An ISO 13485 internal audit plan for a small company: a worked example

An ISO 13485 internal audit plan is a documented schedule setting out which parts of your quality management system will be audited, when, against what criteria and by whom, so that over a defined period (normally twelve months) the whole QMS gets looked at. Clause 8.2.4 of the standard asks for audits at planned intervals, with the criteria, scope, interval and methods defined and recorded, and it asks that whoever does the auditing is objective and impartial and is not auditing their own work. That’s the whole requirement, and for a small device company it’s very achievable. In this post I’ll set out the plan we use with small companies, typically two to ten people, including a 12-month schedule you can copy, how to scope each audit, what the report should contain, and the question everyone asks, which is how you stay independent when there are only three of you.

If you’re preparing for the audit itself rather than planning the programme, we’ve covered what to expect on the day in how to prepare for an ISO 13485 internal audit, and the two posts are meant to be read together.

What clause 8.2.4 actually requires

It’s worth being clear about what the standard asks for, because quite a bit of what gets written into audit procedures goes further than it needs to. You need a documented procedure for internal auditing. You need to plan the audit programme taking into account the status and importance of the processes being audited and the results of previous audits. You need to define and record the criteria, scope, interval and methods for each audit. Auditors must be selected so that the process is objective and impartial, and they must not audit their own work. The results have to be recorded, management responsible for the audited area has to take any necessary correction and corrective action without undue delay, and there has to be follow-up to verify the action taken.

Notice what it doesn’t say. It doesn’t say annually, it doesn’t say every clause every year, and it doesn’t say the auditor has to hold a particular qualification. Those are decisions you make and justify in your own ISO 13485 internal audit plan. That said, certification bodies expect to see the full standard covered within a reasonably short cycle, and for a small company covering everything inside twelve months is the arrangement that causes the least argument, so that’s what I’d plan for.

One big audit or several smaller ones?

Both are acceptable. Some small companies do a single full-system audit once a year, usually a few weeks before the certification body visit, and it technically complies. My view is that it’s the wrong way round, because every finding lands at once, at the busiest possible moment, and the evidence feeding your management review is a year old by the time anyone reads it. We set clients up with four smaller audits spread across the year instead. Each one takes roughly half a day to a day of auditing plus the write-up, the findings get fixed as you go rather than in a panic, and by the time the certification body arrives you’ve already found most of what they would have found.

A 12-month ISO 13485 internal audit plan that covers the whole standard

Here’s the worked example, written for a small company whose certification body surveillance visit falls early in the year. Shift the months to suit your own cycle; the pattern is what matters.

Audit	When	Scope	ISO 13485:2016 clauses
1	February	Management responsibility, document and record control, training and competence	4.1, 4.2, 5.1 to 5.6, 6.1, 6.2
2	May	Design and development, including planning, inputs and outputs, reviews, verification, validation, transfer and design files, plus the risk management file	7.1, 7.2, 7.3 (with ISO 14971 records sampled)
3	August	Purchasing and supplier controls, production and service provision, infrastructure, work environment, equipment and calibration	6.3, 6.4, 7.4, 7.5, 7.6
4	November	Feedback and complaints, reporting to regulators, monitoring of product, nonconforming product, data analysis, CAPA, and the internal audit process itself	8.1 to 8.5

The November audit is placed deliberately. Its findings, together with the year’s audit results as a whole, feed straight into a December management review, which means the review has current evidence in it and the actions are underway before the certification body turns up in the new year. Audit 4 also audits the audit programme, which sounds circular but isn’t: it’s checking that audits 1 to 3 happened as planned, were reported properly and had their findings closed out.

Scoping each audit

The schedule gives you the clauses, but the scope statement for each audit should be written in terms of your processes and your evidence, not just clause numbers. For audit 2, for instance, we’d pick one live development project and follow it through, from the design and development plan to the most recent review minutes, checking inputs trace to outputs, verification records exist for the requirements that have been verified so far, and the risk management file is moving with the design rather than being written at the end. Status and importance matter here, which is the standard’s way of saying audit hardest where the risk is. If you released a new supplier this year, sample them in audit 3. If audit 1 found training records missing, go back to training in a later audit rather than waiting for next February. The plan is allowed to change for documented reasons, and showing that it responds to findings is exactly what a certification body wants to see.

One thing worth saying: the internal audit covers your QMS against ISO 13485. It doesn’t by itself tell you whether the device meets the regulatory requirements for UKCA or CE marking. That’s a different exercise, closer to a gap assessment against the regulations, and it’s worth keeping the two separate in your head and in your records.

The independence question

This is the one that worries small companies most, and reasonably so. The standard says auditors must not audit their own work, and in a three-person company the person who wrote the procedures has usually also done half the work in them. There are three workable answers. The first is cross-auditing, where a trained person from one function audits another, so the engineer who owns design audits the quality processes and the quality lead audits design. That works once you’re past four or five people with reasonably separated roles. The second is training up someone slightly removed from the QMS day to day, a director or a part-time member of staff, which can work but tends to produce gentle audits. The third is bringing in an external auditor to run the internal programme, which the standard permits and certification bodies see all the time. In my experience it’s the cleanest answer below about five people, because the independence question simply goes away and you get findings from someone who has seen quite a few other QMSs. It’s something we can run for clients alongside ISO 13485 QMS setup, usually as the quarterly half-day pattern above.

What the audit report should contain

Keep the report short enough that it actually gets read. The outline I use is the same each time:

• A header with the audit reference, date(s), auditor, auditee(s), and the scope and criteria as planned.
• A one-paragraph summary, written for the management review, saying what was audited and the overall conclusion.
• Findings, each one stating the requirement, the objective evidence seen, and a classification (nonconformity, or an observation or opportunity for improvement). Major versus minor grading is optional internally, but it’s useful practice for the real thing.
• The records sampled, so the next audit doesn’t sample the same ones.
• Actions, with each nonconformity raised into your CAPA system rather than living only in the report, with an owner and a date.
• Follow-up, completed later, recording the verification that the action worked.

That last line matters more than people think. An audit finding closed with “procedure updated” and no check that the update took hold is the sort of thing a certification body auditor will pull on, because clause 8.2.4 explicitly asks for verification of the action taken.

Getting a programme in place

If your certification audit is coming up and your ISO 13485 internal audit plan is looking thin, or you’d like someone independent to run the programme so your own time goes on the device, we can help, and I’d be happy to have a call about it. You can book a free 30-minute call here.

Frequently asked questions