Most internal audits fail for the same reason: the auditor walks in with the standard printed out and hopes the conversation goes somewhere useful. A good internal audit is planned around processes, evidence and risk — not around reading clauses aloud.
This guide gives you a working checklist for ISO 13485:2016, organised the way a real audit runs: preparation, then Clause 4, 6, 7 and 8, with the questions to ask and the records to request at each step.
Finding non-conformities is a good outcome
An internal audit that reports nothing is usually an audit that looked at nothing. Minor findings raised internally are far cheaper than the same findings raised by a notified body or an MDSAP auditor.
1. Audit preparation (Clause 8.2.4)
Before you book a single interview, settle four things. Auditors who skip this stage end up with a report that cannot be defended.
- 1Programme and schedule: which processes are audited this year, at what frequency, and why — frequency should follow risk, previous findings and change.
- 2Scope and criteria: the processes, sites and shifts in scope, plus the criteria (ISO 13485:2016, your QMS procedures, and applicable regulatory requirements).
- 3Auditor independence: nobody audits their own work. Document how independence is achieved, including for very small teams.
- 4Preparation pack: previous audit reports, open CAPAs, complaint trends, process KPIs and the current procedure revisions.
| Planning input | Why it matters | Evidence to keep |
|---|---|---|
| Risk of the process | Justifies audit frequency | Audit programme with risk rationale |
| Previous findings | Verifies effectiveness of past CAPA | Prior reports, CAPA closure records |
| Changes since last audit | New equipment, suppliers, software, sites | Change records, validation reports |
| Auditor competence | Required by Clause 6.2 | Training records, auditor qualification |
2. Clause 4 — QMS and documentation
Clause 4 is where document control and the Medical Device File live. It is also the easiest place to collect findings, because obsolete documents leave a paper trail.
Sample questions
- Show me the Medical Device File for this product. Where are the specifications, manufacturing, and installation/servicing requirements held?
- How do you decide that a process is outsourced, and where is the controlled agreement for it?
- How is the current revision of this work instruction identified at the workstation?
- How long are records retained, and how did you determine that period?
- If QMS software is used, where is the validation record for its intended use (Clause 4.1.6)?
| Clause | What to verify | Typical evidence |
|---|---|---|
| 4.2.3 | Medical Device File exists and is complete per product family | MDF index, linked specifications |
| 4.2.4 | Document approval, revision status, obsolete copies removed | Document register, shop-floor spot check |
| 4.2.5 | Record legibility, retention, protection | Retention schedule, archive access log |
| 4.1.5 | Outsourced process control proportional to risk | Quality agreement, supplier monitoring |
The classic Clause 4 finding
A superseded instruction is still laminated at the workstation while the document register shows a newer revision. Always spot-check the floor, not just the register.
3. Clause 6 — Resources, competence and environment
Clause 6 is about whether the people, equipment and environment can actually deliver conforming product. Audit it with your eyes as much as your questions.
Sample questions
- How is competence defined for this role, and how was effectiveness of the training evaluated — not just attendance?
- This gauge is in use today. Show me its calibration status and the action taken the last time it was found out of tolerance.
- What are the environmental limits for this area, how are they monitored, and what happens on an excursion?
- How is personnel health, cleanliness and clothing controlled where it could affect product?
- Where equipment maintenance is required for process capability, show me the plan and the completed records.
| Area | Check | Common gap |
|---|---|---|
| 6.2 Competence | Effectiveness evaluation exists | Signed attendance sheet treated as effectiveness |
| 6.3 Infrastructure | Maintenance plan and intervals followed | Overdue preventive maintenance, no risk assessment |
| 6.4.1 Work environment | Monitoring within defined limits | Excursion recorded, no product impact assessment |
| 7.6 Monitoring equipment | Calibration traceable and in date | Out-of-tolerance gauge with no product recall assessment |
4. Clause 7 — Product realization
This is the largest part of the audit and where most substantive findings sit: design controls, purchasing, production and validation.
Design and development (7.3)
- Walk me through one design project from plan to transfer. Where are the review, verification and validation records?
