This page has been moved…https://medicaldeviceacademy.com/root-cause-analysis/

Quality system auditing is outsourced to consultants providing auditing services to ensure auditor independence. Do you need a quote?

Who quotes auditing services?

The form below provides us with the basic information we need to prepare an auditing services quote for your company. There are instructions below the form that explain exactly what information we are looking for in each section of the form. The quotation process is not automated. A real person (i.e. Lindsey Walker) will get back to you with a quotation. She is our audit program manager. She creates the audit quote and assigns the auditors based on availability and your auditing needs. Her email is sales@medicaldeviceacademy.com. The quotation will be automatically emailed from Freshbooks once she is finished, and then she will follow up with a manual email–just in case your spam filters prevent delivery of the automated email generated by FreshBooks. If Lindsey is on vacation, or out sick, the proposal will be prepared by Rob Packard. His email is rob@fdaestar.com.

General pricing of auditing services

If you are looking for the cheapest auditing services you can find, don’t even bother filling in the form. Our goal is to help you improve your quality system and provide valuable consulting advice to achieve improvements. We specialize in helping start-up companies achieve initial ISO 13485 certification, MDSAP certification, and CE Certification. We will assign an experienced lead auditor with an hourly consulting rate of $275/hour. Typically, we will charge $2,750 plus travel expenses for a one-day supplier audit because we expect to spend 30 minutes on audit preparation, eight hours on-site actively auditing, and 2+ hours generating an audit report. Most quotations are flat-fee quotations so you know exactly how much you will be charged. We also request a 50% deposit for audits.

Name, Company, Email & Phone

What is the audit type?

• Internal Audit – This is also called a “1st party audit,” and these are conducted to evaluate the effectiveness of your quality system. You are required to conduct an audit of the full quality system each year. If you select “Internal Audit,” we will assume that you want us to provide an audit quote for your complete quality system. If you only want a partial quality system audit of one or more process areas, then please select “Individual Process” and specify which process or processes in the text box labeled “Process Areas to Audit.”
• Supplier Audit – This is also called a “2nd party audit,” and these are conducted to evaluate the effectiveness of your supplier’s quality system. Other reasons for a supplier audit include verifying compliance with contractual requirements or identifying the root cause of a quality problem (i.e. nonconforming product). Please provide the details of what processes to audit in the text box labeled “Process Areas to Audit.” We generally recommend focusing supplier audits on the activities you are outsourcing (e.g. manufacturing) rather than general quality system requirements (e.g. management review).
• Individual Process Audits – This is also a “1st party audit,” however, we will focus on one or more processes that you identify in the text box labeled “Process Areas to Audit.” This type of audit is ideal when you do not have a qualified auditor that is independent to audit a process. Another scenario where this type of audit is valuable is when you recently made a significant change to a process and you want to verify that the employees are following the new process, or if you want to verify the effectiveness of corrective actions implemented for a specific process. For example, you want to verify the effectiveness of a CAPA related to an FDA 483 or Notified Body Nonconformity. 

Process areas that need auditing

In this text box, we need you to identify the process areas you want us to audit. You can ask us to audit just one process or multiple processes. For example, if you are the Quality Manager and the only qualified lead auditor in your company, you might want us to audit your internal auditing, CAPA, management review, control of documents, and control of records. For a single process audit, we generally recommend remote audits via Zoom in order to eliminate the cost of travel. This is also a great way to test us before you engage our firm for a full-quality system internal audit. This is also known as the “audit scope,” and should not be confused with “audit criteria” discussed below. The scope can also include the location of the audit.

Location (remote or on-site) for auditing services quote

If you want us to conduct the audit remotely via Zoom, please enter “Remote” in the text box of the auditing services quote form. You can also specify another teleconferencing software of your choice. In general, we recommend that remote audits be split into 90-minute segments or less where one or two processes are covered during the 90-minute Zoom meeting. We explain this further in one of our blog articles: “Why remote audit duration should never exceed 90 minutes.” If you want us to conduct the audit on-site, please provide the address of the audit location and we will include the estimated travel costs in our proposal.

Desired Date or Dates

Please enter the date or dates that you want us to conduct your audit. You can also specify before a specific deadline (e.g. before June 30th). If you want us to conduct an audit of multiple processes remotely, it would help to know what dates and or times of day you would prefer. You can also enter a phone number and say “call me” next to the phone number. Then Lindsey or one of our assigned auditors will contact you to schedule a date and time for your audit. 

