ISO 13485 internal audit: planning, conducting and reporting audits a device certification body will rely on

Where internal audit sits in ISO 13485

ISO 13485:2016 lists internal audit as sub-clause 8.2.4, beside feedback (8.2.1), complaint handling (8.2.2), reporting to regulatory authorities (8.2.3) and the monitoring of processes and product (8.2.5, 8.2.6). The standard follows the layout of ISO 9001:2008 rather than the harmonised structure, so the audit requirement sits next to the very duties it is expected to test. This guide works at the level of sub-clause titles: write your audit procedure from the text of 8.2.4 in your own licensed copy, because the certification body audits the procedure against that wording.

Three connections decide whether the audit is worth doing:

• Criteria. The standard's title ends "for regulatory purposes", and its introduction ties "risk" to device safety, performance and regulatory requirements. Audit against ISO 13485, your own procedures and device files, and the regulations of each market you sell into.
• Management review (5.6). Top management reads audit results with complaints, regulatory reports and new regulatory requirements, and records its decisions.
• Action. Nonconformities go into corrective action (8.5.2); weak signals can open preventive action (8.5.3), which ISO 13485 still names separately.

Under ISO/IEC 17021-1, the certification body's Stage 1 readiness review confirms that internal audits and management reviews are planned and carried out; Stage 2 and each surveillance visit examine them. The sequence is in ISO 13485 certification process, step by step.

Building the audit programme around device risk

For method, use ISO 19011:2026, Guidelines for auditing management systems, published in May 2026 with wider guidance on remote auditing and digital tools. It is guidance, not a certifiable standard. Its risk-based principle matters most here: audit time follows the risks in your risk management file (7.1), so a sterilisation process earns more attention than the goods-in office.

Cover every sub-clause in scope at least once a year, and return more often to processes that could lead to patient harm, a regulatory report or a recall, or that have new complaints, a new device family or a changed critical supplier.

Before initial certification, compress the programme so that one full-scope cycle, with its findings acted on, ends well ahead of Stage 1. With several sites, audit every site that designs or manufactures: the medical device accreditation rules do not let the certification body sample those sites, and your programme should not either.

Conducting the audit: trails, samples and findings

Before the audit, read the procedure, the device file, the last report, open CAPAs and recent complaints, and send the plan (objective, scope, criteria, dates, auditees, auditors) to the process owner. Decide the populations to sample, but pick the items on the day.

On the day, ask people to show you at the bench, the cleanroom door or the complaint desk, and compare a gowning sequence or line clearance with the written method. When one record points to another, go there: a complaint leads to a batch, the batch to its sterilisation load, the load to the validated cycle. Where a trail breaks, widen the sample before you write anything.

Write each finding as requirement, evidence and gap. An illustrative example:

• Requirement: the complaint procedure requires a recorded reportability decision for every complaint.
• Evidence: of twelve complaints received from March to June, four have no recorded decision, two of them alleging malfunction during use.
• Gap: reportability is not assessed for every complaint as the procedure requires.

A finding like this goes to the regulatory reporting owner the same day, because the late decision may itself be reportable.

How the internal audit differs from external audits

External auditors sample within fixed audit days; your programme can go further. IAF MD 9 also requires agreements allowing audit reports to be released to regulators, one more reason to arrive with internal findings closed. The FDA keeps its own inspection authority under the QMSR, covered in ISO 13485 and the FDA QMSR: what to check.

Reporting, grading and closing findings

Grade findings in your procedure using the certification body's terms from ISO/IEC 17021-1: a major nonconformity affects the capability of the system to achieve its intended results, a minor one does not, and an opportunity for improvement notes a better way where nothing is wrong. Treat anything touching device safety, a regulatory report or a released batch as major until the risk file says otherwise.

The report gives scope, criteria, auditors, samples, each finding with its evidence and a conclusion; issue it within a week to the process owner and top management. Closure needs the correction, the root cause, the corrective action and the auditor's check that it worked. A rewritten procedure proves nothing; a quarter of complaints each carrying a recorded reportability decision does.

In Effivity, a master schedule and per-audit plans drive alerts, and audit nonconformities pass to the nonconformity module for root cause, corrective action and the effectiveness review, with reminders when actions run late. Used in 50+ countries, Effivity is included with the engagement, at no additional cost.

Who audits: competence and independence

Internal auditors affect device quality, so they fall under the human resources requirements of 6.2 and need competence records. That means reading a design file, a validation protocol and a complaint investigation, not only audit technique. Nobody audits their own area: in a small company, trained staff from engineering, production and regulatory affairs audit each other, and an external auditor covers the quality lead's processes and the programme itself. Do not use your certification body; ISO/IEC 17021-1 treats internal audits for its own certified clients as a significant threat to impartiality.

As applicable to your standard, internal auditor training for your audit team is part of a Sterling engagement: your Sterling consultant delivers it using your own device files, complaints and suppliers, and it leads to a Certificate of Competence. Your wider workforce also receives preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement. See ISO 13485 training: who needs what.

ISO 13485 internal audit: questions buyers ask