An internal audit program isn’t a calendar with one entry on it. Here’s what ISO 13485 §8.2.4 and ISO 19011 actually expect from a risk-based audit schedule — and why FDA can now check whether yours is real.
A common QMSR procedure scopes §7.5.9.2 out with “we don’t make implants.” That justification works under ISO 13485 alone. Under the QMSR’s §820.10(d) cross-reference, it doesn’t hold up if your device supports or sustains life. Here’s the trap, the definition, and how to write a non-applicability statement that survives an FDA inspection.
ISO 13485 §7.5 is the longest clause in the standard — eleven subclauses that absorbed what the old QSR scattered across Subparts F, G, L, and parts of H and K. Here’s a tour of what changed, what’s genuinely new (customer property, anyone?), and where the gaps tend to live before an FDA inspection.
Section 820.50 is gone from the QMSR — quietly retired into “Reserved” status. ISO 13485 §7.4 took over, with three subclauses, more risk language, and supplier audit reports that FDA can finally read. Here’s what changed and what to fix in your procedures.
ISO 13485 §7.3 keeps the design controls discipline you knew from §820.30 — but threads risk management through every step, treats V&V plans as actual deliverables, and renames your DHF in the process. Here’s what changed and what to do about it.
Most people skim past ISO 13485 §7.1 and §7.2 to get to design controls. That’s a mistake — those two clauses introduced requirements the old QSR didn’t really have, and an FDA inspector auditing to ISO 13485 will know exactly where to look.
ISO 13485 Clause 6 turns training into competence, widens infrastructure to include the server closet, and makes contamination control a written procedure. Here’s what the resource clause actually requires — and where the old QSR wasn’t paying close enough attention.
ISO 13485 Clause 5 is more directive than the old §820.20 — measurable objectives, specified management review inputs and outputs, and a management representative with real authority. And with §820.180(c) gone, those records are now FDA-readable.
ISO 13485 Clause 4.2 restructures the way medical device manufacturers think about documentation — collapsing the DMR, DHR, and DHF into the Medical Device File, and eliminating the old QSR exemption that kept your audit reports out of FDA’s hands. Here’s what that means in practice.
Your contract manufacturer has ISO 13485 certification and a solid QMS. That’s great — and it still doesn’t satisfy your oversight obligations as the legal manufacturer. Here’s what QMSR and ISO 13485 actually require of each party when manufacturing is outsourced.