ensure and maintain the continuing suitability, adequacy and effectiveness of the QMS, nor the link back to 4.1 and 7.1.
What to do instead
Frame improvement answers as a loop: data sources (8.2, 8.4) → management review (5.6) → decisions and actions → changes to the QMS and to risk management files → verification of effectiveness. Name at least two distinct input sources and the feedback path into risk management in every improvement answer.
Preparing for the certification audit by memorising audit-trail questions and forgetting the pre-audit mechanics: defining certification scope and sites, the role of the notified body versus a certification body, the two-stage audit, the requirement for an internal audit and management review before stage 2, and how nonconformities are graded and closed.
Candidates focus on what auditors ask in the room and skip the process around the audit, so they cannot answer questions about stage 1 versus stage 2 objectives, surveillance and recertification cycles, or the difference between a major and minor nonconformity and the corrective action evidence required to close them.
What to do instead
Learn the audit lifecycle as a timeline: application and contract → stage 1 (readiness, documentation, scope) → stage 2 (implementation effectiveness) → certification decision → surveillance audits → recertification. For each stage, know the objective, the typical evidence and the possible outcomes, and know that internal audit (8.2.2) and management review (5.6) must be complete and evidenced before stage 2.