Our Audit Program has five parts:

1. ISO 13485 Compliance Audit Program

2. ISO 13485 Policy Audit Program

3. ISO 13485 Procedures Audit Program

4. ISO 13485 Process Audit Program

5. ISO 13485 Records Audit Program

Each of these five programs will be discussed below.

We begin with a table of contents. It shows how we've organized our
ISO 13485 Internal Audit Program. While the content of each program
is different, the following table shows that each one of our five audit
programs is organized in the same way.

Our Audit Program uses questions to list the ISO 13485 2003 quality
management system requirements. Like ISO’s five sets of requirements,
our Audit Program consists of five separate questionnaires (which start
with the number 4 because ISO’s requirements start in section 4):

4. Systemic Audit Questionnaire

5. Management Audit Questionnaire

6. Resource Audit Questionnaire

7. Realization Audit Questionnaire

8. Remedial Audit Questionnaire >>> SAMPLE

ISO 13485:2003 is based on the ISO 9001:2000 quality management
standard. Both standards are organized in the same way and use much
the same numbering system. In addition, most of the ISO 13485:2003
requirements are taken directly from ISO 9001:2000 without modification.
In order to distinguish between ISO 9001:2000 and ISO 13485:2003
requirements we use two different fonts and colors. A black font
will be used to present ISO 9001 audit questions, while a blue font
will be used to present audit questions that are unique to ISO 13485.

In general, our Compliance Audit Program asks two types of questions:
questions that specify ISO 13485 mandatory quality management system
requirements and questions that specify requirements that may be excluded
or ignored under some circumstances. Questions that point to mandatory
requirements allow two response options: YES or NO, while questions that
specify requirements that may be excluded offer three response options:
YES, NO, or N/A. An N/A response option is provided because you may
exclude or ignore some requirements if you can justify doing so.

You can exclude ISO 13485 section 7 product realization requirements
if you cannot apply them because of the nature of your organization and
its products. Similarly, ISO 13485 says that you can exclude section 7
requirements if they are not applicable in your situation because of
the nature of your medical devices.

You can also exclude subsection 7.3 design and development if
official regulations allow you to do so and if you have made alternative
arrangements that comply with these regulations. In addition, ISO 13485
occasionally uses the phrase “if appropriate” or “where appropriate”.
When a requirement uses this phrase, you may ignore it if you can
justify doing so. In all of these cases all three YES, NO, and N/A
response options will be available.

YES answers mean you’re in compliance with the standard, NO answers
mean you’re not in compliance, and N/A answers mean that a question is
not applicable in your case. NO answers to Compliance Audit questions
point to compliance problems (also known as nonconformities or
noncompliances).

Once you’ve answered all the Compliance Audit Questions, you’re ready
to summarize your audit, calculate compliance scores, draw general audit
conclusions, and make and implement recommendations to address your
compliance problems.

Our Policy Audit covers the following topics:

1. Management

2. Documentation

3. Usability

4. Training

5. Implementation

6. Changes

Start by selecting a policy that you want to audit. Then prepare your Policy
Audit Profile. Before you begin answering policy audit questions, please
record the name of this policy at the top of the Policy Audit questionnaire.
This will help to maintain the focus of your audit.

Three response options are provided: YES, NO, and N/A. NO answers point
to policy performance problems, YES answers identify positive areas, while
N/A responses identify questions that are not applicable in your situation.

Once you’ve answered all the audit questions, you’re ready to summarize
your internal audit, calculate policy performance scores, draw general audit
conclusions, and make and implement recommendations to address your
policy performance problems.

Our Procedures Audit covers the following topics:

1. Management

2. Documentation

3. Content

4. Compliance

5. Usability

6. Training

7. Control

8. Records

9. Changes

Start by selecting a procedure that you want to audit. Then prepare
your Procedures Audit Profile. Define the scope of your audit, identify
the participants, and prepare a brief audit plan.

Before you begin answering procedures audit questions, please record
the name of this procedure at the top of the Audit questionnaire. This
will help auditors to maintain the focus of their audit.

Three response options are provided: YES, NO, and N/A. NO answers point
to procedural performance problems, YES answers identify positive areas,
while N/A responses identify questions that are not applicable in your
situation.

Once you’ve answered all the audit questions, you’re ready to summarize
your audit, calculate procedural performance scores, draw general audit
conclusions, and make and implement recommendations to address your
procedural performance problems.

Our Process Audit covers the following topics:

1. Develop Process >>> SAMPLE PDF

   1. Organization

   2. Documents

   3. Outputs

   4. Inputs

   5. Information

   6. Monitoring

   7. Measurement

   8. Training

   9. Resources

2. Implement Process

   1. Management

   2. Competence

   3. Communication

   4. Infrastructure

   5. Records

3. Maintain Process

   1. Management

   2. Competence

   3. Information

   4. Communication

   5. Infrastructure

   6. Records

4. Control Process

   1. Management

   2. Outputs

   3. Inputs

   4. Monitoring

   5. Measurement

5. Evaluate Process

   1. Scope

   2. Focus

   3. Methods

6. Improve Process

   1. Information

   2. Methods

   3. Implementation

   4. Management

Clause 4.1 of ISO 13485 makes it clear that organizations must identify
and manage the processes that make up their quality management
systems. Therefore, the process approach is now a requirement.

