That gap usually comes from five recurring problems — audit scope that's too vague to sample anything meaningful, checklist questions copied from a template years ago, evidence trails that don't actually connect to a conclusion, auditors who lack real independence from the process they're reviewing, and findings that get "closed" without anyone verifying the fix worked.
This article takes a different approach. Instead of handing you a static question list, it shows you how to map checklist questions to specific ISO 13485:2016 clauses, identify what counts as objective evidence, sample real processes and records instead of just asking "do you have a procedure," and turn findings into corrective action your QMS actually improves from — before an external auditor finds the gap first.
Key Takeaways
- An ISO 13485 checklist supports auditor judgment under Clause 8.2.4; it doesn't replace it
- Scope the audit using risk, patient impact, and prior findings, not a generic template
- Every checklist question needs a linked evidence prompt and a follow-up trigger
- Findings only count once effectiveness is verified, not when the record gets closed
- QMS Learning's Medical Device & Life Sciences pathway builds this capability into teams directly
ISO 13485 Internal Audit Checklist: Purpose, Scope, and Key Requirements
An ISO 13485 audit checklist is a structured set of questions, clause references, evidence prompts, and results fields that guide an auditor through a QMS evaluation. It's an aid, not a substitute. A checklist can't exercise judgment, and it can't decide whether evidence is sufficient; the auditor does that.
Clause 8.2.4 defines what the internal audit program has to accomplish. According to FDA's MDSAP guidance, internal audits must assess conformity with the organization's own QMS arrangements, with ISO 13485 itself, and with applicable regulatory requirements. They must also evaluate whether processes are effectively implemented and maintained. That's four distinct things to check, not one.
Audit Program vs. Audit Plan vs. Checklist
These three terms get used interchangeably, but they aren't the same thing:
- Audit program: determines which processes and areas get audited over a defined period (usually a year)
- Audit plan: defines the scope, criteria, timing, methods, auditors, and participants for one specific audit
- Checklist: guides the actual questions, sampling, evidence review, and recording of results during that audit
Setting a Risk-Informed Scope
Don't audit every process with the same depth every year. Prioritize based on:
- Process importance and potential patient or device risk
- Product lifecycle stage (design, transfer, mature production, end-of-life)
- Previous audit findings and open CAPAs
- Complaint volume and trend direction
- Supplier performance issues or recent changes
- Outsourced processes and recent process or supplier changes
With the FDA's QMSR now incorporating ISO 13485:2016 directly into 21 CFR Part 820, U.S. manufacturers can't treat ISO conformity and FDA conformity as separate exercises anymore.
Your checklist needs to reference both. Verify current clause wording against the licensed standard rather than relying on secondary summaries, including this one.
Clause-Based ISO 13485 Internal Audit Checklist
Treat this as a framework, not a finished product. Every question below needs adapting to your actual products, sites, outsourced activities, and documented procedures before you use it on the floor.
Audit Clauses 4 and 5: QMS Foundation and Leadership
Sample these foundation areas:
- QMS scope and process interactions are documented and still accurate
- Quality manual (or equivalent), document and record controls, and quality objectives
- Management review ran with real inputs and outputs, not a rubber stamp of last quarter's numbers
Ask: What evidence shows leadership acted on QMS performance data, not just reviewed it?
Audit Clause 6: Resource Management
Confirm these resource controls:
- Personnel are competent for assigned work
- Training needs are identified systematically
- Training effectiveness is evaluated where it matters, not only logged as "completed"
- Infrastructure maintenance records are current
- Work environment supports product conformity (contamination control, calibrated equipment, adequate lighting for inspection)
Audit Clause 7: Product Realization
This is usually the deepest sampling exercise. Trace:
- Customer requirements through design and development
- Risk management activities tied to design decisions
- Purchasing and supplier controls
- Production and process validation records
- Identification and traceability
- Preservation, installation, or servicing where applicable
- Monitoring and measuring equipment calibration status
Audit Clause 8: Measurement, Analysis, and Improvement
Examine these improvement-system controls:
- Feedback and complaint handling
- Regulatory reporting obligations
- Internal audit controls themselves
- Nonconforming product dispositions
- Data analysis, CAPA, and continual improvement activity
For each clause group above, structure your checklist prompts around four questions:
- What requirement is being tested?
- What evidence would demonstrate conformity?
- How will effectiveness be verified, not just existence?
- What follow-up is required if evidence is incomplete or contradictory?
Evidence to Collect During an ISO 13485 Internal Audit
Objective evidence is verifiable. A statement like "we always do incoming inspection" isn't evidence; a signed incoming inspection record tied to a specific lot number is.
Common evidence sources include:
- Controlled procedures and approved records
- System entries, interviews, and direct observation
- Training records, equipment logs, and test results
- Complaint files, supplier records, and CAPA documentation
Document and Record Controls
Confirm these controls are working in practice:
- Current approved versions, change history, and access controls
- Obsolete-document prevention and record legibility
- Retention periods and retrieval speed
- Procedures that actually link to the records they generate
Product and Process Controls
Pick a product, batch, lot, or work order and trace it end to end:
- Inputs and production steps
- Inspections and acceptance records
- Equipment status and personnel competence at the time of production
- Nonconformities and the release decision
Following one real item through the whole process surfaces gaps a document review never will.
