Quality Manager - QMS ISO 13485 Specialist

ISO 13485:2016 Quality Management System implementation, maintenance, and certification support for medical device organizations.

Table of Contents

• QMS Implementation Workflow
• Document Control Workflow
• Internal Audit Workflow
• Process Validation Workflow
• Supplier Qualification Workflow
• QMS Process Reference
• Decision Frameworks
• Tools and References

QMS Implementation Workflow

Implement ISO 13485:2016 compliant quality management system from gap analysis through certification.

Workflow: Initial QMS Implementation

1. Conduct gap analysis against ISO 13485:2016 requirements
2. Document current state vs. required state for each clause
3. Prioritize gaps by:
   • Regulatory criticality
   • Risk to product safety
   • Resource requirements
4. Develop implementation roadmap with milestones
5. Establish Quality Manual per Clause 4.2.2:
   • QMS scope with justified exclusions
   • Process interactions
   • Procedure references
6. Create required documented procedures:
   • Document control (4.2.3)
   • Record control (4.2.4)
   • Internal audit (8.2.4)
   • Nonconforming product (8.3)
   • Corrective action (8.5.2)
   • Preventive action (8.5.3)
7. Deploy processes with training
8. Validation: Gap analysis complete; Quality Manual approved; all required procedures documented and trained

Gap Analysis Matrix

QMS Structure

Required Procedure List

Document Control Workflow

Establish and maintain document control per ISO 13485 Clause 4.2.3.

Workflow: Document Creation and Approval

1. Identify need for new document or revision
2. Assign document number per numbering convention:
   • Format:

     [TYPE]-[AREA]-[SEQUENCE]-[REV]

   • Example:

     SOP-02-001-01

3. Draft document using approved template
4. Route for review to subject matter experts
5. Collect and address review comments
6. Obtain required approvals based on document type
7. Update Document Master List
8. Validation: Document numbered correctly; all reviewers signed; Master List updated

Document Numbering Convention

Area Codes

Document Change Control

Document Review Schedule

Internal Audit Workflow

Plan and execute internal audits per ISO 13485 Clause 8.2.4.

Workflow: Annual Audit Program

1. Identify processes and areas requiring audit coverage
2. Assess risk factors for audit frequency:
   • Previous audit findings
   • Regulatory changes
   • Process changes
   • Complaint trends
3. Assign qualified auditors (independent of area audited)
4. Develop annual audit schedule
5. Obtain management approval
6. Communicate schedule to process owners
7. Track completion and reschedule as needed
8. Validation: All processes covered; auditors qualified and independent; schedule approved

Workflow: Individual Audit Execution

1. Prepare audit plan with scope, criteria, and schedule
2. Notify auditee minimum 1 week prior
3. Review procedures and previous audit results
4. Prepare audit checklist
5. Conduct opening meeting
6. Collect evidence through:
   • Document review
   • Record sampling
   • Process observation
   • Personnel interviews
7. Classify findings:
   • Major NC: Absence or breakdown of system
   • Minor NC: Single lapse or deviation
   • Observation: Risk of future NC
8. Conduct closing meeting
9. Issue audit report within 5 business days
10. Validation: All checklist items addressed; findings supported by evidence; report distributed

Audit Program Template

Auditor Qualification Requirements

Finding Classification Guide

Process Validation Workflow

Validate special processes per ISO 13485 Clause 7.5.6.

Workflow: Process Validation Protocol

1. Identify processes requiring validation:
   • Output cannot be verified by inspection
   • Deficiencies appear only in use
   • Sterilization, welding, sealing, software
2. Form validation team with subject matter experts
3. Write validation protocol including:
   • Process description and parameters
   • Equipment and materials
   • Acceptance criteria
   • Statistical approach
4. Execute Installation Qualification (IQ):
   • Verify equipment installed correctly
   • Document equipment specifications
5. Execute Operational Qualification (OQ):
   • Test parameter ranges
   • Verify process control
6. Execute Performance Qualification (PQ):
   • Run production conditions
   • Verify output meets requirements
7. Write validation report with conclusions
8. Validation: IQ/OQ/PQ complete; acceptance criteria met; validation report approved

Validation Documentation Requirements

Revalidation Triggers

Special Process Examples

Supplier Qualification Workflow

Evaluate and approve suppliers per ISO 13485 Clause 7.4.