What is the audit duration in hours?

Please enter the desired duration of the auditing services you want to be quoted. We typically expect at least 30 minutes of audit preparation to review the audit preparation documents that you provide and to create an audit agenda. In addition, we expect to spend approximately two hours of report writing time for each eight-hour day of auditing. Therefore, a typically one-day supplier audit will require a duration of ten hours, while a three-day on-site internal audit will require a duration of 30 hours.

Auditing criteria for auditing services quote

It is important to specify the audit criteria for your auditing services quote, because otherwise, we might assign an auditor that does not have training on that criteria. Audit criteria are the standards, regulations, procedures, and contracts that may be used to evaluate your quality system or an individual process. Most of our audit team is qualified to audit against the following criteria:

• 21 CFR 820, 803, 806, and 830 – the US FDA regulations including medical device reporting, corrections and removals, and unique device identifier regulations
• ISO 13485:2016/Amd 2021 – the international quality system standard for medical device manufacturers
• Regulation (EU) 2017/745 – the European Medical Device Regulations
• SOR 98/282 – the Canadian Medical Devices Regulation
• MDSAP AU P0002.009 – the Medical Device Single Audit Program audit approach guidance document

Below is a countdown clock for our next live-stream YouTube video, as well as the schedule for the new live webinars we are hosting.

Weekly Live-Streaming Topics on YouTube

Our next YouTube Live-streaming video will be:

What Usability Services Do You Offer?

🗓️Thursday, July 9, 2026 @ 12:30 p.m. ET

📌For 2026, we are scheduling our live-streaming on Thursdays at 12:30 pm ET.

Webinars Coming Soon

• July 16, 2026 – How to prepare a Submission Issue Review (SIR) Meeting Request using FDA PreSTAR v3.0 (Live-Streaming)
• July 23, 2026 – What is an FDA Study Risk Determination Q-Sub? (Live-Streaming)

Do you have suggestions for future webinars and live-streaming videos? Visit our Suggestion Portal.

Our latest YouTube shorts.

Human Factors Webinars

• Human Factors Training Series – $950
• Formative Usability Testing Webinar & Template Bundle – $79
• Use Error and Abnormal Use Decision Tree Training – $79
• Use Specification Template & Webinar Bundle – $79
• Known Use Errors Search Webinar – $129
• Task Analysis Template & Webinar Bundle – $129 
• Use-Related Risk Analysis (URRA) Template & Webinar Bundle – $299
• Participant Screening & Data Collection Forms – $79 
• Summative Usability Testing Protocol & Webinar Bundle – $199 
• Summative Usability Testing Report – Live-streaming Free Webinar

Risk Management

• Auditing Risk Management Files – $64.50
• Risk Management Training Webinar for ISO 14971:2019 – $129
• ISO/TR 24971:2020 Guidance on the application of risk management – $129
• Benefit-Risk Analysis Webinar – $79
• Hazard identification webinar – $79 (live on August 29, 2024)

Design Controls

• Design Controls Webinar (Updated for 2024) – $129
• Design Change Webinar (Updated for 2022) – $129
• Design History File (DHF) Webinar (Updated for 2024) –  $129 (September 26, 2024 @ 10:30 a.m. ET)
• Combining Product Risk Management with Design Controls – $129

Quality System Webinars

• ISO 13485 – need training? – Stage 1 & 2 training webinars (Free Refresher Training)
• 21 CFR 820 Training Webinar (new QMSR) – $79
• How to Create a Risk-Based CAPA Process – $129
• How to qualify your suppliers – $129
• Good Documentation Practices “GDP 101”  – $129
• Complaint Handling and Vigilance Reporting – $129

Auditing

• Lead Auditor Training Course for Medical Devices and SaMD – Preorders begin December 1, 2025
• Auditing MDSAP and QSR 4-part Webinar Series – $299
• Remote & Supplier Auditing – $129
• Tool kit for supplier auditing – Forms, templates, etc. – $299
• How to audit using the process approach – $129
• WI-009 FDA Inspection Work Instruction (Webinar Bundle) – $299 (Updated for the QMSR)

