Pharmaceuticals and medical devices · ISO and GRC consulting
ISO certification for pharmaceuticals and medical devices, with files that stand up to every auditor and inspector who reads them.
One quality system for the certification body, the notified body, the MDSAP auditor and the medicines inspector: device and risk files, batch records, validation, data integrity, complaints and recalls. Sterling's expert and experienced consultants build it with your QA, engineering, production and warehouse teams in 60+ countries, and stay through the audit and after it. We ensure successful certification for our clients.
- One all-inclusive proposal for a fixed scope: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standards
- A team of expert and experienced medical device and pharmaceutical quality consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- One system, many readersISO 13485 at the core, with the FDA, EU and GMP provisions written into the procedures they change.
- Files that hold upDevice, design and risk files built from real engineering records, not assembled the week before.
- Any batch, any packBatch, release, storage and distribution records that trace a unit from starting material to customer.
- Suppliers under controlContract manufacturers, sterilisers, packaging suppliers and carriers inside the system, not beside it.
What pharmaceutical and medical device companies are asked for
The standards your regulators, customers and partners will ask to see.
Device makers start from ISO 13485, with ISO 14971 for risk and IEC 62304 where software is involved; the FDA QMSR and the EU IVDR decide what the US and European markets add. Medicine makers and distributors answer to GMP and GDP, set by regulators rather than a standards body, with 21 CFR Part 11 and EU Annex 11 for the computerised systems behind the records. Packaging suppliers are asked for ISO 15378. We help you choose the set that matches your products, operations and markets.
Why now
Why pharmaceutical and device quality teams are acting this year.
The rules moved in 2026, and the people who read your records are reading more of them.
- The FDA now inspects to ISO 13485The QMSR has applied since 2 February 2026, with ISO 13485:2016 incorporated by reference and the FDA's own provisions on top. The FDA inspects; an ISO certificate does not exempt you.
- EU transition dates are closeUnder the IVDR, legacy diagnostics run out of time from 31 December 2027 for class D, and a notified body is now involved for every class B, C and D test.
- Market access dossiers ask for itHealth Canada requires MDSAP for class II, III and IV devices, and several regulators treat an ISO 13485 or MDSAP certificate as a document the registration file needs.
- Partners audit before they signA Qualified Person, a principal or a device brand owner audits your site before contracting, and asks for the same records an inspector would.
- GMP texts keep revisingPIC/S revision PE 009-18 has been in force since 24 September 2026, and revisions to EU GMP Chapter 4 and Annex 11 were consulted on in 2025 and are not yet adopted.
- Findings that repeatData integrity observations, deviations that return, temperature excursions nobody can explain and labelling corrections in the field are what turn a routine inspection into a follow-up.
Scope and evidence
What auditors and inspectors look for on a pharma or device site.
Six areas that decide most audits in this sector, and the records that answer them.
| Requirement area | What it looks like in pharmaceuticals and medical devices | Evidence auditors ask for |
|---|---|---|
| Quality system and management review | A system that names every regulation it must satisfy, with management reading complaints, reporting, audits and regulatory change | Quality manual, regulatory register, objectives with post-market measures, management review minutes with decisions |
| Design and risk management | Design controls from inputs to transfer, a risk file engineers keep current, and a software life cycle where the device runs on code | Design and development files, the ISO 14971 risk management file, software plans and test records, change records |
| Suppliers and outsourced work | Contract manufacturers, sterilisers, test laboratories, primary packaging suppliers and carriers selected and monitored on risk | Supplier evaluations, quality agreements, audit reports, requalification records and incoming inspection results |
| Production, validation and release | Validated processes, controlled environments, line clearance, and a release decision taken by someone independent of production | Batch and device history records, validation reports, sterilisation records per batch, labelling release and calibration records |
| Data integrity and computerised systems | Electronic records and signatures that an inspector can rely on, with systems validated for their intended use | System inventory, validation packages, audit trails reviewed regularly, access reviews and supplier assessments |
| Complaints, vigilance, recall and distribution | Every complaint assessed for reportability, storage conditions held from dock to customer, and any batch traceable within hours | Complaint files with reportability decisions, CAPA closed with proof, temperature mapping and monitoring, recall test records |
Which rows weigh most depends on what you make and where you sell it. A distributor's audit turns on storage, suppliers and recall; a device designer's turns on design and risk files; a medicine maker's on batch records, validation and data integrity.
The engagement
What happens between the first call and the certificate.
Shown here for ISO 13485, the standard most device clients certify to first. For GMP, GDP and the FDA QMSR the same six steps lead to the regulator's inspection, and for the EU IVDR to the notified body's assessment, rather than to a certification body's audit.
- 01Define what the certificate needs to cover.Confirm activities, sites, headcount, customer expectations and the intended certification scope.
- 02Gap analysis: review the current system against the requirements.The gap analysis identifies what is missing, preserves effective practice and agrees actions, owners, dates and resources.
- 03Implement and collect meaningful evidence.Put controls into use, train the relevant people and keep the records that show how the system operates.
- 04Audit, review and address the findings.Internal audit and management review evaluate implementation; findings are raised by us first and closed with evidence.
- 05Complete the independent assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit; respond to any findings and await its decision.
- 06Maintain the system after certification.Monitoring, internal audits, reviews and improvement continue, alongside the body's surveillance audits and three-yearly recertification.
What you receive
Everything a working, certifiable system needs, in one engagement and one fee.
- Scope and gap analysis reportThe scope of the certificate and every shortfall against the standard, with an owner and a date.
