ISO 13485 handbook: what must it contain?
An ISO 13485 handbook is the quality manual of your medical device organisation. It describes the scope of your quality management system (QMS) and refers to the procedures that belong to it. Clause 4.2.2 of the standard requires such a handbook, and it is often the first document an auditor opens at stage 1 of the audit. You can find more about the standard at ISO , and the requirements themselves on the page requirements of ISO 13485.
The handbook does not have to be a thick book. A short document with clear references to your procedures is stronger than a hundred-page handbook that nobody keeps up to date.
What must an ISO 13485 handbook contain as a minimum?
Under clause 4.2.2, the handbook must contain three things. That is the minimum the auditor checks. In addition, the handbook outlines how the documentation in your QMS is structured.
- The scope of the QMS, including the products and product groups it applies to.
- A justification for any exclusions. If you do not apply a requirement from the standard, explain why. An example is a contract manufacturer that designs nothing.
- The documented procedures, or a reference to them, and a description of how the processes link together.
That last point is the most important. A handbook that says “we have a complaint procedure” is weak. A handbook that shows how a complaint runs from intake to CAPA and back to the customer is strong.
Handbook, procedure and work instruction: what is the difference?
Many organisations use these terms interchangeably. A handbook is the overview. A procedure describes what you do and why. A work instruction describes how an employee carries out a task on the shop floor.
| Document | Purpose | Typical length | Example |
|---|---|---|---|
| Handbook | Scope, structure and references | 10 to 30 pages | The overview of the whole QMS |
| Procedure | What, who, when and which records | 1 to 4 pages | Complaint handling procedure |
| Work instruction | Step by step, on the shop floor | 1 to 2 pages | Instruction for cleaning the assembly line |
| Record | Evidence that something was done | Form or log | Completed CAPA record |
The auditor always traces from handbook to procedure to record. If the handbook says “see procedure PR-07”, PR-07 must exist, be current, and be followed in practice.
Example structure of a handbook
The structure below is a fictional example and you can use it as a starting point. The standard does not prescribe a fixed chapter structure. The column with clause references is a tool: check the numbers against your own copy of the standard.
| Chapter | Content | Reference in the standard |
|---|---|---|
| 1. Scope and application | Products, product groups, exclusions with justification | 4.2.2 |
| 2. Organisation and responsibilities | Organisation chart, roles, quality representative | 5.5 |
| 3. Quality policy and objectives | Policy, measurable objectives, owners | 5.3, 5.4 |
| 4. Process overview | Process model with references to procedures | 4.1 |
| 5. Document and record control | How documents are approved and kept | 4.2.4, 4.2.5 |
| 6. Core processes | Design, purchasing, production, traceability | 7.x |
| 7. Measurement, analysis and improvement | Internal audit, complaints, CAPA, management review | 8.x, 5.6 |
A tip for the process overview: draw one diagram with arrows. An auditor understands how your organisation works in two minutes when they see the picture.
Document control: the handbook must be current
The handbook itself is also a controlled document. It has a version number, an approval date and an owner. Every change to a process should lead to a check of the handbook. That sounds obvious, but it often goes wrong.
A common situation: the handbook refers to procedure version 2, but that has since been replaced by version 4. The auditor will spot this immediately. So set up a fixed link: a change to a procedure triggers a review of the handbook. How you arrange that depends on your QMS software or your paper system.
How big should your handbook be for a small company?
A start-up with one product line needs a shorter handbook than a manufacturer with several sites. The difference lies in the scope, not in the requirements. The standard asks for the same elements, but for a small company each element can be shorter.
For a small organisation, it is sensible to begin the handbook as a short scope description plus a process overview. Add to it as your procedures take shape. Also read ISO 13485 for start-ups for the minimum system you should have early on.
Common mistakes with the handbook
- The handbook is a copy of the standard. Auditors recognise this immediately. The handbook must describe how you do it.
- Exclusions without justification. If you exclude design control, for example because you only manufacture to order, explain why and show that it holds.
- References to documents that do not exist. Check every reference before you approve the handbook.
- No owner. If nobody maintains the handbook, it goes out of date within a year.
- A handbook only for the auditor. Employees must be able to find it and know what it says.
How is the handbook used during the audit?
At stage 1, the auditor often asks for the handbook first. They read it and check whether the references are correct. At stage 2, they check whether the procedures the handbook names are actually followed. See the audit process for how both stages run.
So do not only hand over the handbook as a PDF. Make sure you can show an employee where a particular procedure is and how it is used.
Checklist for your handbook
Work through these questions before you approve the handbook:
- Does the scope state the products and product groups that belong to it?
- Are there exclusions in it, with a justification for each one?
- Does every procedure refer to an existing, current document?
- Is there a process diagram that shows how the processes link together?
- Does the handbook have a version, an approval date and an owner?
- Can a new employee find where a procedure is within fifteen minutes?
If you answer no to any of these questions, the handbook is not yet ready for an auditor.