Skip to content

Free template

Updated

ISO 13485 internal audit checklist

An ISO 13485 internal audit is a medical device maker's own check that its quality management system works as ISO 13485 and its procedures say. It is done at planned intervals, by auditors who do not audit their own work. This ISO 13485 internal audit checklist has 38 questions on clauses 4 to 8 of ISO 13485:2016, in plain words, each with what to look at. Beside each question is the FDA QMSR section that brings the clause in: since February 2, 2026, 21 CFR Part 820 incorporates ISO 13485:2016 by reference, and adds a few requirements of its own on records (820.35), labeling and packaging (820.45) and UDI, tracking, reporting and corrections (820.10(b)). A production floor tab checks what an auditor sees at a station: the device history record complete to the current step, the current work instruction, operators trained before the task, nonconforming product segregated, and open NCRs and CAPAs moving. Every question is graded OK, Minor, Major, Critical or N/A. It supports internal audits beside your quality system; it is not a certification or MDSAP audit and does not make a plant compliant.

Free to use: print it, copy it and edit it for your team. Enter your name and work email once to download.

Page 1 of the ISO 13485 internal audit checklistAudit details, the five grades, and clause 4 to 6 questions, each with its clause, QMSR section, what to look at, a grade and a finding column.
38 questions, clauses 4 to 8QMSR section beside eachProduction floor tabFive grades with days to fixFindings logScore by clauseWorked catheter line auditPDF, Excel and Word
Filled-in ISO 13485 internal audit checklist: an internal audit of a catheter assembly line
The same sheet filled in with the worked example (page 7 of the PDF, illustrative numbers). Open full size (opens the picture in a new tab)

When to use it

When to use an ISO 13485 internal audit checklist

  • For the internal audits in your audit program, clause by clause or process by process, so the whole system is covered over the cycle.
  • Before a certification, surveillance or MDSAP audit, or an FDA inspection under the QMSR, to find gaps while there is time.
  • After a complaint trend, a field action or a run of NCRs on one line, to see whether the process behind it is working.
  • To train new internal auditors on what to look for at a station and how to trace from the floor back into the system.

How to fill it in

  1. 1

    Plan from the audit program

    Pick the clauses and processes due, weighted by importance and past results, and an auditor who does not work in the area.

  2. 2

    Start on the floor

    Use the production floor tab first: one row per station, against the lot running. What you see at the station tells you which records to pull.

  3. 3

    Trace back into the system

    From each station, trace to the procedure, the training record, the validation report, the calibration record and any open NCR or CAPA.

  4. 4

    Grade with the evidence

    Grade each question and write what you sampled: lot numbers, gauge IDs, record numbers. Name the clause and, where it adds something, the QMSR section.

  5. 5

    Hold product questions first

    A finding that touches released or running product, such as a validated process outside its range, goes to quality the same day for containment.

  6. 6

    Close in the CAPA system

    Agree findings in the closing meeting, give each an owner and a due date, and send systemic ones into CAPA. Verify effectiveness before closing.

On the floor

Start at the station, then trace back into the system

The order this checklist suggests, shown with the example's major finding.

  1. 1Floor

    See it at the station

    Pouch sealer at station 4 set to 182 °C.
  2. 2System

    Trace it back

    The validation report says 185 to 195 °C; three lots sealed since Monday.
  3. 3Product first

    Hold and test

    The three lots held and seal strength tested; NCR opened.
  4. 4CAPA

    Fix how it happened

    Find out how a validated setting changed without control.

ISO 13485 and the FDA QMSR

Where the QMSR adds to ISO 13485

21 CFR 820.10(a) brings in ISO 13485 as a whole. These are the places where the regulation adds something of its own, checked against the eCFR. Named, not quoted.

