ISO 13485 Clause 8.2.4 Internal Audit Explained for Medical Device Companies (2026 Guide)
ISO 13485 Clause 8.2.4 requires medical device companies to conduct internal audits to verify that their quality management system is both compliant and effectively implemented. Audits must be planned, independent, documented, and linked to corrective action. The goal is not to check compliance—it is to identify system weaknesses before external audits do.
If your internal audit program is not finding meaningful issues, it is not working.
What ISO 13485 Clause 8.2.4 Actually Requires
Clause 8.2.4 focuses on verifying whether your quality management system:
- Conforms to ISO 13485 requirements
- Is effectively implemented and maintained
This means internal audits must go beyond documentation checks. They must test whether processes work in real conditions.
Related: ISO 13485 Internal Audit Explained
Key Requirements of Clause 8.2.4
1. Audit Planning
Audits must be planned based on:
- Status and importance of processes
- Previous audit results
What this means in practice:
High-risk processes (CAPA, design controls, risk management) must be audited more frequently.
2. Defined Audit Criteria and Scope
Each audit must clearly define:
- What is being audited (process, department, system)
- Which requirements apply (ISO clauses, procedures, regulations)
Mistake to avoid: Generic “full QMS audit” without defined focus.
3. Auditor Independence
Auditors must be independent of the area being audited.
Common failure: Process owners auditing their own work.
Fix: Cross-functional auditors or external support.
4. Documented Evidence
Audits must be supported by objective evidence:
- Records
- Observations
- Interviews
If you cannot show evidence, it does not exist.
5. Reporting of Findings
Audit results must include:
- Nonconformities
- Observations
- Opportunities for improvement
Findings must be clear, evidence-based, and actionable.
6. Link to CAPA
All nonconformities must trigger corrective action.
Weak system: Findings recorded but no CAPA raised.
Strong system: Findings drive systemic improvement.
Tools:
What Auditors Actually Look For
External auditors assessing your internal audit system will check:
- Is the audit program risk-based?
- Are auditors competent and independent?
- Do findings reflect real system issues?
- Are CAPAs raised and effective?
- Are repeat findings being eliminated?
If your internal audits always show “no issues,” that is a red flag.
Common Internal Audit Mistakes
Checklist Auditing
Auditing clause-by-clause instead of process-by-process.
Weak Findings
Vague statements like “procedure not followed.”
No Root Cause
Findings closed without proper investigation.
No Follow-Up
CAPAs raised but never verified for effectiveness.
Fix these and your audit system becomes a strength, not a liability.
How to Build an Effective Internal Audit Program
Step 1: Define Risk-Based Audit Schedule
- Audit high-risk processes more frequently
- Adjust frequency based on findings and changes
Step 2: Train Auditors Properly
- Interviewing skills
- Evidence evaluation
- Writing strong findings
Step 3: Audit Processes, Not Just Procedures
- Follow inputs → process → outputs
- Test real execution
Step 4: Strengthen Findings
- State requirement
- State evidence
- State impact
Step 5: Close the Loop with CAPA
- Link all findings to corrective actions
- Verify effectiveness over time
Related:
Internal Audit vs External Audit: Key Difference
Internal audit: You find the problems
External audit: They find the problems
The companies that pass audits consistently are the ones where internal audits are more demanding than external ones.
Quick Internal Audit Effectiveness Checklist
- Are audits planned based on risk?
- Are auditors independent?
- Are findings evidence-based?
- Are CAPAs raised and effective?
- Are repeat issues decreasing?
If not, your system needs strengthening.
When to Upgrade Your Internal Audit System
You should take action if:
- Your audits rarely find issues
- External audits identify major findings
- CAPAs are recurring
- Your team lacks audit expertise
Next steps:
Final Thought
Clause 8.2.4 is not about running audits. It is about building a system that continuously tests and improves itself.
If your internal audit system is strong, your external audits become predictable—and passable.
If it is weak, your audit outcome is just a matter of time.
