ISO 13485 Internal Audit Report Example With Findings
A good internal audit report is short, factual and traceable. This ISO 13485 internal audit report example shows how to state scope and criteria, record what was seen, grade findings and tie them to clauses so the quality manager can feed them into CAPA and management review.
Fill in
ISO 13485 Internal Audit Report Example
Internal Audit Report IA-2026-04
Organization: Meridian Medical Components Inc. Audit date: 2026-09-16 Lead auditor: J. Rivera Auditee(s): Production manager, purchasing lead Audit criteria: ISO 13485 requirements, applicable regulatory requirements, the organization's quality manual and procedures
1. Scope and objective
Purchasing, supplier evaluation, incoming inspection and production of the infusion pump housing family (clauses 7.4, 7.5, 8.2.4, 8.3).
Objective: determine whether the processes in scope conform to planned arrangements, are effectively implemented and maintained, and meet the stated criteria.
2. Method
The audit was carried out by interview, observation of work and sampling of records. Samples were selected from the last 12 months. Auditor independence: the auditor does not work in the processes audited.
3. Positive observations
Complaint handling records were complete and traceable to CAPA. Calibration status labels were present and current on all gauges sampled. Device history records for the three lots sampled matched the production orders.
4. Findings
| No. | Grade | Description | ISO 13485 clause | Due date |
|---|---|---|---|---|
| 1 | Major nonconformity | Two critical suppliers on the approved supplier list had no re-evaluation record in the last 24 months, although the procedure requires an annual review (clause 7.4.1). | 7.4.1 | |
| 2 | Minor nonconformity | Cleaning station log for the molding area had three missing signatures in August (clause 6.4.1). | 6.4.1 | |
| 3 | Observation | Incoming inspection work instruction WI-RI-03 refers to a gauge that was replaced; the instruction may confuse new inspectors. | 7.5.1 | No action required |
5. Conclusion
Overall result: Partly effective, major finding raised.
The auditee must respond to each nonconformity with containment, root cause and corrective action, and the quality manager will track them to closure through the CAPA system. Effectiveness of the actions will be verified at follow-up.
6. Distribution and follow-up
Copies to: top management, process owners, quality manager. This report is an input to the next management review. Follow-up audit of findings 1 and 2 to be scheduled after the due dates.
7. Sign-off
The example is fictional. Replace every field with your own audit evidence. Clause references are to the ISO 13485 structure; confirm them against your licensed copy of the standard and add any regulatory references (for example FDA QMSR or EU MDR) that apply to your scope.
Audit evidence on demand
Optional: ask how a private AI layer can retrieve records for auditors from your ERP and QMS.
Optional. The tool and every export work without this. No spam.
How to use the example
Edit the fields with your audit details, then export the report to Word or PDF. Keep the findings text objective: say what the requirement is, what you saw and the evidence (record number, date, location). Avoid blame and avoid advice on the solution. Grade each finding using your own procedure, and give a due date for the response. Add the records sampled to your audit file so that the finding can be reproduced if challenged.
- State the requirement, the evidence and the gap.
- Cite the clause or procedure for every finding.
- Separate nonconformities from observations.
- Keep the report to a few pages.
What ISO 13485 expects from internal audits
Clause 8.2.4 requires internal audits at planned intervals to check that the quality management system conforms to the standard, regulatory requirements and the organization's own arrangements, and is effectively implemented and maintained. You need a documented procedure covering audit criteria, scope, frequency, methods, auditor selection for objectivity, and reporting. Management responsible for the audited area must act without undue delay to eliminate nonconformities and their causes, and follow-up must verify the actions. Results feed the management review.
Findings: grading and common mistakes
Most organizations use major and minor nonconformity grades plus an optional observation or opportunity. A major usually means a missing or systemic failure of a requirement, or a risk to product safety or compliance. A minor is an isolated lapse. Common mistakes are vague findings with no evidence, auditing only documents and not the work, mixing consultancy advice into the report, auditors reviewing their own processes, and no check that corrective actions worked. Plan the audit schedule by process risk and past results, not just by calendar.
- Findings with no objective evidence.
- Auditor not independent of the process.
- Corrective action closed without effectiveness check.
- Same findings repeated audit after audit.
Frequently Asked Questions
What should an ISO 13485 internal audit report include?
Scope, criteria, date, auditors and auditees, method, positive observations, findings with clause and evidence, an overall conclusion, distribution and follow-up dates. Sign-off by the lead auditor shows the report is complete.
How often must internal audits be done under ISO 13485?
At planned intervals defined in your audit procedure. Many companies cover all processes across a year, with higher-risk or problem areas audited more often. Regulators and notified bodies expect the plan to be risk based.
What is the difference between a major and minor nonconformity?
There is no single definition, so write yours in the audit procedure. A major usually means a system-level failure or a risk to safety or regulatory compliance, while a minor is an isolated lapse that does not undermine the system.
Can the quality manager audit their own area?
No. The standard asks for objectivity and impartiality, so auditors must not audit their own work. In small companies use a trained person from another area or an external auditor for the areas the quality manager owns.
Where audit evidence sits in an ERP, we can set up a private assistant on your own servers to pull the records an auditor asks for. This template stands on its own.
Related Tools
ISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
Quality & InspectionISO 13485 Nonconformance Report Template with Disposition and CAPA Link
An NCR form for medical device manufacturers with disposition, risk assessment, concession approval and a CAPA decision.
Quality & InspectionISO 13485 Management Review Example and Minutes Template
A filled-in management review minutes example with agenda, the review inputs, outputs, decisions and an action log you can adapt for ISO 13485 or AS9100.
Quality & InspectionAS9100 Internal Audit Report Template
Generate a structured internal audit report with scope, criteria, findings, observations and follow-up for an AS9100 quality management system.
More Quality & Inspection tools
See all- CAPA Corrective and Preventive Action Form Template
- Device History Record (DHR) Template
- Process Validation IQ OQ PQ Template
- Medical Device Complaint Handling Form Template
- ISO 14971 Risk Management Worksheet
- Sterilization Load Record Template
- Medical Device Design Verification Protocol Template
- Medical Device Supplier Evaluation Scoring Worksheet
- Medical Device Cleanroom Environmental Monitoring Log
Keep exploring
Free tools
- ISO 13485 Internal Audit Report TemplateA fillable ISO 13485 internal audit report with scope, findings by clause, CAPA references, conclusions and a short audit checklist. Includes realistic sample content.
- ISO 13485 Quality Plan Template with Medical Device File ExampleA fill-in ISO 13485 quality plan with a medical device file content example and a clause compliance checklist table.
- ISO 13485 Internal Audit ChecklistA clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
Guides
- ISO 13485 ERP Requirements for Medical Device Contract ManufacturersWhat ISO 13485 and FDA QMSR actually require of an ERP at a medical device contract manufacturer: records, traceability, change control and software validation.
- How to Quote Medical Device Contract Manufacturing WorkHow medical device contract manufacturers build a quote: materials with certs, cleanroom labor, validation, inspection, sterilization handoffs and NRE.
- ERP for Medical Device Manufacturing: Compliance, Traceability, and ValidationERP for medical device manufacturing: FDA 21 CFR Part 820, ISO 13485, UDI and DHR traceability requirements, plus vendor fit and implementation guidance.
AI on your ERP
- AI on Infor SyteLine for Medical Device Manufacturers: Genealogy, DHR and Audit EvidencePrivate AI on Infor SyteLine for medical device makers: lot and serial genealogy, DHR assembly, UDI and QMSR evidence, with human approval on every write.
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.