ISO 13485 Audit Plan Template and Management Review Template
This ISO 13485 audit plan template and management review template give you both documents in one fill-in file. Edit the fields, export to Word or PDF, and use the notes below on clause 7.5, good documentation practices and post-market surveillance.
Fill in
ISO 13485 Internal Audit Plan and Management Review Template
Internal Audit Plan: Acme Medical Devices Inc
Scope of QMS: Design, manufacture and distribution of Class II single-use surgical instruments at the Wichita site. Process audited: Production and service provision (clause 7.5) Date: 2026-11-10 Lead auditor: S. Wong (independent of the area audited) Criteria: ISO 13485:2016, company QMS procedures, 21 CFR Part 820 (QMSR), customer and regulatory requirements
Objectives
Determine whether the process conforms to planned arrangements, to ISO 13485 and to applicable regulatory requirements, and whether it is implemented and maintained effectively. Consider previous audit results, complaints, CAPA and process performance when deciding the depth of audit.
Audit schedule
| Time | Activity | Clause focus | Contact |
|---|---|---|---|
| 08:30 | Opening meeting | Scope and plan | |
| 09:00 | Production control and work instructions | 7.5.1 | |
| 10:30 | Process validation and equipment records | 7.5.6, 7.6 | |
| 13:00 | Identification and traceability sampling | 7.5.8, 7.5.9 | |
| 14:30 | Cleanliness, environment and records | 6.4, 4.2.5 | |
| 15:30 | Auditor review | ||
| 16:00 | Closing meeting | Findings summary |
Process checklist prompts
| Prompt | Evidence to sample | Result |
|---|---|---|
| Are work instructions current and available at point of use? | Controlled copies | |
| Do batch records show every step completed, signed and dated? | 3 recent device history records | |
| Are validated processes within their validated parameters? | Validation reports and run data | |
| Can a finished lot be traced to materials and equipment? | Mock trace | |
| Were corrections to records made per good documentation practice? | Record sample |
Management Review Minutes
Date: 2026-12-05 Chair: J. Doe, President Period reviewed: 1 Dec 2025 to 30 Nov 2026 Attendees:
Review inputs (clause 5.6.2)
| Input | Summary and data | Trend |
|---|---|---|
| Feedback | ||
| Complaint handling | ||
| Reporting to regulatory authorities | ||
| Audits (internal, external, supplier) | ||
| Monitoring of processes | ||
| Monitoring of product | ||
| Corrective and preventive action | ||
| Follow-up from earlier reviews | ||
| Changes that could affect the QMS | ||
| Recommendations for improvement | ||
| New or revised regulatory requirements |
Review outputs (clause 5.6.3)
| Output | Decision | Owner | Due |
|---|---|---|---|
| Improvements needed to keep QMS suitable, adequate and effective | |||
| Improvement of product related to customer and regulatory requirements | |||
| Changes needed to the QMS | |||
| Resource needs |
Approvals
Keep the audit plan, report and review minutes as quality records under clause 4.2.5. Auditors must not audit their own work. Adapt prompts to your process and regulatory markets.
Automate your management review inputs
Optional: see how complaint, CAPA and audit data can be pulled from your ERP into review inputs.
Optional. The tool and every export work without this. No spam.
Using the audit plan and review templates
Clause 8.2.4 requires internal audits at planned intervals to check conformity and effective implementation. Plan the program by risk and importance of each process, then use one plan per audit like the first half of this template. Management review under clause 5.6 happens at planned intervals and must consider the inputs listed, with outputs recorded as decisions with owners and dates. Both documents are records, so keep signed copies.
- Audit independence: auditors do not audit their own work
- Use results of the last audit, complaints and CAPA to set depth
- Review the QMS at least annually, more often if risk requires
What is ISO 13485 clause 7.5
Clause 7.5 covers production and service provision. It requires controlled conditions: documented procedures and work instructions, suitable equipment, monitoring and measurement, labeling and packaging operations, and the use of validated processes where output cannot be verified. Sub-clauses address cleanliness, installation, servicing, sterile devices, process validation, identification, traceability, customer property and preservation of product. Traceability for implantable devices must include component and work environment records.
