Neither approach is sustainable. This article explains what FDA and ISO 13485 actually require from a small regulated business’s quality management system, which requirements scale down and which do not, and what a right-sized QMS looks like in practice.

What “small business” means in a regulatory context

FDA defines a small business differently depending on the regulatory program. For medical device manufacturers under 21 CFR Part 820, a small business is generally defined as a company with annual gross receipts of $100 million or less. This affects certain fee structures and some compliance timelines, but the substantive quality system requirements — document control, CAPA, design controls, supplier management — apply regardless of company size.

ISO 13485:2016 makes no formal distinction by company size. The standard includes explicit language in many clauses acknowledging that requirements must be interpreted in the context of organizational scale, complexity, and risk. The 2016 revision added “where appropriate” and “where applicable” qualifiers in multiple places, giving small companies documented flexibility in how they implement certain requirements.

What this means practically: a 15-person medical device startup needs a functioning quality management system before it receives its first purchase order from a hospital system. The system can be simpler than what a 2,000-person contract manufacturer runs, but the core elements — controlled documents, CAPA, complaints, supplier controls, management review — must be in place and demonstrably working.

The core QMS elements every small regulated company needs

Whether you are under FDA QMSR, ISO 13485, ISO 9001, or a combination, a regulated small business needs these foundational elements:

Document control

Every regulated company needs a system to control its quality documents — SOPs, work instructions, forms, specifications — including version control, approval workflows, and controlled distribution. This does not require a massive content management system. It does require that you know which version of every document is current, who approved it, and that obsolete versions are not being used in production.

The most common inspection finding for small companies in this area is not that documents are absent — it is that current and obsolete versions coexist, or that employees are working from printed copies that have not been updated since a revision was issued.

Corrective and Preventive Action (CAPA)

A CAPA process is non-negotiable in regulated environments. Every identified quality problem — a non-conforming product, a customer complaint, a failed audit finding — needs a documented path from identification through root cause investigation to corrective action and effectiveness verification.

Small companies often resist formal CAPA processes because they feel bureaucratic when the team is small enough to just “talk about it.” The problem with informal CAPA is that it is invisible to an auditor and unverifiable to a customer. When a customer asks “how do you handle quality escapes?” the answer needs to be a documented system, not a description of how the team holds weekly meetings.

Supplier qualification and management

Both FDA QMSR and ISO 13485 require that you qualify and maintain oversight of suppliers who provide materials, components, or services that affect product quality. For a small medical device company, this might mean qualifying three to ten key component suppliers with documented evaluation records, approved supplier lists, and incoming inspection criteria.

Supplier Quality Management for a small business does not require on-site supplier audits for every vendor. A risk-based approach — with more rigorous qualification for high-risk, sole-source, or critical suppliers — is defensible and practical.

Training records

You need documented evidence that employees performing quality-affecting work are trained and competent to do so. Training records must link each person to the specific procedures they are qualified to perform and the date that training was completed. This is one of the simplest requirements to meet but one of the most frequently cited during inspections when paper-based systems fall behind.

Management review

ISO 13485 and FDA QMSR both require periodic management review of the quality system. For a small company, this is typically a quarterly or annual meeting where leadership reviews CAPA status, complaint trends, audit findings, supplier performance, and quality objectives. The meeting must be documented — agenda, attendees, data reviewed, and decisions made.

Customer complaints

Every complaint from a customer about product quality, safety, or performance must be captured, evaluated, and — where required — investigated and reported. For medical device companies, adverse event reporting to FDA under 21 CFR Part 803 may be triggered by certain complaint types. Missing this link between your complaint process and your MDR obligations is a common inspection gap.

Internal audits

Your quality system needs to audit itself periodically. Internal audits do not need to be elaborate — a small company with a focused quality system can conduct a meaningful internal audit in a day or two. What matters is that the audit is planned, conducted by someone other than the person responsible for the area being audited, documented, and that findings are followed up through the CAPA process.

What small companies often build that they do not need

Just as problematic as under-building a QMS is over-building one. Small regulated companies that model their quality system on large enterprise frameworks often create systems that are too heavy to maintain with their available staff.

Common over-engineering traps:

• Writing SOPs for every conceivable activity, including ones that happen rarely or do not affect product quality — this creates a maintenance burden that soon outpaces the team’s ability to review and update documents on schedule
• Building a CAPA process with ten stages and multiple approval levels appropriate for a 500-person organization — at 15 people, this means every CAPA sits in an approval queue for weeks
• Implementing a design control system in full at product launch when the product is already commercialized and design history documentation exists only partially — retrospective DHF construction is a real task, but it needs to be scoped appropriately
• Buying an enterprise QMS platform with per-user licensing that prices out at $200,000 per year for a company with 12 quality-relevant users

The test for whether a QMS element belongs in your system: if FDA or your ISO certification body reviewed your quality system today, would the absence of this element be a finding? If the answer is no for your product type and regulatory pathway, it may not belong in version 1 of your system.

