ISO 13485 Internal Audit Checklist: Clause by Clause with Common Findings

Introduction

The internal audit is the most powerful tool a quality team has, and the one most often reduced to a formality. Done well, it finds the weaknesses before a Notified Body or an FDA investigator does. Done badly, it becomes evidence against you: a documented record that the organisation examined its own quality system and failed to find what a regulator later found in a single day.

Since February 2026 the stakes are higher. The FDA QMSR brought internal audit records within the scope of routine inspection — under the previous QSR they were exempt. Reports written on the assumption that no regulator would read them are now inspectable, and the right response is not to write blander audits. It is to make sure every finding has a CAPA record attached to it.

This guide covers what Clause 8.2.4 actually requires, how to build the annual programme, how to run an individual audit, a clause-by-clause checklist you can work from, the eight findings that recur, and how to write a nonconformity that produces a useful corrective action.

Table of Contents

• What Clause 8.2.4 requires
• Building the annual audit programme
• Planning and conducting an individual audit
• Before — preparation
• During — conduct
• After — reporting and follow-up
• The checklist, clause by clause
• The eight findings that recur
• How to write a nonconformity
• The records you must retain
• Frequently asked questions
• Conclusions

What Clause 8.2.4 requires

The requirement is a single clause of ISO 13485:2016, and it carries five distinct obligations. Internal audit is also one of the six documented procedures the standard mandates outright.

Building the annual audit programme

The programme is not a single audit. It is a planned series that, taken together, covers the whole quality system within a defined period — normally a year.

Scope covers every process, department and site inside the QMS. For a single-site manufacturer this is straightforward; for multi-site organisations it needs planning so that nothing falls between the sites.

Frequency follows risk. The standard requires frequency to reflect the status and importance of processes and the results of previous audits. Processes with previous nonconformities are audited more often. Design and development, production, CAPA and complaint handling normally warrant at least annual coverage; support processes with a clean history can go longer.

Auditors must be independent of the process and competent to assess it, and competence has to be documented — training records, lead auditor qualification, or evidence of relevant experience.

The programme document maps each QMS process against its planned date, assigned auditor and scope. It is a standard request in Notified Body Stage 1 audits and in FDA pre-inspection information requests, so it should be current rather than reconstructed.

Results feed back. Findings from one cycle move that process to a higher frequency in the next. This step is what turns a schedule into a programme, and it is the one most often missing.

Planning and conducting an individual audit

Before — preparation

Each audit within the programme needs its own plan: scope and objectives, audit criteria (which clauses and procedures apply), dates and location, auditor assignment, and the processes to be covered. The plan goes to the auditee in advance.

Review the previous audit of the same process before starting — both to verify that earlier corrective actions were implemented and to identify where to focus. Then prepare the checklist, based on the relevant clauses, the organisation’s own procedures and any applicable regulatory requirements. A good checklist prompts investigation; a bad one prompts confirmation.

During — conduct

Open with a short meeting confirming scope, objectives and methodology. It is not a formality — it sets the tone.

Evidence comes from three methods: interviews with personnel, observation of activities and conditions, and review of documents and records. No finding is recorded without objective evidence supporting it. Sampling is used rather than full review, and the sample has to be large enough to support the conclusion and representative of the range of activity in the process.

Findings fall into three categories: nonconformities, which are failures to meet a stated requirement; observations or opportunities for improvement, which are weaknesses that do not yet constitute a nonconformity; and positive findings. Close with a meeting presenting the findings, to confirm they are factually accurate and that the auditee understands the evidence behind each one.

After — reporting and follow-up

Issue the report within the timeframe your procedure defines, typically five to ten working days. It covers scope and objectives, criteria, auditor and auditee, dates, a summary of findings and the overall conclusion.

Every nonconformity goes through the CAPA system: immediate correction, root cause analysis, corrective action, implementation timeline, and verification of effectiveness before the finding is closed. A finding closed because the action was implemented, without evidence the problem stopped recurring, fails Clause 8.5.2(f) rather than Clause 8.2.4.

The checklist, clause by clause

Organised by clause, with the evidence to look for in each. It is a working document, not a script.

Clause 4.2.3 — the medical device file — is missing from most internal audit checklists in circulation, including several published ones. It is a distinct requirement from the design history file: the DHF records how the device was developed, the medical device file holds the documentation demonstrating conformity for the device as marketed. Auditing one and calling it the other leaves a gap a Notified Body will find.

The eight findings that recur

Six of these eight are the same families that appear in Notified Body findings and FDA inspection observations. That overlap is the argument for the internal audit programme: these are the things that will be found, and the only variable is who finds them first.