- Implementation planMilestones, responsibilities, the weekly session calendar and the target audit window.
- The documented management systemPolicies, processes, procedures, forms and records on Sterling's template sets, tailored to your operation.
- Effivity workspace, configuredDocuments, registers, audits, actions, training records and management review in one place, included at no additional cost.
- Trained peopleAwareness e-learning for everyone, practitioner courses for the people who run the system, internal auditor training for your audit team, as applicable to your standard, with Certificates of Completion.
- Internal audit and management reviewProgramme, checklists, report, corrective actions closed with evidence, and a management review record with decisions.
- Certification readinessCertification bodies compared and their accreditation checked, Stage 1 and Stage 2 preparation, and support until the certificate is issued.
- The Sustain™ calendarThe year after certification planned: surveillance dates, internal audits, refreshers, new-hire training and any transition to a revised edition.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Standards for Pharmaceuticals and medical devices
- ISO 13485ISO 13485 certification consulting for medical device makers: design controls, risk, traceability and complaints, prepared for an accredited audit.
- GDPGDP compliance consulting for medicine wholesalers, 3PLs and carriers: quality kept from dock to pharmacy, every batch traceable, ready for inspection.
- IEC 62304IEC 62304 compliance and requirements explained: safety classes, the software life cycle processes, evidence reviewers expect, cost and timeline factors.
- ISO 15378ISO 15378 certification and requirements for pharma packaging makers: the 2017 edition, ISO 9001 with GMP, the audit route, cost and timing factors.
- 21 CFR Part 11 / EU Annex 1121 CFR Part 11 and Annex 11 compliance for GxP systems: requirements, validation, audit trails and e-signatures, with evidence ready for FDA and EU inspectors.
- ISO 22716ISO 22716 Cosmetics GMP certification consulting: cosmetic production, control, storage and shipment under documented control, ready for a certification audit.
- ISO 14971ISO 14971 Risk Management implementation consulting: device hazards identified, risks controlled and files ready for ISO 13485 and notified-body audits.
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
Pharmaceuticals and medical devices client experience
On the record: what pharmaceutical and medical device clients say about working with Sterling.
The compliance officer reports a strong grasp of medical device quality system requirements and guidance that was practical, clear and well structured, with improvements in documentation, risk management and operational controls that strengthened the system and the company's overall efficiency.
The president writes that staff and management found Sterling an efficient and focused service provider, and that the company would recommend Sterling without hesitation to others looking for a dedicated level of support.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions pharmaceutical and medical device clients ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Which standard should a medical device company start with?
Most start with ISO 13485, because the FDA QMSR incorporates it, MDSAP is built on it and many registration files ask for the certificate. ISO 14971 risk management sits inside it from the first workshop, and IEC 62304 joins where the device is or contains software. If you sell diagnostics in Europe, the IVDR's performance evidence and technical documentation are planned alongside, since a certificate alone does not place a test on the EU market.
We make medicines. Is there an ISO certificate for GMP?
No. GMP has no certification-body route: the national medicines regulator inspects your site and, where it finds compliance, issues its GMP certificate or licence, and PIC/S itself certifies no one. What we build is the pharmaceutical quality system that inspection examines. Suppliers of primary packaging are often asked for ISO 15378, and ISO 9001 remains useful for the parts of the business GMP does not cover.
Can one quality system serve ISO 13485, the FDA QMSR and MDSAP?
Yes, and it should. The QMSR is ISO 13485:2016 plus a short list of FDA provisions on UDI, complaint and service records, labelling controls, reporting and advisory notices, so one system written to the standard with those provisions built into the relevant procedures answers the certification body, the MDSAP auditing organisation and the FDA investigator. Running three sets of procedures is how records start to disagree.
Does an ISO 13485 certificate make our diagnostics IVDR-compliant?
No. The IVDR asks for a quality management system, which ISO 13485 helps you demonstrate, and also for classification, a performance evaluation covering scientific validity and analytical and clinical performance, technical documentation, UDI and EUDAMED registration, a person responsible for regulatory compliance and vigilance. For class B, C and D tests, and sterile class A, a notified body assesses that evidence before you sign the declaration of conformity.
How long does a pharmaceutical or device programme take?
It depends on what already exists. As a guide from our engagements, ISO 13485 takes six to twelve months, FDA QMSR work three to twelve, GMP six to eighteen before the inspection, GDP three to nine and IVDR six to eighteen, with the notified body's review on top. Design history, validation and sterilisation lead times and the time records need to accumulate set the pace, not the consultant's timetable.
Do distributors and logistics providers need GDP or ISO 13485?
Businesses that hold, supply or export medicines need GDP: in the EU the competent authority grants the wholesale distribution authorisation and inspects against the guidelines. Carriers, 3PLs and forwarders are brought in through quality agreements and audits. Device distributors and importers are within the scope of ISO 13485, and many take the certificate because manufacturers and hospitals ask for it. Where you handle both, one system can carry both.
Does Sterling certify, inspect or validate on anyone's behalf?
No. Sterling's expert and experienced consultants build the system, the files and the evidence with your team, then prepare you for the assessment. An independent, accredited certification body decides ISO certification; notified bodies assess CE marking under the IVDR; the FDA and national medicines regulators inspect and decide compliance. We help you check a certification body's accreditation for medical device quality systems before you choose it.
Keep exploring
More industries
Watch a video on ISO standards for pharmaceuticals and medical devices here.
Talk to a consultant
Plan certification for your pharmaceutical or medical device operation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice