The ISO 13485 internal audit checklist for medical device startups (2026).

i. How auditors actually think

Most founders imagine an audit as a sequential march through the standard: Clause 4, then 5, then 6, and so on. Some auditors do work this way, but the effective ones work in concentric circles. They start at the center — your quality policy, your organizational structure, your scope — and spiral outward through increasing levels of detail. At each ring, they ask one question: “does the evidence match the claim?”

If your quality manual says you have design controls, the auditor will follow the thread into your Design History File and check whether the process described in your SOP was actually followed. If your training procedure says all employees are trained on the QMS, the auditor will pull a name off the org chart and ask to see their training record. If your CAPA procedure describes a five-step process, the auditor will open a completed CAPA and check whether all five steps were actually executed.

The implication: the auditor is testing consistency between what you say and what you do. The most common audit failure is not “we did not have a procedure.” It is “we had a procedure but did not follow it” — or “we followed a process but did not document it.” Either gap produces a nonconformity.

Preparation is not about having more documents. It is about making sure the documents you have accurately describe what you actually do, and that evidence exists for every claim you make.

ii. Before anything else: the company basics nobody prepares

This section exists because of a problem I have seen at more startups than I can count, and it is so fundamental that most checklist guides do not even mention it.

Auditors are not mind readers. They walk into your company (or join your video call) knowing almost nothing about your business. Before they can assess your QMS, they need to understand the basic landscape: what you make, where you operate, who your customers are, what regulations apply, and what the scope of your quality system actually covers.

Most startups assume this context is obvious. It is not. When the auditor has to spend the first hour piecing together basic facts from scattered documents and confused answers, two things happen: the audit gets compressed (less time for substantive review, which means sharper, more targeted questions to compensate), and the auditor’s confidence in your organization drops before the real examination even begins.

What you need ready before the audit starts:

• Company overview. One document (it can be one page) that states: legal entity name, physical locations, number of employees, founding date, and a brief description of what the company does. At least half the startups I have audited do not have this.
• Product portfolio. What devices do you make or are developing? Intended use for each? Regulatory classification? Target markets?
• Geographic scope. Which countries or regions do you market or intend to market in? This determines which regulatory frameworks apply.
• Applicable regulations and standards. A clear, maintained list of every regulation, standard, and guidance document that applies to your device(s) and operations.
• QMS scope statement. What is covered by your quality management system and what is not? If you have excluded certain clauses of ISO 13485, document the exclusions and the rationale.
• Organizational chart. Who reports to whom, who is responsible for quality, who is the management representative? For a 5-person startup, this takes 10 minutes to draw. For the auditor, it is the map they use to navigate everything else.

This documentation is not just audit prep. It is the foundation that every other piece of your QMS sits on. Getting this right takes an afternoon. Getting it wrong creates systemic issues the auditor will find in every subsequent area they examine.

iii. The five things auditors examine in the first 30 minutes

The opening of an audit sets the tone for everything that follows. Experienced auditors make a quick assessment of organizational maturity based on a small number of high-signal items.

1. Quality Policy and Quality Objectives

The quality policy is a short statement of your commitment to quality and regulatory compliance. ISO 13485 requires it. Most startups either do not have one, or have one copied from a template that does not reflect their actual business.

What catches startups: quality objectives that are vague (“maintain high quality”) rather than measurable (“achieve zero critical nonconformities in external audits,” “close all CAPAs within 60 days”). If your objectives are not measurable, the auditor cannot assess whether you have met them.

2. Organizational Structure and Responsibilities

What catches startups: in a 5-person company, one person often holds multiple roles. That is fine — ISO 13485 permits it — but the roles need to be explicitly documented and the person needs to be aware of each responsibility.

3. QMS Scope and Exclusions

What catches startups: claiming the QMS covers manufacturing when you do not manufacture, or failing to exclude clauses that genuinely do not apply. Both create confusion and can lead to findings against requirements you did not need to comply with.

4. Internal Audit Program

What catches startups: internal audits are scheduled but have not been conducted on time. The second most common finding: the person who conducted the internal audit is the same person responsible for the area audited (violates the independence requirement of Clause 8.2.4).

5. Management Review

What catches startups: management review minutes that read as a status update rather than a decision-making record. The standard requires decisions and actions — resource allocation, improvement initiatives, QMS changes. If your minutes do not show decisions, the auditor will note it.

iv. The three areas where startups fail most often

These three areas account for the majority of nonconformities in startup audits. They fail not because startups do not know they are important, but because the gap between “having a procedure” and “having evidence the procedure was followed” is larger than expected.

