ISO 13485 Internal Audit Report Template (with Sample Findings and Checklist)
This ISO 13485 internal audit report template includes a filled sample so you can see what a good finding looks like: a clause reference, the evidence found, a type, and a CAPA link. Change the fields, export to Word or PDF, and use the short checklist during the audit.
Fill in
ISO 13485 Internal Audit Report Template
Internal Audit Report
Organization: Acme Medical Devices Ltd Audit number: IA-2026-04 Audit date: 2026-10-14 Lead auditor: J. Rivera (Quality Engineer) Process audited: Purchasing and supplier evaluation
1. Scope and criteria
Scope: Purchasing process, approved supplier list maintenance, incoming inspection records for the last six months.
Criteria: ISO 13485:2016 clause 7.4, QP-004 Purchasing procedure, applicable regulatory requirements
Method: interviews, document and record review, sampling of records, observation. The auditor was independent of the process audited.
2. Findings
| No. | Type | Clause | Finding and evidence | CAPA no. | Due date |
|---|---|---|---|---|---|
| 1 | Nonconformity | 7.4.1 | Three of ten sampled critical suppliers had no documented re-evaluation within the interval set in QP-004. Evidence: approved supplier list rows 4, 7 and 9. | CAPA-2026-031 | |
| 2 | Observation | 4.2.4 | Incoming inspection sampling plan references a superseded revision of the inspection specification in the ERP; the released revision was used on the floor. | ||
| 3 | Good practice |
3. Conclusion
The purchasing process is generally effective. One nonconformity and one observation were raised. Corrective action is required for the supplier re-evaluation gap.
4. Audit checklist (record answers during the audit)
| Question (paraphrased requirement) | Evidence reviewed | Y / N / NA |
|---|---|---|
| Are suppliers evaluated and selected on their ability to supply to requirements, with criteria defined? | ||
| Is the approved supplier list controlled, with re-evaluation done at the defined interval? | ||
| Do purchasing records describe the product, including quality and regulatory requirements? | ||
| Is incoming product verified according to a plan matched to risk? | ||
| Are supplier performance issues recorded and acted on? | ||
| Are previous audit nonconformities closed with effective corrective action? |
Sign-off
Internal audits under clause 8.2.4 must be planned with a documented procedure, cover the whole system on a schedule that considers risk and previous results, use auditors independent from the area, and report results to management. This sample is a starting point and the checklist paraphrases clause 7.4; it does not replace the standard. Change the clause and criteria for each process audited.
Link audit findings to CAPA data
Optional: see how a private AI layer could retrieve audit evidence and open CAPA status from your systems.
Optional. The tool and every export work without this. No spam.
How to use this audit report template
Plan the audit before you write anything: scope, criteria, auditee, date and who is independent. During the audit, record evidence in the checklist table, such as record numbers, lot numbers and who you interviewed. After the audit, write each finding as the requirement, the evidence and the gap, then assign a clause reference and a type: nonconformity, observation or good practice. Link nonconformities to a CAPA so the report and the corrective action system match. Send the signed report to the process owner and include a summary in the next management review.
- One finding per issue, not a paragraph of mixed problems
- Cite record IDs, not 'some records'
- Classify nonconformities consistently, major versus minor, using your own definition
- Verify effectiveness of earlier CAPAs at the next audit of that process
What ISO 13485 requires of internal audits
Clause 8.2.4 requires audits at planned intervals to check that the quality management system conforms to the planned arrangements, the standard and your regulatory requirements, and is effectively implemented and maintained. The audit programme is planned considering the status and importance of the processes and areas, and the results of previous audits. A documented procedure must describe responsibilities, planning, reporting and records. Auditors must not audit their own work. Management responsible for the area must take timely action on findings, and follow-up must verify the actions and report the results.
Writing a good finding: sample wording
A weak finding says 'supplier evaluation is inadequate'. A strong one says: 'Three of ten critical suppliers sampled had no re-evaluation record within the interval defined in QP-004, rows 4, 7 and 9 of the approved supplier list. Requirement: clause 7.4.1.' The strong version is checkable, traceable and gives the CAPA owner a starting point. Add a risk comment where the gap could affect product quality or compliance, because it influences how quickly the action should close.
Auditor training and checklists
Internal auditor training for ISO 13485 should cover the standard, your regulatory environment, audit planning, interviewing, evidence collection and reporting findings. A checklist is a prompt, not a script, and auditors who read every question aloud miss what the evidence shows. Build checklists from your own procedures and risk, and keep them with the report so another auditor can see the sample. If you need a clause by clause list, start with our ISO 13485 internal audit checklist.
Frequently Asked Questions
What must an ISO 13485 internal audit report contain?
Scope and criteria, the date and auditors, findings with evidence and clause references, conclusions, and follow-up actions. The report is a record under clause 4.2.5 and feeds management review. The exact layout is up to you.
How often should internal audits be done?
Clause 8.2.4 requires planned intervals but does not fix them. Most manufacturers audit the whole system annually and high-risk processes more often. Consider process changes, complaints, and the previous audit results.
Can the quality manager audit their own department?
No. Auditors must be objective and impartial and must not audit their own work. In a small company, use an auditor from another department or an external auditor for that process.
What is the difference between an observation and a nonconformity?
A nonconformity is a failure to meet a requirement of the standard, regulation or your own procedure and needs corrective action. An observation is a potential weakness or improvement opportunity. Your audit procedure should define both.
If audit evidence is spread across your ERP, document control and CAPA tool, Netray can build a private AI layer on your own servers to retrieve it for the auditor in seconds.
Related Tools
ISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
Compliance & ContractsISO 13485 Document Templates
An editable ISO 13485 template set covering a quality manual outline, a software validation plan for ERP and quality software, and a supplier quality agreement.
Quality & InspectionAS9100 Internal Audit Report Template
Generate a structured internal audit report with scope, criteria, findings, observations and follow-up for an AS9100 quality management system.
Quality & InspectionISO 13485 Supplier Audit Checklist
A clause-based checklist for auditing component, material and service suppliers to a medical device manufacturer, covering QMS, process control, traceability and change control.
More Quality & Inspection tools
See all- CAPA Corrective and Preventive Action Form Template
- Device History Record (DHR) Template
- Process Validation IQ OQ PQ Template
- Medical Device Complaint Handling Form Template
- ISO 14971 Risk Management Worksheet
- Sterilization Load Record Template
- Medical Device Design Verification Protocol Template
- Medical Device Supplier Evaluation Scoring Worksheet
- Medical Device Cleanroom Environmental Monitoring Log
Keep exploring
Free tools
- ISO 13485 Internal Audit Report ExampleA filled-in internal audit report for a medical device manufacturer: scope, criteria, conforming practices, findings with clause references and conclusion.
- ISO 13485 Internal Audit ChecklistA clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
- ISO 13485 Internal Audit Plan and Management Review TemplateFill-in ISO 13485 internal audit plan and management review minutes covering required inputs and outputs, with guidance on clause 7.5.
AI on your ERP
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.
- AI for ProShop ERP in Medical Device Machining: Traceability, NCRs and Audit ReadinessPrivate AI for ProShop medical device machine shops: work orders, NCRs, CAPA, calibration and lot traceability answered from your own data, with QMSR in mind.