Workflow: New Supplier Qualification

1. Identify supplier category:
   • Category A: Critical (affects safety/performance)
   • Category B: Major (affects quality)
   • Category C: Minor (indirect impact)
2. Request supplier information:
   • Quality certifications
   • Product specifications
   • Quality history
3. Evaluate supplier based on:
   • Quality system (ISO certification)
   • Technical capability
   • Quality history
   • Financial stability
4. For Category A suppliers:
   • Conduct on-site audit
   • Require quality agreement
5. Calculate qualification score
6. Make approval decision:

   • 80: Approved

   • 60-80: Conditional approval
   • <60: Not approved
7. Add to Approved Supplier List
8. Validation: Evaluation criteria scored; qualification records complete; supplier categorized

Supplier Evaluation Criteria

Supplier Category Requirements

Supplier Performance Metrics

QMS Process Reference

ISO 13485 Clause Structure

Management Review Required Inputs (Clause 5.6.2)

Record Retention Requirements

Decision Frameworks

Exclusion Justification (Clause 4.2.2)

Nonconformity Disposition Decision Tree

Nonconforming Product Identified
            │
            ▼
    Can it be reworked?
            │
       Yes──┴──No
        │       │
        ▼       ▼
    Is rework     Can it be used
    procedure     as is?
    available?        │
        │        Yes──┴──No
    Yes─┴─No     │       │
     │    │     ▼       ▼
     ▼    ▼  Concession  Scrap or
  Rework  Create    approval    return to
  per SOP  rework    needed?    supplier
          procedure     │
                    Yes─┴─No
                     │    │
                     ▼    ▼
                 Customer  Use as is
                 approval  with MRB
                          approval

CAPA Initiation Criteria

Tools and References

Scripts

python qms_audit_checklist.py --help

Audit Checklist Generator Features:

• Generate clause-specific checklists (e.g.,

  --clause 7.3

  )
• Generate process-based checklists (e.g.,

  --process design-control

  )
• Full system audit checklist (

  --audit-type system

  )
• Text or JSON output formats
• Interactive mode for guided selection

References

Quick Reference: Mandatory Documented Procedures

Related Skills

ISO 13485:2016 Alignment with FDA QMSR

QMSR Transition Impact on ISO 13485 QMS

With the FDA's QMSR (effective February 2, 2026) incorporating ISO 13485:2016 by reference, organizations already ISO 13485 certified gain significant advantages:

FDA-Retained Requirements Beyond ISO 13485

Even under QMSR, certain FDA-specific requirements remain. The QMS must address:

QMSR Gap Analysis Checklist

• Map all existing QSR SOPs to ISO 13485 clause numbers
• Identify FDA-retained requirements not covered by ISO 13485
• Update Quality Manual scope and references
• Retrain staff on ISO 13485 terminology (e.g., "design output" terminology alignment)
• Update supplier quality agreements to reference QMSR
• Revise internal audit checklist to combined ISO 13485 + FDA requirements
• Verify complaint handling addresses both ISO 13485 Clause 8.2.2 and 21 CFR 820.198
• Conduct mock audit against QMSR requirements

Digital QMS Implementation

Electronic Document Management System (eDMS) Requirements

Electronic Signatures

Audit Trail Requirements

Cross-Reference: 21 CFR Part 11 / Annex 11

21 CFR Part 11 Requirements for Electronic Records

Annex 11 (EU GMP) Requirements

Remote Audit Considerations (Post-COVID)

Remote Audit Methodology

Remote Audit Best Practices

Hybrid Audit Model

Cross-Reference: ISO 42001 for AI-Enabled Medical Devices

ISO 42001 (AI Management System) Integration with ISO 13485

For medical device organizations developing AI-enabled products, ISO 42001:2023 provides an AI management system framework:

AI Lifecycle Integration with Design Controls

ISO 13485 Design Control (Cl. 7.3)     ISO 42001 AI Lifecycle
─────────────────────────────────       ─────────────────────
Design Input (7.3.3)                    AI System Requirements
    ↓                                       ↓
Design Output (7.3.4)                   Data Collection & Preparation
    ↓                                   Model Architecture & Training
    ↓                                       ↓
Design Review (7.3.5)                   AI Model Validation Review
    ↓                                       ↓
Design Verification (7.3.6)            Model Verification (accuracy, bias)
    ↓                                       ↓
Design Validation (7.3.7)             Clinical Validation (real-world performance)
    ↓                                       ↓
Design Transfer (7.3.8)               Model Deployment & Monitoring
    ↓                                       ↓
Design Changes (7.3.9)                Model Retraining & Update Control

Supplier Qualification for Software/Cloud Providers

Cloud Service Provider Qualification

Software Supplier Assessment

CAPA Integration with Cybersecurity Incidents

Cybersecurity Incident as CAPA Trigger

Cybersecurity CAPA Process

Step 1: Incident Detection and Containment
        → Activate incident response plan
        → Contain threat and preserve evidence
        → Assess impact on product safety and quality

Step 2: Investigation (Root Cause Analysis)
        → Technical forensic analysis
        → 5 Whys + attack chain reconstruction
        → Identify QMS process failures that enabled the incident
        → Assess whether product quality was affected

Step 3: Corrective Actions
        → Technical: patch vulnerability, update security controls
        → Process: update SOPs, access controls, monitoring
        → People: security awareness training
        → Product: assess need for field safety corrective action (FSCA)

Step 4: Preventive Actions
        → Threat modeling review for similar attack vectors
        → Security control gap analysis
        → Supply chain security review (if applicable)
        → Update cybersecurity risk assessment

Step 5: Effectiveness Verification
        → Penetration testing to verify fix
        → Monitoring for recurrence (90-day window)
        → Review of updated security metrics
        → Close CAPA with evidence of effectiveness

Step 6: Regulatory Reporting (if required)
        → MDR vigilance report (if patient safety affected)
        → FDA MedWatch report (if applicable)
        → GDPR breach notification (if personal data involved)
        → NIS2 incident report (if essential entity)

Cross-references: See

../information-security-manager-iso27001/SKILL.md

for ISO 27001 incident response procedures,

../fda-consultant-specialist/SKILL.md

for FDA QMSR alignment, and

../risk-management-specialist/SKILL.md

for cybersecurity risk integration with ISO 14971.

