This guide explains what ISO 13485 and FDA QMSR actually require from a quality manual, what auditors expect to find, and how to write one that holds up under inspection without becoming a document that no one inside the organization actually uses.

What is a quality manual?

A quality manual is the top-level document that defines the scope of an organization's quality management system, describes how the QMS elements relate to each other, and references the procedures, work instructions, and records that form the system's operational backbone.

It sits at the top of the document hierarchy. Below the quality manual come standard operating procedures, then work instructions, then forms and records. The manual does not describe how to perform work in detail. That is the role of procedures. The manual describes what the QMS includes, why it is structured the way it is, and where to find the documents that govern specific processes.

Is a quality manual required under ISO 13485?

Yes. ISO 13485:2016 Section 4.2.2 explicitly requires a quality manual. The section specifies minimum content:

• The scope of the QMS, including details of and justification for any exclusions
• The documented procedures established for the QMS, or reference to them
• A description of the interaction between the processes of the QMS

Unlike ISO 9001:2015, which removed the quality manual requirement in its 2015 revision, ISO 13485 retained it because the medical device sector operates under regulatory requirements that benefit from a defined top-level QMS document. Certification bodies audit against the manual during initial certification and surveillance audits.

Is a quality manual required under FDA QMSR?

FDA's Quality Management System Regulation (21 CFR Part 820, commonly called QMSR) does not use the term "quality manual" specifically, but it requires organizations to establish and maintain a quality system. In practice, FDA investigators expect to find a document or set of documents that describe the QMS scope and structure. During inspections, investigators frequently request the quality manual as a starting point.

Organizations operating under both ISO 13485 and FDA QMSR typically maintain a single quality manual that satisfies both requirements. This is practical because the two frameworks are broadly aligned, and managing separate top-level documents for each creates version control complexity without adding regulatory value.

What must a quality manual include?

The minimum content required by ISO 13485 Section 4.2.2 is the starting point, but a manual that contains only the minimum is usually too sparse to be useful either to auditors or to employees. The sections below cover the elements that consistently appear in quality manuals that pass third-party audits and FDA inspections without findings related to the manual itself.

Organization profile and scope

The opening section describes the organization: legal name, address, what it makes or does, and which regulatory frameworks apply. The scope statement specifies what the QMS covers. If the organization has excluded any clause of ISO 13485 because that activity does not apply, the exclusion is stated here with its justification.

Scope exclusions are common for smaller companies. A contract manufacturer that does not design products may exclude Section 7.3 (Design and Development). A distributor that does not manufacture may exclude several production-related clauses. Each exclusion requires a brief explanation of why the clause does not apply to the organization's activities.

QMS overview and document hierarchy

This section explains how the quality management system is organized and how the documents within it relate to each other. A simple diagram showing the four tiers of documentation, quality manual at the top, followed by SOPs, work instructions, and forms or records, is standard here and gives auditors an immediate visual map of the system.

This section also lists or references the documented procedures that form the operational core of the QMS. Under ISO 13485, several procedures are explicitly required to be documented. These include audits, corrective and preventive action, control of nonconforming product, control of documents, and control of records, among others. The quality manual should either list these procedures by name or reference the section of the QMS where they are located.

Management responsibility

This section covers the commitments and authorities that senior leadership has defined for the QMS. It describes how quality objectives are set, how they are communicated, and how they are reviewed. It identifies the management representative, the person responsible for ensuring QMS processes are maintained and for reporting QMS performance to top management.

The section also describes the planning process for the QMS, including how the organization manages changes that affect the QMS without losing continuity.

Resource management

This section describes how the organization ensures it has the people, infrastructure, and work environment needed to meet product and regulatory requirements. For regulated companies in life sciences, this typically includes references to personnel qualification, training requirements, equipment qualification, and facility controls.

The manual does not describe how training is conducted. That is the role of the training SOP. The manual states that a training process exists, what it covers at a high level, and where to find the governing procedure.

Product realization

This section maps the major product realization processes: from customer requirements and design through purchasing, production, and delivery. For a medical device manufacturer, this section typically includes references to design controls, purchasing controls, production and process controls, and monitoring and measurement of products.

Again, the manual does not describe how to perform these activities in detail. It describes the processes that exist and references the procedures that govern them. Auditors use this section to verify that the organization has acknowledged and documented all required processes.

Measurement, analysis, and improvement

This section describes how the organization monitors QMS performance and drives improvement. It typically references the processes for internal auditing, management review, control of nonconforming product, corrective and preventive action, and statistical techniques where applicable.

For ISO 13485 auditors, this section is scrutinized because it connects the quality manual to the improvement cycle. An organization whose quality manual describes robust monitoring and analysis processes but whose actual records show little data collection or follow-through is a common audit scenario. Auditors check whether the manual's description of the improvement system matches what they find in the records.

