This article walks through every major clause of ISO 13485:2016, explains what each section requires in practice, and identifies the most common audit findings per clause.

How ISO 13485 is structured

ISO 13485:2016 follows the clause structure common to ISO management system standards:

• Clauses 1–3: Scope, normative references, and terms and definitions
• Clause 4: Quality management system general requirements
• Clause 5: Management responsibility
• Clause 6: Resource management
• Clause 7: Product realization
• Clause 8: Measurement, analysis, and improvement

Clauses 1 through 3 contain no auditable requirements. Clauses 4 through 8 contain the substantive QMS requirements that certification bodies assess.

Clause 4: Quality management system

4.1 General requirements

The organization must establish, document, implement, and maintain a QMS and continually improve its effectiveness. This clause requires the organization to identify QMS processes, determine their sequence and interaction, and ensure controls are in place wherever processes are outsourced.

Common audit finding: outsourced processes, particularly contract testing or contract manufacturing, not included in the QMS scope.

4.2 Documentation requirements

Section 4.2 requires a quality manual, a documented statement of quality policy and objectives, documented procedures required by the standard, and records required by the standard. The quality manual must describe the scope of the QMS and the interaction between QMS processes.

Section 4.2.4 covers control of records, requiring that records remain legible, readily identifiable, and retrievable. Retention periods must be defined and must comply with applicable regulatory requirements.

Common audit finding: record retention periods not defined, or records stored in locations that make retrieval difficult during an audit.

Clause 5: Management responsibility

5.1 Management commitment

Top management must demonstrate commitment to the QMS by communicating the importance of meeting regulatory and customer requirements, establishing quality policy and objectives, conducting management reviews, and ensuring resource availability.

5.3 Quality policy

The quality policy must be appropriate to the organization, include a commitment to compliance and continual improvement, and be communicated and understood throughout the organization.

5.4 Planning

Quality objectives must be measurable and consistent with the quality policy. Quality planning must ensure the QMS is maintained when changes are planned and implemented.

5.5 Responsibility, authority, and communication

Responsibilities and authorities must be defined and communicated. A management representative must be appointed with specific responsibilities for the QMS.

5.6 Management review

Top management must review the QMS at planned intervals to confirm its continuing suitability, adequacy, and effectiveness. Review inputs must include audit results, customer feedback, process performance, corrective and preventive action status, regulatory changes, and follow-up from previous reviews. Outputs must include decisions and actions related to improvement.

Common audit finding: management reviews conducted as a formality with no documented follow-up actions, or inputs missing customer feedback and CAPA status data. See also: How to conduct a management review under ISO 13485 Section 5.6

Clause 6: Resource management

6.2 Human resources

Personnel performing work affecting product quality must be competent based on education, training, skills, and experience. Competence must be evaluated, training provided where gaps exist, and records maintained.

Common audit finding: training records that document attendance but do not include evidence of competency evaluation.

6.3 Infrastructure

The organization must determine, provide, and maintain the infrastructure needed to achieve product conformity, including buildings, workspace, equipment, and supporting services.

6.4 Work environment

The organization must determine and manage the work environment needed to achieve product conformity. For sterile medical devices, this includes specific documented requirements for the controlled environment.

Clause 7: Product realization

Clause 7 is the most detailed section of ISO 13485 and typically generates the most audit findings. It covers the entire product lifecycle from planning through delivery.

7.2 Customer-related processes

Requirements related to the product must be determined, including regulatory requirements, and reviewed before the organization commits to supply. Customer communication processes must be defined and documented.

7.3 Design and development

This section maps closely to 21 CFR Part 820 design controls. It requires documented design and development planning, inputs, outputs, reviews, verification, validation, transfer, changes, and a design and development file (equivalent to the FDA's design history file).

Common audit finding: design verification records that test against internal specifications without demonstrating those specifications originated from documented design inputs.

7.4 Purchasing

Purchasing procedures must ensure that purchased product meets specified requirements. Suppliers must be evaluated and selected based on their ability to supply conforming product. Records of evaluations, selection, monitoring, and re-evaluation must be maintained.

