ISO 13485 Internal Audit Checklist (Free, Export)

0%

0 of 36 items complete

22 critical items still open - these are the highest-risk gaps.

Download checklist:

Quality management system (clauses 4 and 5)

Quality manual or equivalent defines scope, exclusions and justification for any non-applicable requirementCRITICALYour regulatory role (manufacturer, authorized representative, importer, distributor) is documented per marketDocumented procedures exist for document control and changes are reviewed and approvedCRITICALA medical device file exists for each device type or family and is kept currentCRITICALRecords are legible, identifiable, retrievable and have defined retention periodsCRITICALSoftware used in the QMS or production is validated for its intended useQuality policy and measurable quality objectives are set and communicatedManagement review inputs and outputs are complete and recorded at planned intervalsCRITICAL

Resources and infrastructure (clause 6)

Competence requirements are defined per role and training records prove themCRITICALInfrastructure and maintenance requirements are documented where they affect product qualityWork environment and contamination controls are defined for cleanrooms and controlled areasCRITICALHealth, cleanliness and clothing requirements are defined for staff who affect productEnvironmental monitoring records exist and are reviewed

Tick every item you can show objective evidence for. Items marked critical should be closed before a certification, surveillance or MDSAP audit. An item with no evidence is a finding, not a pass.

Audit evidence search over your own records

Optional: a short review of how private search could speed up audit evidence retrieval from your ERP and document systems.

Optional. The tool and every export work without this. No spam.

How to use this checklist

Pick the process or clause group you are auditing, then tick each item only when you have seen objective evidence such as a record, a signed document or a live demonstration. Do not tick from memory or from an interview alone. Export the result to PDF or Excel and attach it to your audit report. Cover every clause of the QMS over your audit cycle, giving more frequency to high-risk processes and areas with past findings.

Sample records, do not just check procedures exist
Trace one device from design input to complaint to prove the links
Record the evidence you saw, not only pass or fail
Raise a finding for each unmet requirement and track it as a CAPA

What the standard asks of an internal audit

ISO 13485 requires a documented procedure covering the audit criteria, scope, frequency and methods, responsibilities and requirements for planning, conducting and reporting. Auditors must not audit their own work. Management of the area audited must take timely corrections and corrective actions on findings, and follow-up must verify the actions and report the results. Regulators and MDSAP auditors read internal audit records closely because they show whether the QMS can find its own problems.

Reading your result

A high score means you can show evidence, not that the system is perfect. Any critical item left open should become a finding with an owner and a due date. If several unchecked items fall in the same clause, look for a systemic cause such as missing training or an out of date procedure instead of closing each one separately. Repeat the same checklist next cycle so you can compare results.

Common mistakes

Frequent weaknesses are audits that only read procedures, a schedule that skips post-production processes, auditors who audit their own department, and findings closed with a correction but no root cause. Another is ignoring regional add-ons: MDSAP, EU MDR and 21 CFR Part 820 each add expectations beyond the base standard, so extend the checklist for each market you sell into.

Frequently Asked Questions

How often must ISO 13485 internal audits be done?

The standard says at planned intervals, based on the status and importance of processes and past audit results. Many companies audit the whole QMS at least once a year, with higher risk areas such as sterilization and complaints reviewed more often.

Who can perform an ISO 13485 internal audit?

Any trained, competent and objective person who is not auditing their own work. Many companies use internal staff with lead auditor training, while smaller firms hire an outside auditor to keep independence.

Does this checklist replace the standard?

No. It is a working aid that paraphrases the structure of the standard. Always audit against the current text of ISO 13485:2016 and your regulatory requirements, which you must purchase from the standards body.

Is this enough for an MDSAP audit?

It covers the base ISO 13485 expectations. MDSAP adds requirements from the participating regulators, so add items from the MDSAP audit model and the rules of each country in your scope.

If audit evidence lives across your ERP, document system and quality tools, Netray can help build a private search over those records so auditors find evidence faster, with the data staying on your infrastructure.

Talk to an Expert Explore More Free Tools

Related Tools

Quality & Inspection

More Quality & Inspection tools

See all

ISO 13485 Internal Audit Checklist for Medical Device QMS