ISO 13485 · Expert · 20 min lesson

Capstone: integrated internal audit of a fictional company file

ISO 19011 clauses 6.2 to 6.7, ISO 13485:2016 clauses 8.2.4, 8.5.2, 5.6.2 and 4.1.6, MDR Articles 84 to 86, AI Act Articles 9 to 15

What you will learn

Plan around threads, such as a complaint, a model change or a CAPA, that cross ISO 13485, MDR and AI evidence.
Auditors must be objective and impartial; never audit your own process (clause 8.2.4).
A good NCR has requirement, evidence, factual finding and a reasoned grade.
Repeated minor lapses in one process may show a systemic failure that justifies a major.
A CAPA is effective only when objective evidence shows the problem did not return (clause 8.5.2 f).

You plan an integrated audit of Quillon's ApneaScope. The team proposes three separate audits over three months, one for each family of records.

What is the main weakness of this plan?

Threads such as a complaint or a model change cross all three families and would be missed by separate audits.

Correct. ISO 19011 clause 6.3.2 planning is about covering the objectives; threads reveal gaps between documents that silo audits miss.

Three audits cost more than one at any company size.

Not quite. Cost is not the main weakness; clause 6.3.2 planning is about whether the audit objectives are achieved.

The ISO 13485 standard forbids audits of the MDR documents.

Not quite. Clause 8.2.4 sets the criteria and scope by planning, and does not forbid auditing MDR obligations.

Separate audits cannot produce findings.

Not quite. Separate audits can still produce findings under clause 8.2.4; the weakness is that they miss cross-document gaps.

integrated audit: An audit that follows threads across several sets of requirements and records, such as ISO 13485, the MDR and AI Act evidence, in one plan and one report.
audit thread: A single case, for example a complaint or model change, traced across all records and requirements it touches.
nonconformity report (NCR): A finding with four parts: requirement, evidence, statement of non-conformity and grade.
effectiveness review: Clause 8.5.2 f check, using objective evidence, that a corrective action achieved its aim and the problem did not return.
periodic safety update report (PSUR): MDR Article 86 report for class IIa, IIb and III devices summarising post-market data and benefit-risk conclusions.
audit conclusion: The auditor's judgment against the audit objectives, presented at the closing meeting and written in the report (ISO 19011 clauses 6.4.9 and 6.5.1).

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Illustrative example. Educational only, not legal advice.