Internal audit ISO 13485: planning, checklist and example
An internal audit under ISO 13485 is the check you carry out yourself on your quality management system (QMS), before the certification body comes to look. The standard requires planned internal audits, carried out by independent auditors, with recorded findings and follow-up. The standard is published by ISO . You can find a summary of all requirements on the page requirements of the standard.
The internal audit is not a formality. At stage 1 and stage 2, the auditor checks whether your own audit really works: has it found gaps, and have those gaps been closed?
What does ISO 13485 require for the internal audit?
The core requirement is in clause 8.2.4 of the standard. In practice, it comes down to five requirements:
- Planning: audits follow a planned frequency, based on the status and importance of the processes.
- Scope: the whole QMS is audited in a controlled cycle, not only the easy parts.
- Independence: auditors do not check their own work.
- Recording: the plan, the audit findings and the results are kept on paper or in a system.
- Follow-up: corrections and corrective actions are followed up without unnecessary delay. Afterwards, you check whether the actions were actually carried out and whether they work.
That last point is where many companies trip up. An audit that ends with a list of findings, with nothing done about them, produces a finding at the external audit.
Setting up an audit plan: an example
An audit plan is a table that shows, for each year, which processes are checked, when, and by whom. The example below is fictional: a manufacturer of a class IIa device with five core processes.
| Process | Risk indication | Frequency | Auditor | Quarter |
|---|---|---|---|---|
| Document control | Medium | Annual | Quality officer B | Q1 |
| Design and development | High | Half-yearly | External consultant | Q2 and Q4 |
| Supplier control | High | Annual | Purchaser, not responsible for the supplier | Q3 |
| Traceability and production | High | Half-yearly | Quality officer A | Q1 and Q3 |
| CAPA and complaints | High | Annual | Quality manager, not involved in the CAPAs | Q4 |
A high risk indication means a process is checked more often. You need to justify that choice, for example with the number of complaints, nonconformities or changes in the past year.
Step by step
Set the scope and frequency
Record which processes you audit every year and which ones more often. Link this to your risk management and your complaint data.
Choose auditors who do not run the process themselves
This does not have to be an external party. An employee from another team can audit a process, as long as they do not manage it themselves. Record the choice.
Create a checklist per process
Use the checklist below as a basis and translate the questions to your own system. For each point, ask for evidence, not just a yes or no.
Carry out the audit and record findings
For each finding, note: where, what, the evidence, and the classification (nonconformity or improvement point). A nonconformity gets a CAPA number. CAPA stands for corrective and preventive action; see CAPA.
Follow up the actions
Set an owner and a deadline for each action. After completion, check whether the cause has been removed. The auditor will also check this later.
Report to top management
Discuss the outcomes in the management review (see requirements of the standard). That is where top management decides on priorities and resources.
Checklist for an internal audit
| Question for the process | Evidence you show | Common mistake |
|---|---|---|
| Is the procedure the latest version? | Document control, approval and version history | An old work instruction is still hanging at the production line |
| Does the employee do it as described? | Observation on the shop floor plus training | The procedure exists, but nobody knows it |
| Are records filled in consistently? | Sample of 5 to 10 recent records | Fields are left blank without reason |
| Is a CAPA opened when there are deviations? | Link between the deviation and the CAPA number | The deviation is fixed but not recorded |
| Has effectiveness been checked? | Measurement data after the action | The action is closed without a check |
A sample is enough for most processes. Pick records from different periods, not only the records you already know.
Findings: what do you write down?
A good finding contains three elements: the requirement or procedure, what you saw, and the evidence. “The process is not good” is not a finding. “Work instruction WI-042 version 3 is in use on line 2, while version 5 was approved on 14 March” is a finding.
Classify the finding. A nonconformity means the system does not meet the standard or your own procedure. An improvement point means it meets requirements but could be better. Only nonconformities require a formal CAPA.
Common mistakes with the internal audit
- The auditor audits their own work. A quality manager who checks their own CAPA process does not give an independent judgment.
- Only the easy processes. An audit plan that always picks document control and never suppliers or traceability will be noticed at the external audit.
- Audit without follow-up. Findings are on paper, but there is no owner and no deadline.
- No evidence in the report. A report with only conclusions is hard to defend.
- An audit only for the auditor. If the internal audit happens only in the week before stage 1, the auditor will see that.
Stage 1 and stage 2 check whether the internal audit was carried out, not only whether a report exists. So start well before the external audit.
Internal audit and start-ups
For a small organisation, it is sensible to see the first internal audit as a learning tool. Especially at a start-up medtech company, you find gaps while they are still easy to close. You do not have to audit everything at once. Start with the core processes that matter most for your product, and expand from there.
An internal auditor does not need expensive training. They do need to know the standard and understand the process they check. For the costs of an external audit and the related internal effort, see costs and timeline.