ISO 13485 · Expert · 12 min lesson
Auditor competence, ethics and continual development
ISO 19011 clause 7 and clause 4, ISO 13485:2016 clauses 6.2 and 8.2.4, MDR Annex VII section 3, IAF MD 9, IMDRF competence requirements
What you will learn
- Evaluate auditor competence using the approach of ISO 19011 clause 7 and clause 6.2 of ISO 13485.
- Use witnessed audits, feedback and report review to confirm and improve auditor performance.
- Apply what regulators and notified bodies expect of auditors to an internal audit programme.
Key takeaways
- Competence is defined in writing and evidenced per auditor; a one-word qualified status is not evidence (clause 6.2).
- Use several evaluation methods: records, feedback, interview, observation and post-audit review (ISO 19011 clauses 7.3 to 7.5).
- Independence is part of competence: auditors must not audit their own work (clause 8.2.4).
- Training effectiveness is evaluated by observed performance, not by attendance sheets.
- Notified bodies work to MDR Annex VII section 3 and certification bodies to IAF MD 9; internal programmes can borrow the same discipline.
Free practice question
Selwyn's internal audit procedure says only 'qualified auditors' may audit. The matrix has one column, status, showing 'qualified' for four people and a single entry 'ISO 13485 course 2019'. No criteria document exists.
What is the main gap?
Competence criteria are not defined and evidence per person is missing, so 'qualified' has no basis.
Correct. Clause 6.2 requires determining necessary competence and keeping records of education, training, skills and experience.
The course is too old to count as anything.
Not quite. Age alone is not the criterion; clause 6.2 asks for defined competence and evidence against it.
Four auditors are too many for a small company.
Not quite. The number is not regulated, and clause 8.2.4 only expects objectivity and impartiality.
The word 'qualified' should be replaced by 'approved'.
Not quite. Wording does not fix the missing criteria and evidence required by clause 6.2.
Key terms
- competence: Ability to apply knowledge and skills to achieve intended results (ISO 19011 clause 3).
- witnessed audit: An evaluator observes an auditor during a real audit against agreed criteria (ISO 19011 clause 7.4).
- authorisation matrix: Record of each person's qualifications, evidence and the scope they may audit (MDR Annex VII 3.3.2).
- objectivity and impartiality: Requirement that auditors do not audit their own work (ISO 13485 clause 8.2.4).
- training effectiveness: Evidence that training changed what the person can do (ISO 13485 clause 6.2).
- technical expert: Person who provides specific knowledge to an audit team but does not act as an auditor (ISO 19011 clause 3).
- IAF MD 9: IAF mandatory document applying ISO/IEC 17021-1 to certification of medical device quality management systems.
- continual development: Planned activity that maintains and improves auditor competence (ISO 19011 clause 7.6).
Official sources
- ISO 19011 Guidelines for auditing management systems (fourth edition, 2026; replaces the 2018 edition)
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- IAF MD 9:2023 (Issue 5) Application of ISO/IEC 17021-1 in the field of medical device quality management systems (ISO 13485)
- IMDRF Competence and training requirements for auditing organizations (MDSAP)
- Regulation (EU) 2017/745 (MDR), Annex VII section 3 resource requirements for notified bodies
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.