ISO 13485 training: who needs what, from the design bench to the complaint desk

What ISO 13485 requires on competence

People requirements sit in clause 6, Resource management, under 6.2, Human resources. The principle is simple to state and demanding to evidence: anyone whose work can affect the quality of a device must be able to do that work properly, and the organisation must be able to show it. That includes designers, warehouse staff, service technicians and temporary workers whenever their work touches the device.

Two features of the standard raise the bar compared with a general quality system. First, ISO 13485 reads "risk" as risk to the safety or performance of the device or to meeting regulatory requirements, so training priorities should follow the tasks where a mistake could reach a patient. Second, anything the standard requires you to document must also be established, implemented and maintained, so a competence procedure nobody follows is a finding waiting to be written.

Other clauses create their own competence demands. Design reviews, risk management, validated processes, sterile product and reporting decisions all depend on people who understand the method, not only the form. ISO 14971 goes further and sets out competence of personnel, with records, as a requirement of its own. The full map is in the ISO 13485 requirements guide.

Who needs what: training by role

Top management and the management representative

Leaders need to understand what ISO 13485 and the applicable regulations demand of them: the quality policy, objectives that include post-market measures, and a management review that reads complaints, regulatory reports, audit results and new regulatory requirements. The management representative needs working knowledge of the whole system.

Design, development and risk management

Engineers need to know the design control sequence the standard expects, from planning and inputs through verification, validation, transfer and change control, and how the design and development file records it. Everyone who contributes to hazard analysis or risk acceptability decisions needs ISO 14971 method, not a template. Software teams add the life-cycle processes of IEC 62304.

Production, validation and sterile operations

Operators need their work instructions, acceptance criteria and the handling of nonconforming product. Those who run or supervise validated processes need to know the validated parameters and what happens when a process drifts outside them. Staff working with sterile product or in controlled environments need contamination control, gowning and the batch records the sterilisation process demands.

Complaints, vigilance and regulatory affairs

The people who receive feedback must recognise a complaint when they hear one. Those who investigate need root-cause method, and those who decide whether an event must be reported to a regulator, or an advisory notice issued, need the reporting rules of every market you sell into.

Purchasing, distribution and servicing

Buyers need risk-based supplier controls. Warehouse and distribution staff need identification, traceability and preservation of product, including distribution records for implantable devices. Service engineers need the servicing procedures.

Internal auditors

Internal auditors need the standard, the regulations in scope and audit skill. The programme and method belong to ISO 13485 internal audit: planning, conduct and reporting.

An ISO 13485 training matrix

A matrix ties each role to what it must learn and to the record that proves the learning took hold. Shape it around your devices, sites and markets.

Revisit the matrix when a device, process, site or market changes, after a significant complaint or recall, and when a regulation in scope is amended.

What counts as evidence of competence

Auditors test competence by following people they meet during the audit. They ask what the role requires, compare the person's record with it, and then ask the person to explain or show the work. Evidence persuades when those three agree.

• Role criteria: the education, training, experience and skills each role needs, written before anyone is measured against them.
• Records traceable to the person: qualifications, course records, CVs and internal authorisations, current for the version of the process in use.
• A check that the training worked: a test, an observed task or a supervisor's sign-off, recorded against the training it evaluates, with more rigour where the task carries more risk to the device.
• The work itself: design files, risk files, batch records and complaint decisions whose quality speaks for the person who produced them.

The people auditing you are held to device-specific rules of their own. Certification bodies apply IAF MD 9, which sets competence expectations for medical device auditors. Because the FDA's QMSR incorporates ISO 13485:2016 by reference, investigators in the United States are working from the same requirements. What changed there, and what to check, is covered in ISO 13485 and the FDA QMSR: what to check.

Where training evidence fails in device audits

• Risk file owners with no risk training. The file exists, but the people who wrote it cannot explain how acceptability was judged.
• Validated processes run by unauthorised operators. A new starter on a sealing or sterilisation line with no sign-off undermines the validation itself.
• Complaint staff who cannot tell a complaint from a query. Feedback is logged as a service call and never evaluated for reporting.
• ISO 9001 records carried over unchanged. A general quality induction says nothing about patient safety, sterile product or regulatory reporting.

Sterling Academy and internal auditor training

Sterling Academy provides e-learning for the wider workforce. Its courses combine learning checks with a final exam, and learners who complete them receive a numbered Sterling Academy Certificate of Completion. For hands-on roles, add the observed sign-off from the matrix.

Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

Contact us about Academy access

Internal auditor training, as applicable to your standard, forms part of the consulting engagement and is built on your own device files, processes and records. The training records and the competence matrix sit in Effivity, described in Effivity for ISO 13485: the guide.

ISO 13485 training: questions buyers ask