Every regulatory consultant has heard some version of this conversation:
“We need to fix our CAPA process.”
“Great. Who owns it?”
“Sarah. She also runs internal audits, complaint handling, and supplier qualification. Oh, and she just took over for the regulatory affairs person who left.”
“…How many hours a week does Sarah have?”
“Forty. Officially.”
Welcome to §6.1.
What §6.1 Actually Says
Section 6.1 of ISO 13485:2016 is one of the shortest clauses in the entire standard. Two sentences. The whole thing fits on a single line of text.
It says the organization shall determine and provide the resources needed to:
- implement the QMS and maintain its effectiveness, and
- meet applicable regulatory and customer requirements.
That’s it. No specifics. No formulas. No magic threshold for “enough.” Just a single, quiet directive: provide the resources. Two verbs, both load-bearing. Determine what you need. Then provide it.
The Reason This Clause Exists
This section is here because ISO has seen — and FDA has seen, and your auditor has seen — what happens when a company adopts a QMS and then refuses to fund it.
You get a quality manager with no team. A training matrix nobody has time to update. Measuring equipment that hasn’t been calibrated since the last time it broke. A CAPA system that’s perpetually behind because the only person who knows it works 50-hour weeks. A document control software trial that expired in 2022 that everyone is still using anyway.
None of that is a §6.1 violation in isolation. Together, they are §6.1 in flashing neon letters. The QMS is not being maintained at the level the standard requires, because top management didn’t provide the resources to maintain it.
What “Resources” Actually Means
This is broader than money. The standard uses one word — resources — and it covers all of the following:
- People. Headcount, qualifications, training, and yes — the time those people actually have available to do quality work.
- Infrastructure. Facilities, equipment, IT systems, software. Things that have to work for the QMS to work.
- Information. Access to the standards, regulations, customer specs, and internal data you need to make quality decisions.
- Time. Time is a resource. A CAPA allocated zero hours of investigation time is not actually being investigated.
- Money. Because all of the above eventually cost something.
If the budget conversation only happens once a year, and only in the context of “how much can we cut,” your QMS is being underfunded by design. §6.1 doesn’t say you have to be lavish. It does say you have to be deliberate.
What This Looks Like in Real Life
Auditors don’t ask “did top management provide adequate resources?” That’s too easy to answer with a brisk yes. They ask sideways:
- “How many CAPAs are currently overdue?”
- “When was this gauge last calibrated?”
- “Show me the training records for the last new hire.”
- “Who is your backup for product release?”
- “Why hasn’t this nonconformance been investigated?”
Every one of those questions can surface a §6.1 problem. Overdue CAPAs because the only investigator is also the only auditor. Out-of-cal gauges because the metrology budget got cut and nobody pushed back. Untrained staff because there is no training plan and no time on the calendar. A bus factor of one for product release because management never approved the second QA hire. None of these are technically §6.1 findings — but they all start there.
How to Show §6.1 Is Actually Happening
Doing §6.1 right doesn’t require a separate Resource Provision Procedure (please, no). It usually shows up in artifacts you already have:
- Management review inputs that include resource adequacy as a discussion item (and outputs that document decisions).
- An annual budget that has visible line items for quality, training, calibration, software, and audit programs — not just “G&A — Quality.”
- A training plan with assigned owners and due dates, not a spreadsheet that lives in someone’s Documents folder.
- An equipment lifecycle plan that doesn’t read like a wish list.
- Evidence that when something was under-resourced, somebody escalated, somebody decided, and somebody documented the decision.
The Quiet Trap
The trap with §6.1 is that nothing ever fails because of §6.1 alone. Failures get tagged to the clause where the symptom shows up — late CAPAs are an 8.5.2 finding, missed training is a 6.2 finding, broken equipment is a 7.6 finding. But underneath every one of those is often the same root cause: somebody decided not to fund the work, and the work failed.
So when an auditor asks about §6.1 during the management section of the audit, the right answer isn’t “Yes, of course we provide resources.” The right answer is, “Here are the inputs to our resource planning, here are the decisions we made last year, here’s what we funded, here’s what we deferred, and here’s how we’re tracking whether those decisions were correct.”
If you can answer that with a straight face, you’re in good shape. If you can’t — and the QMS is currently running on goodwill and the QA manager’s personal stamina — then the next conversation in your office shouldn’t be with the auditor. It should be with whoever signs the budget.