ISO 13485 from zero, episode ten: management review and certification readiness.
ISO Cloud Consulting editorial teamClose the ISO 13485 loop with a management review that covers every required input and records decisions with owners and dates. Before booking certification, check six things honestly: real records, a full internal audit, a complete review, device files, current risk files and people who can explain their part.
What does the final episode cover?
This is the final episode of ISO 13485 from zero. Over ten episodes we have built a medical device quality system: role and scope, the quality manual and document control, risk management, design controls, suppliers, production and validation, complaints and surveillance, CAPA and internal audit. This episode closes the loop with management review and a readiness check before certification.
What inputs must management review cover?
ISO 13485 lists the inputs that management review must cover, and auditors check them one by one: feedback, complaint handling, reporting to regulators, audits, monitoring and measurement of processes and of product, CAPA, follow-up actions from previous reviews, changes that could affect the quality system, recommendations for improvement, and new or revised regulatory requirements.
Prepare each input as a short summary with data and a trend, not a pile of raw reports.
What outputs must management review record?
The review must record decisions and actions on improvements needed to maintain the suitability, adequacy and effectiveness of the system and its processes, on improvement of product related to customer requirements, on changes needed to respond to new or revised regulatory requirements, and on resource needs.
Write each output as a decision with an owner and a date. Review at planned intervals, at least annually, and more often while the system is new.
How do you check readiness for certification?
Before booking a certification audit, check six things honestly. Every process has run long enough to produce real records. The internal audit covered the whole system and its findings are closed or under control. Management review has been held with all required inputs. Each device has a medical device file. Risk management files are current. And the people who will be interviewed can explain their part of the system in their own words.
If any of these is weak, fix it first. A delayed audit costs far less than a failed one.
How do you choose and prepare for the audit?
Choose a certification body with experience in your device type, recognized by the regulators in your markets where that matters. Ask about auditor availability, the audit stages, and the full cost over the certification cycle.
Before the audit, brief your team on how audits work: answer the question asked, show the record, and say so when you do not know.
How do you keep the system alive after certification?
Certification is the beginning of a cycle, not the end of a project. Keep the internal audit program running, keep CAPA flowing, update the risk files with what the market tells you, and hold management reviews on time. The system you have built protects patients and your business only as long as it is used.
That completes ISO 13485 from zero.
Where do you go from here?
The ISO 13485 Starter Kit contains the six kits most organizations need first, and the ISO 13485 Complete QMS Kit contains every ISO 13485 kit we make. If you want us to build it with you remotely, the consulting page explains how. You can also browse the ISO 13485 templates collection.
