Forty-one findings, all closed correctly, and nobody ever read them sideways. Here’s how audit reports, trend analysis under §8.4, and management review turn a pile of closed findings into a signal — and why FDA can now read the whole chain.
Your supplier’s questionnaire describes the company they mean to be. The audit shows you the one that showed up. Here’s what ISO 13485 §7.4.1 actually asks for, how to run a risk-based supplier audit that’s still a real audit, and why FDA can now read the results.
For twenty years you could cram for an FDA inspection, because the evidence of the cramming was invisible. The QMSR dropped the §820.180(c) exemptions and FDA retired QSIT — so your internal audit program isn’t just what prepares you for the inspection, it’s one of the things being inspected. Here’s what audit-ready on an ordinary Tuesday actually looks like.
The regulation doesn’t have a headcount exemption — ISO 13485 §8.2.4 asks the same thing of a team of one that it asks of a team of thirty. Here’s what breaks first when the quality department is a single person, what you can fix in-house, and what outsourcing an audit program really means (you can contract the auditing; you cannot contract the responsibility).
Auditor independence isn’t an accusation — it’s an admission that nobody can proofread their own handwriting. Here’s what ISO 13485 §8.2.4 and ISO 19011 actually require of who audits what, why competence is the half that quietly does more damage, and four things to do when you’re a quality team of two.
The regulations already cover AI tools in your quality system — you just have to read them with fresh eyes. Here’s what ISO 13485 clause 4.1.6, FDA’s CSA guidance, and ISO/IEC 42001 actually require, and a practical, risk-tiered approach to qualifying AI use without over-validating everything.
“Operator error” is almost always true, which is exactly what makes it useless. Here’s why 5 Whys keeps landing on a human, the one rule that gets you past it, and how to tell a systemic cause from a proximate one.
A good audit finding does three things: names the requirement, states the evidence, and stops there. Here’s how to write findings that get fixed instead of argued about — and why mislabeling a nonconformity as an “observation” comes back to bite you.
Containment, correction, corrective action: three different things, one form, endless confusion. Here’s the order of operations after an audit finding, how to decide (on the record) whether it warrants a CAPA, and why “operator retrained” is a correction wearing a lanyard.
Auditors don’t collect what you say you do — they collect objective evidence: the records, the observations, the proof. Here’s how the three sources of evidence work, why every audit is really a sampling exercise, and how to think like an auditor before one shows up.