1. Design Controls (Clause 7.3)

This is where auditors spend the most time at startups. The Design History File (DHF) is the single most important body of evidence in a startup QMS. The auditor examines: design planning, design inputs (functional, performance, regulatory, safety requirements), design outputs, formal design reviews with documented participants and decisions, design verification, design validation, design transfer, design changes, and end-to-end traceability from requirement to verification evidence.

Where startups fail: incomplete traceability is the most common finding. The startup has design inputs and test results, but cannot demonstrate a clear thread connecting a specific requirement to the specific test that verified it. The second most common: missing or informal design reviews — the team discussed the design around a whiteboard but there is no record of who was present, what was decided, or what actions were assigned.

2. Risk Management (ISO 14971)

ISO 13485 requires risk management throughout the product lifecycle. The risk management file is the second most examined document after the DHF. The auditor checks: risk management plan, systematic hazard identification, risk estimation and evaluation against defined acceptability criteria, risk control implementation, verification of risk control effectiveness, overall residual risk evaluation, and production/post-production risk management planning.

Where startups fail: the risk file exists but is disconnected from design controls. Hazards were identified, but risk controls do not trace back to specific design inputs or verification activities. The risk file was created as a standalone exercise rather than as an integrated part of the design process.

3. CAPA (Clause 8.5.2 / 8.5.3)

Even pre-commercial startups are expected to have the CAPA procedure and to have exercised it.

Where startups fail: the CAPA procedure exists but has never been used. The founder reasons: “we have not had any problems yet.” The auditor responds: “you conducted an internal audit — did it have any findings? If yes, where is the CAPA?” Internal audit findings should feed into the CAPA system. The second failure: CAPAs that were opened and “closed” without evidence that the corrective action was verified for effectiveness.

v. The areas auditors expect but startups forget

These are not the areas with the most findings — they are the areas where startups have no evidence at all, because they did not realize the requirement applied.

Training Records (Clause 6.2). Every person performing work that affects product quality must be trained, with records maintained. The training happened — you walked the new engineer through design controls — but there is no sign-off sheet, no training log, no evidence. For the auditor, undocumented training is the same as no training.

Supplier Controls (Clause 7.4). If you use any external provider that affects product quality — a CMO, a test lab, a cloud provider, a data source — they need to be evaluated, selected based on defined criteria, and monitored. Most startups have been using AWS and a university hospital for months without formally evaluating either as a supplier. No approved supplier list, no quality agreement, no evaluation evidence.

Document Control (Clause 4.2.4). QMS documents must be controlled: approved before use, clearly identified with current revision status, and prevented from unintended use of obsolete versions. “We all just use the latest version on Google Drive” is not document control.

vi. The areas that matter less than everyone thinks

At a pre-commercial startup, some ISO 13485 requirements are either not yet applicable or can be addressed with minimal procedures. Over-investing in these areas wastes time better spent on design controls and risk management.

Full-scale complaint handling (Clause 8.2.2). If you are pre-market, you may have zero complaints. You need a procedure for handling them when they arrive, but you do not need an elaborate trending system or a dedicated complaint coordinator. A lean procedure and a log is sufficient.

Elaborate post-market surveillance (Clause 8.2.1). You need a procedure that describes how you will monitor post-market performance, but if the product is not on the market yet, the procedure is largely prospective.

Detailed production controls (Clause 7.5). If you are not manufacturing at scale, these requirements are either not applicable or minimal. Your QMS scope statement should reflect this.

Extensive purchasing controls (Clause 7.4). Beyond essential supplier controls, you do not need a full purchasing department process with multiple approval levels and competitive bidding. Scale your purchasing controls to your actual purchasing activity.

vii. The gotchas

Specific items that experienced auditors probe for — not because they are major clauses, but because they reveal the maturity and integrity of the QMS.

Management review minutes that do not show decisions. The standard requires decisions related to improvement, resource needs, and QMS changes. Minutes that read as “we discussed X, Y, Z” without documenting what was decided and who is responsible are a finding waiting to happen.

Internal audits conducted by non-independent auditors. Clause 8.2.4 requires objectivity and impartiality — auditors cannot audit their own work. The cleanest solution for startups is to engage an external auditor, which is explicitly permitted and common practice.