The Supplier Quality Management system must define the criteria for supplier evaluation and the controls applied based on the potential impact of the purchased product on finished device quality.

Common audit finding: approved supplier list not maintained, or supplier evaluation criteria not defined in a documented procedure.

7.5 Production and service provision

Production must be carried out under controlled conditions, including documented work instructions, use of suitable equipment, availability of monitoring equipment, and implementation of release and delivery activities.

Section 7.5.3 covers traceability, requiring that the organization maintain records of the identity of the product throughout production and delivery, and for implantable devices, the identity of all components, materials, and work environments used.

7.6 Control of monitoring and measuring equipment

Equipment used to monitor and measure product must be calibrated or verified at specified intervals, protected from damage, and its calibration status maintained. Records of calibration results must be kept.

Common audit finding: equipment in use with expired calibration certificates, or calibration records that do not link the instrument to its calibration standard.

Clause 8: Measurement, analysis, and improvement

8.2 Monitoring and measurement

Customer satisfaction must be monitored. Internal audits must be conducted at planned intervals to determine whether the QMS conforms to planned arrangements and is effectively implemented and maintained.

Audits must be conducted by personnel who do not audit their own work. Audit findings and corrective actions must be recorded and tracked to closure.

8.3 Control of nonconforming product

Nonconforming product must be identified and controlled to prevent unintended use or delivery. Procedures must define the controls for identification, documentation, evaluation, segregation, and disposition of nonconforming product.

Common audit finding: nonconformance records that document the defect but lack a root cause investigation or documented disposition decision.

8.4 Analysis of data

The organization must determine, collect, and analyze data to demonstrate the suitability and effectiveness of the QMS and evaluate where continual improvement can be made. Data must include customer feedback, product conformity, process and product characteristics, and supplier performance.

8.5 Improvement

Section 8.5.2 requires a documented procedure for corrective action. Corrective actions must address the root cause of nonconformities, not just the immediate symptom. Effectiveness of corrective actions must be verified.

Section 8.5.3 requires a documented procedure for preventive action to eliminate the causes of potential nonconformities before they occur.

Common audit finding: corrective action records that describe the containment action taken but do not document a root cause investigation or an effectiveness check. See also: FDA enforcement trends: CAPA as the top cited observation

Aligning ISO 13485 with FDA QMSR

The FDA's QMSR, effective February 2026, incorporated ISO 13485:2016 by reference. Companies that are already certified to ISO 13485:2016 will find substantial overlap with QMSR requirements. The primary differences concern FDA-specific regulatory requirements, such as the design history file terminology, specific labeling and unique device identification requirements, and adverse event reporting obligations that appear in FDA regulations but not in ISO 13485.

A combined QMS that satisfies both ISO 13485 and the FDA QMSR is achievable with a single integrated quality system rather than two parallel systems.

Managing ISO 13485 compliance in a QMS platform

Cloudtheapp's platform includes 60+ pre-configured applications mapped to ISO 13485 clause requirements, covering document control, CAPA, supplier management, design controls, calibration, nonconformance management, internal audits, and management review.

Each application is pre-validated and includes role-based workflows, audit trails, and record retention controls that satisfy ISO 13485 Section 4.2.4 documentation requirements.

Schedule a demo to see how Cloudtheapp supports ISO 13485 certification and maintenance: https://www.cloudtheapp.com/demo/

Key takeaways

ISO 13485:2016 requires a fully documented QMS covering management responsibility, resource management, product realization, and measurement and improvement. The most frequent audit findings across all clauses reflect the same pattern: documented procedures that are not consistently followed, records that lack required information, and CAPA processes that address symptoms rather than root causes.

The standard's alignment with FDA QMSR means that companies building a QMS to satisfy ISO 13485 are simultaneously building the foundation needed for FDA compliance. The investment in a conforming QMS pays dividends across both certification and regulatory inspection readiness.

This post created by and appeared first on Cloudtheapp