ISO 13485 Auditor Competency and Follow-Up: What Auditors Expect
ISO Cloud Consulting editorial team
Most internal audit failures are not caused by bad systems.
They are caused by unqualified auditors and poor follow-up.
Why Auditor Competency Matters
An internal audit is only as strong as the person performing it.
ISO 13485 requires personnel performing quality-related activities to be competent based on education, training, skills, and experience.
This directly applies to internal auditors.
What Makes a Competent ISO 13485 Auditor
1. Knowledge of ISO 13485
- Understanding of clauses and intent
- Ability to interpret requirements in practice
2. Understanding of Your QMS
- Knowledge of internal procedures
- Understanding of process interactions
3. Process-Based Auditing Skills
- Ability to follow process flows
- Identify breakdowns in implementation
4. Risk-Based Thinking
- Focus on high-risk processes
- Link findings to regulatory impact
5. Audit Skills
- Interviewing techniques
- Evidence-based assessment
- Clear reporting
Auditor Independence Requirement
Auditors must be independent of the area they are auditing.
- Do not audit your own work
- Avoid conflicts of interest
- Use cross-functional auditors where possible
Common Auditor Competency Gaps
- Auditors trained once but never developed
- Checklist-only auditing
- No understanding of regulatory impact
- Weak or subjective findings
Fix: Implement structured auditor training and competency assessment.
ISO 13485 Audit Follow-Up Requirements
Finding issues is only half the job. ISO 13485 requires that audit findings are followed up effectively.
This means:
- Corrective actions must be defined
- Root causes must be identified
- Actions must be implemented
- Effectiveness must be verified
This aligns with corrective action requirements under Clause 8.5.
The Audit Follow-Up Process (Step-by-Step)
1. Raise Nonconformity
- Clear description
- Objective evidence
- Clause reference
2. Root Cause Analysis
- Identify true cause (not symptoms)
- Use structured methods (5 Whys, Fishbone)
3. Define Corrective Actions
- Address root cause
- Prevent recurrence
4. Implement Actions
- Assign responsibility
- Track timelines
5. Verify Effectiveness
- Confirm issue does not recur
- Review objective evidence
6. Close Audit Finding
- Document closure
- Maintain records
Common Audit Follow-Up Failures
- Root cause not properly identified
- Corrective actions address symptoms only
- No effectiveness checks
- Delayed or overdue actions
How Auditors Assess Follow-Up
External auditors will:
- Review previous audit findings
- Check CAPA records
- Verify effectiveness of actions
- Look for repeat issues
Repeat findings are a major red flag.
Link Between Audit, CAPA and Risk
A mature QMS links:
Template for this step: the CAPA SOP, CAPA register and root cause toolkit are in the ISO 13485 CAPA & Nonconformance Kit ($79).
- Audit findings → CAPA
- CAPA → Risk management
- Risk → Process controls
Risk management requires ongoing monitoring and control throughout the lifecycle.
How to Build a Strong Auditor Competency System
- Define competency criteria
- Train auditors formally
- Assess competency regularly
- Use supervised audits for development
- Maintain competency records
How to Strengthen Audit Follow-Up
- Integrate audit findings into CAPA system
- Enforce root cause analysis standards
- Track effectiveness checks
- Monitor trends across findings
FAQ: Auditor Competency and Follow-Up
What is auditor competency in ISO 13485?
It is the ability to perform audits based on training, skills, and experience.
Can anyone perform an internal audit?
No. Auditors must be trained, competent, and independent.
What is audit follow-up?
It is the process of correcting findings and verifying effectiveness of actions.
Is effectiveness verification required?
Yes. Without it, findings are not considered closed.
Final Takeaway
Strong audits come from competent auditors.
Strong systems come from effective follow-up.
If you fix these two areas, your audit outcomes improve immediately.
