ISO 13485 Internal Audit: Audit a Workflow, Not a Clause

A clause-by-clause audit can find a procedure for every requirement and still miss the place where the quality system breaks: the handover.

A complaint enters through customer service, product identification sits with supply, risk is assessed by quality, reportability belongs to regulatory, and corrective action may require engineering or the manufacturer. Every team can show its own document while the case itself remains incomplete.

The more useful audit question is not, “Do we have a complaint procedure?” It is, “Can this complaint travel from first awareness to a defensible closure without losing its identity, rationale or owner?”

Pick one case and follow it

Take a recent complaint. Start with the earliest usable information, not the date on which Quality opened a ticket. Confirm the device, model, lot or serial number and the person who first received the report. Then trace the case through triage, investigation, risk review, regulatory assessment, CAPA decision and closure.

At every handover, ask three questions:

• What information was available at that point?
• Who had authority to make the next decision?
• Which record proves the decision and its basis?

This approach often reveals gaps hidden by a document review: the distributor uses a different product name; the awareness date is unclear; the risk file was not consulted; a CAPA was closed after implementation but before effectiveness was tested.

Turn the workflow into an audit spine

Map the path on one page before interviewing anyone:

**Trigger → identification → assessment → decision → implementation → verification → closure**

For each stage, define the expected evidence. A change workflow might require a change request, impact assessment, approval, verification or validation, updated documents, training and an effectiveness check. A release workflow would have a different evidence chain.

The map is not a substitute for the applicable audit criteria. It is a way to test whether requirements, procedures and actual records remain connected when work crosses teams and systems.

Let risk choose the sample

A useful audit programme does not give every process equal depth. It reflects the organisation’s products, role and recent signals.

A manufacturer with frequent supplier changes may need deeper sampling of purchasing, change control and verification. A Saudi importer or distributor may need stronger testing of receipt, storage, traceability, complaint escalation and recall execution. A service organisation may need to focus on installation, maintenance, calibration and service records.

Possible end-to-end samples include:

• one complaint from intake to regulatory disposition;
• one supplier change from proposal to approved implementation;
• one batch or unit from receipt to release and distribution;
• one CAPA from root cause to effectiveness;
• one employee from competence definition to observed performance.

Write findings that can be closed

“Complaint handling is ineffective” is difficult to investigate and easy to dispute. A strong finding separates the fact observed, the objective evidence, the audit criterion, the potential effect and the known scope of the issue.

That separation also prevents every error from becoming a CAPA. A single record correction and a systemic corrective action are not the same response. The evidence should determine which is justified.

Requirement versus method

ISO 13485 addresses internal audits and QMS effectiveness. Current SFDA QMS inspection requirements also focus on implemented procedures, records and traceability according to the establishment’s role and activities. Auditing a full workflow is Basier’s recommended professional method for testing those connections; it is not presented as a separate clause of ISO 13485. ISO 19011 provides guidance for auditing management systems but does not itself create a certification.

Basier can design risk-based audit programmes, prepare process trails, coach internal auditors and structure finding closure. Basier is not a certification body, does not issue an SFDA determination and cannot promise an inspection outcome.