ISO 13485 audit process
ISO 13485 certification runs through audits carried out by an accredited certification body. The standard is set by ISO and published in the Netherlands by NEN (Netherlands Standardisation Institute) . You can check whether a certification body is accredited in the RvA (Dutch Accreditation Council) register .
An audit does not only check documents. It mainly checks whether processes demonstrably work in daily practice.
The ISO 13485 audit process in brief
| Component | What happens? | Result |
|---|---|---|
| Stage 1 | Document and system review | Ready/no-go for stage 2 |
| Stage 2 | On-site audit of implementation | Certification recommendation |
| Surveillance | Annual follow-up audit | Certificate maintained |
| Recertification | Full reassessment in year 3 | Certificate renewed |
The ISO 13485 audit process step by step
Stage 1: document and system review
The auditor checks whether your QMS is ready for audit:
- scope and context;
- procedures and records;
- internal audit and management review;
- follow-up on known risks.
Outcome: findings and improvement points that you resolve before stage 2.
Stage 2: implementation in practice
Here the auditor checks whether processes really work. Auditors often follow the chain from requirement to design, purchasing, production and release, and post-market feedback.
Outcome: conformities, minor and major findings, and a certification recommendation.
Annual surveillance
After certification, an annual check audit follows. It covers critical processes, trends and follow-up on earlier findings.
Outcome: certification is maintained if follow-up is sufficient.
Recertification (year 3)
In year 3, the certification body reassesses the full system.
Outcome: the certificate is renewed.
Types of findings in the ISO 13485 audit
| Type of finding | Meaning | Effect on certification |
|---|---|---|
| Major nonconformity | Fundamental gap in the system or its implementation | Certification is postponed until it is resolved |
| Minor nonconformity | Deviation with limited impact | A correction plan is required within the agreed deadline |
| Observation/opportunity | Improvement point without a formal deviation | No direct block, but an area to watch |
ISO 13485 audit readiness checklist
| Check | Why it matters | Read more |
|---|---|---|
| Documents on the current version | Prevents inconsistencies during the audit | Requirements of the standard |
| Internal audit completed | Required, and it reduces risk | Step-by-step plan |
| Management review recorded | Shows demonstrable management involvement | Requirements of the standard |
| CAPA demonstrably effective | Shows the ability to improve | MDR and ISO 13485 |
| Traceability tested | Critical in medtech audits | Requirements of the standard |
| Critical suppliers assessed | High audit sensitivity | Costs and timeline |
What auditors check beyond the basics
Two topics need extra preparation during the audit. CAPA under ISO 13485 is a common audit focus: auditors want to see that you not only open CAPAs but close them effectively, with evidence. Also make sure your technical documentation is up to date: document control is critical in an audit. Auditors also ask about your internal audit: did you plan, carry out and follow up on it yourself before they arrived?
4 common mistakes in the ISO 13485 audit
- Starting to build evidence too late.
- Procedures that do not match practice.
- CAPA without root cause analysis and effectiveness checks.
- Incomplete supplier files for critical suppliers.