Last reviewed: October 2026
No Credit Card Required
This free ISO 13485 internal audit checklist is for quality managers, internal auditors and regulatory affairs teams at medical device manufacturers. One run covers one internal audit from the audit programme: the scope and criteria, independent and competent auditors, the document and medical device file review, the opening meeting, fieldwork by clause from the QMS to CAPA, graded findings, the closing meeting and the report. When the audit raises a nonconformity, the corrective action plan needs the quality manager’s approval before the actions and their verification can be completed. Choosing the US, Great Britain or the EU adds that market’s rules to the tasks they affect, and the device types and design scope add the matching tasks.
ISO 13485:2016 sets out quality management system requirements for organisations involved in the design, production, installation and servicing of medical devices. It is the third edition, published in March 2016, and ISO last reviewed and confirmed it in 2025. Compared with ISO 9001 it puts more weight on regulatory requirements, risk management and process validation, and it asks for things a general quality system does not have, such as a medical device file for each device type or family, complaint handling and reporting to regulatory authorities.
Regulators now build on it directly. In the United States, the Quality Management System Regulation (21 CFR part 820), effective 2 February 2026, incorporates ISO 13485:2016 by reference, and FDA investigators may now read internal audit reports, which the old regulation kept out of inspections. Article 10(9) of the EU Medical Devices Regulation requires a quality management system covering a list of aspects from regulatory strategy to CAPA, and the MHRA regulates the Great Britain market under the UK Medical Devices Regulations 2002.
This checklist covers one internal audit of a medical device QMS, by clause, with notes for the markets you supply. The ISO 9001 internal audit checklist audits one process of a general quality management system; use this one where the devices, their files and their regulators are in scope. Preparing for an FDA visit itself is covered by the FDA inspection readiness checklist, and the CAPA checklist runs larger corrective actions on their own.
Covers: the reason for the audit, objectives, scope and criteria, independent and competent auditors, earlier findings, the procedures and the medical device files to sample.
Owned by: the quality manager and the lead auditor.
Output: an audit plan the auditee manager has agreed.
Covers: the QMS and documentation, management responsibility, resources, product realisation from design to servicing, and measurement, analysis and improvement, with sterile, implantable and design tasks when they apply.
Owned by: the lead auditor, with regulatory affairs for anything reportable.
Output: objective evidence for every clause sampled.
Covers: graded findings, the closing meeting, the report, the corrective action plan, the quality manager’s approval and verification of effectiveness.
Owned by: the auditee manager, with the quality manager’s approval.
Output: closed findings and a complete audit record.
Eight phases take one audit from its slot in the programme to verified corrective action. The market, the device types and design scope chosen on the first task add the matching notes and tasks. Phases 7 and 8 appear only when the audit raises a nonconformity, and nothing after the quality manager’s approval of the corrective action plan can be completed until it is given.
Each internal audit is one entry in your audit programme. Answer the setup questions first: the market, whether design and development is in scope and the device types decide which notes and tasks appear.
Read the documents before you go to the floor, so fieldwork tests what people do against what the procedures say. Choose the medical device files and the data trends to follow now.
Clauses 4 to 6 cover the quality management system, management responsibility and resources. Sample real records and talk to the people who do the work, not only the managers.
Clause 7 covers how the device is planned, designed, bought, made, released and serviced. Trace real batches and real design records. The design, sterile and implantable tasks appear only when the first task puts them in scope.
Clause 8 holds what regulators look at first: feedback, complaints, reports to regulators, nonconforming product and CAPA. Read real complaint files, not only the procedure. If the sample shows a possibly reportable event that nobody assessed, the escalation task appears.
Write each finding so the auditee manager can find the same evidence again. The answer to “Were any nonconformities raised?” decides whether Phases 7 and 8 appear.
Appears only when the audit raised a nonconformity. A correction deals with the problem found; corrective action removes its cause. Nothing after the quality manager’s approval of the plan can be completed until it is given.
A finding stays open until the auditor has seen evidence that the action worked. Leave enough time for the changed process to produce new records before you check.
ISO 13485 is the same everywhere, but each market adds its own rules, and an internal audit should test them too. The table compares a few that the clause 7 and 8 tasks check. It is drawn from 21 CFR parts 803, 806 and 820 on eCFR, FDA’s QMSR pages, the UK Medical Devices Regulations 2002 on legislation.gov.uk, the MHRA’s guidance on regulating medical devices in the UK and Regulation (EU) 2017/745 on EUR-Lex. It is a summary, not legal advice: check the current text for your devices.
