ISO 13485 · Medium · 13 min lesson
Internal audit programme and management review inputs and outputs - clauses 8.2.4 and 5.6
ISO 13485:2016 clauses 8.2.4, 5.6.1, 5.6.2 and 5.6.3, with ISO 19011:2018 as guidance
What you will learn
- Explain what clause 8.2.4 requires of an internal audit programme, auditor objectivity and verified follow-up of findings.
- List the inputs and outputs of the management review required by clauses 5.6.2 and 5.6.3 and the role of top management under clause 5.6.1.
- Link audit results to the management review and tell a weak record from a compliant one.
Key takeaways
- Clause 8.2.4: plan the audit programme by process importance and previous results, with defined criteria, scope, interval and methods.
- Auditors must be objective and impartial and must not audit their own work.
- Findings need timely correction and corrective action, then verified follow-up with reported results.
- Clause 5.6.1: top management reviews the system at documented planned intervals for suitability, adequacy and effectiveness.
- Clause 5.6.2 inputs include audits and complaints; clause 5.6.3 outputs are recorded decisions on improvement, regulation and resources.
Free practice question
Corvane audits eight areas on a fixed rotation, each once a year. Complaint handling had two repeat findings and the most customer complaints, yet it has the same frequency as training records. The new quality manager asks whether this satisfies the programme rule.
What does clause 8.2.4 expect?
Frequency set by the status and importance of processes and results of previous audits, so complaint handling is audited more often.
Correct. Clause 8.2.4 requires the programme to consider the status and importance of processes and previous audit results.
Equal rotation is always compliant because it is fair.
Not quite. Clause 8.2.4 names importance and previous results as the basis, so a rotation that ignores them is weak.
Frequency is set only by the notified body.
Not quite. Clause 8.2.4 makes the organisation responsible for planning its own programme at planned intervals.
Audit only the areas that had complaints.
Not quite. Clause 8.2.4 requires planned coverage of the system, so limiting audits to complaint areas leaves gaps.
Key terms
- internal audit: Systematic, independent check by the organisation of whether the quality system conforms and is effectively implemented (clause 8.2.4).
- audit programme: The planned set of audits for a period, with purpose, scope, criteria and dates.
- audit criteria: The set of requirements used as the yardstick, such as clauses, procedures and regulations.
- correction: Action to eliminate a detected nonconformity itself, without addressing its cause.
- corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence.
- top management: The person or group who directs and controls the organisation at the highest level.
- management review: Planned review by top management of the quality system's suitability, adequacy and effectiveness (clause 5.6).
- suitability, adequacy, effectiveness: Fit to the organisation, coverage of requirements, and delivery of intended results.
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- ISO 19011:2018 Guidelines for auditing management systems
- FDA, Quality Management System Regulation (QMSR) final rule, effective 2 February 2026
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.