Design and Risk Management
Sample a design project or change and trace user needs through inputs, outputs, reviews, verification, validation, risk controls, residual risk decisions, transfer, and change approvals. Living risk files that connect design changes back to post-market data are a strong signal the process works in practice, not just on paper.
CAPA, Complaints, Suppliers, and Management Review
Compare issue sources (complaints, nonconformities, audit findings) against investigation records, root-cause analysis, action plans, and effectiveness checks. A solid CAPA investigation record names the investigator, source records, action owner, due date, and the specific effectiveness criterion used to close it, not just a closure date.
When documenting evidence, record:
- The record identifier and revision or date
- The sampled process, product, or lot
- Personnel interviewed and location observed
- The specific link between evidence and your audit conclusion
Avoid reproducing confidential device or patient information in audit records. Reference the identifier, not the clinical detail.
How to Use an ISO 13485 Internal Audit Checklist
A checklist is only as good as the process around it. That process has three distinct phases.
Before the Audit
Confirm these items before you start:
- Audit criteria, scope, and schedule
- Process owners and auditor independence
- Sampling approach and prior findings
Update the checklist against the currently approved standard and your own QMS procedures, not last year's version. Auditor competence and independence matter here: someone auditing their own process can't be objective about it, regardless of intent.
During the Audit
Combine questioning, observation, record review, and traceability exercises. Follow process linkages (how one process's outputs feed another) instead of only confirming a procedure exists. Record compliant evidence alongside deficiencies; a checklist that only documents problems misses the full picture of how the QMS actually functions.
After the Audit
Review findings with process owners directly:
- State the requirement and the evidence clearly
- Assign responsibility and a due date
- Determine whether the issue needs a simple correction or a systemic corrective action
Don't close the finding until effectiveness is verified. A revised document or a few good parts right after an adjustment doesn't prove the fix held.
This is where most internal audit programs break down. Teams complete training on paper but still can't write a nonconformity statement with proper objective evidence six months later. Others close CAPAs without a verified effectiveness check, and the same finding resurfaces the following year.
QMS Learning's Medical Device & Life Sciences pathway, currently enrolling pilot cohorts for Q3 2026, builds this specific capability. The ISO 13485 Internal Auditor with FDA QMSR course walks teams through a risk-based audit program, a full audit plan and checklist, a complaint audit, and a mock audit.
Auditors practice the judgment calls before they're making them against a live finding. It's a training and capability tool, not a replacement for auditor competence or a certification guarantee.
Common ISO 13485 Internal Audit Findings and Follow-Up
A checklist with every box marked "yes" can create false confidence if nobody verified implementation, effectiveness, or how processes interact. Recurring weaknesses show up consistently in external reviews too. Emergo by UL's 2025 warning letter review identified recurring categories across FDA enforcement actions, including:
- Incomplete CAPA investigations
- Weak complaint escalation that doesn't trigger further action
- Insufficient supplier evaluation and incoming controls
- Incomplete process validation
- Uncontrolled or outdated documentation
- Management reviews that don't lead to actual decisions
Writing a Finding That Holds Up
A strong finding follows a simple formula:
- Identify the requirement
- Describe the objective evidence
- Explain the gap or risk
- Define the required response
Stay within what the evidence supports. Do not overstate the conclusion.
Prioritizing Follow-Up
Not every observation deserves the same response. Weigh risk and systemic impact: a one-off documentation lapse on a low-risk product isn't the same category as a supplier evaluation that's been overdue for a year and tied to an open complaint trend.
Verify your organization's documented classification rules and applicable regulatory expectations before you categorize a finding. Don't default to treating everything as equally severe, or equally minor.
Conclusion
The strongest ISO 13485 internal audit checklist does four things:
- Connects clauses to real processes
- Demands objective evidence instead of assumptions
- Scopes work around actual risk
- Drives findings through to verified corrective action
Your next step is practical. Tailor the checklist to your QMS scope, regulatory markets, products, outsourced processes, and prior findings. Then validate it with a competent, independent auditor before you run it against your own operation.
Frequently Asked Questions
What is an ISO audit checklist?
It's a structured audit aid linking requirements to questions, evidence prompts, and findings fields. It supports a systematic review but doesn't replace auditor competence or process-based judgment.
What are the 5 C's of internal audit?
A commonly used framework covering Criteria, Condition, Cause, Consequence, and Corrective Action. Terminology varies: some organizations use Criteria, Condition, Effect, Cause, and Recommendation instead.
What are the mandatory documents required by ISO 13485?
Required documentation depends on your applicable clauses, QMS scope, device activities, and regulatory obligations. Verify the current standard and identify the specific procedures and records your own QMS requires.
Which ISO 13485 clause covers internal audits?
Clause 8.2.4 is the primary requirement. It covers planned and documented audit arrangements, auditor independence and competence, audit records, and follow-up corrective action.
What evidence should be collected during an ISO 13485 internal audit?
Representative evidence includes controlled documents, completed records, interviews, direct observations, training and equipment records, product traceability, complaints, CAPA files, supplier records, and management review outputs.
How often should an ISO 13485 internal audit be conducted?
ISO 13485 requires audits at planned intervals, not one fixed universal frequency. Set frequency using process risk, importance, prior results, recent changes, complaint trends, and applicable regulatory requirements.