- How do design inputs trace to outputs, and how do you demonstrate that every input was verified?
- Show me a design change after the design freeze: what was the impact assessment on risk, verification and regulatory submissions?
- Where is the design transfer record that shows production specifications were verified as suitable for manufacturing?
Purchasing (7.4)
- How are suppliers evaluated and selected, and what criteria were applied to this supplier?
- Show me the monitoring and re-evaluation of this supplier's performance, and what happened after the last rejected lot.
- Does the purchasing information include a requirement for the supplier to notify you of changes?
- How is incoming verification proportionate to the risk of the purchased item?
Production and service (7.5)
- Take this batch record: show me traceability from the finished device back to raw material lots and operators.
- Which processes are validated rather than verified, and on what basis? Show me the validation and revalidation records.
- How is product identified through the process, including inspection status?
- How is cleanliness, contamination control and — where applicable — sterile barrier integrity controlled?
| Direction | What you follow | What proves it |
|---|---|---|
| Forward | Raw material lot → devices → customers shipped | Lot records, distribution records |
| Backward | Serial number → batch record → components → supplier | Batch record, incoming inspection |
| Sideways | Same batch → non-conforming units → disposition | NC log, rework instruction, re-inspection |
5. Clause 8 — Measurement, analysis and improvement
Clause 8 tells you whether the QMS learns. Focus on root cause quality and effectiveness checks, not on whether forms were filled.
Sample questions
- Take this CAPA: what was the root cause methodology, and how do you know the stated cause is the actual cause?
- How was effectiveness verified after implementation, and over what period or sample size?
- How do complaints get screened for reportability, and what is the timeline evidence for the last reportable event?
- Show me the data analysis that feeds management review — what trend triggered an action in the last twelve months?
- How do you distinguish a correction from a corrective action, and where is the preventive action pipeline?
| Clause | Verify | Weak-evidence signal |
|---|---|---|
| 8.2.1/8.2.2 | Feedback and complaint handling, reportability screening | Complaints closed as 'no trend' with no analysis |
| 8.3 | Non-conforming product identification and disposition | Repeated use-as-is concessions with no trend review |
| 8.4 | Analysis of data covers feedback, conformity, suppliers, processes | Data presented but no conclusions or actions |
| 8.5.2/8.5.3 | Root cause, action, effectiveness check | Root cause = 'operator error', action = 'retrained operator' |
Auditor tip: test the effectiveness check, not the closure date
Ask what evidence would have shown the action failed. If the CAPA owner cannot answer that, the effectiveness verification was a formality.
6. Three mistakes that cause repeat findings
- 1Auditing clauses instead of processes. Interviews that march through the standard miss the handovers between departments — which is where most real failures live.
- 2Accepting statements as evidence. 'We always do that' is not a record. Ask for the document, the date and the signature, and sample a second example.
- 3Writing findings without the requirement. Every non-conformity needs three parts: the requirement, the objective evidence, and the statement of non-fulfilment. Without all three, the finding is disputed and dies in review.
7. Quick internal audit checklist
Use this before, during and after every internal audit
- Audit programme reflects process risk, past findings and recent changes
- Auditor is independent of the audited process and competence is recorded
- Scope, criteria and schedule communicated to process owners in advance
- Previous findings and open CAPAs reviewed as an audit input
- Medical Device File and document revisions checked at the point of use
- Competence effectiveness, calibration and environmental monitoring sampled
- One design change traced through impact assessment and verification
- One supplier traced through evaluation, monitoring and a rejection event
- One device traced forward and backward through production records
- One CAPA tested for root cause quality and effectiveness verification
- Every finding states requirement, evidence and non-fulfilment
- Report issued within the defined timeframe and inputs sent to management review
8. Where to go next
If you want to build this into a repeatable skill — audit planning, questioning technique, writing defensible findings, and grading non-conformities — that is exactly what the SkillMed internal auditor programme covers, with worked exercises and a certificate on passing.
Related training
ISO 13485 Internal Auditor Programme
A 2-day guided internal auditor programme with 24 lessons, checkpoint quizzes, a 30-question exam and a verifiable certificate.
View the programme Browse free courses