| What the audit checks | United States (QMSR) | Great Britain (UK MDR 2002) | EU and Northern Ireland (EU MDR) |
|---|---|---|---|
| The quality management system | Section 820.10: document a QMS that complies with ISO 13485:2016, plus the added requirements of part 820. In force since 2 February 2026. | Devices must conform to the UK MDR 2002, with UKCA marking or a CE marking still accepted until 30 June 2028 or 30 June 2030, depending on the device. | Article 10(9): a QMS proportionate to the risk class and type of device, addressing at least the aspects the Article lists. |
| Serious incidents | Medical device reports within 30 calendar days of becoming aware, or 5 work days when remedial action is needed or FDA asks (803.50, 803.53). | Regulation 44ZH: no later than 15 days after becoming aware; 10 days for a death or unanticipated serious deterioration; 2 days for a serious public health threat. | Article 87: the same 15, 10 and 2 days. Incidents in Northern Ireland are reported to the MHRA. |
| Field actions | Corrections and removals to reduce a risk to health reported within 10 working days of starting them (806.10). | Regulation 44ZJ: a risk assessment, an initial report and the proposed field safety notice before the action, unless it is urgent. | Article 87(1)(b): field safety corrective actions are reported, including some taken outside the EU. |
| Post-market information | Section 820.35(a): complaint records with set content, and a recorded justification when a complaint is not investigated. | Regulation 44ZE: a post-market surveillance system for each device, used to find corrective actions and trends. | Article 10(10): a post-market surveillance system kept up to date under Article 83. |
| Identification and registration | Section 820.10(b): a UDI system under part 830 and tracking under part 821 where it applies; the UDI recorded for each device or batch. | Devices registered with the MHRA before they are placed on the market; a UK responsible person for manufacturers outside the UK. | Article 10(7): UDI obligations under Article 27 and registration under Articles 29 and 31. |
Certificates and inspections are separate. FDA says it will not require, or issue, certificates of conformance to ISO 13485, and a certificate does not exempt a manufacturer from inspection. FDA inspections assess compliance with FDA regulations, while third-party audits assess conformance to the standard. FDA does use reports from the Medical Device Single Audit Program (MDSAP) in place of routine surveillance inspections for manufacturers that take part.
The quality manager’s approval of the corrective action plan is assigned to them alone, and the checklist halts there. The actions and their verification cannot be completed until every action, owner, date and effectiveness check has been approved. See how approvals that halt a checklist work.
Choose the US, Great Britain, the EU or several markets, and the tasks they affect show that market’s rules on records, labelling, UDI, post-market surveillance and reporting. A possibly reportable complaint found in the sample goes straight to regulatory affairs. The Reports Grid shows every audit as tasks are completed, so the quality manager can follow the programme without asking.
Planning tasks count back from the opening meeting, and fieldwork, the report, the corrective action plan and verification count forward from it. Run the next audit in the programme on a recurring schedule, and change the offsets or add your own procedure’s steps in the template designer.
CheckFlow does not certify anything, and this template is not certification, legal or regulatory advice. It does not tell you whether your quality management system conforms to ISO 13485 or meets any regulation. It runs the same audit steps in the same order every time, with a record of who did what and when.
This template covers one internal audit. Run larger corrective actions with the CAPA Checklist and the Root Cause Analysis (8D) Checklist, audit your suppliers with the Supplier Audit Checklist, and prepare for an FDA visit with the FDA Inspection Readiness Checklist. The Annual Compliance Calendar Checklist keeps the audit programme on schedule. Running audits across several sites? CheckFlow’s compliance checklist software keeps owners, evidence and sign-offs in one place.
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
It tests whether your medical device quality management system meets ISO 13485:2016, your own procedures and the regulations of the markets you supply, and whether it works in practice. Across the audit programme that means the QMS and documentation, management responsibility, resources, product realisation from design to servicing, and measurement, analysis and improvement. One audit samples part of that, chosen for the importance of the processes and the results of earlier audits.
ISO 9001 applies to any industry. ISO 13485 is written for medical devices and puts more weight on regulatory requirements, risk management and process validation. An ISO 13485 audit also samples things ISO 9001 does not require, such as medical device files, complaint handling, reports to regulators, sterile and implantable device controls and UDI. For a general quality system, use the ISO 9001 internal audit checklist.
Yes, for inspections under the Quality Management System Regulation. FDA’s questions and answers on the QMSR say it gives FDA the authority to inspect management review, quality audit and supplier audit reports, and that the exemption in the old section 820.180(c) was not kept. FDA reasons that manufacturers already give these records to other regulators. Write internal audit reports as records an investigator may read.
No. FDA says it will not require certificates of conformance to ISO 13485 and will not issue them, and a certificate does not exempt a manufacturer from an FDA inspection. FDA inspections assess compliance with FDA regulations. The QMSR does require a documented quality management system that complies with the applicable requirements of ISO 13485:2016, so the internal audit should test against it either way.
On 2 February 2026, two years after FDA published the final rule. The QMSR incorporates ISO 13485:2016 and clause 3 of ISO 9000:2015 by reference and adds requirements of its own, for example on UDI, complaint and servicing records, and labelling and packaging. On the same date FDA stopped using the Quality System Inspection Technique and began inspecting under Compliance Program 7382.850.
Yes. ISO lists ISO 13485:2016 as the third edition, published in March 2016, and says it was last reviewed and confirmed in 2025. It replaced the 2003 edition. FDA has said it will evaluate any future revision to decide whether the QMSR should be amended, which would be done through rulemaking.
Escalate it to regulatory affairs the same day rather than waiting for the audit report, because reporting time limits run from when the manufacturer becomes aware. In the US a medical device report is due within 30 calendar days, or 5 work days in some cases. In Great Britain and the EU a serious incident is reported within 15 days at most, 10 days for a death or unanticipated serious deterioration and 2 days for a serious public health threat.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request