Technology choices for small regulated businesses

Small regulated companies have historically had two technology options, neither of them good. The first was a large enterprise QMS platform with per-user pricing, implementation fees, and validation costs that made the total cost of ownership $150,000 to $500,000 in year one. The second was spreadsheets and shared drives, which failed under audit pressure and created compliance risk as the company scaled.

The emergence of cloud-native QMS platforms changed this. Modern SaaS platforms offer subscription pricing that scales with company size, pre-validated infrastructure that eliminates the worst of the validation burden, and configurable workflows that can start simple and grow with the business.

For a small regulated company, the right QMS platform should provide:

• Document control with version management and approval workflows
• CAPA management with root cause investigation tracking
• Training record management
• Complaint management
• Supplier qualification records and an approved supplier list
• Internal audit management
• Management review documentation
• Audit trail and electronic signature capabilities that meet 21 CFR Part 11

These eight capabilities cover the vast majority of what FDA and ISO 13485 require for a small medical device, pharma, or biotech company. A platform that delivers all eight at a price point accessible to a Series A or early commercial-stage company eliminates the false choice between compliance and affordability.

Building your QMS in the right order

Small companies often ask in what order to build their quality system. The short answer is: start with the documents and processes that directly touch your product, then build the oversight structure around them.

A practical sequencing for a medical device startup:

Month 1-2: Document control system, SOP template, core SOPs for the processes actually in use (manufacturing, incoming inspection, labeling, shipping). Get these approved and into the hands of the people doing the work.

Month 2-3: CAPA process, non-conforming material handling, complaint intake procedure. These can start simple — five-step CAPA is fine for a small team — and add complexity only as volume justifies it.

Month 3-4: Training record system, supplier qualification for your top ten suppliers, approved supplier list.

Month 4-6: Internal audit program (even if the first audit is conducted by an outside consultant), management review process, first formal management review.

By month six, you have a defensible, functioning quality management system. It will not pass a notified body audit without additional work on design controls and technical documentation, but it will withstand a customer audit and demonstrate to a potential investor or partner that quality management is not an afterthought.

Common mistakes small businesses make when implementing a QMS

Starting with the manual, not the processes

Many small companies write a quality manual before they have any real processes documented. The manual describes how things should work in theory; the actual processes have not been captured anywhere. The result is a quality manual that describes a system that does not exist, which is worse than having no manual at all from an audit perspective.

Assigning QMS ownership to someone without authority

A quality management system run by someone without management authority over the processes it governs will fail. The quality manager — even in a 10-person company — needs direct access to leadership and the authority to stop a nonconforming shipment. If your quality function is subordinate to operations with no independent escalation path, your system will struggle to function when quality and production schedule conflict.

Treating certification as the goal rather than compliance

ISO 13485 certification is a market access requirement for many medical device markets, but it should not be the organizing goal of your quality system. Companies that build their QMS around passing a certification audit often end up with systems that look correct on paper but fail to prevent real quality problems. Build the system to prevent the problems; certification follows.

Underestimating document maintenance

The most consistent long-term burden in any quality management system is keeping documents current. SOPs need periodic review cycles, typically every two years. When a process changes, every document that references it needs updating. Small companies that start with 30 SOPs often find that within two years they have 80, and that managing review cycles across all of them consumes more staff time than they budgeted.

How Cloudtheapp supports small regulated businesses

Cloudtheapp is built for regulated businesses that need a complete, validated quality management system without enterprise pricing. The platform includes 60+ configurable applications covering document control, CAPA, training, complaints, supplier qualification, audits, and management review — all in a single cloud platform that scales as your team grows.

For small businesses, the key advantages are:

• No-code configuration that allows quality teams to set up and modify workflows without IT support or vendor involvement
• Pre-validated infrastructure with a validation package provided with every platform update, reducing the software validation burden that typically consumes weeks of a small team’s time
• Subscription pricing that starts at a scale appropriate for small companies, without per-user fees that penalize growth
• Built-in audit trail and electronic signature capabilities that satisfy 21 CFR Part 11 without additional configuration

If you are building or modernizing a quality management system at a small regulated company, schedule a demo to see how the platform scales to fit where you are today and where you will be in three years.

Summary

Small regulated companies have the same FDA and ISO quality obligations as large enterprises, but the right-sized implementation looks very different from an enterprise system. The core elements — document control, CAPA, training, complaints, supplier management, internal audits, management review — are non-negotiable regardless of company size. Everything else should be added only when the process genuinely exists and needs to be controlled.

Technology has made a functioning, validated quality management system accessible to companies of any size. The constraint today is less about platform capability and more about making thoughtful decisions about scope, sequencing, and maintenance capacity before you start building.

This post created by and appeared first on Cloudtheapp