Medical Device Audit Checklist Example

ISO 13485:2016 and 21 CFR 820

Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
Quality Management System
4.1.1 Is the quality management system (QMS) documented,
§820.5 implemented, and maintained?
Are the QMS processes monitored and measured? Are there
4.1.2
adequate resources to support the processes? Are the processes
4.1.3 controlled using a risk-based approach?
Are changes to QMS processes evaluated for impact on the QMS and
4.1.4
devices? Are changes controlled?
4.1.5 Are outsourced processes adequately controlled?
Is software used in the QMS system properly monitored and
4.1.6 controlled, including validations and revalidations based on risk and
in writing?
Documentation requirements
Does the quality management system (QMS) documentation include
4.2.1
quality policy, quality objectives, procedures, and records?
Is the Quality Manual properly documented, including procedures or
references to them? Does it include details of and justification for
4.2.2 any exclusion or non-application?
§820.20(e) Does it address all relevant requirements of ISO 13485 and 21 CFR
820?

Is the interaction between the processes of the quality system

4.2.2
documented (process map, flowcharts, etc.)?
Is the structure of the quality system documentation outlined in the
4.2.2
manual?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

1
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
Is there a Medical Device File (ISO) for each medical device type or
medical device family, and/or Device Master Record (FDA) including:
• description of the device, intended use/purpose, packaging,
labeling, instructions for use;
4.2.3 • product specifications;
§820.181 • production process specifications;
• procedures for measuring and monitoring / quality assurance;
and,
• as appropriate: requirements for installation, maintenance and
service?
Control of Documents
Is there a written procedure defining the controls needed to:
● Review and approve documents prior to issue,
● Review, update and re-approve documents,
● Identify changes and current revisions of documents
● Make relevant versions of applicable documents available at
points of use
4.2.4 ● Ensure that documents are legible and identifiable,
§820.40(a) ● Identify and control the distribution of documents of external
origin, and
● Prevent deterioration or loss of documents
● Identify retained obsolete documents and prevent their
unintended use

Is there evidence of implementation of the procedure?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

2
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
Is the period for retention of obsolete controlled documents
4.2.4
defined? Is the retention period at least equal to the lifetime of the
§820.180 device?
Are document changes reviewed and approved by the same function
that performed the original review and approval (unless specifically
4.2.4 designated otherwise)?
§820.40(b) Are change records maintained, including description of the change,
identification of the affected documents, approval signatures and
date, and when the change becomes effective?
Control of Records
4.2.5 Are quality records maintained?
4.2.5 Do procedures define the control for identity, storage, security,
§820.184 retrieval, retention, and disposition of records?
4.2.5
Is confidential health information protected?
§820.186
Are retention periods for records defined?
4.2.5
Are records retained for at least the period of time equivalent to the
§820.180 expected life of the device, and no less than 2 years?
Are records organized and maintained to ensure that they remain
legible, readily identifiable and retrievable, and to prevent
4.2.5
deterioration and loss?
§820.180 Are records accessible to the regulatory inspections?
Are electronic records backed up?
Are records maintained to enable changes to records to remain
4.2.5 identifiable?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

3
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
Management Responsibility
Is the top management
● communicating to the organization the importance of meeting
customer and other applicable requirements,
5.1 ● establishing the quality policy,
§820.20 ● establishing quality objectives,
● conducting management reviews, and
● ensuring availability of resources?

Is the top management ensuring that customer requirements are

5.2
determined and are met?
Is there a documented quality policy; and
● Is it appropriate to the purpose of the organization?
● Does it include a commitment to comply with requirements and
to maintain the effectiveness of the quality management system?
5.3
● Does it provide a framework for establishing the quality
§820.20
objectives?
● Is it communicated and understood throughout the organization?
● Is it periodically reviewed for continuing suitability?

