PECB ISO 13485 Foundation common mistakes
PECB ISO 13485 Foundation · Understand the traps and how to avoid them.
Treating ISO 13485 as a voluntary 'best practice' framework rather than recognizing it as a certifiable standard whose requirements are auditable and largely mandatory once adopted; answering 'recommended' where the standard says 'shall'.
Candidates transfer intuition from ISO 9001 guidance material or general quality articles that describe clauses as good ideas, and they do not distinguish 'shall' from 'should' or 'may' while reading the text.
What to do instead
Before answering, locate the verb in the clause. Build a mental rule: 'shall' = requirement (auditable, non-negotiable for certification), 'should' = guidance in ISO 13485:2016 (Annex guidance is informative), 'may' = permission. Drill by classifying ten clauses by verb type and noting the consequence for audit findings.
Confusing the scope of ISO 13485 with ISO 9001, for example stating that ISO 13485 requires continual improvement of the QMS effectiveness or that customer satisfaction must be monitored as a QMS objective.
ISO 13485 is built on the ISO 9001 structure, so candidates assume all ISO 9001 requirements carry over unchanged, and they overlook that ISO 13485 emphasizes maintenance of the QMS and regulatory compliance rather than continual improvement of effectiveness.
What to do instead
Memorize three deliberate divergences: ISO 13485 requires 'maintenance' of the QMS and its processes (improvement is expected but the effectiveness-improvement requirement of ISO 9001 is not carried), customer satisfaction is an input/consideration rather than a mandated measured objective, and risk-based approach applies to product realization. Use a two-column comparison table and test yourself on which standard contains each phrase.
Listing ISO 13485 clauses from memory in the wrong order or attributing content to the wrong clause number, e.g. placing 'validation of processes' under clause 7.1 instead of 7.5.6, or mixing up 7.3 design and 7.4 purchasing.
Candidates study by topic (design, purchasing, production) without anchoring each topic to its clause number, and clause numbering is not intuitive because 7.5 has many subclauses.
What to do instead
Build a one-page clause map from 4 to 8 with subclause titles only, then recite it daily until the sequence is automatic. Practice 'clause-to-topic' flashcards in both directions (number to content, content to number), focusing on 6.4, 7.3, 7.4, 7.5.6, 7.5.9, 7.5.11, 8.2.1, 8.2.2, 8.2.3, and 8.5.
Describing the documentation hierarchy as a rigid four-tier pyramid (manual, procedures, work instructions, records) and asserting a quality manual and six mandatory procedures are always required in fixed form.
Older training material and ISO 9001:2008 habits persist, and candidates do not notice that ISO 13485:2016 removed the explicit six-procedure requirement and allows a documented quality manual that may be a set of documents.
What to do instead
State the current position precisely: the organization must document a quality manual (or equivalent set of documents) that includes scope, justification for exclusions, procedures or references, and a description of interaction of processes. Documented procedures are required where the standard specifies them, but format is flexible. Answer questions by what the standard requires, not by pyramid diagrams.
Treating risk management as a one-time design activity rather than a requirement that applies across product realization and is proportionate to the risk of the device, and failing to link risk management to clause 7.1.
Candidates associate risk only with ISO 14971 and design controls, so they miss that ISO 13485 requires a risk-based approach throughout product realization and that risk management records are part of the product file.
What to do instead
Learn clause 7.1 as the anchor: the organization must document risk management activities throughout product realization and maintain records. Then trace how risk outputs feed design inputs, verification/validation, purchasing controls, process validation, and post-market activities. Practice questions that ask 'where in ISO 13485 is risk management required?' and answer with the clause, not just ISO 14971.
Mixing up verification and validation, for example saying design validation confirms outputs meet inputs, or that process validation is done before process verification.
The words are used loosely in everyday engineering language, and candidates memorize definitions without applying them to design and production scenarios.
What to do instead
Fix two crisp definitions: verification = objective evidence that specified requirements have been fulfilled (outputs meet inputs); validation = objective evidence that requirements for a specific intended use are fulfilled (the device or process meets user needs and intended use). For processes, validation (7.5.6) applies where output cannot be verified by subsequent monitoring or measurement. Test yourself with scenario stems and label which activity is described.
Confusing correction, corrective action, and preventive action, or asserting that preventive action is a separate mandatory clause in ISO 13485:2016.
The three terms sound similar, and many candidates learned ISO 9001:2008 where preventive action had its own clause 8.5.3; ISO 13485:2016 addresses risk-based preventive activity differently.
What to do instead
Memorize: correction removes a detected nonconformity (rework, re-grading); corrective action eliminates the cause of a nonconformity to prevent recurrence; preventive action eliminates the cause of a potential nonconformity. Note that ISO 13485:2016 clause 8.5.2 covers corrective action, and preventive action is addressed through risk-based approaches rather than a standalone 8.5.3 requirement. Practice sorting ten scenario statements into the three categories.
Answering questions about nonconforming product by saying it must always be scrapped or that rework is prohibited, instead of describing the required procedure, evaluation, and authorization before acceptance.
Candidates conflate 'nonconforming' with 'unusable' and forget that the standard permits rework or re-grading under controlled conditions with documented authorization and, where applicable, re-verification.
What to do instead
Learn clause 8.3 as a sequence: identify and segregate to prevent unintended use, evaluate and record the nonconformity, determine disposition (correction, rework, concession, scrap), obtain authorization for concession from the relevant authority and, where regulatory requirements require it, the customer, and re-verify after correction. Answer with the process, not with a single disposition.
Describing the internal audit and management review requirements incorrectly, e.g. saying management review must occur monthly, that internal audits must cover every clause every year, or that auditors may audit their own work.
Candidates import practices from their own employer or from ISO 9001 study material and do not check the specific ISO 13485 wording on audit programme planning and reviewer independence.
What to do instead
Anchor on the wording: internal audits at planned intervals to determine whether the QMS conforms and is effectively implemented and maintained, with an audit programme planned taking into account the status and importance of processes and areas, and auditors not auditing their own work. Management review at planned intervals with defined inputs and outputs including assessment of opportunities for improvement and need for changes. Answer 'planned intervals', not fixed frequencies.
Ignoring the regulatory and advisory-communication layer, for example answering that customer complaints alone must be handled, without mentioning notification to regulatory authorities where required, or omitting the requirement to plan post-market surveillance activities.
Candidates focus on classic quality clauses and skip clauses 7.2.3 (communication), 8.2.1 (feedback including complaints), and 8.2.2/8.2.3, treating regulatory reporting as outside the QMS.
What to do instead
Memorize the communication and feedback cluster: 7.2.3 requires communication with regulatory authorities where regulatory requirements require it; 8.2.1 requires feedback as an input to risk management and a documented procedure for early warning of quality problems and complaint handling; 8.2.2 covers regulatory reporting where required; 8.2.3 covers advisory notices. Answer questions on complaints by including notification obligations and linkage to risk management.