ISO 13485 · Expert · 14 min lesson
Auditing clause 4: QMS, documents, records and QMS software
ISO 13485:2016 clauses 4.1.2 to 4.1.6 and 4.2.1 to 4.2.5, Regulation (EU) 2017/745 Article 10(8), 21 CFR Part 820 (QMSR)
What you will learn
- Use a clause 4 checklist with the typical evidence for each sub clause.
- Spot traps in document control and in record retention against device life and regulation.
- Audit validation of software used in the quality management system under clause 4.1.6.
Key takeaways
- Clause 4 evidence is traced through one process end to end: procedure, current document, record, retention, software.
- Record retention is at least the device lifetime, never less than two years from release, and longer where regulation requires (clause 4.2.5).
- Document control is proved at the point of use, where obsolete revisions and uncontrolled spreadsheets hide (clause 4.2.4).
- Software used in the QMS, including spreadsheets, is validated before first use and after changes in proportion to risk (clause 4.1.6).
- Outsourced processes need control and written quality agreements (clause 4.1.5).
Free practice question
Brannock procedure QP-08 rev 3 states: 'All quality records are retained for five years from the date of shipment.' The company makes bone plates with a defined ten year expected life.
What is the finding?
Retention is shorter than the device lifetime, so clause 4.2.5 is not met; regulatory periods may be longer still.
Correct. Clause 4.2.5 requires retention for at least the device lifetime or longer if regulations specify, never under two years.
No finding, because five years exceeds the two year minimum.
Not quite. The two year figure is only a floor; clause 4.2.5 also requires at least the device lifetime.
Only an observation, because the plates are not sold any more.
Not quite. Records must outlive the device on the market under clause 4.2.5, so the product status does not remove the gap.
A finding against clause 4.1.6 on software.
Not quite. The issue is the retention period of records under clause 4.2.5 and not software validation.
Key terms
- medical device file: File for each device type or family holding or pointing to its specifications and procedures (ISO 13485 clause 4.2.3).
- obsolete document: Superseded document that must be identified and prevented from unintended use (clause 4.2.4).
- retention period: Time records are kept: at least the device lifetime, never under two years from release, longer if regulation requires (clause 4.2.5).
- QMS software validation: Documented confirmation that software used in the QMS fits its intended use, proportionate to risk (clause 4.1.6).
- outsourced process: Process performed by an external party that the organization still controls (clause 4.1.5).
- point of use: Place where a document is applied; current versions must be available there (clause 4.2.4).
- QMSR: FDA Quality Management System Regulation, 21 CFR Part 820, effective 2 February 2026, incorporating ISO 13485:2016 by reference.
- quality agreement: Written agreement defining quality responsibilities with a supplier of an outsourced process (clause 4.1.5).
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- ISO 19011 Guidelines for auditing management systems (fourth edition, 2026; replaces the 2018 edition)
- Regulation (EU) 2017/745 (MDR), Article 10 general obligations of manufacturers
- MDSAP AU P0002.011 MDSAP Audit Approach
- GHTF SG4 Guidelines for regulatory auditing of quality management systems of medical device manufacturers, Part 1: general requirements
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.