ISO 13485 · Expert · 15 min lesson
Auditing clause 8: feedback, complaints, reporting, nonconforming product and CAPA
ISO 13485:2016 clauses 8.2.1 to 8.2.3, 8.3, 8.4 and 8.5, with EU MDR Articles 83 to 89 and ISO 19011 audit practice
What you will learn
- Audit complaint files for reportability decisions.
- Audit nonconforming product control.
- Audit data analysis and CAPA linkage.
Key takeaways
- Clause 8.2.2 requires complaint receipt, evaluation, investigation, reportability decision and action to be recorded, or the omission justified.
- Clause 8.2.3 requires procedures and records for notifying authorities, and MDR Article 87 sets 2, 10 and 15 day limits from awareness.
- Concessions under clause 8.3.2 need justification, approval, regulatory compliance and the authoriser's identity.
- Clause 8.3.3 requires an advisory notice procedure and records of actions after delivery.
- Clause 8.4 analysis needs defined data, limits and trends, not charts without thresholds.
- Clause 8.5.2 CAPA needs cause, action, verification of no harm and a dated effectiveness review.
Free practice question
Fenwick complaint C-318 was received on 2 March: a nurse reported a pump overheating. The form shows the receipt date and serial number. The death, injury and malfunction fields are blank, there is no reportability decision, and the file is open after 94 days.
What is the main gap?
No evaluation of the complaint for reportability, with the harm questions never asked, which clause 8.2.3 requires to be decided.
Correct. Clause 8.2.3 requires a procedure and decision on notifying authorities, and none is recorded in this file.
The serial number is in the wrong format.
Not quite. Serial number format is not the gap; clause 8.2.2 concerns evaluation and reportability decisions.
The file should have been closed at day 30.
Not quite. Clause 8.2.2 requires timely handling, but no fixed closure day exists, so the missing decision is the real gap.
The nurse should have used an email instead of a phone call.
Not quite. Clause 8.2.1 accepts feedback from any channel, so the channel is not the problem.
Key terms
- complaint: Written, electronic or oral communication alleging deficiencies related to identity, quality, durability, reliability, usability, safety or performance of a device that has been released (ISO 13485:2016 clause 3.4).
- advisory notice: Notice issued by the organisation after delivery to give supplementary information or advise on action regarding the use or modification of a device (ISO 13485:2016 clause 3.1).
- concession: Permission to use or release a product that does not conform to specified requirements, allowed only with justification and approval (ISO 13485:2016 clause 8.3.2).
- corrective action: Action to eliminate the cause of a detected nonconformity and prevent recurrence, with a review of its effectiveness (ISO 13485:2016 clause 8.5.2).
- serious incident: An incident that led, might have led or might lead to death, serious deterioration in health or a serious public health threat, reportable under EU MDR Article 87.
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- Regulation (EU) 2017/745 on medical devices (MDR), Articles 83 to 89 and Annex III
- ISO 19011:2026 Guidelines for auditing management systems
- FDA Quality Management System Regulation (QMSR), effective 2 February 2026
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.