MISC Webinars

• How to write Instructions for Use (IFU) Webinar – $129
• Post-Market Surveillance Summary Report Webinar – $129
• IFU Validation and PMS Webinar – $49
• Process Validation: Avoiding Nonconformities, Complaints, FDA 483s and Recalls – $129
• Bioburden Failure Analysis: How auditors can investigate spikes in environmental monitoring – $129
• 7 Steps to Respond to an FDA 483 Inspection Observation – $129
• FDA Medical Device Recalls, Labeling, and 21 CFR 820.120 – $129
• 513g Request Webinar – $149

CE Marking Webinars

• EU MDR Regulation Webinar Series (8-part series) – $825
• CE Marking to UK Market Webinar – for $129
• Technical File Auditing for Compliance with MDR – $129
• FDA Declaration of Conformity (Form 3654) Webinar – $49
• New European Medical Device Regulations Webinar – $129
• Notified Body Unannounced Audit: A Roadmap for Successful Preparation – $64.50
• Preparing for the New Post Market Clinical Follow Up (PMCF) Requirements – updated for Regulation (EU) 2017/745 – $129
• Preparing for New Technical File and Design Dossier Requirements: How to Convert a Class IIb Technical File to a Class III Design Dossier – $129

Canadian Medical Device Licensing

• Canadian Device Licensing Webinar – $49
• Health Canada Medical Device Regulations & CMDCAS Requirements  – $129

If you want to be notified of new webinars another way, including the paid webinars that we do not post on our YouTube channel, please subscribe to our email webinar notification list using the form below:

In addition to the webinars available for purchase on this page, you can also watch videos that we have posted on our YouTube channel. If you are a channel subscriber, you will receive automatic notifications of new YouTube postings on our channel by clicking on the notification bell. The time remaining until our YouTube live-streaming video is shown below, and please don’t forget to email Rob your questions at rob@13485cert.com.

The following is a list of quality and regulatory training webinars that are available for on-demand purchase from this website. If you subscribe to our email notification list using the form on the right, we will notify you by email of any new webinars when we add them to this page. You can also suggest new topics by submitting your idea to the Suggestion Portal.

• What is a CE Mark and how to you apply for certification? – Free
• Cybersecurity Webinar – Free
• Interview with Aaron Moncur – Test Fixture Design – Free
• Interview with Rick Stockton: How to Manage Your a Design FMEA – Free
• Management Review Webinar: Making Your Meetings More Effective – Free
• Create an ISO 13485 Quality Plan – Free
• Audit team communication during a remote audit – Free
• Opening Meetings Webinar – Free if you submit a question
• Is Your Medical Device Startup Missing Out on the R&D Tax Credit? – Free
• Post-Market Clinical Follow-up (PMCF) Mobile App – Free if you submit a question
• Human Factors Testing Webinar – Free if you submit a question
• Traceability Matrix Webinar – Free if you submit a question
• IEC 60601 Standards Status Update Webinar – Free if you submit a question
• Combining Risk and Design Controls – Free if you submit a question
• Factory-CRO Clinical Study Webinar – Free if you submit a question
• How To Perform A CAPA Effectiveness Check and 5 Tools for Root Cause Analysis – Free Download
• 6 Steps to ISO 13485 Certification – Free Download
• Management Review Webinar: Making Your Meetings More Effective – Free Download
• FDA UDI Regulation’s Impact on Medical Device Labelers – Free Download
• MDSAP QMS update webinar to meet country-specific requirements – Free Download

If you received an FDA 483 inspection observation, make sure you watch this training video before sending your response (within 15 days).

What happens if you miss the FDA’s response deadline for an FDA 483 inspection observation?

This is the first step in responding to an FDA 483 inspection observation. You need to identify the response deadline. You have 15 business days, starting from the date you received the FDA Form 483 from the inspector. This does not include weekends or US Federal Holidays. To make sure, you can confirm the date with the inspector by email or during the closing meeting before the inspector leaves. If you miss the deadline, and the inspection outcome is “Official Action Indicated (OAI),” then your company will automatically receive a Warning Letter. You and your company’s top management should take this deadline seriously. Seek immediate regulatory help if you do not have extensive experience writing corrective action plans.

What does this training cover?