CAPAs completed without effectiveness verification. Implementing a corrective action and closing the CAPA without evidence that the action resolved the problem is one of the most common findings across all company sizes.

Training records for the management representative. Auditors often check whether the person responsible for the QMS has been trained on ISO 13485 and on the organization’s own procedures. If the management representative cannot demonstrate their own training, it undermines the entire training program.

Controlled copies of external standards. If your QMS references ISO 14971 or IEC 62304, do you have access to current versions? Are they listed in your document control system? “We used the version our consultant had” is not controlled access.

Calibration records for measurement equipment. If you use any measurement equipment in verification or validation (even test fixtures or reference datasets), calibration or qualification records should exist.

viii. How to use this guide

If you are preparing for an internal audit or a certification audit, work through this guide in sequence:

Start with the company basics (Section ii). Get the foundational documents in order. This takes an afternoon and prevents the auditor from starting with a negative impression.

Then work through the first 30 minutes (Section iii). These five items are your opening statement — make them clean. A confident, well-organized opening buys you goodwill for the rest of the audit.

Then honestly assess your status against the three failure areas (Section iv). If you find gaps in design controls, risk management, or CAPA, these are your highest-priority remediation items. Focus on completeness and traceability first.

Check the forgotten areas (Section v) for anything genuinely missing. Training records and supplier controls are the most common blind spots.

Skim what matters less (Section vi) to make sure you have not over-invested in areas that do not apply at your stage.

Finally, review the gotchas (Section vii) and check each one against your own QMS. These are all fixable in a day or two.

If you work through this guide and find gaps you are not confident you can close on your own, that is exactly what our internal audit and gap assessment services are built for — independent assessment with prioritized findings and remediation guidance.

ix. Common questions

How often should we conduct internal audits?

ISO 13485 requires internal audits “at planned intervals.” Most organizations interpret this as annually, with the full QMS scope covered over a 12-month cycle. For startups, an annual comprehensive audit is usually sufficient — supplemented by targeted audits after significant changes or findings.

Can our CEO conduct the internal audit?

Only if the CEO is not responsible for the area being audited. In practice, at most startups, the CEO is involved in everything. The cleanest solution is to engage an external auditor for internal audits. This is explicitly permitted by the standard, is common practice, and brings an outside perspective.

What is the difference between a minor and major nonconformity?

A major nonconformity is a complete absence of a required element or a systematic breakdown of a process (e.g., “no design review records exist”). A minor nonconformity is an isolated lapse within an otherwise functional system (e.g., “one of six design reviews is missing a sign-off”). Observations are concerns that do not rise to the level of a nonconformity but suggest improvement opportunities.

Should we fix issues before the certification audit or let the auditor find them?

Fix them. Always. Auditors are not impressed by transparency about known problems — they are impressed by evidence that you found and fixed them proactively. Your internal audit is your opportunity to identify and remediate issues before an external auditor sees them.

How do we handle our first internal audit if we have never done one?

The first internal audit is the hardest because you are building the process and executing it simultaneously. Prioritize getting the procedure written (who audits, how findings are documented, how CAPAs are initiated), conduct the audit against the highest-risk areas first (design controls, risk management), document findings honestly, and open CAPAs for anything significant. The first audit will not be perfect — but having done it, with documented results, is infinitely better than not having done it at all.

Does an internal audit cover information security if we have an integrated management system?

If your QMS is integrated with an ISMS (which we recommend for SaMD and connected device companies), your internal audit program should cover both quality and security controls. The audit schedule should define which controls are audited when, and auditors should have appropriate competence for each domain.

What records should we have ready for the auditor on day one?

Beyond the company basics in Section ii: your quality manual, QMS scope statement, quality policy, org chart, list of applicable regulations and standards, audit schedule, most recent management review minutes, employee training matrix, approved supplier list, and your document master list. Having these organized and immediately accessible signals preparation and maturity.

Closing

An internal audit is not a test to pass. It is a diagnostic tool — a structured, evidence-based assessment of whether your quality system does what it claims to do. The startups that treat it as a chore produce checklists that gather dust. The startups that treat it as a genuine quality activity find problems early, fix them cheaply, and walk into certification audits with confidence.

This guide is organized around what actually matters for startups at your stage — not around what a textbook says should matter in general. Use it to prepare, use it to assess, and use it to improve.