How to prepare for an ISO 13485 audit
ISO 13485:2016 · Audit types, common findings and preparation strategy
Quick answer
Know your QMS scope thoroughly, have all records readily accessible, brief every staff member on their responsibilities, and conduct a mock audit 4–6 weeks before the real one. The most effective preparation is running your QMS correctly day-to-day — a last-minute document sprint rarely fools an experienced auditor.
Audit types
| Audit type | When | Focus | Duration |
|---|---|---|---|
| Stage 1 (document review) | Initial certification — typically off-site | QMS documentation, scope, readiness for stage 2 | 0.5–1 day |
| Stage 2 (on-site audit) | Initial certification — on-site | Full QMS implementation, records, process walk-throughs, interviews | 2–5 days depending on size |
| Surveillance audit | Annual (MDSAP: typically year 2 and 3) | Continued compliance, CAPA on previous findings, selected clauses | 1–2 days |
| Recertification audit | Every 3 years | Full QMS re-assessment — similar scope to stage 2 | 2–4 days |
The MDSAP audit model
The Medical Device Single Audit Programme (MDSAP) uses a structured audit approach covering five processes: Management, Measurement, Analysis & Improvement; Design & Development; Production & Service Controls; Purchasing; and Device Marketing Authorisation & Facility Registration. A full MDSAP initial audit typically runs 5 days on-site. MDSAP certificates are accepted by Australia, Brazil, Canada, Japan, and the USA (as an alternative to 21 CFR 820 audits), making the investment in a single thorough audit worthwhile for internationally-active manufacturers.
What auditors review
During a stage 2 or recertification audit, expect auditors to examine:
- QMS documentation — quality manual, procedures, work instructions (completeness and currency)
- Records — batch records, calibration logs, training records, CAPA files, complaint records
- Process walk-throughs — physically observing production, testing, or inspection activities
- Staff interviews — asking operators, engineers, and managers about their responsibilities
- The medical device file for one or more products
- Management review minutes from the past 12 months
- Internal audit programme and recent audit reports
Top 10 most common nonconformities
| Clause | Typical finding | Prevention |
|---|---|---|
| 8.5.2 CAPA | Root cause analysis insufficient; effectiveness not verified | Use structured RCA; define measurable effectiveness criteria upfront |
| 4.2.4 Document control | Obsolete documents at point of use; approval missing | EDMS with access control; periodic document review schedule |
| 7.3 Design controls | Incomplete DHF; validation not completed before release | DHF checklist; phase gate reviews against DHF completeness |
| 6.2 Training | Training records incomplete; effectiveness not evaluated | Training matrix per role; sign-off and effectiveness quiz per training |
| 8.2.1 Feedback / PMS | No documented PMS system; feedback not analysed | Formal PMS procedure with periodic reports as management review input |
| 7.4 Purchasing | Approved supplier list not current; no quality agreements | Annual ASL review; quality agreements for all critical suppliers |
| 7.6 Calibration | Equipment past calibration due date; no calibration records | Calibration register with alert dates; EDMS-linked calibration schedule |
| 5.6 Management review | Inputs missing from review; no action items tracked | Standardised agenda covering all clause 5.6.2 inputs; action tracker |
| 8.3 Nonconforming product | No segregation of NCP; concession not documented | Physical quarantine area; NCP log; concession approval record in DHR |
| 4.2.5 Records | Records not legible or retrievable; retention periods undefined | Records retention schedule; EDMS with backup; legibility check programme |
Day-before preparation checklist
- Confirm audit agenda, auditor names, and scope with the certification body
- Brief all staff who may be interviewed — they should know their role in the QMS
- Ensure the opening meeting room is ready with presentation materials
- Pre-pull recent batch records, CAPA files, and complaint records auditors will likely sample
- Verify all documents at production stations are current versions
- Check calibration status of all measurement equipment on the production floor
- Ensure the nonconforming product quarantine area is clearly marked and in use
- Confirm training records are up to date for all QMS-relevant staff
- Have the approved supplier list and recent supplier evaluations accessible
- Prepare a site tour route with key process stops
- Identify the scribe who will take notes during the audit
- Review findings from the last audit and confirm all CAPAs are closed with evidence
During the audit
Answer only what is asked — do not volunteer additional information that opens new audit trails. If you do not know an answer, say so and offer to find out rather than guessing. If an auditor raises a concern, listen carefully and ask for clarification before responding. The lead auditor tracks findings on a scoring sheet throughout the day — a professional, calm response to challenges creates a better impression than defensive arguments.
Nonconformity types and timelines
| Type | Description | Response timeline |
|---|---|---|
| Observation | Opportunity for improvement; no requirement violated | Optional response; typically addressed in next surveillance |
| Minor NC | Single isolated instance of non-compliance; no immediate risk | Corrective action plan within 30–60 days; evidence within 90 days |
| Major NC | Systemic failure, missing required element, or safety risk | Immediate containment; CAPA plan within 30 days; close-out within 90 days |
Post-audit CAPA response
After the audit, the certification body issues a formal finding report. For each nonconformity you must provide: a root cause analysis, corrective action plan with timelines, and evidence of implementation. Close-out typically requires submitting documentary evidence (updated procedures, training records, process improvements) within 30–90 days. For major NCs, the certification body may conduct a follow-up visit before issuing the certificate.