106 Clause Ecdb052b

ISO 13485 Audit Guide

Clause-by-clause audit methodology with sample questions and common findings.

Table of Contents

• Audit Approach
• Clause 4: Quality Management System
• Clause 5: Management Responsibility
• Clause 6: Resource Management
• Clause 7: Product Realization
• Clause 8: Measurement and Improvement
• Common Nonconformities

Audit Approach

Risk-Based Audit Planning

Prioritize audit focus based on:

Evidence Collection Methods

Clause 4: Quality Management System

4.1 General Requirements

Audit Questions:

• Show me documentation of your QMS scope and exclusions
• How do you identify processes needed for the QMS?
• Show me evidence of outsourced process control

Evidence to Review:

• Quality Manual or QMS description
• Process interaction diagram
• Outsourced process agreements

Common Findings:

• Scope exclusions not justified
• Outsourced processes not controlled
• Process interactions not defined

4.2 Documentation Requirements

4.2.1-4.2.2 Quality Manual and Documents

Audit Questions:

• Where is your documented quality policy?
• Show me the procedure for document control
• How do you ensure documents are current at point of use?

Evidence to Review:

• Quality Manual
• Document master list
• Sample of controlled documents

4.2.4 Control of Records

Audit Questions:

• What is your record retention policy?
• Show me the procedure for record storage and protection
• How do you ensure record legibility and retrievability?

Evidence to Review:

• Record control procedure
• Retention schedule
• Sample record retrieval test

Common Findings:

• Obsolete documents in use
• Records not legible or retrievable
• Retention periods not defined for all record types

Clause 5: Management Responsibility

5.1-5.2 Management Commitment and Customer Focus

Audit Questions:

• How does top management demonstrate commitment to QMS?
• Show me evidence of customer requirement determination
• How are regulatory requirements communicated?

Evidence to Review:

• Quality policy communication
• Management review minutes
• Customer feedback records

5.4 Planning

Audit Questions:

• Where are your quality objectives documented?
• Show me the plan for achieving quality objectives
• How do you maintain QMS integrity during changes?

Evidence to Review:

• Quality objectives (measurable, time-bound)
• Quality planning documentation
• Change management records

5.5 Responsibility and Authority

Audit Questions:

• Where are responsibilities and authorities defined?
• Who is the management representative?
• How is QMS performance communicated to top management?

Evidence to Review:

• Organization chart
• Job descriptions with QMS responsibilities
• Management representative appointment

5.6 Management Review

Audit Questions:

• Show me management review records from last 12 months
• What inputs are included in management review?
• What decisions and actions resulted?

Required Review Inputs:

• Audit results
• Customer feedback (including complaints)
• Process performance and product conformity
• CAPA status
• Changes affecting QMS
• Recommendations for improvement
• New/revised regulatory requirements

Common Findings:

• Management review not conducted at planned intervals
• Required inputs missing
• Action items not tracked to completion

Clause 6: Resource Management

6.1-6.2 Human Resources

Audit Questions:

• How do you determine competency requirements?
• Show me training records for personnel affecting quality
• How do you evaluate training effectiveness?

Evidence to Review:

• Competency requirements by role
• Training records
• Effectiveness evaluations

6.3-6.4 Infrastructure and Work Environment

Audit Questions:

• How do you determine infrastructure requirements?
• Show me maintenance records for critical equipment
• How is work environment controlled for product conformity?

Evidence to Review:

• Equipment list with maintenance schedules
• Environmental monitoring records
• Contamination control procedures (if applicable)

Common Findings:

• Training effectiveness not evaluated
• Preventive maintenance not performed on schedule
• Environmental conditions not monitored

Clause 7: Product Realization

7.1 Planning of Product Realization

Audit Questions:

• Show me the quality plan for a recent product
• How do you determine verification and validation activities?
• What records are required to demonstrate conformity?

Evidence to Review:

• Quality plan or project plan
• Risk management integration
• Required records defined

7.2 Customer-Related Processes

Audit Questions:

• How do you determine customer requirements?
• Show me the contract review process
• How do you handle customer communications?

Evidence to Review:

• Contract/order review records
• Customer requirement documentation
• Communication records

7.3 Design and Development

Audit Questions (per phase):

Evidence to Review:

• Design History File (DHF)
• Design review records with participants
• Verification/validation protocols and reports
• Design change requests

7.4 Purchasing

Audit Questions:

• How do you evaluate and select suppliers?
• Show me approved supplier list with evaluation criteria
• How do you verify purchased product?

Evidence to Review:

• Supplier evaluation procedure
• Approved supplier list
• Incoming inspection records
• Supplier audit records

7.5 Production and Service Provision

Audit Questions:

• Show me work instructions for production
• How are special processes validated?
• Show me traceability records for a product lot

Evidence to Review:

• Production work instructions
• Process validation records
• Device history records (DHR)
• Traceability records

7.6 Control of Monitoring and Measuring Equipment

Audit Questions:

• Show me calibration records for measuring equipment
• How do you handle out-of-tolerance conditions?
• How is software used for monitoring validated?

Evidence to Review:

• Equipment calibration records
• Calibration procedure
• Out-of-tolerance investigation records

Common Findings:

• Design inputs not completely addressed in outputs
• Supplier evaluations not performed or documented
• Process validation not maintained after changes
• Calibration overdue

Clause 8: Measurement and Improvement

8.2.1 Feedback

Audit Questions:

• How do you collect customer feedback?
• Show me complaint handling records
• How is feedback data used for improvement?

Evidence to Review:

• Complaint procedure
• Complaint log with trending
• Feedback to design/production

8.2.2 Internal Audit

Audit Questions:

• Show me the internal audit schedule
• How do you ensure auditor independence?
• Show me audit records and follow-up actions

Evidence to Review:

• Audit program/schedule
• Auditor qualification records
• Audit reports and findings
• CAPA records from audits

8.2.3-8.2.4 Monitoring and Measurement

Audit Questions:

• How do you monitor process performance?
• Show me product acceptance records
• What happens when acceptance criteria not met?

Evidence to Review:

• Process monitoring data
• Inspection records
• Nonconforming product records

8.3 Control of Nonconforming Product

Audit Questions:

• Show me the procedure for nonconforming product
• How do you prevent unintended use of nonconforming product?
• Who authorizes concessions/deviations?

Evidence to Review:

• NC product procedure
• NC product records
• Concession authorizations

8.4 Analysis of Data

Audit Questions:

• What data do you analyze for QMS effectiveness?
• Show me trend analysis for complaints, NC, CAPA
• How does data drive improvement?

Evidence to Review:

• Data analysis reports
• Trend charts
• Management review inputs

8.5 CAPA

Audit Questions:

• Show me the CAPA procedure
• How do you determine root cause?
• Show me CAPA effectiveness verification

Evidence to Review:

• CAPA procedure
• Open/closed CAPA log
• Root cause analysis records
• Effectiveness verification records

Common Findings:

• Complaint trending not performed
• CAPA not initiated for recurring issues
• Root cause analysis superficial
• Effectiveness verification not documented

Common Nonconformities

Top 10 ISO 13485 Audit Findings

Finding Severity Classification