Forty-one findings, all closed correctly, and nobody ever read them sideways. Here’s how audit reports, trend analysis under §8.4, and management review turn a pile of closed findings into a signal — and why FDA can now read the whole chain.
Your supplier’s questionnaire describes the company they mean to be. The audit shows you the one that showed up. Here’s what ISO 13485 §7.4.1 actually asks for, how to run a risk-based supplier audit that’s still a real audit, and why FDA can now read the results.
For twenty years you could cram for an FDA inspection, because the evidence of the cramming was invisible. The QMSR dropped the §820.180(c) exemptions and FDA retired QSIT — so your internal audit program isn’t just what prepares you for the inspection, it’s one of the things being inspected. Here’s what audit-ready on an ordinary Tuesday actually looks like.
The regulation doesn’t have a headcount exemption — ISO 13485 §8.2.4 asks the same thing of a team of one that it asks of a team of thirty. Here’s what breaks first when the quality department is a single person, what you can fix in-house, and what outsourcing an audit program really means (you can contract the auditing; you cannot contract the responsibility).
In nearly every training session I hold, I ask the same question: who is responsible for quality in this organization?
Auditor independence isn’t an accusation — it’s an admission that nobody can proofread their own handwriting. Here’s what ISO 13485 §8.2.4 and ISO 19011 actually require of who audits what, why competence is the half that quietly does more damage, and four things to do when you’re a quality team of two.
The regulations already cover AI tools in your quality system — you just have to read them with fresh eyes. Here’s what ISO 13485 clause 4.1.6, FDA’s CSA guidance, and ISO/IEC 42001 actually require, and a practical, risk-tiered approach to qualifying AI use without over-validating everything.
On July 23, 2025, I got a call that made me cancel every meeting on my calendar. What followed became the hardest project I’ve ever managed — and I finished it.
“Operator error” is almost always true, which is exactly what makes it useless. Here’s why 5 Whys keeps landing on a human, the one rule that gets you past it, and how to tell a systemic cause from a proximate one.
A good audit finding does three things: names the requirement, states the evidence, and stops there. Here’s how to write findings that get fixed instead of argued about — and why mislabeling a nonconformity as an “observation” comes back to bite you.