Are quality objectives, including those needed to meet applicable

5.4.1 regulatory/ product requirements, established within the
organization? Are they consistent with the quality policy?
5.4.1 Are the quality objectives measurable?
5.4.2 Is quality management system planning carried out to ensure quality
§820.20 objectives are met and the QMS integrity remains when changes are

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

4
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
planned and implemented? Has the manufacturer established how
the requirements for quality will be met?
5.5.1 Is top management ensuring that responsibilities and authorities are
§820.20 defined, documented, and communicated within the organization?
5.5.1 Is an outline of the interrelation of all personnel who manage,
§820.20 perform, and verify work affecting quality documented?
Is top management ensuring the independence and authority
5.5.1
necessary to perform tasks and work affecting quality?
Is there an appointed member of management (Management
Representative) whose responsibility and authority includes the
following?
● Ensuring processes needed for the QMS are documented
5.5.2 ● Reporting to top management on the effectiveness of the QMS
§820.20 and any need for improvement
● Ensuring the promotion of awareness of applicable regulatory
requirements and quality management system requirements
throughout the organization

Are appropriate communication processes established within the

5.5.3 organization? Does top management ensure that communication
takes place regarding the effectiveness of the QMS?
Does the organization have documented procedures for
Management Review? Does top management review the
5.6.1
organization’s quality management system at documented planned
§820.20 intervals to ensure continuing suitability, adequacy, and
effectiveness? Are records of reviews maintained?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

5
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
Does input to management reviews cover the appropriate topics,
including the following?
• Customer feedback
• Complaint Handling
• Reports to regulatory authorities
• Audits
• Monitoring/ measurement of processes
5.6.2 • Monitoring/ measurement of products
• Corrective Actions
• Preventive Actions
• Follow-up actions from previous Management Reviews
• Changes affecting the QMS
• Assessment of opportunities for improvement and need for
changes to the QMS
• Applicable new or revised regulatory requirements
Is output from management review recorded, including recording
the input reviewed and any decisions and actions related to
5.6.3
improvements to QMS or product, any resource needs, and changes
needed to respond to new or revised regulatory requirements?
Resource Management
Has the organization determined and provided sufficient resources
6.1
to implement and maintain the QMS and meet regulatory and
§820.25 customer requirements?
Are personnel performing work affecting product quality competent
6.2
on the basis of appropriate education, training, skills, and
§820.25 experience? Are records of competence maintained?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

6
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
Is there a documented process for establishing competence,
6.2
providing needed training, and ensuring awareness of personnel?
6.2 Does the organization provide training or take other action to
§820.25 achieve or maintain the necessary competence?

Is the effectiveness of the training or other actions evaluated? Is the

6.2 evaluation method proportionate to the risk associated with the
functions?

6.2 Are personnel aware of the effects of their activities and how they
§820.25 contribute to the quality objectives?
6.3 Are there adequate buildings, workspace, and utilities present to
§820.70 achieve compliance to product requirements?
Does the organization have documented requirements for the
6.3
maintenance activities, including the interval of performance of
§820.70 maintenance activities that can affect product quality?
6.3
Are records of maintenance maintained?
§820.70
Does the organization have documented requirements for the work
6.4.1 environment needed to achieve conformity to product
§820.70 requirements? Does the organization have procedures to monitor
and control the work environment?
6.4.1 Are requirements documented for health, cleanliness, and clothing
§820.70 of personnel where contact could affect medical device safety or
performance?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

7
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
6.4.1 Are temporary personnel adequately trained or supervised within
§820.70 special environmental conditions within the work environment?

Does the organization plan and document arrangements for the

6.4.2 control of contaminated or potentially contaminated products in
§820.70 order to prevent further contamination of the work environment,
personnel, or product?
For sterile medical devices, are requirements for control of
contamination and micro-organisms documented? Does the
6.4.2
organization maintain the required cleanliness during assembly or
packaging processes?
Product Realization
7.1 Is there a procedure for product realization?
7.1 Is there a process for risk management? Are records of risk
management documented?
Is there evidence of the following?
• Objectives/ requirements for the product?
• Process documents and resources available?
7.1 • Requirements for validation, verification, monitoring,
§820.80 measurement, inspection, handling, storage, distribution and
product acceptance?
• Documentation that the product and design control processes
meet the requirements?
7.2.1 Are delivery and post-delivery requirements defined?
Are requirements necessary for specified intended use defined?
7.2.1
(Both specified and not specified by the customer)

