Qms Audit Expert

QMS Audit Expert

ISO 13485 internal audit methodology for medical device quality management systems.

---

Table of Contents

• Audit Planning Workflow
• Audit Execution
• Nonconformity Management
• External Audit Preparation
• Reference Documentation
• Tools

---

Audit Planning Workflow

Plan risk-based internal audit program:

1. List all QMS processes requiring audit 2. Assign risk level to each process (High/Medium/Low) 3. Review previous audit findings and trends 4. Determine audit frequency by risk level 5. Assign qualified auditors (verify independence) 6. Create annual audit schedule 7. Communicate schedule to process owners 8. Validation: All ISO 13485 clauses covered within cycle

Risk-Based Audit Frequency

Audit Scope by Clause

Auditor Independence

Verify auditor independence before assignment:

• [ ] Auditor not responsible for area being audited
• [ ] No direct reporting relationship to auditee
• [ ] Not involved in recent activities under audit
• [ ] Documented qualification for audit scope

---

Audit Execution

Conduct systematic internal audit:

1. Prepare audit plan (scope, criteria, schedule) 2. Review relevant documentation before audit 3. Conduct opening meeting with auditee 4. Collect evidence (records, interviews, observation) 5. Classify findings (Major/Minor/Observation) 6. Conduct closing meeting with preliminary findings 7. Prepare audit report within 5 business days 8. Validation: All scope items covered, findings supported by evidence

Evidence Collection

Audit Questions by Clause

Document Control (4.2):

• Show me the document master list
• How do you control obsolete documents?
• Show me evidence of document change approval

Design Control (7.3):

• Show me the Design History File for [product]
• Who participates in design reviews?
• Show me design input to output traceability

CAPA (8.5):

• Show me the CAPA log with open items
• How do you determine root cause?
• Show me effectiveness verification records

See references/iso13485-audit-guide.md for complete question sets.

Finding Documentation

Document each finding with:

Requirement: [Specific ISO 13485 clause or procedure]
Evidence: [What was observed, reviewed, or heard]
Gap: [How evidence fails to meet requirement]

Example:

Requirement: ISO 13485:2016 Clause 7.6 requires calibration
at specified intervals.

Evidence: Calibration records for pH meter (EQ-042) show
last calibration 2024-01-15. Calibration interval is
12 months. Today is 2025-03-20.

Gap: Equipment is 2 months overdue for calibration,
representing a gap in calibration program execution.

---

Nonconformity Management

Classify and manage audit findings:

1. Evaluate finding against classification criteria 2. Assign severity (Major/Minor/Observation) 3. Document finding with objective evidence 4. Communicate to process owner 5. Initiate CAPA for Major/Minor findings 6. Track to closure 7. Verify effectiveness at follow-up 8. Validation: Finding closed only after effective CAPA

Classification Criteria

Classification Decision

Is required element absent or failed?
├── Yes → Systematic (multiple instances)? → MAJOR
│   └── No → Could affect product safety? → MAJOR
│       └── No → MINOR
└── No → Deviation from procedure?
    ├── Yes → Recurring? → MAJOR
    │   └── No → MINOR
    └── No → Improvement opportunity? → OBSERVATION

CAPA Integration

See references/nonconformity-classification.md for detailed guidance.

---

External Audit Preparation

Prepare for certification body or regulatory audit:

1. Complete all scheduled internal audits 2. Verify all findings closed with effective CAPA 3. Review documentation for currency and accuracy 4. Conduct management review with audit as input 5. Prepare facility and personnel 6. Conduct mock audit (full scope) 7. Brief personnel on audit protocol 8. Validation: Mock audit findings addressed before external audit

Pre-Audit Readiness Checklist

Documentation:

• [ ] Quality Manual current
• [ ] Procedures reflect actual practice
• [ ] Records complete and retrievable
• [ ] Previous audit findings closed

Personnel:

• [ ] Key personnel available during audit
• [ ] Subject matter experts identified
• [ ] Personnel briefed on audit protocol
• [ ] Escorts assigned

Facility:

• [ ] Work areas organized
• [ ] Documents at point of use current
• [ ] Equipment calibration status visible
• [ ] Nonconforming product segregated

Mock Audit Protocol

1. Use external auditor or qualified internal auditor 2. Cover full scope of upcoming external audit 3. Simulate actual audit conditions (timing, formality) 4. Document findings as for real audit 5. Address all Major and Minor findings before external audit 6. Brief management on readiness status

---

Reference Documentation

ISO 13485 Audit Guide

references/iso13485-audit-guide.md contains:

• Clause-by-clause audit methodology
• Sample audit questions for each clause
• Evidence collection requirements
• Common nonconformities by clause
• Finding severity classification

Nonconformity Classification

references/nonconformity-classification.md contains:

• Severity classification criteria and decision tree
• Impact vs. occurrence matrix
• CAPA integration requirements
• Finding documentation templates
• Closure requirements by severity

---

Tools

Audit Schedule Optimizer

# Generate optimized audit schedule
python scripts/audit_schedule_optimizer.py --processes processes.json

# Interactive mode
python scripts/audit_schedule_optimizer.py --interactive

# JSON output for integration
python scripts/audit_schedule_optimizer.py --processes processes.json --output json

Generates risk-based audit schedule considering:

• Process risk level
• Previous findings
• Days since last audit
• Criticality scores

Output includes:

• Prioritized audit schedule
• Quarterly distribution
• Overdue audit alerts
• Resource recommendations

Sample Process Input

{
  "processes": [
    {
      "name": "Design Control",
      "iso_clause": "7.3",
      "risk_level": "HIGH",
      "last_audit_date": "2024-06-15",
      "previous_findings": 2
    },
    {
      "name": "Document Control",
      "iso_clause": "4.2",
      "risk_level": "MEDIUM",
      "last_audit_date": "2024-09-01",
      "previous_findings": 0
    }
  ]
}

---

Audit Program Metrics

Track audit program effectiveness:

---

Troubleshooting

---

Success Criteria

• Annual audit schedule covers 100% of ISO 13485 clauses with risk-based frequency (quarterly for high-risk, semi-annual for medium, annual for low)
• Schedule compliance rate exceeds 90% (audits completed on time vs. planned)
• All Major findings result in full root cause analysis CAPA initiated within 30 days and verified effective within 6 months
• Finding closure rate exceeds 95% by due date, with no overdue Major findings at any point
• Repeat finding rate below 10% across consecutive audit cycles, demonstrating effective corrective actions
• Auditor independence verified and documented for every audit assignment (no self-auditing of own work area)
• Mock audit conducted before every external certification or surveillance audit with all Major and Minor findings resolved

---

Scope & Limitations

In Scope:

• ISO 13485:2016 internal audit planning, scheduling, and execution
• Risk-based audit frequency optimization
• Nonconformity classification (Major/Minor/Observation) with decision tree
• CAPA integration for audit findings
• External audit preparation and mock audit protocols
• Audit program metrics and effectiveness tracking

Out of Scope:

• External audit execution (this skill supports preparation for and response to external audits, not conducting them)
• Regulatory inspection management (FDA, Notified Body inspections have jurisdiction-specific protocols beyond internal audit scope)
• Detailed CAPA root cause analysis methodology (use capa-officer skill for 5-Why, Fishbone, FTA, FMEA)
• ISO 19011 auditor certification or training program administration
• Technical product testing or process validation
• QMSR-specific audit checklist generation (use quality-manager-qms-iso13485 for QMSR gap analysis)

---

Integration Points

---

Tool Reference

audit_schedule_optimizer.py

Generates risk-based audit schedules optimized by process risk, findings history, and time since last audit.

ISO 13485 Audit Guide

Clause-by-clause audit methodology with sample questions and common findings.

---

Table of Contents

• Audit Approach
• Clause 4: Quality Management System
• Clause 5: Management Responsibility
• Clause 6: Resource Management
• Clause 7: Product Realization
• Clause 8: Measurement and Improvement
• Common Nonconformities

---

Audit Approach

Risk-Based Audit Planning

Prioritize audit focus based on:

Evidence Collection Methods

---

Clause 4: Quality Management System

4.1 General Requirements

Audit Questions:

• Show me documentation of your QMS scope and exclusions
• How do you identify processes needed for the QMS?
• Show me evidence of outsourced process control

Evidence to Review:

• [ ] Quality Manual or QMS description
• [ ] Process interaction diagram
• [ ] Outsourced process agreements

Common Findings:

• Scope exclusions not justified
• Outsourced processes not controlled
• Process interactions not defined

4.2 Documentation Requirements

4.2.1-4.2.2 Quality Manual and Documents

Audit Questions:

• Where is your documented quality policy?
• Show me the procedure for document control
• How do you ensure documents are current at point of use?

Evidence to Review:

• [ ] Quality Manual
• [ ] Document master list
• [ ] Sample of controlled documents

4.2.4 Control of Records

Audit Questions:

• What is your record retention policy?
• Show me the procedure for record storage and protection
• How do you ensure record legibility and retrievability?

Evidence to Review:

• [ ] Record control procedure
• [ ] Retention schedule
• [ ] Sample record retrieval test

Common Findings:

• Obsolete documents in use
• Records not legible or retrievable
• Retention periods not defined for all record types

---

Clause 5: Management Responsibility

5.1-5.2 Management Commitment and Customer Focus

Audit Questions:

• How does top management demonstrate commitment to QMS?
• Show me evidence of customer requirement determination
• How are regulatory requirements communicated?