Good documentation practices and post-market surveillance
Good documentation practice means records are attributable, legible, contemporaneous, original and accurate: one line strike-through for corrections with date, initials and reason, no white-out, no pre-dated entries, and electronic records protected by access controls and validated software. Post-market surveillance is the proactive collection and review of experience from devices in the field, including complaints, service data and literature, and it feeds management review, risk management and CAPA. Regulators in several markets require a documented plan and periodic reports.
Common mistakes
Treating management review as a slide deck without decisions, auditing only against procedures instead of the standard and regulations, allowing the quality manager to audit their own function, and keeping handwritten corrections that obscure the original entry. Make sure every review output has an owner and due date and that actions are tracked to closure.
Frequently Asked Questions
How often are ISO 13485 internal audits required?
The standard says at planned intervals. Most companies cover the whole QMS at least once a year, with higher risk or poorly performing processes audited more often, based on a documented audit program.
What must be in ISO 13485 management review?
Inputs include feedback, complaints, regulatory reporting, audits, process and product monitoring, CAPA, follow-up actions, changes, recommendations and new regulatory requirements. Outputs cover improvements, changes and resources.
What is post-market surveillance under ISO 13485?
It is the ongoing collection and analysis of data on devices in the market, such as complaints and service records. ISO 13485 links it to feedback, complaint handling and regulatory reporting, and many markets add formal plan and report requirements.
What are good documentation practices?
Records must be attributable, legible, contemporaneous, original and accurate. Correct errors with a single line, initials, date and reason, never obscure the original, and protect electronic records with validated systems and access control.
Netray can build a private AI assistant over your ERP and quality records so audit and review inputs such as complaint trends are produced from live data on-prem.
Related Tools
ISO 13485 Gap Analysis Template
Editable clause-by-clause ISO 13485:2016 gap analysis worksheet that shows how each clause compares with ISO 9001 and scores your gap.
Quality & InspectionISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
Compliance & ContractsMedical Device Post-Market Surveillance Plan Template
Plan template covering data sources, analysis methods, trend triggers and reporting for post-market surveillance.
Quality & InspectionAS9100 Management Review Minutes Template
Record management review inputs, decisions and actions in a structured document that follows AS9100 clause 9.3 and exports to PDF or Word.
More Quality & Inspection tools
See all- CAPA Corrective and Preventive Action Form Template
- Device History Record (DHR) Template
- Process Validation IQ OQ PQ Template
- Medical Device Complaint Handling Form Template
- ISO 14971 Risk Management Worksheet
- Sterilization Load Record Template
- Medical Device Design Verification Protocol Template
- Medical Device Supplier Evaluation Scoring Worksheet
- Medical Device Cleanroom Environmental Monitoring Log
Keep exploring
Free tools
- ISO 13485 Management Review Example and Minutes TemplateA filled-in management review minutes example with agenda, the review inputs, outputs, decisions and an action log you can adapt for ISO 13485 or AS9100.
- ISO 13485 Internal Audit ChecklistA clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
- ISO 13485 Internal Audit Report TemplateA fillable ISO 13485 internal audit report with scope, findings by clause, CAPA references, conclusions and a short audit checklist. Includes realistic sample content.
Guides
- ISO 13485 ERP Requirements for Medical Device Contract ManufacturersWhat ISO 13485 and FDA QMSR actually require of an ERP at a medical device contract manufacturer: records, traceability, change control and software validation.
- Using AI to Review Device History Records Before Lot ReleaseHow a medical device contract manufacturer can use private AI to pre-check device history records for missing entries, cert mismatches and out-of-spec data.
- How to Set Up ISO 9001 Workflows in SyteLineComplete guide to configuring ISO 9001:2015 quality management workflows in Infor SyteLine. Set up management review, internal audit, risk assessment, continual improvement, and process performance monitoring.
AI on your ERP
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.
- AI on Infor SyteLine for Medical Device Manufacturers: Genealogy, DHR and Audit EvidencePrivate AI on Infor SyteLine for medical device makers: lot and serial genealogy, DHR assembly, UDI and QMSR evidence, with human approval on every write.