ISO 13485 Internal Audit Checklist: Clauses 4-8

TL;DR

• ISO 13485:2016 Clause 8.2.4 requires organizations to conduct internal audits at planned intervals to evaluate QMS conformity and effectiveness.
• A useful checklist covers applicable requirements across Clauses 4-8, including documentation, management responsibility, resources, product realization, and measurement and improvement.
• Auditors should record objective evidence, document nonconformities clearly, and follow corrective actions through effectiveness checks.
• The checklist must be tailored to your organization's QMS scope, processes, risks, and applicable regulatory requirements.

An ISO 13485 internal audit helps medical-device organizations evaluate whether their quality management system (QMS) is implemented, maintained, and operating as intended. It can reveal gaps in documentation, training, supplier controls, production records, risk management, and corrective action before they become recurring problems.

The most useful audit goes beyond checking whether a procedure exists. Auditors examine how work is performed, sample records, interview personnel, and compare actual practices with documented procedures and applicable requirements.

Use the following ISO 13485 internal audit checklist as a starting point. Adapt it to your certification scope, organizational processes, and the edition of the standard applicable to your QMS. It is not a substitute for the full standard or qualified regulatory advice.

What Should an ISO 13485 Internal Audit Checklist Include?

ISO 13485:2016 organizes QMS requirements across Clauses 4-8. Your audit programme should address the applicable requirements and consider process importance, changes, previous findings, and other relevant risks.

Clause 4: Quality management system

• Is the QMS scope defined and maintained, with any permitted non-applicability justified?
• Are required processes, their interactions, and outsourced processes identified and controlled?
• Are controlled documents reviewed and approved before use?
• Are records identifiable, legible, retrievable, and retained according to defined requirements?
• Is a medical device file maintained for each device type or family, as applicable?

Evidence to sample: QMS documentation, process maps, approved procedures, revision histories, retention rules, and relevant medical device files.

Clause 5: Management responsibility

• Does management demonstrate commitment to the QMS and applicable regulatory requirements?
• Are quality policies, objectives, responsibilities, and authorities defined?
• Are responsibilities communicated to relevant personnel?
• Are management reviews conducted at planned intervals?
• Are required review inputs considered and decisions and actions recorded?

Evidence to sample: Quality policy, measurable objectives, organizational responsibilities, management-review minutes, and action logs.

Clause 6: Resource management

• Are personnel competent for their assigned responsibilities?
• Are training and competence records maintained, with effectiveness evaluated where appropriate?
• Is infrastructure affecting product quality maintained?
• Are relevant work-environment and contamination-control requirements defined and followed?
• Are monitoring and measurement resources suitable for their intended use?

Evidence to sample: Training records, competency assessments, equipment maintenance, calibration records where applicable, and environmental monitoring records.

Clause 7: Product realization

• Are product realization processes planned and controlled?
• Are design and development controls implemented when applicable?
• Are suppliers evaluated, selected, monitored, and re-evaluated according to defined criteria?
• Are production and service processes controlled, including validation where required?
• Are product identification, traceability, inspection, and release records maintained as applicable?
• Are customer feedback, complaints, and post-production activities addressed according to applicable requirements?

Evidence to sample: Design records, supplier evaluations, purchasing records, production or service records, process-validation evidence, inspection results, and traceability records.

Clause 8: Measurement, analysis, and improvement

• Are monitoring and measurement activities defined and performed?
• Are internal audits conducted according to a documented procedure and planned programme?
• Are nonconforming products identified and controlled?
• Is quality data analyzed to evaluate QMS suitability and effectiveness?
• Are corrective actions based on appropriate investigation and cause analysis?
• Is corrective-action effectiveness evaluated and recorded?

Evidence to sample: Audit reports, nonconformity records, complaint trends, data-analysis reports, corrective and preventive action records, and effectiveness checks.

ISO 13485 Internal Audit Checklist: Planning and Execution

A clause checklist helps with coverage, but the audit programme and the way each audit is conducted matter just as much.

Before the audit

• Define the audit objective, scope, criteria, and methods.
• Select an auditor with appropriate competence who does not audit their own work.
• Consider process importance, previous audit findings, significant changes, and relevant risks when planning frequency.
• Review previous findings and open corrective actions.
• Prepare process-specific questions and identify records to sample.
• Communicate the schedule and relevant arrangements to process owners.

During the audit

• Interview personnel who perform or oversee the process.
• Observe work where relevant.
• Sample actual records rather than relying only on verbal explanations.
• Trace selected records across connected processes, for example, from supplier receipt to inspection and disposition.
• Compare objective evidence with the applicable requirement and the organization's own documented procedure.
• Record evidence references, including document identifiers, record dates, or other details that allow the evidence to be retrieved.

After the audit

• Document findings against specific requirements and supporting evidence.
• Communicate results to relevant management and process owners.
• Record corrections and corrective actions where required.
• Assign owners and due dates for follow-up.
• Verify corrective-action effectiveness where appropriate.
• Retain audit records and feed results into management review as required.

How to Document ISO 13485 Audit Findings

A checklist response alone does not demonstrate conformity. Audit conclusions should be supported by evidence, and a nonconformity should clearly identify the requirement that was not met and the evidence demonstrating the failure.

Use this simple structure for each finding:

For example, instead of writing "training records are incomplete," identify the applicable competence or training requirement, the sampled role or record, and the specific missing evidence. This makes the finding clearer and easier to investigate.

Do not assume that every observation is a nonconformity. Compare the evidence with the applicable requirement and follow the organization's defined process for classifying and reporting findings.

Common ISO 13485 Internal Audit Mistakes

Auditing documents instead of actual practices

A procedure may be approved and current while staff follow an older version or use an undocumented workaround. Sample actual work and records to test whether the process is implemented.

Treating the checklist as proof of compliance

A completed checklist does not replace objective evidence. Link each conclusion to records, observations, or interviews relevant to the audit criteria.

Ignoring repeat findings

Closing a corrective action administratively does not establish that it was effective. Review recurrence, investigate causes where appropriate, and verify the result against defined acceptance criteria.

Applying the same audit frequency to every process

Audit planning should consider process importance, changes, and previous audit results rather than relying solely on a fixed annual rotation. The programme must still cover applicable QMS requirements at planned intervals.

How Scispot Can Support Audit Readiness

Internal audits often require teams to retrieve approved documents, training records, workflow history, and other supporting evidence across different systems. Disconnected records can make this review more time-consuming.

Scispot's QMS capabilities include document control, training management, change-control workflows, and audit trails. Depending on configuration and intended use, these capabilities can help teams organize quality records and make relevant evidence easier to retrieve.

Organizations remain responsible for defining their QMS, determining applicable requirements, validating systems where necessary, and making final quality and compliance decisions. Software supports the process; it does not guarantee ISO 13485 conformity or certification.