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

8
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
7.2.1 Are regulatory requirements defined and met?
7.2.1 Is necessary user training for the safe use of the device identified?
7.2.2 Are product requirements defined and documented?
7.2.2 Are contract and order requirements resolved?
7.2.2 Is the organization able to meet the defined requirements?
Are relevant documents amended when product requirements
7.2.2
change?
7.2.2 Are records of product requirement reviews retained?
Are there documented arrangements for communications with the
7.2.3 customer for product information, customer feedback (complaints),
advisory notices, and contracts/ amendments to contracts?
7.3.1
Are there documented Design and Development Procedures?
§820.30
Are the following subjects documented?
• Design/ development stages
7.3.2 • Reviews needed for each stage
§820.30 • Verification, validation, and design transfer activities
• Methods to ensure traceability of design outputs to design inputs
• Resources needed, including competent personnel
Are the following covered by design inputs?
• Regulatory requirements and standards
7.3.3
• Functional performance, usability, and safety requirements per
§820.30 intended use
• Output risk management

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

9
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
• Information derived from similar designs
• Other requirements needed for the development of the product
• Are the inputs reviewed, approved, and documented
7.3.4
Are design outputs verifiable against the design inputs?
§820.30
7.3.4 Do design outputs provide appropriate and adequate information
§820.30 for purchasing, production, and servicing?
7.3.4
Do design outputs reference product acceptance criteria?
§820.30
7.3.4 Are the essential characteristics for safe and proper use specified in
§820.30 the design outputs?
7.3.4
Are design outputs approved prior to release?
§820.30
7.3.5 Are systematic reviews of the design performed at the appropriate
§820.30 stages?
Do design reviews evaluate whether the design results meet the
7.3.5
requirements? Do they include identification and proposal of
§820.30 necessary actions?
7.3.6 Is design verification performed for each documented process to
§820.30 verify that the design outputs meet the design inputs?
7.3.6 Does design verification specify the method, acceptance criteria,
§820.30 statistical techniques, and rationale for sample size?
If a device is required to interface with another device, does the
7.3.6
verification confirm that design outputs meet design inputs when
§820.30 the devices are interfaced?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

10
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
7.3.6 Are records of results and conclusions of design verification
§820.30 maintained?
Is design validation performed for each documented process to
7.3.7
verify that the design can meet the requirements for the intended
§820.30 use?
7.3.7 Does design validation specify the method, acceptance criteria,
§820.30 statistical techniques, and rationale for sample size?
7.3.7 Is design validation conducted on representative product?
7.3.7 Does design validation include clinical evaluation?
If a device is required to interface with another device, does the
7.3.7
validation confirm that design requirements have been met when
§820.30 the devices are interfaced?
7.3.7 Are records of results and conclusions of design validations
§820.30 maintained?
7.3.8 Are design transfer processes documented? Do the processes ensure
§820.30 design outputs are verified to be suitable for manufacturing?
7.3.8 Does production capability meet product requirements?
Are changes to design and development reviewed, verified,
7.3.9
validated (when needed), and approved? Are changes evaluated for
§820.30 the impact to the component or device?
7.3.10 Is there a design and development file or Design History File (DHF)
§820.30 for each device or device family?
Does the design and development file contain references to records
7.3.10
that demonstrate conformance to the device requirements and
§820.30 design changes?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

11
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
7.4.1 Is there a procedure defining the purchasing process and ensuring
§820.50 that purchased product conforms to the purchasing information?
Are there criteria for selection and approval of suppliers,
proportional to the risk related to the device? Are criteria based on
the following?
7.4.1
• Suppliers’ ability to provide product that meets the
§820.50 component/service requirements
• Supplier’s performance
• Effect of the product of the quality of the device
7.4.1 Are suppliers monitored and reevaluated? Does reevaluation
§820.50 consider supplier performance?
Are supplier nonconformances addressed in proportion to the risk
7.4.1 associated with the purchased product and compliance to regulatory
requirements?
7.4.1 Are results of supplier selection, evaluation, re-evaluation,
§820.50 performance, and actions arising from these activities documented?
As appropriate, is the following purchasing information provided?
• Product specifications
• Product acceptance, processes, and equipment requirements
• Qualifications of supplier personnel
7.4.2
• QMS requirements
• Purchase order review and approval
• Change notification on file
• Records of purchased materials maintained
Are verification processes established to confirm purchased product
7.4.3
meet requirements?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

