How ISO 13485 Audits Are Conducted
The ISO 13485:2016 certification audit is a systematic and independent evaluation of a manufacturer's quality management system (QMS). Udem Atlantic's audit process follows the principles established in ISO 19011 (Guidelines for auditing management systems) and is conducted by qualified auditors with expertise in medical device manufacturing and regulatory requirements.
The audit process is structured to ensure thorough coverage of all applicable ISO 13485 requirements while being respectful of the manufacturer's operations. Our auditors focus on objective evidence, process effectiveness, and compliance with both the standard and applicable regulatory requirements.
The Certification Audit Process
- Application and Contract Review: The process begins when the manufacturer submits a certification application. Udem Atlantic reviews the application to confirm the scope of the QMS, the types of medical devices covered, the number and location of manufacturing sites, and the number of employees. Based on this information, an audit plan and timeline are established.
- Stage 1 Audit — Documentation Review: The Stage 1 audit is a preliminary assessment focused on reviewing the organization's QMS documentation. Auditors evaluate the quality manual, documented procedures, process maps, and organizational structure to determine whether the QMS is adequately designed and documented. The Stage 1 audit also identifies any areas of concern that should be addressed before the Stage 2 audit. This audit may be conducted on-site or remotely, depending on the scope and complexity.
-
Stage 2 Audit — On-Site Assessment:
The Stage 2 audit is a comprehensive on-site evaluation of the QMS implementation
and effectiveness. The audit team examines objective evidence, including records,
documented information, and process outputs. Key activities include:
- Opening meeting with management to confirm the audit scope and plan
- Process audits covering design and development, production, purchasing, and service provision
- Review of CAPA records, complaint handling, and management review outputs
- Interviews with personnel at all levels of the organization
- Observation of manufacturing processes and working conditions
- Closing meeting presenting audit findings
- Nonconformity Management: If nonconformities are identified during the audit, they are classified as major or minor. Major nonconformities indicate a significant failure in the QMS that affects the ability to achieve intended outcomes. Minor nonconformities are isolated issues that do not compromise the overall system effectiveness. The manufacturer must submit corrective action plans and evidence of implementation within a defined timeframe.
- Certification Decision: A certification decision is made by qualified personnel who were not involved in the audit. The decision is based on the audit report, evidence of corrective actions for any nonconformities, and an overall assessment of QMS compliance. If the decision is favorable, the ISO 13485:2016 certificate is issued.
- Surveillance Audits: Following initial certification, Udem Atlantic conducts annual surveillance audits to verify ongoing QMS compliance. Surveillance audits are typically shorter than the initial certification audit and focus on specific processes, changes, and the effectiveness of corrective actions from previous audits.
- Recertification Audit: At the end of the three-year certification cycle, a recertification audit is conducted. This audit is similar in scope to the initial certification audit and evaluates the overall effectiveness of the QMS over the certification period.
What to Expect During an Audit
Udem Atlantic's auditors are professional, objective, and respectful. During the on-site audit, they will:
- Request access to documented information, records, and facilities relevant to the audit scope
- Interview employees at various levels to assess their understanding of quality procedures and responsibilities
- Observe processes in real-time to verify that documented procedures are followed in practice
- Review traceability records, device history records, and batch/lot documentation
- Assess the effectiveness of risk management processes throughout the product lifecycle
Preparing for Your ISO 13485 Audit
Successful audit outcomes are built on thorough preparation. Manufacturers should:
- Ensure all QMS documentation is current, approved, and accessible to relevant personnel
- Conduct internal audits covering all QMS processes before the certification audit
- Complete a management review that addresses all required inputs and outputs
- Verify that corrective and preventive actions from internal audits are implemented and effective
- Ensure employees are trained and can demonstrate understanding of their QMS responsibilities
- Confirm that all manufacturing records and device history files are complete and traceable
- Review all applicable regulatory requirements and ensure the QMS addresses them
Audit Duration and Planning
The duration of an ISO 13485 audit depends on the size of the organization, the complexity of its processes, the number of manufacturing sites, and the scope of products covered. Udem Atlantic calculates audit time in accordance with IAF mandatory documents and provides a clear audit plan well in advance of the scheduled dates.
For US manufacturers seeking ISO 13485 certification, Udem Atlantic's auditors are available to conduct audits at facilities throughout the United States.
Request a quote to begin planning your ISO 13485 certification audit with Udem Atlantic.