The process approach is a management strategy. When managers use a
process approach, it means that they manage the processes that make up
their organization, the interaction between these processes, and the inputs
and outputs that “glue” these processes together.

But, what’s a process, and what are inputs and outputs? Briefly put, a
process uses inputs to generate outputs. Or, more precisely, a process is
an integrated set of activities that uses resources to transform inputs into
outputs. A system exists whenever several processes are interconnected
using such input-output relationships.

Processes are interconnected because the output from one process
becomes the input for another process. In effect, processes are “glued”
together by means of such input-output relationships. And because the
output of one process becomes the input of another process, inputs and
outputs are really the same thing. In general, there are three basic types
of inputs/outputs: products, services, and information.

Below you will find a list of some of the processes that can
be audited using our Audit Program:

1. Production process

2. Assembly process

3. Purchasing process

4. Design process

5. Delivery process

6. Marketing process

7. Management process

8. Manufacturing process

9. Service provision process

10. Communications process

11. Record keeping process

12. Document control process

13. Measurement process

14. Monitoring process

15. Planning process

16. Training process

Of course, this does not exhaust the list of possible processes that could
be audited using our approach. Your organization’s processes will certainly
include many more processes that we have failed to mention.

Start your audit by selecting a process. Then prepare your Process Audit
Profile. Define the scope of the audit, prepare an audit plan, and identify
the inputs that are used by this process and the outputs that are generated.

Before you begin answering process audit questions, please enter
the name of your process at the top of the Process Audit questionnaire.
Three response options are provided: YES, NO, and N/A. NO answers
point to process performance problems, YES answers identify positive
areas, while N/A responses identify questions that are not applicable
in your situation.

Once you’ve answered all the audit questions, you’re ready to summarize
your audit, calculate process performance scores, draw general audit
conclusions, and make and implement recommendations to address
your process performance problems.

Our Records Audit Program is partly based on the ISO 15489-1
records management standard and covers the following topics:

1. Management

2. Initiation

3. Recording

4. Revisions

5. Access

6. Maintenance

7. Retention

8. Destruction

9. Reporting

10. Usability

11. Authenticity

12. Protection

13. Continuity

14. Training

15. Auditing

16. Compliance

Start by selecting a set of records. Our Program can be used to audit
virtually any type of record keeping system. Examples that you may
wish to consider include the following: training records, design records,
production records, service delivery records, measurement records,
product traceability records, audit records, manufacturing records, management review records, and calibration records.

Once you’ve chosen which records to audit, you’re ready to prepare your
Records Audit Profile. Specify the scope of your audit, its location, the
participants, and prepare a brief audit plan.

Before you begin answering record keeping audit questions, please enter
the name of the records being audited at the top of the audit questionnaire.
This will help to ensure that the focus of the internal audit is maintained.
Three response options are provided: YES, NO, and N/A. NO answers
point to record keeping performance problems, YES answers identify
positive areas, while N/A responses identify questions that are not
applicable.

Once you’ve answered all the audit questions, you’re ready to summarize
your audit, calculate record keeping performance scores, draw general audit
conclusions, and make and implement recommendations to address your
record keeping performance problems.

Do you maintain the effectiveness of
your quality management system?

YES

NO

Do you maintain the suitability of
your quality management system?

YES

NO

Do you use your quality data to maintain
the effectiveness and suitability of your
quality management system?

YES

NO

Do you use your quality policy to maintain
the effectiveness and suitability of your
quality management system?

YES

NO

Do you use your quality objectives to
maintain the effectiveness and suitability
of your quality management system?

YES

NO

Do you use your quality audits to maintain
the effectiveness and suitability of your
quality management system?

YES

NO

Do you use your management reviews to
maintain the effectiveness and suitability
of your quality management system?

YES

NO

Do you use your corrective actions to
maintain the effectiveness and suitability
of your quality management system?

YES

NO

Do you use your preventive actions to
maintain the effectiveness and suitability
of your quality management system?

YES

NO

Have you established procedures that you
can use to implement advisory notices?

YES

NO

Have you documented your
advisory notice procedures?

YES

NO

Do you use your procedures whenever
an advisory notice must be issued?

YES

NO

Do you maintain your organization's
advisory notice procedures?

YES

NO

Do you maintain a record of your
customer complaint investigations?

YES

NO

Do you exchange information with
external organizations whenever an
investigation shows that the activities
of those organizations have contributed
to the receipt of a customer complaint?

YES

NO

Do you formally authorize decisions not
to take corrective or preventive actions
in response to customer complaints?

YES

NO

Do you record all decisions not to
take corrective or preventive actions
in response to customer complaints?

YES

NO

Do you record why you chose not to
take corrective or preventive actions
in response to a customer complaint?

YES

NO

Have you established procedures to notify
regulatory authorities about adverse events
if national or regional regulations require
special reporting rules to be followed?

YES

NO

N/A

Have you documented your
notification procedures?

YES

NO

N/A

Do you use your notification procedures
whenever adverse events must be
reported to regulatory authorities?

YES

NO

N/A

Do you maintain your
notification procedures?

YES

NO

N/A

Etcetera ...

Introduction to ISO 13485 Standard

Medical Device Quality Management Definitions

Overview of ISO 13485 Quality Management Standard

ISO 13485 2003 Standard Translated into Plain English

How to Develop a Quality Management System for Medical Devices

Quality Management Gap Analysis Tool for Medical Devices

How to Audit Your Organization's QMS Audit Processs