ISO 13485 from zero, episode ten: management review and certification readiness.

How does the series close?

This is the final episode of ISO 13485 from zero. Over ten episodes we have built a medical device quality system: role and scope, the quality manual and document control, risk management, design controls, suppliers, production and validation, complaints and surveillance, CAPA and internal audit. This episode closes the loop with management review and a readiness check before certification.

What inputs must management review cover?

ISO 13485 lists the inputs, and auditors check them one by one: feedback, complaint handling, reporting to regulators, audits, monitoring and measurement of processes, monitoring and measurement of product, CAPA, follow-up actions from previous reviews, changes that could affect the quality system, recommendations for improvement, and new or revised regulatory requirements. Prepare each input as a short summary with data and a trend, not a pile of raw reports.

What outputs must it record?

Decisions and actions on improvements needed to maintain the suitability, adequacy and effectiveness of the system and its processes, on improvement of product related to customer requirements, on changes needed to respond to new or revised regulatory requirements, and on resource needs. Write each output as a decision with an owner and a date. Review at planned intervals, at least annually, and more often while the system is new.

How do you check readiness?

Before booking a certification audit, check six things honestly. Every process has run long enough to produce real records. The internal audit covered the whole system and its findings are closed or under control. Management review has been held with all required inputs. Each device has a medical device file. Risk management files are current. And the people who will be interviewed can explain their part of the system in their own words. If any of these is weak, fix it first. A delayed audit costs far less than a failed one.

How do you choose and prepare for the audit?

Choose a certification body with experience in your device type, recognised by the regulators in your markets where that matters. Ask about auditor availability, the audit stages, and the full cost over the certification cycle. Before the audit, brief your team on how audits work: answer the question asked, show the record, and say so when you do not know.

How do you keep it alive?

Certification is the beginning of a cycle, not the end of a project. Keep the internal audit programme running, keep CAPA flowing, update the risk files with what the market tells you, and hold management reviews on time. The system you have built protects patients and your business only as long as it is used.

The ISO 13485 Starter Kit contains the six kits most organisations need first, and the ISO 13485 Complete QMS Kit contains every ISO 13485 kit we make. If you want us to build it with you remotely, the consulting page explains how. Previously: the internal audit programme.