ISO 13485 Internal Audits and Management Review: A Practical Guide

Internal audits and management review are the two mechanisms a quality management system uses to check itself. When they work, problems are found by your own people months before an external auditor or an FDA investigator arrives. When they are treated as a yearly formality, the same weaknesses surface during certification audits and inspections. This guide explains what ISO 13485 requires for internal audits (clause 8.2.4) and management review (clause 5.6), how to build an audit programme that finds real problems, and how to run a management review that drives decisions rather than producing a stack of slides.

Why they matter more under the QMSR

Since the Quality Management System Regulation took effect on 2 February 2026, FDA’s requirements are based on ISO 13485:2016, which already treats internal audit and management review as core requirements. FDA’s rule also changed how it handles certain records, and the agency has indicated that records of management review and quality audits can now be reviewed in inspections. Confirm the details in the final rule and FDA’s current inspection guidance. In the EU, notified bodies and MDSAP auditors have always examined them, so a weak audit programme is visible in every route. For the wider context see our guides on ISO 13485 and MDSAP audit readiness and FDA inspections under the QMSR.

Internal audit requirements (clause 8.2.4)

ISO 13485 requires the organisation to conduct internal audits at planned intervals to determine whether the QMS conforms to planned and documented arrangements, regulatory requirements and the organisation’s own requirements, and whether it is effectively implemented and maintained. Key expectations include:

• A documented procedure describing responsibilities, planning, conducting audits, reporting and keeping records.
• An audit programme planned considering the status and importance of the processes and areas to be audited, and the results of previous audits.
• Defined criteria, scope, interval and methods for each audit.
• Objective and impartial audit selection and conduct; auditors must not audit their own work.
• Records of audits and results, reported to the management responsible for the area audited.
• Management of the audited area takes corrections and corrective actions without undue delay to eliminate detected nonconformities and their causes, with follow-up verification of the actions.

Building a risk-based audit programme

1. List the processes and requirements. Include every QMS process, each regulatory requirement you must meet (for example FDA, EU MDR and MDSAP country requirements) and the sites and key suppliers.
2. Rank by risk and history. Give higher frequency to high-risk processes such as design controls, CAPA, complaint handling, sterilization and software, and to areas with past findings, complaints or recent change.
3. Plan the year. Spread audits across the year, with every process covered over the planned cycle (often 12 months, longer for low-risk areas if justified), and leave room for unplanned audits triggered by events.
4. Choose competent, independent auditors. Train them on ISO 13485, applicable regulations and audit technique. Use external auditors for specialist areas or where independence is hard in a small company.
5. Write audit plans and checklists that go beyond the clauses and trace real records, such as a complaint from receipt to closure or a design change from request to release.
6. Report clearly. Each finding should state the requirement, the objective evidence and the gap, with a grade such as major or minor.
7. Verify closure. Check that corrective actions were implemented and effective, and feed systemic issues into CAPA.

What makes an internal audit effective

Weak audit	Strong audit
Checks that procedures exist	Samples records and traces them end to end
Uses the same checklist every year	Updates the focus using risk, complaints, changes and prior findings
Auditors are from the audited department	Auditors are independent and competent
Findings are vague, such as “documentation unclear”	Findings cite requirement, evidence and consequence
Closure means a procedure was edited	Closure means the cause was fixed and checked
No audit of design controls, software or suppliers	Covers high-risk areas and sampled products

Aim to audit the way an inspector would: pick a product, follow it through design controls, purchasing, process validation, release, complaints and CAPA, and look for broken links.

Management review requirements (clause 5.6)

Top management must review the QMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness, and keep records of the review. The standard lists the minimum review inputs:

• feedback, including customer feedback;
• complaint handling;
• reporting to regulatory authorities;
• audits (internal and external);
• monitoring and measurement of processes;
• monitoring and measurement of product;
• corrective and preventive action;
• follow-up actions from previous management reviews;
• changes that could affect the QMS;
• recommendations for improvement; and
• applicable new or revised regulatory requirements.

The outputs must record decisions and actions on improvements needed to maintain the suitability, adequacy and effectiveness of the QMS and its processes, improvements of product related to customer requirements, changes needed to respond to new or revised regulatory requirements, and resource needs.

Running a management review that works

1. Set a schedule and agenda aligned with your cycle, with at least an annual review and more frequent reviews if your risk or growth demands it.
2. Prepare data, not narrative. Use trends of complaints, nonconformances, CAPA ageing, supplier performance, audit findings, on-time training and regulatory changes, with targets and thresholds.
3. Involve real decision makers. Top management must attend and engage, because the review is their evidence of leadership and resource commitment.
4. Focus on decisions. For each input, record the conclusion and any action, owner and due date.
5. Check quality objectives. Review whether quality objectives and policy remain suitable and whether they were achieved.
6. Follow up. Track actions in the next review and escalate overdue ones.
7. Feed risk management. Management review is a good moment to confirm that post-market data is reflected in your risk files. See post-market surveillance.

How audits and management review connect

Internal audit results are a mandatory input to management review, and management review outputs shape the next audit programme. Together they form a loop: audits find gaps, management decides on resources and priorities, CAPA fixes causes, and the next audits check whether the fixes worked. If your management review never changes an audit plan, a CAPA priority or a resource decision, it is probably not doing its job. For leadership-focused practice, see our quality manager interview questions.

Common mistakes

• Auditing the same easy areas every year and skipping high-risk processes.
• Auditors checking their own work or reporting to the audited manager.
• Nonconformities closed by “retraining” without addressing the cause.
• Management review held only before the external audit, with minutes written afterwards.
• Reviewing data without thresholds, so nobody can tell whether a trend is a problem.
• Missing required inputs such as regulatory changes or reporting to authorities.
• Actions with no owner, due date or follow-up.

Frequently asked questions

How often must internal audits be done?

ISO 13485 requires them at planned intervals, without fixing a number. Most companies audit every process at least once a year and high-risk processes more often. Justify your frequency in the audit programme using risk and history.

Can a small company audit itself?

Auditors must be objective and impartial and must not audit their own work. In a small company, this often means using an external auditor or a trained colleague from a different function for specific areas.

How often is management review required?

At planned intervals, which the organisation defines. Annual review is the minimum most auditors expect, and more frequent reviews are common in companies with higher risk, growth or regulatory change.

Does a supplier audit count as an internal audit?

No. Supplier audits are external audits that you conduct as part of supplier control, although their results are a valid input to management review. Internal audits examine your own QMS.

Clause numbers and regulatory treatment of audit and review records can change with new editions and rules. Confirm against the current ISO 13485 text, FDA’s QMSR and the requirements of your certification body.

Related reading

• ISO 13485 and MDSAP audit readiness: a full readiness programme.
• ISO 13485 and QMSR training: what teams should learn.
• CAPA and complaint handling: closing findings effectively.
• Quality assurance interview questions: audit finding case studies.

Talk to the AptSkill team

Want training in internal auditing, ISO 13485 or QMSR? Send us your role and goal.