Medical device quality management must answer a practical question: when design, purchasing, or production changes, how do the related risks, documents, and batches remain under control? An ISO 13485 project can map the decisions and operational evidence to retain at each stage, based on the organization’s role in the product lifecycle.
Service category and standard
Management System Auditing (MS)
Depending on the organization’s scope and applicable edition, work may cover system implementation, internal audits, supplier audits, or preparation for external audits. Certification is decided by the independent certification body that accepts the application, under its own procedures.
This service focuses on the medical device lifecycle, regulatory requirements, design and process controls, and traceability.
Who may need this and when
This is relevant to organizations establishing systems for device development, manufacturing, installation, or servicing; suppliers receiving medical device customer requirements; and existing businesses adding markets, products, or outsourced processes. Start by confirming the organization’s actual role so that activities for which it is not responsible are not simply removed, and requirements are not applied indiscriminately.
Common business challenges
A design change is approved, but a supplier still uses the old specification. Inspection results pass, but required process validation evidence is missing. A complaint is recorded only as a return quantity, without risk assessment or follow-up. These issues often cross R&D, procurement, manufacturing, and regulatory functions, so one quality form alone cannot address them fully.
Approach and applicable requirements
The ISO catalogue confirms ISO 13485:2016 as the quality management system standard for medical devices and notes that it was confirmed as current in 2025. Management system certification is separate from product registration, licensing, or market authorization in each jurisdiction.
Project scope can begin with applicable requirements and a review of the current state, followed by document controls aligned with assigned responsibilities. For design, connect inputs, reviews, verification, validation, transfer, and risk management. For purchasing, address supplier evaluation, quality agreements, and outsourced-process controls. For production, focus on identification, traceability, product preservation, release, and validation of applicable processes and software. Assign decision owners for complaints, feedback, reportability assessment, and corrective action; then use training, internal audits, and management review to confirm that the system works.
Information to prepare
Prepare a product and market list, organization chart and quality procedures, design and risk files, supplier and outsourcing agreements, batch and validation records, and complaint, audit, and corrective-action records. De-identified examples can be used in an initial discussion; patient or other sensitive personal information is not needed at that stage.
Assessing schedule and fees
Timing depends on product complexity, design responsibility, the number of sites and markets, and the completeness of validation evidence. Product testing, regulatory submissions, technical process validation, and third-party certification should be scoped separately rather than combined into an undefined overall commitment.
Frequently asked questions
Can a quality system certificate serve as market authorization?
No. Market access depends on the product and local regulations; the required applications and evidence must be confirmed separately.
Can we keep our existing documents?
Documents that support the current products, roles, and requirements can be retained. The work should address missing links among responsibilities, decisions, and records.
Are complaint records with return counts enough?
They should also include issue assessment, necessary actions, and improvement follow-up. Qualified personnel should determine whether reporting or other obligations apply.
Who determines conformity after a consultant prepares documents?
The organization remains responsible for operating its system and for its products. The certification body assesses the management system under its procedures. Project support replaces neither party’s decisions.
Can we use our ISO 9001 documents unchanged?
Common processes may be integrated, but medical device risks, regulations, traceability, validation, and other specific requirements still need to be addressed.
Which edition should we use?
This page is based on the public ISO catalogue for ISO 13485:2016. At project start, confirm the documents required by customers, target markets, and the selected certification scheme.
Related services and enquiries
See ISO 9001 quality management for common processes. When contacting Captain International about a medical device system, describe the product role, target markets, and the evidence gaps you currently face.