Included are examples, recommendations and tips; for implementing the 7 steps, including:

1. Respond within 15 business days
2. Use your CAPA form
3. How to document a root cause investigation
4. Correction and containment
5. Corrective action plans
6. Show you took action
7. Follow up BEFORE the FDA
8. Watch our video…

Other related topics reviewed include: 

• 8 D Process -“8 Disciplines” to be utilized as a model for an effective CAPA process
• Recalls
• Documentation to include in your CAPA record
• Effectiveness checks (examples)
• Trend analysis

This webinar recording is only $129 (AND INCLUDES NATIVE SLIDE POWERPOINT PRESENTATION FILES):

7 Steps to Respond to an FDA 483 Inspection Observation Webinar

This FDA 483 training webinar was recorded on April 5, 2026 by Rob Packard. The webinar includes 32 slides with individual "short" videos embedded into each slide. The video is an unlisted video on our private YouTube channel. Therefore, you do not need to download the video and you can watch it as many times as you want. The full length of the video is approximately one hour long. There is also a free quiz and training certificate available on-demand (delivered by email automatically).

Price: $129.00

How do I get a training certificate for the FDA 483 training webinar?

When you purchase this webinar, you will receive an email with a link for the training video. At the end of the video, there is a slide that provides you with a link to our quiz to verify training effectiveness. The quiz is available on-demand (24/7), and there is no need to download anything. When you submit your answers to the 10 multiple-choice questions, your quiz will be automatically graded, and you will receive the results. If you answer 7 out of 10 questions correctly, you will receive a training certificate. We also have a 10-question quiz for our Risk-Based CAPA webinar.

VIEW OUR PROCEDURES – CLICK HERE OR IMAGE BELOW:

About Your Instructor

Rob Packard is a regulatory consultant with 30+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a UConn graduate in Chemical Engineering. Rob was a senior manager at several medical device companies, including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certifications. From 2009 to 2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Rob’s specialty is regulatory submissions for high-risk medical devices, including implants and drug/device combination products for CE marking applications, Canadian medical device license applications, and 510(k) submissions. The favorite part of his job is training others. He can be reached via phone at +1.802.258.1881 or by email. You can also follow him on YouTube, LinkedIn, or Facebook.

This CAPA training webinar explains how to create a risk-based CAPA process, and you will learn how to implement corrective and preventive actions step-by-step.

When is CAPA Training?

The CAPA training webinar for risk-based CAPA was recorded on June 30, 2020. Everyone who purchases the webinar will receive a link to download the recording and a copy of the native slide deck. We also created a 20-question quiz to verify the training effectiveness. When you purchase the webinar, you will receive links for the slide deck, recording, and the quiz. Upon successful completion of the quiz, you will receive an email that includes your training certificate.

This CAPA training recording is only $129 (AND INCLUDES NATIVE SLIDE POWERPOINT PRESENTATION FILES):

Create a Risk-Based CAPA Process

How to Create a Risk-Based CAPA Process. This webinar includes the most recent updates to ISO 13485:2016, ISO 9001:2015, and ISO 14971:2019.

Price: $129.00

Do you also need a CAPA Procedure?

Companies that receive a non-conformity or FDA 483 inspection observation often need a new CAPA procedure as well as CAPA training. Our CAPA procedure, and all of our quality system procedures, are risk-based. Specifically, we use the GHTF grading system to score CAPAs in the same numeric scoring system used for MDSAP audit findings. Therefore, this is the perfect CAPA procedure and form for ISO 13485 certification and MDSAP certification. The CAPA procedure also includes a webinar, but the webinar focus is specific to implementing the procedure and customizing it for your company. In contrast, this risk-based CAPA training webinar explains the details of performing a CAPA investigation, identifying the root cause, writing a corrective action plan, and performing effectiveness checks.

Description of the CAPA training webinar on how to create a risk-based CAPA process

A risk-based CAPA process is a common goal of medical device manufacturers, but until recently “risk-based” was not clearly defined. The two quality management system standards, ISO 9001 and ISO 13485 were revised and re-issued. The current versions are: ISO 9001:2015 released in October 2015 and ISO 13485:2016  released in February 2016. The biggest fundamental change in both standards is an emphasis on risk-based process management. The CAPA process is the heart of your quality system and one of the most important processes. Therefore, this CAPA training gives you a whole new set of tools for managing your CAPA process using a risk-based approach.

A risk-based CAPA process is more than prioritization

This CAPA training goes beyond simple prioritization of CAPAs and color-coding of CAPAs as high, medium, and low risks. Instead, Rob Packard reviews best practices in risk management (i.e., ISO 14971:2019 and ISO/TR 24971:2020) and he applies the more rigorous risk management process to the CAPA process.

This is a “must-see” presentation for anyone that is responsible for the CAPA process or participates in their company’s CAPA Board. Register for our CAPA training and our speaker will help you integrate risk management activities with your CAPA process.