  • 4.2.5 records, with 8.2.2 complaints and 7.5.4 servicing

    QMSR section
    820.35(a), (b)
    What it adds
    Set details to record for investigated complaints and for servicing.
  • 7.5.1, 7.5.8, 7.5.9

    QMSR section
    820.35(c)
    What it adds
    The UDI recorded for each device or batch.
  • 7.5.1 control of production

    QMSR section
    820.45
    What it adds
    Labeling and packaging examined for accuracy before release and inspected before use, to prevent mix-ups.
  • 7.5.8 identification

    QMSR section
    820.10(b)(1)
    What it adds
    UDI assigned under part 830.
  • 7.5.9.1 traceability

    QMSR section
    820.10(b)(2)
    What it adds
    Tracking under part 821, where it applies.
  • 8.2.3 reporting

    QMSR section
    820.10(b)(3)
    What it adds
    Reportable complaints notified to FDA under part 803.
  • 7.2.3, 8.2.3, 8.3.3 advisory notices

    QMSR section
    820.10(b)(4)
    What it adds
    Handled under part 806 (corrections and removals).
  • 7.3 design and development

    QMSR section
    820.10(c)
    What it adds
    Required for class II and III devices and some class I devices.

The 38 questions

What to audit, clause by clause, with the QMSR section

Each question starts with its ISO 13485 clause and the FDA QMSR section that brings it in or adds to it, asks one question in plain words and says what to look at. The last group is the production floor tab, one row per station. On the sheet each one is graded OK, Minor, Major, Critical or N/A.

Clause 4: quality management system

Processes, QMS software, files, documents and records

  1. 14.1; QMSR 820.10(a): Are the QMS processes, their order and how they interact set out, with outsourced processes and their controls identified? Look at: the process map; one supplier that does a process for you, and how it is controlled.
  2. 24.1.6; QMSR 820.10(a): Is software used in the QMS (eQMS, ERP, test software) validated for its use before first use and after changes, in proportion to its risk? Look at: the list of QMS software and one validation record.
  3. 34.2.3; QMSR 820.10(a): Does each device type or family have a medical device file with its description, labeling, specifications and production procedures? Look at: the file for the device running today.
  4. 44.2.4; QMSR 820.10(a): Are documents approved before issue, is the current version the one in use, and are obsolete copies kept out of use? Look at: two documents at a station against the document list.
  5. 54.2.5; QMSR 820.35: Are records legible, retrievable and kept for the set period, and do complaint and servicing records hold the extra details the QMSR lists? Look at: retrieve one record from two years ago; one complaint record.

Clause 5: management responsibility

Policy, objectives, roles and management review

  1. 65.3, 5.4.1; QMSR 820.10(a): Are the quality policy and measurable quality objectives set, and do people in the area know the ones that apply to them? Look at: objectives on the area board; ask two people.
  2. 75.5.1, 5.5.2; QMSR 820.10(a): Are responsibilities and authorities defined and written, with a management representative named? Look at: the organization chart and two job descriptions.
  3. 85.6; QMSR 820.10(a): Is management review held at planned intervals with the inputs the standard lists (audits, feedback, complaints, CAPA, process and product monitoring) and recorded decisions? Look at: the last review's minutes and its actions.

Clause 6: resource management

People, infrastructure, work environment and contamination

  1. 96.2; QMSR 820.10(a): Are competence needs set for each job that affects quality, is training given before the task, and is its effectiveness checked? Look at: the line's training matrix against who is working today.
  2. 106.3; QMSR 820.10(a): Are buildings, equipment, utilities and supporting software maintained to written requirements, with records? Look at: maintenance records for one production machine.
  3. 116.4.1; QMSR 820.10(a): Are work environment requirements (temperature, humidity, cleanliness, clothing) written and monitored where they can affect the product? Look at: the cleanroom or work area monitoring log.
  4. 126.4.2; QMSR 820.10(a): Are contamination controls in place for the work environment, people and product, including particulate and microbial contamination where it matters? Look at: the contamination control procedure and the cleanroom records.

Clause 7: planning, customer requirements, design and purchasing

7.1 to 7.4

  1. 137.1; QMSR 820.10(a): Is product realization planned, with risk management applied and recorded across it? Look at: the risk file for the product running today.
  2. 147.2.1, 7.2.2; QMSR 820.10(a): Are customer and regulatory requirements reviewed before an order or change is accepted? Look at: one order review record.
  3. 157.3; QMSR 820.10(c): Where design controls apply, are design plans, inputs, outputs, reviews, verification, validation, transfer and changes recorded? Look at: the design records for one recent change.
  4. 167.4.1; QMSR 820.10(a): Are suppliers evaluated and chosen on criteria in proportion to risk, then monitored and re-evaluated? Look at: the approved supplier list and one supplier's file.
  5. 177.4.3; QMSR 820.10(a): Is purchased product verified before use (inspection, certificate or other means), as its risk calls for? Look at: receiving inspection records for one lot.