Common quality manual writing mistakes

Copying regulatory language verbatim. A quality manual that reproduces the text of ISO 13485 section by section, with the organization's name substituted for "the organization," tells an auditor almost nothing about how the company actually operates. It is also frequently out of date the moment a procedure changes. The manual should describe what the organization does, not restate what the standard requires.

Describing activities at procedure level. The quality manual is not a procedure. It should not explain step by step how to conduct an internal audit or process a CAPA. Those details belong in the corresponding SOPs. A manual that contains step-by-step instructions becomes unmanageably long and requires revision every time an operational process changes.

Making commitments the procedures do not keep. A quality manual that states "all corrective actions are verified for effectiveness within 30 days" creates an audit obligation. If the CAPA procedure does not specify 30 days, or if records show effectiveness checks being completed at 60 or 90 days, the manual creates a finding rather than preventing one. The manual must align with what the procedures actually say and what the records actually show.

Not updating the manual after QMS changes. The quality manual is a controlled document subject to the same document control requirements as every other QMS document. Organizations that update procedures and work instructions but fail to update the manual over time end up with a top-level document that describes a QMS that no longer exists. This is a common finding in surveillance audits.

Treating the manual as internal-only. Quality manuals are frequently shared with customers, regulatory bodies, and certification bodies. Some organizations maintain two versions: a detailed internal version and a shorter external version. If only one version exists, it should be written with the understanding that it may be reviewed by any of these audiences.

How to structure a quality manual that survives audits

The structure below works for most regulated companies operating under ISO 13485 and FDA QMSR. It maps directly to the clause structure of ISO 13485, which makes cross-referencing straightforward during audits.

Section 1: Introduction and scope. Organization overview, applicable regulatory frameworks, QMS scope, scope exclusions with justification.

Section 2: Normative references. List of standards and regulations the QMS is designed to satisfy (ISO 13485:2016, 21 CFR Part 820, any other applicable standards).

Section 3: Terms and definitions. Key terms used in the manual, with definitions. For organizations with a glossary document or procedure, this section can reference that document rather than duplicating definitions.

Section 4: Quality management system. Document hierarchy, list of required documented procedures and their locations, record retention requirements at a summary level.

Section 5: Management responsibility. Quality policy, quality objectives process, management commitment, management representative, management review overview.

Section 6: Resource management. Human resources and competency, infrastructure, work environment.

Section 7: Product realization. Planning, customer requirements, design and development (or exclusion with justification), purchasing, production and service provision, control of monitoring and measuring equipment.

Section 8: Measurement, analysis, and improvement. Feedback processes, internal audits, monitoring and measurement of processes and products, control of nonconforming product, data analysis, improvement processes including corrective and preventive action.

How long should a quality manual be?

There is no required length. Quality manuals range from 10 pages to more than 100 pages. The right length depends on the complexity of the organization and the QMS.

For a small company with a focused product line and a relatively simple QMS, 15 to 25 pages is typically sufficient. For a large, multi-site organization with complex product realization processes and multiple regulatory frameworks, 40 to 60 pages may be necessary to adequately describe the system without duplicating procedure content.

The test is whether the manual, read on its own, gives an auditor or new employee a clear understanding of what the QMS includes and where to find the documents that govern specific processes. If it does that in 15 pages, 15 pages is the right length. If additional context is needed for the system to be comprehensible, that context belongs in the manual.

How Cloudtheapp supports quality manual management

A quality manual is only as useful as the document control system that governs it. A manual sitting in a shared drive without version control, approval workflow, or revision history is not compliant with ISO 13485 Section 4.2.4 (control of documents) regardless of how well it is written.

Cloudtheapp's document control module manages quality manuals and all other QMS documents in a single controlled environment. Version history, approval workflows, review reminders, and electronic signatures are built into the document lifecycle. When a procedure changes and the quality manual needs updating, the system routes the revision through the same controlled approval process as the original document, with a full audit trail.

With 60+ applications across quality, safety, and compliance, Cloudtheapp gives regulated organizations the infrastructure to maintain a living quality management system where the manual and the procedures stay aligned over time, not just at initial certification.

Request a demo to see how Cloudtheapp manages document control for quality manuals in regulated industries.

Summary

A quality manual written to satisfy auditors without being useful to the people who work inside the QMS is a compliance liability. The most effective quality manuals are precise about scope, honest about what the organization does, and structured so that anyone reading them can quickly understand the QMS and navigate to the governing procedures for any process area.

ISO 13485 Section 4.2.2 sets the minimum content requirements. FDA QMSR expects a document that describes the QMS structure. What turns a compliant quality manual into a useful one is alignment with the actual procedures, specificity about organizational commitments, and a document control process that keeps it current as the QMS evolves.

This post created by and appeared first on Cloudtheapp