This CAPA training includes:

• Revised requirements for ISO 9001:2015 and ISO 13485:2016
• An outline of the CAPA process and proposed risk management activities
• Various risk control options that can be integrated with corrective actions
• How to reconcile conflicts between the definitions for risk in ISO 9001:2015 and ISO 13485:2016
• Root Cause Analysis Tools
• 5 Why Analysis
• Is/Is Not Analysis
• Fishbone diagrams
• Brainstorming
• Pareto analysis
• Effectiveness checks
• Sources of corrective and preventive actions
• Pareto analysis of service issues
• Trending CAPAs, average aging of CAPAs, “Death by CAPA”
• Risk Management: risk-based CAPAs, risk thresholds, 7 criteria for estimating risk
• Documenting CAPAs
• How to write an effective CAPA SOP
• Auditing the CAPA process
• Problem-solving A3 reports
• Key elements of CAPA forms

VIEW OUR PROCEDURES – CLICK HERE OR IMAGE BELOW:

About Your Instructor

Rob Packard is a regulatory consultant with 30+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Rob was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certifications. From 2009 to 2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Rob’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510k submissions. The most favorite part of his job is training others. He can be reached via phone at +1.802.258.1881 or by email. You can also follow him on YouTube, LinkedIn, or Instagram.

Learn how to become ISO 13485 certified while avoiding the stress that tortures other quality system managers.

What is ISO 13485?

ISO 13485 is an international standard for quality management systems that is specific to the medical device industry. ISO 13485:2016 is the most recent version of the standard, and it has become the blueprint for medical device company quality systems globally. If your company wants to design, manufacture, or distribute medical devices, you should consider becoming ISO 13485 certified.

Do you have to purchase a copy of ISO 13485?

Yes, you need to maintain a copy of the ISO 13485 standard as a “document of external origin.” This is needed for reference when you are making updates to procedures in your quality system. If you are looking for the best place to purchase a copy of the ISO 13485:2016 standard, we recommend the Estonian Centre for Standardisation and Accreditation. If you purchase a copy, we recommend selecting the option for a multi-user license so the standard can be used by more than one person in your company and printed. The only difference between the EN ISO version and the International ISO version is that the EN ISO version includes harmonization Annex ZA for compliance with the EU MDR and Annex ZB for compliance with the EU IVDR. This version is also referred to as A11:2021. Here’s a copy of the text from the beginning of the Standard:

“This Estonian standard EVS-EN ISO 13485:2016/A11:2021 consists of the English text of the European standard EN ISO 13485:2016/A11:2021. This standard has been endorsed with a notification published in the official bulletin of the Estonian Centre for Standardisation and Accreditation. Date of Availability of the European standard is 08.09.2021. The standard is available from the Estonian Centre for Standardisation and Accreditation.”

There is a big difference between being ISO 13485 certified and being compliant with ISO 13485:2016, the medical devices quality management systems standard. Anyone can claim compliance with the standard. Certification, however, requires that an accredited certification body has followed the requirements of ISO 17021:2015, and they have verified that your quality system is compliant with the standard. To maintain that certification, you must maintain your quality system’s effectiveness and endure both annual surveillance audits and a re-certification audit once every three years.

Step 1 – Planning for ISO 13485 certification

There are six steps in the ISO 13485 certification process, but that does not mean there are only six tasks. The first step in every quality system is planning. Most people refer to the Deming Cycle or Plan-Do-Check-Act (PDCA) Cycle when they describe how to implement a quality system. However, when you are implementing a full quality system, you need to break the “doing” part of the PDCA cycle into many small tasks rather than one big task. You also can’t implement a quality system alone. Quality systems are not the responsibility of the quality manager alone. Implementing a quality system is the responsibility of everyone in top management.

Below you will find seven tasks listed. I did NOT identify these nine tasks as “Steps” in the ISO 13485 certification process, because these tasks are typically repeated for each process in your quality system. Most quality systems are implemented over time, and the scope of the quality system usually grows. Therefore, you are almost certain to have to perform all of the following nine tasks multiple times–even after you receive the initial ISO 13485 certification. As the saying goes, “How do you eat an elephant? One bite at a time.” Therefore, avoid the inevitable heartburn caused by trying to do too much at one time. Implement your quality system one “bite” at a time.

