# ISO 13485 Internal Audit Checklist for Medical Device QMS > Source: https://netray.co/tools/iso-13485-internal-audit-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged. ## Category quality ## Industry Medical Devices ## Audience - Quality manager - Internal auditor - Regulatory affairs ## Tool **Kind:** checklist **Scoring Note:** Tick every item you can show objective evidence for. Items marked critical should be closed before a certification, surveillance or MDSAP audit. An item with no evidence is a finding, not a pass. **Groups:** #### Quality management system (clauses 4 and 5) **Items:** **Text:** Quality manual or equivalent defines scope, exclusions and justification for any non-applicable requirement **Critical:** true Your regulatory role (manufacturer, authorized representative, importer, distributor) is documented per market **Text:** Documented procedures exist for document control and changes are reviewed and approved **Critical:** true **Text:** A medical device file exists for each device type or family and is kept current **Critical:** true **Text:** Records are legible, identifiable, retrievable and have defined retention periods **Critical:** true Software used in the QMS or production is validated for its intended use Quality policy and measurable quality objectives are set and communicated **Text:** Management review inputs and outputs are complete and recorded at planned intervals **Critical:** true #### Resources and infrastructure (clause 6) **Items:** **Text:** Competence requirements are defined per role and training records prove them **Critical:** true Infrastructure and maintenance requirements are documented where they affect product quality **Text:** Work environment and contamination controls are defined for cleanrooms and controlled areas **Critical:** true Health, cleanliness and clothing requirements are defined for staff who affect product Environmental monitoring records exist and are reviewed #### Product realization (clause 7) **Items:** **Text:** A risk management process is documented and applied across the product life cycle **Critical:** true **Text:** Design and development plans, inputs, outputs, reviews, verification and validation are recorded **Critical:** true **Text:** Design transfer is documented and design changes are controlled **Critical:** true **Text:** Suppliers are evaluated, approved and re-evaluated on defined criteria **Critical:** true Purchasing information is complete and incoming inspection records exist **Text:** Production processes are controlled and a record exists for each batch or device **Critical:** true **Text:** Process validation covers processes where output cannot be fully verified **Critical:** true **Text:** Sterilization process validation records exist where applicable **Critical:** true **Text:** Unique device identification and traceability are implemented as required **Critical:** true Customer property, preservation and storage conditions are controlled **Text:** Calibration of monitoring and measuring equipment is traceable and up to date **Critical:** true Installation and servicing activities are controlled where applicable #### Measurement, analysis and improvement (clause 8) **Items:** **Text:** Feedback process collects production and post-production information for risk management **Critical:** true **Text:** Complaint handling is documented, timely and investigated, with decisions recorded **Critical:** true **Text:** Reporting to regulatory authorities is defined with timelines per market **Critical:** true **Text:** Internal audits follow a program based on process status and past results **Critical:** true Auditors are independent of the area audited Processes and product are monitored and measured with defined criteria **Text:** Nonconforming product is identified, segregated and dispositioned with records **Critical:** true Advisory notices and recalls have a documented procedure Data analysis covers trends in complaints, NCRs, audits and supplier performance **Text:** Corrective actions address root cause and are checked for effectiveness **Critical:** true Preventive actions are initiated from trends before problems occur ## Content **Intro:** Clause 8.2.4 of ISO 13485:2016 requires internal audits at planned intervals. This checklist follows the structure of the standard so you can plan, perform and record an audit against clauses 4 to 8 without starting from a blank page. **Sections:** #### How to use this checklist **Body:** Pick the process or clause group you are auditing, then tick each item only when you have seen objective evidence such as a record, a signed document or a live demonstration. Do not tick from memory or from an interview alone. Export the result to PDF or Excel and attach it to your audit report. Cover every clause of the QMS over your audit cycle, giving more frequency to high-risk processes and areas with past findings. **Bullets:** - Sample records, do not just check procedures exist - Trace one device from design input to complaint to prove the links - Record the evidence you saw, not only pass or fail - Raise a finding for each unmet requirement and track it as a CAPA #### What the standard asks of an internal audit **Body:** ISO 13485 requires a documented procedure covering the audit criteria, scope, frequency and methods, responsibilities and requirements for planning, conducting and reporting. Auditors must not audit their own work. Management of the area audited must take timely corrections and corrective actions on findings, and follow-up must verify the actions and report the results. Regulators and MDSAP auditors read internal audit records closely because they show whether the QMS can find its own problems. #### Reading your result **Body:** A high score means you can show evidence, not that the system is perfect. Any critical item left open should become a finding with an owner and a due date. If several unchecked items fall in the same clause, look for a systemic cause such as missing training or an out of date procedure instead of closing each one separately. Repeat the same checklist next cycle so you can compare results. #### Common mistakes **Body:** Frequent weaknesses are audits that only read procedures, a schedule that skips post-production processes, auditors who audit their own department, and findings closed with a correction but no root cause. Another is ignoring regional add-ons: MDSAP, EU MDR and 21 CFR Part 820 each add expectations beyond the base standard, so extend the checklist for each market you sell into. **Cta:** If audit evidence lives across your ERP, document system and quality tools, Netray can help build a private search over those records so auditors find evidence faster, with the data staying on your infrastructure. **Faq:** #### How often must ISO 13485 internal audits be done? **Answer:** The standard says at planned intervals, based on the status and importance of processes and past audit results. Many companies audit the whole QMS at least once a year, with higher risk areas such as sterilization and complaints reviewed more often. #### Who can perform an ISO 13485 internal audit? **Answer:** Any trained, competent and objective person who is not auditing their own work. Many companies use internal staff with lead auditor training, while smaller firms hire an outside auditor to keep independence. #### Does this checklist replace the standard? **Answer:** No. It is a working aid that paraphrases the structure of the standard. Always audit against the current text of ISO 13485:2016 and your regulatory requirements, which you must purchase from the standards body. #### Is this enough for an MDSAP audit? **Answer:** It covers the base ISO 13485 expectations. MDSAP adds requirements from the participating regulators, so add items from the MDSAP audit model and the rules of each country in your scope. ## Search terms ISO 13485 internal audit checklist, ISO 13485 audit checklist, ISO 13485:2016 internal audit, medical device QMS audit checklist, internal audit checklist medical device, ISO 13485 clause 8.2.4, MDSAP audit preparation checklist, ISO 13485 gap assessment --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json