ISO 13485 Internal Audit Checklist (Excel) and Kit

By Ishan Maharaj, Founder and Principal Consultant. Last reviewed 26 October 2026.

See the Internal Audit Kit ($79)

What is included in the internal audit kit?

All files are editable Word, Excel and PowerPoint documents, licensed for one organisation including its sites. The kit is also included in the Starter Kit ($249) and the Complete QMS Kit ($449).

What does a checklist row look like?

These example rows show the structure of an audit checklist (written for this page, not copied from the kit):

How do I run the audit, step by step?

1. Adapt the Internal Audit SOP and set frequency by process risk and past results.
2. Build the year's programme.
3. For each audit, write a plan, filter the checklist to the clauses in scope and record evidence against each row.
4. Write the report, raise findings as CAPAs and verify they worked (see the CAPA template).
5. Qualify auditors with the log and the training module. Nobody audits their own work.

For a clause-level explanation, read ISO 13485 clause 8.2.4 explained and the internal audit hub. To run audits inside SharePoint, see the SharePoint QMS guides.

How does the FDA QMSR affect internal audits?

The QMSR took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. In the final rule, FDA described aligning requirements for internal audits and management reviews with ISO 13485. From the same date, FDA stopped using the Quality System Inspection Technique (QSIT) and now uses Compliance Program 7382.850 for inspections. FDA's rule also notes that it accepts certain MDSAP audits as a substitute for its own routine surveillance. FDA states that the rule does not affect its inspection authority under section 704 of the FD&C Act, so plan on records being requested. Check current FDA guidance before relying on any specific inspection practice.

Worked example: a first internal audit in one week

A 15-person manufacturer has a certification audit in eight weeks. Day 1: filter the checklist to document control and CAPA, two high-risk areas. Day 2 to 3: sample records against each row. Day 4: write findings. Day 5: open CAPAs for any finding and give each an owner and due date. Repeat for design controls, production and supplier control over the following weeks. If you want an independent view, we offer remote internal audits: single process from $1,250, several linked processes from $2,250 and a full-system audit from $4,500.

Frequently asked questions

How often should internal audits happen?

ISO 13485 requires audits at planned intervals. Set the interval by process risk and past results, and record the reasoning in the programme.

Can I audit my own department?

No. Auditors should be independent of the work they audit. For small teams, use someone from another function or an external auditor.

Does the checklist include the standard's text?

No. Requirements are summarised in plain words with audit questions and evidence prompts. You need your own licensed copy of ISO 13485.

Is there a free option?

Try the free sample pages from every kit and the Free ISO 13485 Gap Assessment Lite.

Sources

• FDA, Quality Management System Regulation (QMSR)
• Federal Register, Medical Devices; Quality System Regulation Amendments (2 February 2024)
• ISO, ISO 13485:2016