ISO 13485 Enhanced — QMSR, Digital QMS & Cross-Framework Integration

ISO 13485:2016 Alignment with FDA QMSR

With FDA's Quality Management System Regulation (QMSR) effective Feb 2026:

• Direct Alignment: FDA now recognizes ISO 13485:2016 as the quality system standard
• Single QMS: Organizations can maintain one QMS for both FDA and EU market access
• Gap Analysis: Identify differences between current QSR procedures and ISO 13485 requirements
• Transition Plan: Map QSR 21 CFR 820 sections to ISO 13485 clauses, update procedures
• Cross-reference: See

  fda-consultant-specialist

  for detailed FDA requirements

Digital QMS Implementation

• Electronic Document Control: Validated electronic document management system (eDMS)
• Electronic Signatures: 21 CFR Part 11 / EU Annex 11 compliant e-signatures
• Audit Trail: Automated, timestamped, immutable record of all document changes
• Cloud QMS Platforms: Qualification requirements for SaaS QMS solutions (IQ/OQ/PQ)
• Cross-reference: See

  quality-documentation-manager

  for Part 11 compliance

Remote Audit Considerations

• Hybrid Audits: Combination of on-site and remote activities (ISO 19011 guidance)
• Technology Requirements: Secure video conferencing, screen sharing, document access
• Limitations: Physical process observations may require on-site verification
• Notified Body Acceptance: Most NBs accept hybrid audits for surveillance and recertification

AI-Enabled Medical Device QMS

• ISO 42001 Integration: For organizations developing AI-enabled medical devices
• Data Governance: Training data quality per ISO 42001 Annex A.7 within QMS
• Model Lifecycle: AI model versioning and change control within existing QMS processes
• Cross-reference: See

  iso42001-ai-management

  for AI management system requirements

Supplier Qualification for Software/Cloud Providers

• Cloud Service Providers: Qualification checklist (SOC 2, ISO 27001, data residency, SLAs)
• Open Source Software: Risk assessment for OSS components (licensing, maintenance, vulnerabilities)
• SaaS Tools: Validation requirements for SaaS platforms used in QMS processes
• SBOM Management: Track software components across the supply chain

Troubleshooting

7.3

4.2.3

8.5.2

--interactive

--audit-type system

--clause

--process

Success Criteria

• QMS gap analysis completed against all ISO 13485:2016 clauses with documented current state, gap severity, priority, and remediation actions
• All 6 mandatory documented procedures established, trained, and effective (document control, record control, internal audit, NC product, corrective action, preventive action)
• Quality Manual approved with justified clause exclusions, process interactions documented, and scope clearly defined
• QMSR transition completed: all QSR SOPs mapped to ISO 13485 clauses, FDA-retained requirements addressed, internal audit checklist updated for combined ISO 13485 + FDA requirements
• Supplier qualification program operational with category-based assessment (A/B/C), documented scoring, and approved supplier list maintained
• Process validation completed for all special processes (IQ/OQ/PQ documented with approved protocols and reports)
• Certification audit passed with zero Major nonconformities and a plan to address any Minor findings within 60 days

Scope & Limitations

In Scope:

• ISO 13485:2016 QMS implementation from gap analysis through certification
• Document control system design (numbering, approval, change control, review schedules)
• Internal audit program planning and execution per Clause 8.2.4
• Process validation methodology (IQ/OQ/PQ) per Clause 7.5.6
• Supplier qualification and monitoring per Clause 7.4
• FDA QMSR transition planning and gap analysis
• Digital QMS implementation (eDMS, Part 11, Annex 11 requirements)
• Remote and hybrid audit methodology
• AI-enabled medical device QMS considerations (ISO 42001 integration)

Out of Scope:

• Clinical evaluation or clinical investigation management (use regulatory-affairs-head for clinical evidence strategy)
• Product-specific design control execution (the skill provides the design control framework, not product-specific design inputs/outputs)
• Sterilization validation protocol development (requires product-specific expertise per ISO 11135/11137/17665)
• Regulatory submission preparation (use fda-consultant-specialist or mdr-745-specialist)
• Post-market surveillance program execution (use risk-management-specialist for post-production risk monitoring)
• IT infrastructure or cybersecurity implementation (use infrastructure-compliance-auditor for technical security)

Integration Points

Tool Reference

qms_audit_checklist.py

Generates ISO 13485:2016 audit checklists by clause, process, or full system audit.

--clause

7.3

4.2.3

8.5.2

--process

design-control

purchasing

capa

--audit-type

system

--output

json

--interactive