Three kinds of ISO 13485 assessment
| Assessment | Who performs it | Purpose |
|---|---|---|
| Gap analysis | Your team or a consultant | Compare the current QMS with ISO 13485 (and regulatory) requirements before certification, transition or inspection |
| Internal audit | Trained internal auditors | Required by clause 8.2.4 to verify the QMS conforms and is effectively implemented |
| Certification or MDSAP audit | Accredited certification body or MDSAP auditing organization | Grant and maintain certification, or satisfy multiple regulators in one audit |
The three use the same reference, ISO 13485:2016, which ISO confirmed as current in 2025 (ISO).
For an internal audit checklist aligned with FDA’s inspection areas, see ISO 13485 Internal Audit Checklist: QMSR-Ready for 2026.
How the ISO 13485 certification audit works
BSI describes a three-year certification cycle (BSI):
- Stage 1: “an assessment to figure out whether you are ready for a full Stage 2 assessment,” usually focused on documentation and planning.
- Stage 2: “confirms your management system is fully aligned to the standard and is fully operational.”
- Surveillance: “Your first CAV will usually be within 10 months of your Stage 2 assessment, and then annually after that.”
- Recertification: “Three months before the end of your certification period, we will visit you for another assessment.”
Findings are graded, typically as major or minor nonconformities, and certification requires an accepted corrective action plan.
MDSAP audits
The Medical Device Single Audit Program lets one audit cover ISO 13485 plus the requirements of Australia, Brazil, Canada, Japan and the United States (FDA). BSI notes that “MDSAP is based on a three year audit cycle,” with surveillance audits in years one and two and a recertification audit in year three (BSI).
Why ISO 13485 audits matter more for US makers in 2026
FDA’s QMSR, effective February 2, 2026, requires a QMS that “complies with the applicable requirements of ISO 13485” (eCFR, 21 CFR 820.10). FDA does not rely on certificates, but its investigators now cite ISO 13485 clauses: the first QMSR warning letters cited clause 7.1 on risk management and clause 7.3.9 on design changes (FDA Law Blog). And because the QMSR dropped the old 820.180(c) exception, FDA can now read internal audit and management review records (FDA QMSR FAQ). A weak internal audit program is now visible to two audiences.
How to run an ISO 13485 gap analysis
- Define the reference set. ISO 13485:2016, plus the QMSR’s FDA-specific provisions, EU MDR Article 10 or MDSAP country requirements as relevant.
- Inventory the QMS. List procedures, forms, records and the processes they cover, including outsourced processes.
- Assess clause by clause. For each requirement, record the procedure that addresses it, the evidence that it is followed and a rating: met, partially met or not met.
- Test the content, not just the existence. A procedure that names ISO 14971 but does not describe activities, responsibilities and records is a partial gap.
- Sample records. Check that complaints, CAPAs, design changes and supplier evaluations follow the procedures.
- Prioritize by risk. Product safety, regulatory reporting and areas FDA cites most often come first.
- Plan and track closure through CAPA or a project plan, then confirm with an internal audit before the certification body or FDA arrives.
ISO 13485 clause-by-clause checklist
Clause 4: Quality management system
- QMS roles documented; regulatory requirements identified (4.1.1)
- Risk-based approach applied to control of QMS processes (4.1.2)
- Outsourced processes controlled (4.1.5)
- QMS software validated proportionate to risk (4.1.6)
- Quality manual and medical device files maintained (4.2.2, 4.2.3)
- Document and record control, including retention (4.2.4, 4.2.5)
Clause 5: Management responsibility
- Quality policy and measurable objectives (5.3, 5.4.1)
- Responsibilities, authorities and management representative defined (5.5)
- Management review inputs, outputs and records complete (5.6)
Clause 6: Resource management
- Competence, training and effectiveness documented (6.2)
- Infrastructure, maintenance, work environment and contamination control (6.3, 6.4)
Clause 7: Product realization
- Risk management documented across product realization (7.1)
- Customer and regulatory requirements reviewed (7.2)
- Design and development planning, verification, validation, transfer and changes (7.3)
- Supplier evaluation, selection and monitoring based on risk (7.4)
- Production controls, process validation, sterilization where relevant (7.5)
- Identification, traceability and preservation (7.5.8 to 7.5.11)
- Monitoring and measuring equipment controlled (7.6)
Clause 8: Measurement, analysis and improvement
- Feedback and complaint handling, with regulatory reporting decisions (8.2.1 to 8.2.3)
- Internal audits planned and performed, records inspection-ready (8.2.4)
- Nonconforming product controlled (8.3)
- Data analysis feeds improvement (8.4)
- Corrective and preventive action with verified effectiveness (8.5)
Where audits most often find gaps
Certification body Perry Johnson Registrars lists software validation, risk-based supplier control, identification and traceability, preservation of product and document control among the most common ISO 13485 nonconformities (PJR). FDA’s early QMSR inspections point to risk management, purchasing, complaint handling, UDI and corrective action (RAPS). Put these at the top of your gap analysis.
Run your gap analysis faster, with evidence
A clause-by-clause gap analysis means reading every procedure against every requirement. AskDona does that first pass: it assesses procedures and records against ISO 13485:2016, QMSR provisions or your own checklist, rates each requirement and cites the passage behind every finding, so your team can focus on judgment and fixes.
Run a sample ISO 13485 gap analysis on one procedure. AskDona shows the evidence; your quality team decides.
FAQ
What is an ISO 13485 audit? An assessment of a medical device QMS against ISO 13485, performed internally or by a certification body.
What happens in stage 1 and stage 2? Stage 1 checks readiness, mostly documentation; stage 2 confirms the QMS is fully implemented and operating (BSI).
What is an ISO 13485 gap analysis? A structured comparison of your QMS with ISO 13485 requirements to find what is missing or weak.
Is MDSAP the same as ISO 13485 certification? No. MDSAP covers ISO 13485 plus the requirements of participating regulators in one audit program.
Does FDA accept ISO 13485 certificates? FDA does not substitute certificates for its own inspections, though MDSAP audit reports can be used in place of routine FDA inspections.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| ISO: ISO 13485:2016 | Standards body | Confirmed 2025 | Status |
| BSI: ISO 13485 certification pathway | Certification body | 2025/2026 | Audit stages |
| BSI: MDSAP brochure | Certification body | 2020 | MDSAP cycle |
| FDA: MDSAP | Regulator | Dec 19, 2025 | Participants |
| eCFR: 21 CFR 820 | Regulation | Current | 820.10 |
| FDA Law Blog: First QMSR warning letters | Law firm | Aug 12, 2026 | Clauses cited |
| FDA: QMSR FAQ | Regulator | Oct 2, 2026 | Records access |
| PJR: Common ISO 13485 nonconformities | Certification body | n.d. | Common gaps |
| RAPS: Top QMSR observations | Professional body | May 14, 2026 | FDA findings |