What does ISO 13485 expect from an internal audit program?

Internal audits should be planned at defined intervals, take into account the importance of processes and previous results, be carried out by competent personnel, and produce records as evidence. Findings should feed into improvement systems such as CAPA. The system must show planning logic, structured records, tracking to closure, and links to CAPA and risk.

Where do most internal audit systems break down?

Most companies handle the audit program, planning, execution, and raising findings reasonably well. They tend to fail at the later steps: linking findings to CAPA, implementing actions, and verifying effectiveness. Common causes are no structured tracking of findings, no enforced CAPA linkage, and no verification that actions worked.

Why should audit findings be tracked separately from audit reports?

Each finding needs its own record with an ID, audit reference, description, classification as major, minor, or observation, risk impact, and status. Findings buried inside reports are hard to follow through to closure. Independent tracking allows findings to be linked to CAPA and prevents an audit from closing before related CAPAs are complete.

What should an internal audit trail be able to demonstrate?

It should show who planned the audit, who conducted it, what evidence was reviewed, what findings were raised, what actions were taken, and when closure was approved. ISO 13485 requires records to be maintained as evidence of QMS effectiveness, so if the system cannot show this clearly, it is likely to be challenged.

How to Manage ISO 13485 Internal Audits in SharePoint: A Practical System That Passes Audits

April 20, 2026 ISO Cloud Consulting editorial team

Editorial illustration for the guide: ISO 13485 Internal Audit in SharePoint Guide

To manage ISO 13485 internal audits in SharePoint, you need a structured system that controls audit planning, captures audit records, tracks findings, links them to CAPA, and maintains a complete audit trail. This is typically implemented using SharePoint lists for audit schedules and findings, document libraries for audit reports, and Power Automate workflows to enforce follow-up and closure. A properly designed SharePoint audit system ensures traceability, accountability, and audit readiness—something manual or spreadsheet-based systems consistently fail to achieve.

If your audit system does not enforce planning, execution, and follow-up, it is not compliant—it is administrative.

What Internal Audit Management Actually Means

Internal audit is not just a checklist exercise. It is a controlled process that verifies whether your QMS is:

Template for this step: the audit checklist, audit plan and report templates are in the ISO 13485 Internal Audit Kit ($79).

Implemented as defined
Effective in practice
Compliant with ISO 13485 and regulatory requirements

ISO 13485 requires internal audits to be planned, conducted, and documented systematically, with records maintained as evidence.

In practice, internal audit is one of the strongest indicators of QMS maturity.

How Internal Audits Work in Practice

The Real Audit Lifecycle

Audit programme defined (annual plan)
Individual audit planned (scope, criteria, auditor)
Audit executed (interviews, records review)
Findings raised (nonconformities, observations)
Findings linked to CAPA
Actions implemented
Effectiveness verified
Audit closed

Most companies perform steps 1–4 well.

They fail at steps 5–7:

No structured tracking of findings
No enforced CAPA linkage
No verification of effectiveness

This is exactly what auditors look for.

How This Applies to ISO 13485

ISO 13485 requires internal audits to:

Be planned at defined intervals
Consider process importance and previous results
Be conducted by competent personnel
Generate records and evidence

It also requires that issues identified feed into improvement systems such as CAPA.

This means your system must:

Show audit planning logic
Maintain structured audit records
Track findings through to closure
Link audits to CAPA and risk

If any of these are weak, your audit system will be challenged.

Audit Planning in SharePoint

Audit Programme List

Create a SharePoint list to manage your audit schedule.

Key fields:

Audit ID
Process / department
Risk level of process
Previous audit reference
Planned date
Assigned auditor
Status

This allows you to demonstrate risk-based audit planning.

Audit Plan Record

Each audit should have a defined plan:

Scope
Criteria (ISO clauses, procedures)
Audit objectives
Audit team

Store this in a controlled document library.

Audit Records Structure

Your audit system should produce structured records, not free-text notes.

Template for this step: the Document Control SOP and master document list are in the ISO 13485 Document Control & Records Kit ($79).

Audit Execution Record

Checklist or audit questions
Evidence reviewed
Interviews conducted
Objective evidence captured

This is what auditors will review—not your procedure.

Audit Report

Should include:

Summary of audit
Findings raised
Risk impact
Regulatory impact
Conclusion

Store reports in a version-controlled SharePoint library.

Findings Tracking in SharePoint

Audit Findings List

This is critical.

Key fields:

Finding ID
Audit reference
Description
Classification (major, minor, observation)
Risk impact
Status

Each finding must be tracked independently—not buried in reports.

CAPA Linkage (Where Most Systems Fail)

Every significant finding should trigger CAPA.

Your SharePoint system must:

Link findings to CAPA records
Track CAPA progress
Prevent audit closure before CAPA completion

Without this, your audit system is disconnected.

See the CAPA Hub for full CAPA system design.

How to Implement This in Practice

Step-by-Step SharePoint Audit System Setup

Create audit programme list
Create audit findings list
Build document libraries for audit plans and reports
Implement Power Automate workflows:
- Audit scheduling reminders
- Finding assignment notifications
- CAPA linkage enforcement
Restrict editing permissions by role
Require closure approval

For full system architecture, refer to the SharePoint QMS guide.

Practical insight: The audit system must drive behaviour. If it relies on discipline alone, it will fail under pressure.

If you are implementing or fixing your system, structured guidance helps avoid common pitfalls. Explore ISO 13485 consulting support.

Common Mistakes to Avoid

Audit as a checklist exercise
No real evaluation of effectiveness
Findings buried in reports
No structured tracking
No CAPA linkage
Issues identified but not resolved
No follow-up verification
Actions implemented but not tested
No risk-based planning
Audits treated equally regardless of impact
Manual tracking in Excel
No control or audit trail

Audit Trail Expectations

Your SharePoint system must demonstrate:

Who planned the audit
Who conducted the audit
What evidence was reviewed
What findings were raised
What actions were taken
When closure was approved

This is your audit trail.

ISO 13485 requires records to be maintained as evidence of QMS effectiveness.

If your system cannot show this clearly, it will be challenged.

Internal Audit System Checklist

Risk-based audit programme
Defined audit plans
Structured audit records
Independent findings tracking
CAPA linkage
Effectiveness verification
Controlled audit reports
Full audit trail

If any of these are missing, your audit system is incomplete.

Final Takeaway

Internal audit is not about passing audits. It is about proving your system works.

SharePoint enables you to:

Structure audit planning
Track findings properly
Link to CAPA
Maintain audit-ready records

Without structure, audits become superficial—and that risk carries into certification audits.

Next Step

If your audit system:

Lacks structure
Does not enforce follow-up
Fails to drive improvement

Fixing it early prevents major audit findings later.

Strengthen your system with the Internal Audit Hub and Document Control Guide.

Work with an ISO 13485 expert to build an audit system that actually works

Back to blog

Item added to your cart