Evidence to Review:

• [ ] Quality policy communication
• [ ] Management review minutes
• [ ] Customer feedback records

5.4 Planning

Audit Questions:

• Where are your quality objectives documented?
• Show me the plan for achieving quality objectives
• How do you maintain QMS integrity during changes?

Evidence to Review:

• [ ] Quality objectives (measurable, time-bound)
• [ ] Quality planning documentation
• [ ] Change management records

5.5 Responsibility and Authority

Audit Questions:

• Where are responsibilities and authorities defined?
• Who is the management representative?
• How is QMS performance communicated to top management?

Evidence to Review:

• [ ] Organization chart
• [ ] Job descriptions with QMS responsibilities
• [ ] Management representative appointment

5.6 Management Review

Audit Questions:

• Show me management review records from last 12 months
• What inputs are included in management review?
• What decisions and actions resulted?

Required Review Inputs:

• [ ] Audit results
• [ ] Customer feedback (including complaints)
• [ ] Process performance and product conformity
• [ ] CAPA status
• [ ] Changes affecting QMS
• [ ] Recommendations for improvement
• [ ] New/revised regulatory requirements

Common Findings:

• Management review not conducted at planned intervals
• Required inputs missing
• Action items not tracked to completion

---

Clause 6: Resource Management

6.1-6.2 Human Resources

Audit Questions:

• How do you determine competency requirements?
• Show me training records for personnel affecting quality
• How do you evaluate training effectiveness?

Evidence to Review:

• [ ] Competency requirements by role
• [ ] Training records
• [ ] Effectiveness evaluations

6.3-6.4 Infrastructure and Work Environment

Audit Questions:

• How do you determine infrastructure requirements?
• Show me maintenance records for critical equipment
• How is work environment controlled for product conformity?

Evidence to Review:

• [ ] Equipment list with maintenance schedules
• [ ] Environmental monitoring records
• [ ] Contamination control procedures (if applicable)

Common Findings:

• Training effectiveness not evaluated
• Preventive maintenance not performed on schedule
• Environmental conditions not monitored

---

Clause 7: Product Realization

7.1 Planning of Product Realization

Audit Questions:

• Show me the quality plan for a recent product
• How do you determine verification and validation activities?
• What records are required to demonstrate conformity?

Evidence to Review:

• [ ] Quality plan or project plan
• [ ] Risk management integration
• [ ] Required records defined

7.2 Customer-Related Processes

Audit Questions:

• How do you determine customer requirements?
• Show me the contract review process
• How do you handle customer communications?

Evidence to Review:

• [ ] Contract/order review records
• [ ] Customer requirement documentation
• [ ] Communication records

7.3 Design and Development

Audit Questions (per phase):

Evidence to Review:

• [ ] Design History File (DHF)
• [ ] Design review records with participants
• [ ] Verification/validation protocols and reports
• [ ] Design change requests

7.4 Purchasing

Audit Questions:

• How do you evaluate and select suppliers?
• Show me approved supplier list with evaluation criteria
• How do you verify purchased product?

Evidence to Review:

• [ ] Supplier evaluation procedure
• [ ] Approved supplier list
• [ ] Incoming inspection records
• [ ] Supplier audit records

7.5 Production and Service Provision

Audit Questions:

• Show me work instructions for production
• How are special processes validated?
• Show me traceability records for a product lot

Evidence to Review:

• [ ] Production work instructions
• [ ] Process validation records
• [ ] Device history records (DHR)
• [ ] Traceability records

7.6 Control of Monitoring and Measuring Equipment

Audit Questions:

• Show me calibration records for measuring equipment
• How do you handle out-of-tolerance conditions?
• How is software used for monitoring validated?

Evidence to Review:

• [ ] Equipment calibration records
• [ ] Calibration procedure
• [ ] Out-of-tolerance investigation records

Common Findings:

• Design inputs not completely addressed in outputs
• Supplier evaluations not performed or documented
• Process validation not maintained after changes
• Calibration overdue

---

Clause 8: Measurement and Improvement

8.2.1 Feedback

Audit Questions:

• How do you collect customer feedback?
• Show me complaint handling records
• How is feedback data used for improvement?

Evidence to Review:

• [ ] Complaint procedure
• [ ] Complaint log with trending
• [ ] Feedback to design/production

8.2.2 Internal Audit

Audit Questions:

• Show me the internal audit schedule
• How do you ensure auditor independence?
• Show me audit records and follow-up actions

Evidence to Review:

• [ ] Audit program/schedule
• [ ] Auditor qualification records
• [ ] Audit reports and findings
• [ ] CAPA records from audits

8.2.3-8.2.4 Monitoring and Measurement

Audit Questions:

• How do you monitor process performance?
• Show me product acceptance records
• What happens when acceptance criteria not met?

