Quality management systems and audits

The situation

Quality systems come under pressure at predictable moments: before a first certification audit, before a surveillance or recertification audit, before an FDA inspection, after a notified-body non-conformity, after a product or site change, or when a second market asks for a certificate the first did not. Since 2 February 2026 there is one more: the FDA now inspects against a regulation that incorporates ISO 13485:2016 by reference, and systems written to the old Part 820 vocabulary are being read against the new one.

What goes wrong when this is handled late

A system that was written for a certificate rather than for the work drifts from what the people actually do, and auditors find the gap between the two within an hour. A CAPA system that records corrections but not root causes fills with repeat findings. Supplier controls that stop at a signed questionnaire fail the first time a supplier changes a material without telling anyone. And a QMS that still says "device master record" in a company shipping to the US invites a conversation with an FDA investigator about whether anyone has read the current regulation.

The late fix for any of these is a scramble before the audit date. The timely fix is an assessment honest enough to be uncomfortable, done early enough to act on.

What Authentcare does

Assess. Review the documented system and a sample of records against ISO 13485:2016, the FDA QMSR, the MDSAP audit approach or whichever combination your markets require. Interview the people who run the processes, remotely or on site. Grade each finding by severity with the evidence reference, the way a certification auditor or an FDA investigator would, and attach a closure action and an owner to each.

Develop. Design or repair the system: the quality manual, the procedure architecture, the work instructions, forms and records, and the interactions between them, sized to your scope. Build the CAPA, supplier-control, design-control and change-control procedures so that they produce the records the audits will ask for. Plan sterilisation and cleanroom validations and review the protocols and reports the validation partners produce.

Coordinate. Run the internal audit programme or train your people to run it. Rehearse the certification audit or the FDA inspection: the opening meeting, the document requests, the interviews, the closing. Support the certification-body relationship and the response to findings.

On the FDA QMSR

The most common misunderstanding is that the QMSR is ISO 13485 with a new cover. It incorporates the standard by reference and then does three things the standard does not: it keeps FDA's own definitions where the FD&C Act requires them, it adds provisions on complaint files, records, labelling and packaging controls and servicing, and it changes how FDA inspects. The record types the old regulation named — the design history file, the device master record and the device history record — are no longer named as such; their obligations are met across ISO 13485 clauses 4.2.3, 7.3.10 and 7.5.1 and the QMSR's own record provisions, and FDA has cautioned against treating the medical device file as the DMR renamed. A system built to ISO 13485 and then mapped carefully to the QMSR's additions passes; a system that assumes equivalence does not.

What you receive

• QMS gap assessment against ISO 13485:2016, FDA QMSR, MDSAP or a combination, with findings graded by severity, evidence reference and closure action
• QMS architecture tailored to the manufacturer's scope — quality manual, procedures, work instructions, forms and records — built to be used, not shelved
• Internal audit programme and audits to ISO 19011 practice, with reports your certification body will recognise
• CAPA system design and CAPA reviews, including root-cause method and effectiveness checks
• Supplier and outsourced-process controls, including supplier evaluation criteria and quality agreements
• Design-control and change-control procedures aligned to ISO 13485 clause 7.3 and the QMSR
• {'Inspection and audit readiness': 'mock audit, document and record walk-through, interview rehearsal'}
• Sterilisation and cleanroom validation strategy and protocol review (coordinated with validation partners)

Frameworks and editions

Applicability is device-specific. Which of these apply, and in what combination, depends on device type, intended purpose, classification and target market; the applicability assessment at the start of every engagement settles it in writing.

What this engagement excludes

• Certification; ISO 13485 certificates and MDSAP certificates are issued by accredited certification bodies and auditing organisations
• Hosting an FDA inspection on the manufacturer's behalf
• Executing process validations; validation partners run them, Authentcare plans and reviews
• Certification-body and auditing-organisation fees