Task 1 – Purchase applicable standards

The first task in implementing an ISO 13485 quality system is to purchase a copy of the ISO 13485:2016 standard, such as the MDSAP Audit Approach document. You will also need other applicable medical device standards. Some of these standards are general standards that apply to most, if not all, medical devices, such as ISO 14971:2019 for risk management. There are also guidance documents that explain how to use these general standards, such as ISO/TR 24971:2020, and guidance on how to apply ISO 14971:2019. Finally, there are testing standards that identify testing methods and acceptance criteria for things such as biocompatibility and electrical safety. You will need to monitor these standards for new and revised versions. When these standards are updated, you will need to identify the revised standard and develop a plan for addressing the changes.

When you purchase a standard, be sure to buy an electronic version of the standard so you can search the standard for keywords efficiently. You should also consider purchasing a multi-user license for the standard because every manager in your company will need to look up information in the standard. Alternatively, you could buy a paper copy of the standard and locate the standard where everyone in your company can access it. Often I am asked what the difference is between the EN version of the standard and the ISO version of the standard. “EN” is an abbreviation meaning European Standards or “European Norms,” which is based upon the literal translation from the French (i.e., “normes”) and German (i.e. “norm”) languages. “ISO” versions are international standards. In general, the body of the standard is typically identical but harmonized EN standards for medical devices include annexes ZA, ZB, and ZC that identify any deviations from the requirements in three medical device directives (i.e., MDD, AIMD, and IVDD).

Task 2 – Identify which processes are applicable

Clause 1 of ISO 13485 is specific to the scope of a quality system. ISO 9001, the general quality system standard, allows you to “exclude” any clause from your quality system certification. However, ISO 13485 will only allow you to exclude design controls (i.e., clause 7.3). Other clauses within ISO 13485 may be identified as “non-applicable” based on the nature of your medical device or service. You must also document the reason for non-applicability in your quality manual. Typically, the following clauses are common clauses identified for non-applicability:

1. Clause 4.1.6 – quality system software
2. Clause 6.4 – work environment
3. Clause 7.5.2 – cleanliness of the product
4. Clause 7.5.3 – installation
5. Clause 7.5.4 – servicing
6. Clause 7.5.5 – sterile devices
7. Clause 7.5.6 – process validation
8. Clause 7.5.7 – sterilization validation
9. Clause 7.5.9.2 – implantable devices
10. Clause 7.5.10 – customer property
11. Clause 8.3.4 – rework

Task 3 – Assign a process owner to each process 

The third task is to assign a process owner to each of the processes in your quality system. Typically, you create a master list of each of the required processes. Usually, the assignments are made to managers in the company who may delegate some or all of a specific process. You should expect most managers to be responsible for more than one process because there are 28 required procedures in ISO 13485:2016, but most companies have fewer than ten people when they first implement a quality system.

Task 4 – Prioritize and schedule the implementation of each process

The fourth task is to identify which processes need to be created first and to schedule the implementation of procedures from first to last. You can and should build flexibility into the schedule, but some procedures are needed at the beginning. For example, you need document control, record control, and training processes to manage all of your other procedures. You also need to implement the following processes to document your Design History File (DHF): 1) design controls, 2) risk management, 3) software development (if applicable), and 4) usability. Therefore, these represent the seven procedures that most companies will implement as early as possible. Procedures such as complaint handling, medical device reporting, and advisory notice procedures are usually reserved for last. These procedures are last because they are not needed until you have a medical device in use.

Task 5 – Create forms, flowcharts, and procedures for each process

Forms create the structure for records in your quality system, and a well-designed form can reduce the need for lengthy explanations in a procedure or work instruction. Therefore, you should consider developing forms first. The form should include all required information that is specified in the applicable standard or regulations, and the cells for that information should be presented in the order that the requirements are listed in the standard. You might even consider numbering the cells of the form to provide an easy cross-reference to the corresponding section of the procedure. Once you create a form, you might consider creating a flowchart next. Flowcharts provide a visual representation of the process. You might consider including numbers in the flow chart that cross-reference to the form as well.

Once you have created a form and a flowchart, you are now ready to write your quality system procedure. Many sections are typically included in a procedure template. It is recommended that you use a template to ensure that none of the basic elements of a procedure are omitted. You might also consider adding two sections that are uncommon to a procedure: 1) a risk analysis of the procedure with the identification of risk controls to prevent risks associated with the procedure, and 2) a section for monitoring and measurement of the process to objectively measure the effectiveness of the process. These metrics are the best sources of preventive actions, and some of the metrics might be potential quality objectives to be identified by top management. 

