ISO 13485 Audit Clause by Clause: What Auditors Examine

An ISO 13485 audit looks at the whole standard. But auditors do not spend the same time on every clause. They spend most time where device risk is highest. The current edition is ISO 13485:2016, which ISO reviewed and confirmed in 2025. This guide goes through the clauses one by one for Indian manufacturers, importers and distributors. What auditors sample depends on your devices and activities.

How is the standard laid out, and where does an ISO 13485 audit focus?

ISO 13485 has its own clause structure. It does not use the common structure found in ISO 9001 and many other standards. The requirements sit in clauses 4 to 8. Auditors spend most time on clause 7, product realisation, and clause 8, measurement, analysis and improvement.

Clauses 1 to 3 cover scope, references and terms. If a requirement in clauses 6, 7 or 8 does not apply, the company records the reason under clause 4.2.2.

What do auditors check in clauses 4 to 6?

Clause 4 covers the medical device quality management system and its records. Clause 5 covers management responsibility, and clause 6 covers resources. Auditors begin with the medical device file and the company’s role. They then check the management representative and the management review.

• Medical device file (4.2.3): for each device or family, the description, intended use, labelling and specifications.
• Role (4.1.1): the company records whether it is a manufacturer, importer or distributor.
• Records (4.2.5): kept for at least the life of the device, and never less than two years from release.
• Management representative (5.5.2): this is a clear requirement here, unlike in ISO 9001.
• Management review (5.6): it needs inputs such as complaints and reports to authorities.

How does an auditor test design and development?

An auditor follows one device through the full sequence: plan, inputs, outputs, review, verification, validation, transfer to production and change control. The auditor checks dates and order. A design file built after the event rarely has a believable timeline. This is the most heavily examined area for manufacturers who design devices.

At a hypothetical orthopaedic implant maker in Coimbatore, the trail starts with one complaint. It moves to the risk file, then to the validation report, and ends at the design inputs. The auditor reads the dates at every stop.

Auditors also ask for the risk management file (7.1). They check that it is kept up to date, not left at launch. Design transfer (7.3.8) is often thin. The file should show that outputs were checked as suitable for manufacturing before production began.

What do auditors ask about purchasing, production and traceability?

Auditors often pick a critical supplier and follow the trail. They also ask which production processes need validation and why, then read the protocols, acceptance criteria, results and revalidation triggers. Traceability records must let the company trace each device, with extra rules for implantable devices.

• Purchasing (7.4): supplier controls match the effect on the device.
• Process validation (7.5.6): needed where output cannot be fully checked later. Sterilisation is covered separately (7.5.5 and 7.5.7).
• Software (4.1.6 and 7.5.6): software used in production or the quality system must be validated. Companies often miss this.
• Implantables (7.5.9.2): extra records for components and conditions that could affect conformity.

What does clause 8 show about complaints and corrective action?

Auditors check whether complaints are assessed for reportability and investigated. They also check that the results feed into risk management and corrective action. A documented process for reporting to authorities is expected, with proof of use where events required it. Clauses 8.2.2 and 8.2.3 cover these duties.

Corrective action (8.5.2) is where auditors check the root cause, the actions taken, proof that they worked and any effect on regulatory conformity. In many practitioners’ view, an action closed with retraining and no check of effectiveness is the classic finding. Design timelines, validation gaps and unassessed complaints are other common findings. Good documents cannot make up for a weak process.

What main role do ISO 13485 consultants play?

ISO 13485 consultants match each clause to the company’s role and devices. They then build the procedures and records an auditor will ask for. They prepare the company; they do not run the system or make the certification decision. Their help matters most before the first audit, when gaps are easy to fix.

Typical work includes a gap review of clauses 4 to 8, a trail test of one device from complaint to design file, and a mock audit before Stage 1 of ISO 13485 certification.

How can MSCi help you prepare?

MSCi is a consultancy with 40+ years of experience in ISO consultation. We prepare companies for audit by testing the system against each clause and closing gaps early. We are not a certification body and do not issue ISO 13485 certificates. The certification decision stays with the body you choose.

As ISO certification consultants, we usually start by reading your records against each clause. We then help close gaps in the medical device file, validation plans and complaint handling. Contact us to discuss scope and timing.

Frequently Asked Questions

1. Is design and development always audited?

Only where it applies. If regulations allow design controls to be left out, the company can justify the exclusion in its medical device quality management system. Any claim of conformity must reflect that exclusion.

2. What is the difference between design verification and validation in an ISO 13485 audit?

Verification confirms that design outputs meet design inputs. Validation confirms that the device meets the needs of its intended use. Auditors expect separate records for each (7.3.6 and 7.3.7).

3. What do auditors expect from importers and distributors?

The company records its role, and the system must match the duties that come with it. Design controls may not apply, but supplier, traceability, complaint and reporting controls usually do. What auditors sample depends on the activities in scope.

4. Does software need validation for ISO 13485 certification?

Yes, where it is used in the quality system or in production. Clause 4.1.6 covers the quality system, and 7.5.6 covers production and service provision. Companies often miss this.

5. Can a consultancy audit and certify a company?

No, MSCi prepares companies for audit. It is not a certification body and does not issue ISO 13485 certificates. The company chooses its own certification body.