Clause 7: production and service provision

7.5 and 7.6

  1. 187.5.1; QMSR 820.45: Is production run under controlled conditions, with labeling and packaging examined before release and inspected before use to stop mix-ups? Look at: the line; the labeling inspection record.
  2. 197.5.2; QMSR 820.10(a): Where product must be cleaned or kept clean, is that done and recorded as specified? Look at: the product cleaning procedure and its record.
  3. 207.5.6; QMSR 820.10(a): Are processes whose output cannot be fully checked afterward (sealing, welding, molding, sterilization) validated, with criteria for revalidation? Look at: the validation report for one sealing or welding process, and its settings at the machine.
  4. 217.5.8; QMSR 820.10(b)(1): Is product identified at every stage, with its inspection status shown, and is a UDI assigned as part 830 requires? Look at: labels on work in progress and finished goods.
  5. 227.5.9; QMSR 820.10(b)(2), 820.35(c): Can a lot be traced from its components to its customers, with the UDI recorded for each device or batch? Look at: trace one finished lot back to its component lots.
  6. 237.5.11; QMSR 820.10(a): Is product protected from damage and contamination in handling, packaging and storage, and is shelf life controlled? Look at: storage conditions and shelf life labels.
  7. 247.6; QMSR 820.10(a): Is measuring equipment calibrated, identified and protected from adjustment, and is product assessed when a gauge is found out of tolerance? Look at: three gauges at a station; one out-of-tolerance record.

Clause 8: measurement, analysis and improvement

Feedback, complaints, audits, nonconforming product and CAPA

  1. 258.2.1; QMSR 820.10(a): Is feedback from production and post-production gathered and fed into risk management? Look at: the feedback procedure and one trend from it.
  2. 268.2.2; QMSR 820.35(a): Are complaints recorded, evaluated and investigated, with the reason recorded when no investigation is done? Look at: two complaint files.
  3. 278.2.3; QMSR 820.10(b)(3): Are complaints that meet reporting criteria reported to the regulator, to FDA under part 803 in the US? Look at: the reportability decision on one complaint.
  4. 288.2.4; QMSR 820.10(a): Are internal audits planned by importance and past results, done by auditors who do not audit their own work, and followed up? Look at: the audit program and the last audit's actions.
  5. 298.2.6; QMSR 820.10(a): Is product checked at the planned stages, with evidence of acceptance and the name of the person who released it? Look at: the final inspection record of one lot.
  6. 308.3; QMSR 820.10(b)(4): Is nonconforming product identified, recorded, segregated and dispositioned by authorized people, with concessions justified? Look at: the hold area and the NCR log.
  7. 318.4; QMSR 820.10(a): Are data from feedback, product conformity, process trends, suppliers and audits analyzed? Look at: the last data analysis report.
  8. 328.5.2; QMSR 820.10(a): Does corrective action find and act on the cause, check that the action does not harm the device's safety or performance, and verify that it worked? Look at: two closed CAPAs.
  9. 338.5.3; QMSR 820.10(a): Is preventive action taken on potential problems found in trends? Look at: one preventive action and what started it.

Production floor: station checks

Walk the line; one row per station visited

  1. 347.5.1; QMSR 820.10(a): Is the production record (the device history record) for the lot running complete up to the current step, signed at the time? Look at: the record at the station.
  2. 354.2.4; QMSR 820.10(a): Is the work instruction at the station the current approved version for the product running? Look at: its revision against the document list.
  3. 366.2; QMSR 820.10(a): Was each operator trained and signed off on this task before doing it? Look at: names on the record against training sign-off dates.
  4. 378.3; QMSR 820.10(a): Is nonconforming product tagged and kept in a marked hold area, not on the line? Look at: rejects at the station.
  5. 388.5.2; QMSR 820.10(a): Is each open NCR or CAPA for this line linked to its cause, with an owner and a due date that is being met? Look at: the line's open NCRs and CAPAs.

