Effivity ISO 13485 guide: running a medical device QMS in one system, from the gap analysis to surveillance

What does running ISO 13485 in Effivity mean?

It means the quality management system for your devices lives in one place where people do the work, rather than in a binder written for the auditor. A complaint is entered when it arrives, a supplier is approved before the first order, a design review is minuted when it is held, and a corrective action carries an owner, a due date and a check that it worked.

ISO 13485:2016 is written for regulatory purposes, so traceability, reporting to regulators and action on product in the field sit beside ordinary quality control. Those duties cross service, regulatory affairs, engineering and quality, and when each keeps its own spreadsheet the links between them break first. Effivity does not change what the standard requires; it reduces the effort of meeting it and makes the evidence convincing when an auditor follows one case from start to finish.

Which Effivity module holds each ISO 13485 requirement?

The table maps the requirement areas of ISO 13485 to the Effivity modules that hold them, using the module names Effivity gives them.

Risks to the system itself sit in Risk & Opportunity. The product risk management file that 7.1 asks for, built with the method of ISO 14971, is a controlled engineering document; Sterling's recommended set-up keeps it in Documented Information, linked to the device family it belongs to. What goes into that file and the design file is covered in The medical device file and the design file: what goes in them.

A worked trace: one complaint about an infusion set

A hospital reports that a set leaked at the connector during use. The service coordinator logs the complaint in Customer Life Cycle Management on the day it arrives, against the customer and the lot number. Regulatory affairs evaluates it and records whether it must be reported to the authorities in each market where the lot was sold, with the reason for the decision. Quality opens a nonconformity of the complaint type and assigns an owner. The investigation finds a moulding parameter outside its validated range at the supplier; the supplier's evaluation in Purchase is updated, the risk file is revised through a controlled change, and the corrective action is verified on the following lots before closure. An auditor who picks that complaint finds each step, dated and owned.

What Sterling configures at the start

Effivity is set up in the first weeks of a Sterling ISO 13485 engagement, straight after the gap analysis, so the months before certification produce real operating history.

• The scope and the markets. Device types and families, life-cycle stages, sites and the regulations of each market are entered first.
• Roles and users. Process owners, the management representative and the people who raise complaints, inspections and changes get their own access, so records carry the names of those who did the work.
• Forms adapted to your devices. The pre-configured workflows are adjusted so a complaint form asks the reportability question, a supplier form reflects how critical the part is, and an inspection form matches your acceptance criteria.
• The plan with milestones. The actions agreed at the gap analysis are tracked with owners and dates, so management sees what is late before the audit does.

What the certification audit sees in Effivity

At the Stage 1 readiness review the certification body reads your documentation and judges whether you are ready for Stage 2.

At Stage 2 the auditors test implementation by following cases. Typical threads run from a complaint to its reporting decision, from a design change to the updated risk file, and from a nonconforming lot to its disposition. Your own people open the records and explain them. Under IAF MD 9, the accreditation rules for medical device certification, sites involved in design, development and manufacturing are not sampled, so every such site needs the same quality of evidence; a multi-site set-up in Effivity helps with that.

The same records serve other readers. A notified body, an MDSAP auditing organisation or a regulator samples the same system. The internal audit that comes before any of them is covered in ISO 13485 internal audit: planning, conduct and reporting.

What Effivity does not do

The software records judgements; it does not make them. Whether a complaint is reportable or a risk acceptable is decided by competent people in your organisation, who must explain it to the auditor.

• It does not certify. Neither does Sterling. An independent, accredited certification body decides after Stage 1 and Stage 2.
• It is not market approval. An ISO 13485 certificate is not CE marking, FDA clearance or a Philippine FDA registration, and neither is a well-run Effivity system.
• It does not replace engineering and production tools. CAD, test benches, ERP batch records and sterilisation equipment logs stay where they are made; the quality records in Effivity refer to them.
• It does not fix a system nobody uses. Forms left unadapted, one person entering every record and a parallel spreadsheet all show up in interviews and in the dates on the records.

Surveillance, Sustain™ and regulatory change

The certificate starts a three-year cycle. The certification body returns at least once each calendar year, with the first surveillance audit within twelve months of the decision, and recertifies in the third year. Surveillance tests continuity: complaints evaluated on time, CAPA closed with evidence, audits and reviews held as planned.

That continuity is where the software pays back. Reminders fall due before calibrations lapse, overdue actions escalate, and dashboards show what is still open. Regulation also moves around a stable standard: the FDA's QMSR has applied since 2 February 2026, and a manufacturer selling into the United States records that change in Compliance Obligation and works out what it means, as described in ISO 13485 and the FDA QMSR: what to check. Under Sustain™, Sterling continues internal audits, regulatory change reviews, audit preparation and refresher learning in the same system.

Effivity for ISO 13485: questions buyers ask