# ISO 13485 Gap Analysis Template with ISO 9001 and QMSR Comparison

> Source: https://netray.co/tools/iso-13485-gap-analysis-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Editable clause-by-clause ISO 13485:2016 gap analysis worksheet that shows how each clause compares with ISO 9001 and scores your gap.

## Category

quality

## Industry

Medical Devices

## Audience

- Quality manager
- Regulatory affairs
- QMS consultant

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### ISO 13485 clause

**Key:** clause

**Type:** text

#### Topic

**Key:** topic

**Type:** text

#### What the clause asks for (summary)

**Key:** requirement

**Type:** text

#### Versus ISO 9001

**Key:** vs9001

**Type:** select

**Options:**

- Similar
- More prescriptive
- Medical device specific
- No ISO 9001 equivalent

#### Weight (1-3)

**Key:** weight

**Type:** number

**Help:** 3 = high patient or regulatory risk

#### Maturity (0-4)

**Key:** maturity

**Type:** number

**Help:** 0 = nothing, 4 = implemented and effective

#### Gap points

**Key:** gap

**Type:** number

**Expr:** weight * (4 - maturity)

**Format:** integer

#### Owner

**Key:** owner

**Type:** text

#### Action to close gap

**Key:** action

**Type:** text

**Rows:**

#### General QMS requirements

**Clause:** 4.1

**Requirement:** Define processes, their sequence, risk-based control, outsourced process control, and QMS software validation (4.1.6).

**Vs9001:** More prescriptive

**Weight:** 3

**Maturity:** 2

**Owner:** QA Manager

**Action:** Validate QMS and ERP software used for records

#### Medical device file

**Clause:** 4.2.3

**Requirement:** Maintain a file per device type or family with specifications, process and procedures, and labeling.

**Vs9001:** No ISO 9001 equivalent

**Weight:** 3

**Maturity:** 1

**Owner:** RA Lead

**Action:** Build one device file index per product family

#### Control of records

**Clause:** 4.2.5

**Requirement:** Records legible, retrievable, protected, with retention at least the device lifetime and not less than 2 years from release.

**Vs9001:** More prescriptive

**Weight:** 2

**Maturity:** 3

**Owner:** Document control

**Action:** Confirm retention schedule per device lifetime

#### Management review

**Clause:** 5.6

**Requirement:** Planned reviews with defined inputs (feedback, complaints, audits, CAPA, regulatory changes) and recorded outputs.

**Vs9001:** More prescriptive

**Weight:** 2

**Maturity:** 3

**Owner:** Top management

**Action:** Add regulatory change input to agenda

#### Work environment and contamination control

**Clause:** 6.4

**Requirement:** Control environment, health, cleanliness and contamination of product where they affect conformity.

**Vs9001:** Medical device specific

**Weight:** 3

**Maturity:** 2

**Owner:** Operations

**Action:** Document cleanroom and gowning requirements

#### Planning of product realization

**Clause:** 7.1

**Requirement:** Plan realization processes and document a risk management process across the product lifecycle.

**Vs9001:** More prescriptive

**Weight:** 3

**Maturity:** 2

**Owner:** Engineering

**Action:** Link risk file to ISO 14971 process

#### Design and development

**Clause:** 7.3

**Requirement:** Planning, inputs, outputs, review, verification, validation, transfer, changes and a design file.

**Vs9001:** More prescriptive

**Weight:** 3

**Maturity:** 1

**Owner:** R&D

**Action:** Create design history file template

#### Purchasing

**Clause:** 7.4

**Requirement:** Supplier evaluation criteria tied to risk, purchasing information and verification of purchased product.

**Vs9001:** More prescriptive

**Weight:** 2

**Maturity:** 3

**Owner:** Purchasing

**Action:** Add risk tier to approved supplier list

#### Validation of production processes

**Clause:** 7.5.6

**Requirement:** Validate processes whose output cannot be fully verified, with criteria, equipment, personnel and revalidation.

**Vs9001:** More prescriptive

**Weight:** 3

**Maturity:** 2

**Owner:** Manufacturing Eng

**Action:** Inventory special processes and IQ/OQ/PQ status

#### Traceability

**Clause:** 7.5.9

**Requirement:** Documented traceability procedures; implantable devices need component, lot and work environment records.

**Vs9001:** More prescriptive

**Weight:** 3

**Maturity:** 3

**Owner:** Operations

**Action:** Test a mock recall trace

#### Complaint handling

**Clause:** 8.2.2

**Requirement:** Documented process to receive, evaluate, investigate and trend complaints, with a decision on reporting.

**Vs9001:** No ISO 9001 equivalent

**Weight:** 3

**Maturity:** 2

**Owner:** Complaints lead

**Action:** Add reportability decision step

#### Reporting to regulatory authorities

**Clause:** 8.2.3

**Requirement:** Procedure for notifying authorities of adverse events and advisory notices as regulations require.

**Vs9001:** No ISO 9001 equivalent

**Weight:** 3

**Maturity:** 1

**Owner:** RA Lead

**Action:** Map timelines per market

#### Control of nonconforming product

**Clause:** 8.3

**Requirement:** Control NC product, evaluate need for investigation, rework with documented procedure, and advisory notices.