How to write a nonconformity

A nonconformity statement has three parts: the objective evidence observed, the requirement not being met, and the clause or procedure reference. Missing any one of them produces a finding that cannot support a root cause analysis.

Write findings as if a regulator will read them, because since February 2026 one can. Under the FDA QMSR, internal audit records fall within the scope of routine inspection — they were exempt under the previous QSR. This is not a reason to soften findings. It is a reason to ensure that every finding has a CAPA record attached showing what was done about it: an honest finding with a closed CAPA reads well, and an honest finding with nothing attached does not.

The records you must retain

Six records per audit, at minimum:

1. The annual audit programme
2. The audit plan issued in advance for the individual audit
3. The completed checklist with evidence notes
4. The formal audit report with all findings
5. The CAPA record linked to each nonconformity
6. The effectiveness verification showing the corrective action worked

Retention follows the period defined in your document control procedure — typically the lifetime of the product plus the applicable regulatory retention period, with a general minimum of five years for most ISO 13485-certified organisations. The sixth record is the one most often absent, and its absence converts an internal audit finding into a CAPA finding.

Frequently asked questions

How often must internal audits be conducted under ISO 13485?

The standard requires audits at planned intervals and does not specify a minimum frequency. Industry practice and Notified Body expectation is full QMS coverage at least once per year, with higher-risk processes and those with previous nonconformities audited more frequently. The frequency has to be justified by the status and importance of the process and by previous results, not chosen for convenience.

Can the same person plan and conduct the internal audit?

Yes, provided they are independent of the process being audited. What Clause 8.2.4 prohibits is auditing your own work. Planning and conducting are not in conflict; auditing a process you are responsible for is.

Can we use an external consultant to conduct internal audits?

Yes. It is a legitimate and common approach, particularly for small organisations where independence is otherwise impossible to achieve. The external auditor must have documented competence in ISO 13485 and must be given access to all relevant processes and records.

What happens if we find a major nonconformity during an internal audit?

It goes through the CAPA system with priority, is reported to management immediately, and is addressed before the next certification or surveillance audit. Finding it yourself and correcting it is a materially better position than a Notified Body finding it first — and the record of having done so is evidence that the quality system works.

Are internal audit findings reported to the Notified Body?

Individual findings are not proactively reported. The records — findings and corrective actions — are reviewed during surveillance audits and must be available. Since the FDA QMSR took effect in February 2026, internal audit records are also within the scope of routine FDA inspection, which they were not under the previous QSR.

What is the difference between a nonconformity and an observation?

A nonconformity is a failure to meet a stated requirement of the standard, of a regulation or of the organisation’s own documented procedures. An observation is a weakness that does not yet constitute a failure — a practice that works but is fragile, or a trend heading toward a nonconformity. Observations do not require CAPA, but a pattern of the same observation across audits is itself a finding.

What are the three elements of a well-written nonconformity?

The objective evidence observed, the requirement that is not being met, and the clause or procedure reference. A statement missing any of the three cannot support a meaningful root cause analysis, and will produce a corrective action as vague as the finding.

Does the internal audit have to cover every clause every year?

Every process within the scope of the QMS has to be covered by the programme within the defined period, normally a year. That does not mean every clause is audited at the same depth: frequency and depth follow risk and previous results, which is exactly what Clause 8.2.4 requires. A programme that audits everything identically has not applied the requirement.

Conclusions

A working internal audit programme is the cheapest quality investment available, because every nonconformity found and corrected internally costs a fraction of the same finding raised by a Notified Body, an FDA investigator, or a field event.

Two things separate programmes that work from programmes that exist. Frequency has to move: processes with findings get audited more often, and a schedule that never changes has not applied Clause 8.2.4. And findings have to be written specifically enough to investigate — evidence, requirement, reference — because a vague finding produces a vague corrective action and the same finding next year.

The organisations with clean audit outcomes are not the ones with the most elaborate quality system on paper. They are the ones that audit rigorously, write honest findings, investigate causes properly and verify that their corrective actions actually worked.

If you are building the audit system, the ISO 13485 Documentation Kit includes the internal audit procedure, the annual audit programme template and the audit report and finding forms, alongside the CAPA procedure the findings feed into.

Related articles

• ISO 13485:2016 — The Complete Guide to Medical Device Quality Management
• ISO 13485 CAPA: Clauses 8.5.2 and 8.5.3 Requirements
• ISO 13485 Design Controls and the Design History File
• ISO 13485 Supplier Management and Qualification
• MDSAP Audits: Process Chapters, Grading and Preparation
• ISO 14971 Risk Management for Medical Devices