ISO 13485 · Medium · 12 min lesson

Auditing the device file - sampling, traces, common findings, and DMR versus DHR, DHF and technical file

ISO 13485:2016 clauses 4.2.3, 4.2.4, 4.2.5, 7.3.10, 7.5.1; 21 CFR part 820 sections 820.10, 820.35, 820.45; Regulation (EU) 2017/745 Annex II

What you will learn

Plan a device file audit: choose a risk-based sample and trace from the line to the file and from changes to the floor.
Recognise common findings, grade them and write a clear nonconformity with requirement, evidence and finding.
Tell the device file, batch record, design file and EU technical documentation apart and use current terminology.

Audit the device file by tracing: line to file, closed change to floor, file to design file and technical documentation.
Sample by risk, recent change, complexity and past findings; record the rationale, since the standard sets no fixed sample size.
Common findings: floor revision differs from index, no file for a variant, missing acceptance criteria, change approved after use, labeling not checked against the file.
Device file (clause 4.2.3) says what to do; batch record (clause 7.5.1) shows what was done; design file (clause 7.3.10) shows how the design was proven; technical documentation follows MDR Annex II.
Write findings with the requirement, the evidence (document, revision, line) and a clear statement of what is nonconforming.

An auditor has one hour at Brightwell and ten days of documents to choose from for the Aria device file.

How should she choose the sample?

Take the first ten documents in the index.

Not quite. An arbitrary selection ignores risk and change, which is where clause 4.2.4 control fails most often.

By risk, recent change and past findings, with the rationale recorded in the audit plan.

Correct. ISO 13485 sets no audit sample size in clause 4.2.4 or elsewhere, so a risk-based, justified selection is the defensible approach.

Ask the auditee to choose the best ones.

Not quite. Letting the auditee select documents invites bias and defeats the purpose of independent verification of clause 4.2.4 control.

Only audit documents without changes.

Not quite. Unchanged documents carry the least risk under clause 4.2.4 compared with recently changed ones, where control usually breaks.

trace: Audit technique that follows one item from one record to the related records to confirm that they agree.
sampling rationale: The recorded reasons for choosing which items to audit, usually based on risk, change and past findings.
nonconformity: Failure to fulfil a requirement, written with requirement, evidence and finding statement.
major nonconformity: A finding where a required control is absent or has failed in a way that may affect product conformity or safety.
minor nonconformity: An isolated lapse or partial failure of a control that does not by itself put product conformity in doubt.
device history record: Legacy term for production records of a batch; content now sits in clause 7.5.1 records.
design history file: Legacy term for design records; content now sits in the clause 7.3.10 design and development file.
technical documentation: EU documentation under MDR Annex II showing device conformity; distinct from the device file.

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Illustrative example. Educational only, not legal advice.