12
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
Are changes to the purchased product evaluated for impact on the
7.4.3
finished medical device?
If source inspection is performed, are verification activities and
7.4.3
product release requirements defined on the purchase order?
7.5.1 Are there procedures in place for the control of production?
7.5.1 Is the infrastructure qualified?
Are process parameters monitored and measured? Is equipment
7.5.1
available for monitoring and measurement?
7.5.1 Are defined operations for labeling and packaging implemented?
7.5.1 Are release, delivery, and post-delivery instructions implemented?
7.5.1 Are traceability requirements recorded on the manufacturing
§820.65 records?
7.5.2 Is cleanliness or contamination abatement of the product defined?
7.5.3 Where installation is applicable, are acceptance criteria and
§820.170 verification of installation documented? Are records maintained?
7.5.4
Are servicing procedures documented?
§820.200
Are service records analyzed to determine if they are to be handled
7.5.4
as a complaint? Are service records used as an input for the
§820.200 improvement process?
7.5.4
Are servicing records maintained?
§820.200
For sterile medical devices: Are sterilization process parameters for
7.5.5
each lot/batch of devices maintained?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

13
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
For sterile medical devices: Are sterilization records traceable to
7.5.5
each lot/batch?
Where outputs are not verified or measurable, are they validated?
Does the validated process include the following?
7.5.6
• Criteria for review/approval of the process
§820.140
• Equipment and personnel qualification
• Methods, procedures, and acceptance criteria
Is there a procedure outlining the requirements for sterilization
7.5.7
validation and sterile barriers?
Has sterilization been validated prior to implementation? Have any
7.5.7
process changes been validated, as appropriate?
7.5.8
Is there a procedure defining identification of the product?
§820.60
7.5.8 Is product status maintained throughout the manufacturing, storage,
§820.60 installation, and servicing process?
7.5.9
Is there a procedure defining traceability?
§820.65
7.5.9
Are records of traceability maintained?
§820.65
For implantable devices:
• Are requirements that could affect performance or safety of the
7.5.9 device defined (materials, components, environmental
§820.65 conditions, etc.)?
• Do distributors keep records of distribution?
• Are consignee names and addresses maintained?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

14
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
Is customer property for use in the manufacture of the device
7.5.10
identified and protected while in the manufacturer’s possession?
Are records of damage, loss, and unsuitability conveyed to the
7.5.10
customer? Are the records maintained?
7.5.11
Is there a procedure providing for the preservation of conformity of
§820.140
the product during all phases of manufacturing, handling, storage
§820.150 and distribution?
§820.160
7.5.11 Are the packaging/ shipping procedures suitably designed to protect
§820.130 the product and prevent contamination?
Where special conditions are required, are they controlled and
7.5.11
documented?
Are there procedures ensuring that monitoring and measurement
7.6
can be carried out consistent with the requirements?
Is equipment calibrated at specified intervals using recognized
7.6 national/international standards? Are any adjustments
documented?
7.6
Is equipment identified to determine its calibration status?
§820.72
Is equipment safeguarded from adjustments that would invalidate
7.6
measurement results? Is it protected from damage during handling,
§820.72 storage, and maintenance?
7.6
Are calibration and verification records maintained?
§820.72

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

15
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
Does the organization review the validity of prior measurements if
7.6 the equipment is found to be out of tolerance? Is appropriate action
taken?
7.6 Is software used in measuring equipment validated in accordance
§820.70 with risk? Is there a software validation procedure?
Measurement, Analysis, Improvement
Does the organization implement monitoring, measurement,
analysis, and improvement to confirm the following?
• Conformity of the product
8.1
• Conformity to the QMS
• Effectiveness of the QMS
Are statistical techniques used defined?
Is the process for manufacturing and postproduction feedback
8.2.1 documented? Does the process cover regulatory requirements?
Does postproduction feedback feed into risk management and the
8.2.1
product improvement process?
Is there a complaint handling procedure that contains covers the
following?
• Receipt and recording of information
8.2.2 • Determination of complaint status
§820.198 • Investigation of complaints
• Determining regulatory reporting requirements
• Handling complaint product
• Determining the need for correction and corrective actions
8.2.2 Are complaint records maintained?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

