It is mandatory and it comes first
Clause 8.2.4 requires internal audits at planned intervals, and clause 5.6 requires management review. Both must be complete before your certification audit — evidence is requested at Stage 1.
This catches manufacturers out the same way it does in every other ISO standard: internal audit sounds like something a mature QMS does once it is running, so it gets scheduled for afterwards. It is a prerequisite, not a follow-up.
What the programme must define
| Element | What it means |
|---|---|
| Scope and criteria per audit | Which processes and clauses, audited against what |
| Frequency | Planned intervals reflecting process importance and prior results |
| Auditor selection and independence | Auditors must not audit their own work |
| Method | How the audit is conducted and evidenced |
| Recording and reporting | Findings with evidence, reported to management |
| Follow-up | Corrections and corrective actions without undue delay, and verification |
The follow-up row matters: an audit that raises findings and never verifies their closure has not completed. That verification is itself auditable.
Independence in a small manufacturer
The requirement that auditors do not audit their own work is what makes internal audit genuinely difficult for small teams. If the quality manager wrote the procedures and operates most of the processes, there is nobody internal who can audit them independently.
Cross-audit internally where you have the headcount — someone from production audits document control, someone from engineering audits purchasing, with training.
Use an external internal auditor. A consultancy performs the internal audit as a service. This is legitimate and common. It is a different thing from the certification audit, which must come from an accredited certification body, and where the same firm built your QMS the conflict should be disclosed and managed.
What to audit, and where drift shows
Cover the whole QMS across the programme, but weight it toward where medical device quality systems actually drift:
CAPA. The ageing profile and the quality of root cause analysis. Most-cited area in medtech.
Design controls and the DHF. Whether the file has kept pace with design changes — see design controls.
Supplier controls. Evaluations current, agreements in place, critical suppliers actually monitored.
Complaint handling and post-market surveillance. Continuous obligations that quietly lapse between audits.
Process validation. Still valid after equipment or process changes.
Training records. Current for current roles.
An audit that finds nothing is a problem
A pre-certification internal audit reporting zero findings is not reassuring. It suggests the audit was not looking, and a certification body reading it will conclude the same.
Findings raised internally cost a fix. The same findings raised at Stage 2 cost a fix plus a follow-up audit and a delayed certificate. Internal audit is the cheapest place to find problems, and treating it as a formality forfeits that.
FAQs
Is internal audit required for ISO 13485?
Yes. Clause 8.2.4 requires internal audits at planned intervals and clause 5.6 requires management review. Both must be complete before the certification audit, and evidence of them is requested at Stage 1.
Who can perform an ISO 13485 internal audit?
Anyone competent who is independent of the area being audited, since auditors must not audit their own work. Small manufacturers commonly cross-audit between functions or engage a consultancy to perform the internal audit as a service, which is distinct from the certification audit.
How often should ISO 13485 internal audits happen?
At planned intervals reflecting the importance of the processes and the results of previous audits — annually as a minimum for most manufacturers, with the whole QMS covered across the programme. Higher-risk areas such as CAPA and design controls often warrant more frequent coverage.
What should an ISO 13485 internal audit focus on?
Where medical device quality systems drift: CAPA ageing and root cause quality, whether the design history file kept pace with design changes, supplier evaluations and agreements, complaint handling and post-market surveillance, process validation after changes, and current training records.
Is it a problem if the internal audit finds nothing?
Yes. A pre-certification internal audit with zero findings suggests the audit was not looking, and a certification body will read it that way. Findings raised internally cost a fix; the same findings at Stage 2 cost a fix plus a follow-up audit and a delayed certificate.
Where to go next
See ISO 13485 consulting, CAPA, or what certification costs.