Task 6 – Perform a gap analysis of each procedure

Most companies rely upon internal audits to catch missing elements in their procedures. However, audits are intended to be a sampling rather than a 100% comprehensive assessment. Therefore, when a draft procedure is being reviewed and approved for the first time, or a major rewrite of a procedure is conducted, a thorough gap analysis should be done before the approval of the draft procedure. Matthew Walker created an article explaining how to conduct a gap analysis of procedures. In addition, Matthew has been gradually adding cross-references to ISO 13485:2016 requirements in each procedure. He is color-coding the cross-referenced clauses in blue font as well. This makes it much easier for auditors to verify that a procedure is compliant with the regulations with minimal effort. The success of these two methods has taught us the importance of conducting a gap analysis of all new procedures.

Task 7 – Train applicable personnel for each process 

You are required to document the training requirements for each person or each job in your company. Documentation of training requirements may be in a job description or within a procedure. In addition to defining who should be trained, you also need to identify what type of training should be provided. We recommend recording your training to ensure that new future employees receive the same training to ensure consistency. Design controls training should be the first priority. You are also required to maintain records of the training. You must verify that the training was effective, and you need to check whether the person is competent in performing the tasks. This training may require days or weeks to complete. Therefore, you may want to start training people several weeks before your procedure is approved. Alternatively, you can swap the order of tasks and conduct training after the procedure approval. If that approach is taken, then the procedure should indicate the date the procedure becomes effective–typically 30 days after approval to allow time for training.

Task 8 – Approve the procedure 

Approval of a procedure may be accomplished by signing and dating the procedure itself, while another approach is to create a document that lists all the procedures and forms being approved at one time. The second method is the method we use in our turnkey quality system. Companies can review and approve as many procedures at one time as they wish. Since this process needs to be defined to ensure that all of the procedures you implement are approved, the document control process is typically the first procedure that companies will approve in a new quality system. The second procedure generally is for the control of records. Then the next procedures implemented will typically be focused on the documentation of design controls, risk management, usability testing, and software development. The last procedures to be approved are typically complaint handling, medical device reporting, and recalls. These procedures are left for last because you don’t need them until you are selling your medical device.

Task 9 – Start using the procedure and generating records

The last task required for the implementation of a new quality system is to start using the procedures to generate records. All of the procedures will need records before the process can be verified to be effective. Records can be paper-based, or the records can be electronic. Whichever format you use for the record retention needs to be communicated to everyone in the company through your Control of Records procedure and/or within each procedure. If you include the information in each procedure, the records of each procedure should be listed in the procedure, and the location where those records are stored should be identified. Generally, there is no specific minimum number of records to have for a certification audit, but you should have at least a few records for each process that you implement.

Step 2 – Conducting your first internal audit

The purpose of the internal audit is to verify the effectiveness of the quality system and to identify nonconformities before the certification body auditor finds them. To successfully achieve this secondary objective, it is essential to have a more rigorous internal audit than you expect for the certification audit. Therefore, the internal audit should be of equal duration or longer in duration than the certification audit. The internal audit should not consist of a desktop review of procedures. Reviewing procedures should be part of gap analysis (i.e., task 6 above) that is conducted on draft procedures before they are approved. Internal audits should utilize the process approach to auditing, and the auditor should apply a risk-based approach (i.e., focus on those processes that are most likely to contribute to the nonconforming products, result in a complaint, or cause severe injuries and death).

After your internal audit, you will receive an internal audit report from the auditor. You should also expect findings from the internal auditor, and you should expect opportunities for improvement (OFI) to be identified. Experienced auditors can typically identify the root cause of a nonconformity more quickly than most process owners. Therefore, it is recommended for each process owner and subject matter expert to review nonconformities with the auditor and discuss how the nonconformity should be investigated. The root cause must be correctly identified during the CAPA process, and the effectiveness check must be objective to ensure that problems do not recur.

Step 3 – Initiating corrective actions

Corrective actions should be initiated for each internal audit finding immediately, to make sure the findings are corrected and prevented from repeat occurrence before the Stage 1 audit. It will take a minimum of 30 days to implement the most corrective actions. Depending upon the scheduling of the internal audit, there may not be sufficient time to complete the corrective actions. However, you should at least initiate a CAPA for each finding, perform an investigation of the root cause, and begin to implement corrective actions.