A filled-in example

Illustrative, not a benchmark

An example: an internal audit of a made-up contract manufacturer's catheter assembly and pouch-sealing line in an ISO 7 room (illustrative, the same as the Excel example sheet and page 7 of the PDF). The customer owns the design and reports complaints to the regulator.

The example audit, graded

  • OK: 32 questions
  • Minor: 3 questions
  • Major: 1 question
  • N/A: 2 questions

Score = OK ÷ (OK + Minor + Major + Critical)

38 questions, 2 N/A left out

  1. 32 ÷ 36= 88.9%
Score88.9%

38 questions: 32 OK, 3 minor, 1 major, 0 critical and 2 not applicable. Score 32 of 36 graded, 88.9 percent.

Illustrative. The 2 N/A questions are design and regulatory reporting, which the customer owns; they are left out of the score.
  • 38 questions: 2 N/A (7.3 design, owned by the customer; 8.2.3 reporting, done by the customer as legal manufacturer), so 36 graded.
  • 1 Major (7.5.6): the pouch sealer at station 4 was set to 182 °C against a validated range of 185 to 195 °C, with three lots sealed since the setting changed. Lots held and seal strength tested; NCR and CAPA opened.
  • 3 Minor: an old work instruction revision at station 2, replaced on the spot; a new operator who started a task two days before her sign-off; a pull tester 3 days past its calibration date, checked in tolerance the same day.
  • 32 OK, no Critical.

Score = 32 ÷ 36 = 88.9%. The Major is a product question first: hold and test the three lots, then find out how a validated setting was changed without control.

Common mistakes

  • Auditing clause numbers, not the floor

    Reading procedures clause by clause in an office misses the station with the old work instruction. Start on the floor and trace back.

  • Auditing your own area

    ISO 13485 asks that auditors do not audit their own work. In a small site, swap areas or bring in an auditor from a sister site.

  • Forgetting what the QMSR adds

    Under the QMSR, ISO 13485 is the base, but records, labeling, UDI and reporting carry extra FDA requirements. Check them where they apply.

  • Treating a validation finding as paperwork

    A validated process running outside its range is a product question. Contain first, then investigate the change.

  • Closing CAPAs without an effectiveness check

    Clause 8.5.2 asks you to verify the action worked. Closing on completion brings the same finding back next audit.

Download the template

Free to use: print it, copy it and edit it for your team. Enter your name and work email once to download.

Run this template in LeanSuite

Audit management in LeanSuite lets you build, schedule and run any shop floor audit or inspection, from layered process audits to gemba walks, and turn every finding into a tracked action.

See it in a 45-minute demo

FAQ

ISO 13485 internal audit checklist: common questions

  1. A medical device maker's own audit of its quality management system against ISO 13485 and its procedures, at planned intervals, by auditors who do not audit their own work. Findings feed corrective action and management review. It is required by clause 8.2.4.

  2. At planned intervals set by your audit program, weighted by how important each process is and what earlier audits found. A common pattern is to cover every clause and process at least once a year, with high-risk processes such as sterilization or sealing audited more often.

  3. Since February 2, 2026, the QMSR (21 CFR 820) incorporates ISO 13485:2016 by reference, so its internal audit clause applies to US device makers through the regulation. The QMSR also adds its own requirements on records, labeling and packaging, UDI and reporting, which an internal audit should cover.

  4. An internal audit is your own check of your system. An MDSAP audit is one audit, by a recognized auditing organization, that several regulators accept. Internal audits prepare you for it, and the MDSAP auditor will look at your internal audit program.

  5. At each station: the production record for the lot is complete to the current step, the work instruction is the current approved version, each operator was trained before the task, nonconforming product is tagged and held apart, and open NCRs and CAPAs for the line are moving.

More free templates

All templates
Browse all 254 templates

Can't find the template you need?

Tell us what you're looking for. We'll make it and send it to your inbox, free.

A shift handover sheet, a red tag log, a changeover checklist for one machine: if your team uses it on the floor, ask.

By sending this form you agree to our Terms of Service and Privacy Policy.

Pass it on

We want LeanSuite to be the best place on the internet for lean help. If this was useful, send it to someone on your team or in your network who needs it.