ISO 9001 to ISO 13485 Transition: Process Audits, Risk and Shop-Floor Documents
You are a consultant helping a 60-person dental handpiece manufacturer transition from ISO 9001:2015 to ISO 13485:2016. The company has been ISO 9001 certified for 10 years. Gap analysis findings: no risk management procedure; 14 uncontrolled work instructions are posted on the shop floor; internal audits are performed by the quality manager against clause numbers rather than processes; no internal audit covers the outsourced sterilization or cleanroom; management review inputs exclude regulatory requirements and complaints; training records are attendance lists with no competency evaluation; customer complaints are handled by sales and never fed back to production; calibration of test equipment is outsourced but certificates are not reviewed. Top management asks whether the ISO 9001 documentation can simply be 'upgraded' and whether the quality manager can conduct all internal audits alone.
1. What are the key differences between the existing ISO 9001 approach and the ISO 13485 approach that matter most here?
Read the worked answer
ISO 13485 shares a process-based structure with ISO 9001 but is more prescriptive for medical devices. It requires a risk-based approach throughout the QMS (4.1.2), not just risk management for products. It expects validation of processes where output cannot be verified by later monitoring (7.5.6), control of contamination and cleanliness where relevant (7.5.2), traceability (7.5.9), and validation of software used in the QMS (4.1.6). Regulatory requirements must be treated as inputs, including reporting to authorities (8.2.3). The existing clause-based internal audit and sales-owned complaint process do not demonstrate process effectiveness. The documentation can be reused as a starting point, but it needs restructuring around processes, risks and device-specific controls. Simply 'upgrading' the ISO 9001 manual without addressing risk management, validation, traceability, competency and regulatory reporting would not satisfy ISO 13485.
2. Is the internal audit programme adequate? What changes are needed, including the quality manager's role?
Read the worked answer
It is not adequate. Under 8.2.4, internal audits must assess the QMS and its processes for conformity and effectiveness, not just clause numbers. The programme should cover all processes, including outsourced sterilization and the cleanroom, and should use audit criteria based on procedures, risks and applicable requirements. The quality manager cannot conduct all audits alone because auditors must not audit their own work; independence is required. The company needs a competent audit team, possibly cross-functional auditors or a qualified external auditor for areas the quality manager owns. Audit frequency should be risk-based, and findings should feed CAPA and management review. The current clause-based approach may miss process interfaces, such as complaints not feeding production. Create an audit schedule with process owners, checklists, auditor competence records and follow-up. Include the outsourced sterilization process and cleanroom controls in the programme before the certification audit.
3. What should be prioritized for document control and competency before certification?
Read the worked answer
Uncontrolled work instructions on the shop floor are a direct 4.2.5 issue. Prioritize a master document list, approval and review of the 14 work instructions, controlled distribution, and removal of obsolete copies. Determine which documents are needed for effective process control and which are records. For competency under 6.2, replace attendance lists with evidence of qualification: training requirements by role, assessment, authorization to perform tasks, and records. Calibration certificates for outsourced test equipment should be reviewed for traceability, uncertainty and suitability before use, under 7.6. Complaints handled by sales need a procedure that routes them to quality, production and risk management. These priorities connect: controlled instructions define how to work, competency confirms people can follow them, and calibration confirms measurement confidence. Address these before writing new high-level manuals, because the audit will sample shop-floor evidence.