How to Become an ISO 13485 Internal Auditor
Ishan Maharaj
An ISO 13485 internal auditor checks whether the medical device quality management system conforms to planned arrangements, ISO 13485 and applicable regulatory requirements, and whether it is effectively implemented and maintained. Clause 8.2.4 requires a documented procedure for internal audits, an audit programme based on the status and importance of processes and on risk, and auditors who do not audit their own work.
Last updated: October 2026.
Steps to become an ISO 13485 internal auditor
- Know ISO 13485:2016 well, especially clauses 4.2 (documentation), 7.3 (design and development), 7.4 (purchasing), 7.5 (production and process validation), 8.2.2 (complaints), 8.3 (nonconforming product) and 8.5.2 (corrective action).
- Understand the regulatory layer: EU MDR, the FDA Quality Management System Regulation (which incorporates ISO 13485 by reference) and MDSAP, if they apply to your company.
- Learn audit method from ISO 19011: programme management, sampling, evidence and reporting.
- Practise process audits that follow a product through design, purchasing, production, release and complaints, and link findings to risk (ISO 14971).
- Shadow and then lead audits under supervision.
- Make sure your competence is recorded under clause 6.2: training, supervised audits and an effectiveness check.
Online course
Template for this step: the audit checklist, audit plan and report templates are in the ISO 13485 Internal Audit Kit ($79).
ISO 13485:2016 Internal Auditor Course
Self-paced course on clause 8.2.4, risk-based audit programmes, process audits across design, purchasing, production and CAPA, MDSAP awareness, grading findings and reporting, with a full practice audit.
Common mistakes new auditors make
- Auditing clause by clause instead of following the process and the product.
- Writing findings without objective evidence or a clear requirement.
- Ignoring regulatory requirements that the audit scope must cover.
- Not checking that previous corrective actions were effective.
For more detail see our guides to the ISO 13485 internal audit checklist and clause 8.2.4.
Frequently asked questions
Is online ISO 13485 internal auditor training accepted by notified bodies?
Notified bodies and regulators assess your evidence of auditor competence, not a particular training brand. A training certificate plus records of supervised audits is common evidence.
How often must ISO 13485 internal audits be done?
At planned intervals set by your audit programme, based on the status and importance of processes and on risk. Most companies cover the whole system at least once a year.
Can internal auditors audit their own work?
No. ISO 13485 clause 8.2.4 states that auditors shall not audit their own work.
About our certificates: ISO Cloud Consulting courses award a certificate of completion. We are a new training provider and our certificates are not yet accredited by an external body; we plan to apply for international recognition before the end of 2027.