**Vs9001:** More prescriptive

**Weight:** 2

**Maturity:** 3

**Owner:** Quality

**Action:** Add rework instruction approval step

#### Corrective and preventive action

**Clause:** 8.5.2 / 8.5.3

**Requirement:** Corrective action without delay and preventive action to remove causes of potential nonconformities, with verification.

**Vs9001:** More prescriptive

**Weight:** 2

**Maturity:** 3

**Owner:** Quality

**Action:** Check effectiveness verification records

**Totals:**

#### Total weight

**Key:** weight

**Agg:** sum

**Format:** integer

#### Total gap points

**Key:** gap

**Agg:** sum

**Format:** integer

**Summary:**

#### Readiness against listed clauses

**Key:** readiness

**Expr:** (1 - sum_gap / (sum_weight * 4)) * 100

**Format:** percent

**Primary:** true

**Description:** 100 percent means every weighted clause is at maturity 4.

**Notes:** Rows are examples. Add a row for every clause and sub-clause that applies to your scope, including documented exclusions under clause 1.2. Summaries are paraphrased, read the standard itself for the exact requirements.

## Content

**Intro:** This ISO 13485 gap analysis template walks the clauses of ISO 13485:2016, shows where each one differs from ISO 9001, and turns your maturity scores into a single gap number. Edit the rows, add your own clauses and export to Excel.

**Sections:**

#### How to use the gap analysis template

**Body:** Start with the clause list in the standard's table of contents: 4 Quality management system, 5 Management responsibility, 6 Resource management, 7 Product realization and 8 Measurement, analysis and improvement. For each clause, score weight 1 to 3 by patient and regulatory risk and maturity 0 to 4 by how well you do it today with objective evidence. The sheet multiplies weight by the distance from full maturity so a weak high risk clause outweighs a weak low risk one.

**Bullets:**

- Score from records you can show an auditor, not from intent
- Record an owner and a specific action per gap
- Re-score monthly and export a copy for management review

#### ISO 9001 and ISO 13485 comparison in practice

**Body:** ISO 13485 is not a superset of ISO 9001. It drops the customer satisfaction and continual improvement emphasis and replaces them with regulatory compliance and device safety. Expect the largest new work in design controls, risk management through the lifecycle, process validation, traceability, complaint handling and regulatory reporting. The column Versus ISO 9001 flags which clauses a company coming from ISO 9001 will find familiar and which have no equivalent.

**Bullets:**

- No ISO 9001 equivalent: medical device file, complaint handling, regulatory reporting
- More prescriptive: documentation, design, purchasing, traceability
- Medical device specific: work environment, sterile device and implant controls

#### Comparing with FDA QSR and QMSR

**Body:** FDA's Quality Management System Regulation (QMSR) amends 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, with effect from 2 February 2026. A gap analysis for US devices therefore uses the same clause structure and adds the FDA specific items: complaint files, medical device reporting under Part 803, UDI, labeling and the records FDA can inspect that ISO auditors do not always request. Keep one extra column or a second sheet for the FDA specific actions.

#### Common mistakes

**Body:** Teams score a clause as mature because a procedure exists, even though records show it is not followed. Others forget software used in the QMS, including ERP lot traceability and electronic signatures, which clause 4.1.6 requires to be validated for its intended use. Finally, exclusions are only allowed for clause 7 requirements that do not apply, and they must be justified in the quality manual.

**Cta:** If your lot genealogy, complaints and CAPA data sit in an on-prem ERP, Netray can add a private AI layer that answers trace and audit questions from that data without sending it outside your network.

**Faq:**

#### How long does an ISO 13485 gap analysis take?

**Answer:** For a small manufacturer with an existing ISO 9001 system, a first pass usually takes a few days of interviews and record sampling. The scoring is quick, but collecting evidence per clause is what takes time. Plan a second pass after corrective actions are in place.

#### Is ISO 13485 the same as ISO 9001 plus medical rules?

**Answer:** No. It follows a similar structure, but it is built around regulatory compliance and risk, drops several ISO 9001 improvement and customer satisfaction requirements and adds device specific controls for design, validation, traceability and complaints.

#### Does QMSR replace ISO 13485 for US devices?

**Answer:** QMSR incorporates ISO 13485:2016 by reference into 21 CFR Part 820 and adds FDA specific requirements. Certification to ISO 13485 is still voluntary for FDA purposes, but the content you must meet is now aligned.

#### Can I exclude clauses from my ISO 13485 scope?

**Answer:** Only clause 7 requirements that do not apply to your activities can be excluded, and the reason must be recorded in your quality manual. Clauses 4, 5, 6 and 8 cannot be excluded.

## Search terms

iso 13485 gap analysis template, iso 13485 gap analysis excel, iso 9001 and 13485 comparison table, iso 13485:2016 table of contents, qsr iso 13485 comparison table, iso 13485 checklist for gap assessment, iso 9001 to iso 13485 transition, qmsr gap assessment

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json