Evidence to Review:

• [ ] Process monitoring data
• [ ] Inspection records
• [ ] Nonconforming product records

8.3 Control of Nonconforming Product

Audit Questions:

• Show me the procedure for nonconforming product
• How do you prevent unintended use of nonconforming product?
• Who authorizes concessions/deviations?

Evidence to Review:

• [ ] NC product procedure
• [ ] NC product records
• [ ] Concession authorizations

8.4 Analysis of Data

Audit Questions:

• What data do you analyze for QMS effectiveness?
• Show me trend analysis for complaints, NC, CAPA
• How does data drive improvement?

Evidence to Review:

• [ ] Data analysis reports
• [ ] Trend charts
• [ ] Management review inputs

8.5 CAPA

Audit Questions:

• Show me the CAPA procedure
• How do you determine root cause?
• Show me CAPA effectiveness verification

Evidence to Review:

• [ ] CAPA procedure
• [ ] Open/closed CAPA log
• [ ] Root cause analysis records
• [ ] Effectiveness verification records

Common Findings:

• Complaint trending not performed
• CAPA not initiated for recurring issues
• Root cause analysis superficial
• Effectiveness verification not documented

---

Common Nonconformities

Top 10 ISO 13485 Audit Findings

Finding Severity Classification

Nonconformity Classification

Severity classification, CAPA integration, and finding documentation guidance.

---

Table of Contents

• Classification Criteria
• Severity Matrix
• CAPA Integration
• Finding Documentation
• Closure Requirements

---

Classification Criteria

Nonconformity Definitions

Classification Decision Tree

Is required element absent or failed?
├── Yes → Is failure systematic (multiple instances)?
│   ├── Yes → MAJOR NONCONFORMITY
│   └── No → Could it cause product safety issue?
│       ├── Yes → MAJOR NONCONFORMITY
│       └── No → MINOR NONCONFORMITY
└── No → Is there deviation from procedure?
    ├── Yes → Isolated or recurring?
    │   ├── Isolated → MINOR NONCONFORMITY
    │   └── Recurring → MAJOR NONCONFORMITY
    └── No → Is there improvement opportunity?
        ├── Yes → OBSERVATION
        └── No → NO FINDING

---

Severity Matrix

Impact vs. Occurrence Matrix

Clause-Specific Severity Guidance

---

CAPA Integration

Finding-to-CAPA Workflow

1. Classify finding (Major/Minor/Observation) 2. Document finding with objective evidence 3. Determine CAPA requirement (see table below) 4. Initiate CAPA with finding as source 5. Track resolution through closure 6. Verify effectiveness at follow-up audit 7. Validation: Finding closed only after CAPA effective

CAPA Requirement by Severity

Root Cause Depth by Severity

---

Finding Documentation

Finding Statement Structure

FINDING STATEMENT TEMPLATE:

Requirement: [Specific clause or procedure requirement]
Evidence: [What was observed, reviewed, or heard]
Gap: [How the evidence fails to meet the requirement]

Example:
Requirement: ISO 13485:2016 Clause 8.2.2 requires internal audits
at planned intervals to determine QMS conformity.

Evidence: Audit schedule shows Design Control audit planned for
Q2 2024. No audit records exist. Interview with QA Manager
confirmed audit was not conducted.

Gap: Internal audit for Design Control process not conducted as
planned, representing a gap in audit program execution.

Evidence Types and Requirements

Finding Writing Guidelines

Do:

• State objective evidence clearly
• Reference specific requirements
• Use factual, neutral language
• Include document/record identifiers

Don't:

• Use judgmental language ("poor", "inadequate")
• Generalize without evidence ("always", "never")
• Combine multiple findings
• Include corrective action suggestions

---

Closure Requirements

Closure Criteria by Severity

Major Nonconformity:

• [ ] Root cause analysis completed
• [ ] Corrective action implemented
• [ ] Effectiveness verified (objective evidence)
• [ ] No recurrence observed
• [ ] QA Manager sign-off
• [ ] Auditor verification

Minor Nonconformity:

• [ ] Immediate correction completed
• [ ] Root cause addressed (if applicable)
• [ ] Evidence of correction reviewed
• [ ] QA Manager sign-off

Observation:

• [ ] Action taken (if any) documented
• [ ] Noted for future reference

Verification Methods

Closure Documentation

CLOSURE RECORD TEMPLATE:

Finding ID: [NC-YYYY-XXX]
Original Finding: [Brief description]
Severity: [Major/Minor/Observation]

Corrective Action Taken:
[Description of action implemented]

Evidence of Implementation:
[Document numbers, dates, observations]

Effectiveness Verification:
[Method used, results, date]

Closure Approved By: [Name, Role, Date]

---

Audit Finding Log

Log Template

Status Definitions