16
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
§820.198
Are there procedures in place to direct documenting reporting of
8.2.3
complaints to regulatory authorities when needed (i.e. advisory
§820.198 notices, adverse events)?
8.2.3
Are reports to regulatory authorities maintained?
§820.198
8.2.4 Are internal audits performed at planned intervals?
8.2.4 Does the internal audit process ensure conformance to
§820.22 documentation and to regulatory requirements?
Do internal audits include the following?
• Evaluation of the effectiveness of the implementation and
8.2.4
maintenance of the Quality System
§820.22 • Review of prior audit results
• Defined audit scopes, methods, and intervals
8.2.4
Are auditors qualified and objective?
§820.22
8.2.4 Does management ensure that corrective actions are implemented
§820.22 and effective?
Are measurements and methods appropriate to ensure the
8.2.5 processes can achieve planned results? Have corrective actions been
implemented when required?
Are monitoring and measurement activities carried out at applicable
8.2.6
stages during product realization?
8.2.6
Is evidence of conformity to the acceptance criteria maintained?
§820.86

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

17
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
8.2.6 Is the test equipment used to perform acceptance identified on the
§820.80 measurement?
8.2.6
Is the person performing inspections/ tests recorded?
§820.80
Is there a procedure documenting controls, roles, and
responsibilities to identify, segregate, evaluate, and disposition
8.3.1
nonconforming product?
§820.90 Does the process determine the need for an investigation and
notification to external sources responsible for the nonconformity?
8.3.1
Is nonconforming product identified and segregated?
§820.90
8.3.1 Are records regarding nonconformances and subsequent actions
§820.90 maintained?
When a nonconformance is detected before delivery, are one or
more of the following actions prescribed/taken?
8.3.2
• Eliminate nonconformity
§820.90 • Preclude its original intended use
• Authorize use/ acceptance under concession
When nonconformities are detected post-delivery:
• Does the organization base actions on the effects or potential
8.3.3
effects of the nonconformity? Are the actions maintained?
§820.90
• Is there a procedure for submitting advisory notices? Are records
of advisory notices maintained?
8.3.4 Is there a procedure for rework? Does it have the same level of
§820.90 approval as the original procedure?

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

18
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
8.3.4 Has the rework been verified to conform to the acceptance criteria
§820.90 and regulatory requirements?
8.3.4
Are records of rework maintained?
§820.90
Is there a procedure that defines the collection and analysis of data
to determine the adequacy and effectiveness of the QMS (methods,
statistical techniques, and extent of use)? Does data include
• Feedback?
8.4 • Conformity to product requirements?
• Trends and opportunities for improvement?
• Supplier data?
• Audit data?
• Service reports (if required)?
8.4 Are records for data analysis maintained?
Does the organization use audit results, quality objectives, market
8.5.1 surveillance, corrective and preventive actions, and analysis of data
to improve the QMS and device safety and performance?
8.5.2 Is there a corrective action procedure to address issues including
§820.100 complaints and nonconforming product?
Does the corrective action process include the following?
• Determination of the root cause of the issue
• Evaluating need for action to ensure non-recurrence
8.5.2
• Documenting completed corrective action e.g. document change
§820.100
• Assessment of corrections on impact of the ability of the device
to meet requirements
• Effectiveness checks

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

19
 Standard Complies?
Reference
Requirement (Y/N/NA)
Notes and Evidence
• Maintaining records
8.5.3
Is there a procedure for identifying potential nonconformities and
§820.90
their causes?
§820.100
Does the preventive action process include the following?
• Evaluating the need for corrective action
• Documenting actions taken and the ability to meet the device
8.5.3
safety and device performance requirements
§820.100
• Verification that actions taken do not adversely affect the device
performance, safety, or conformance with regulatory
requirements
• Verification of the effectiveness of actions taken
8.5.3
Are records of preventive actions maintained?
§820.100

Please note: The above Checklist is provided as an example only. Please reference the applicable standard / regulation for additional details.

Additional Notes:
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

20