Also, to take corrective actions related to internal audit findings, you should look for internal audits from other sources. The diagram below shows several different sources of potential corrective and preventive actions.

Monitoring and measuring each process is the best source of preventive actions, while internal audits are typically the best source of corrective actions.  Any quality problems identified during validation are also excellent sources of corrective actions because the validation can be repeated as a method of demonstrating that the corrective actions are effective. However, your ISO 13485 certification auditor will focus on non-conforming products, complaints, and services as the most critical sources of corrective actions. These three sources are prioritized because these three sources have the greatest potential for resulting in serious injury, death, or recall if corrective actions are not implemented to prevent problems from recurring.

Step 4 – Conducting your first management review 

In addition to completing a full quality system audit before your stage 1 audit, you are also expected to complete at least one management review. To make sure that you have inputs for each of the 12 requirements in the ISO 13485:2016 standard, it is recommended to conduct your management review only after you have completed your full quality system audit and initiated some corrective actions. If possible, you should also conduct supplier audits for any contract manufacturers or contract sterilizers. It is recommended to use a template for that management review that is organized in the order of the required inputs to ensure that none of the necessary inputs are skipped. Quality objectives will need to be established long before the management review so that the top management team has sufficient time to gather data regarding each of the quality objectives. Also, you should consider delegating the responsibility for creating the various slides for each input to different members of top management. This will ensure that everyone invited to the meeting is engaged in the process, and it will spread the workload for meeting preparation across multiple people.

At the end of the meeting, top management will need to create a list of action items to be completed before the next management review meeting. Meeting minutes will need to be documented for the meeting, including the list of action items and each of the four required outputs of the management review process. We recommend using the notes section of a presentation slide deck to document the meeting minutes related to each slide. Then the slide deck can be converted into notes pages and saved as a PDF. The PDF notes pages will be your final meeting minutes for the management review. An example of one of these note pages is provided in the figure below.

One of the more common non-value-added findings by auditors is when an auditor issues a nonconformity because you do not have your next internal audit and your next management review scheduled–even though each may have occurred only a month prior to the Stage 1 audit. Therefore, we recommend that you document your next 12-month cycle for internal audits and schedule your next management review as action items in every management review meeting. The schedule can be adjusted if needed, but this allows top management to emphasize various areas in internal audits that may need improvement. You might even set a quality objective to conduct a minimum of three management reviews per year at the end of your first management review.

Step 5 – Stage 1, Initial ISO 13485 Certification Audit

In 2006, the ISO 17021 Standard was introduced for assessing certification bodies. This is the standard that defines how certification bodies shall go about conducting your initial certification audit, annual surveillance of your quality system, and the re-certification of your quality system. In the past, certification bodies would typically conduct a “desktop” audit of your company before the on-site visit to make sure that you have all the required procedures. However, ISO 17021 requires that certification bodies conduct a Stage 1 audit that assesses the readiness of your company before conducting a Stage 2 audit. Therefore, even if the Stage 1 audit is conducted remotely, the certification body is expected to interview process owners and sample records to verify that the quality system has been implemented. Certification body auditors will also typically verify that your company has conducted a full quality system audit and at least one management review. Finally, the auditor will usually select a process such as corrective action and preventive action (CAPA) to make sure that you are identifying problems with the quality system and taking appropriate measures to address those problems.

Your goal for the Stage 1 audit should not be perfection. Instead, your focus is to make sure that there are no “major” non-conformities. The term “major” used to have a specific definition:

1. Absence of a documented procedure or process
2. Release of nonconforming product
3. Repeat nonconformities (not possible during Stage 1)

Under the MDSAP, the grading system for nonconformities now uses a numbering system for grading nonconformities: “Nonconformity Grading System for Regulatory Purposes and Information Exchange Study Group 3 Final Document GHTF/SG3/N19:2012.” Any nonconformity is graded on a scale of one to four, and then two potential escalation rules are applied. If any nonconformities are graded as a four or a 5, then the auditor must assess whether a five-day notice to Regulatory Authorities is required. A five-day notice is required in either of the following situations: 1) one or more findings grading of “5”; or 2) three or more findings graded as “4.” If your Stage 1 audit results in a five-day notice, then you are not ready for your Stage 2 audit. For example, a complete absence of two required procedures in clauses 6.4 through 8.5 of ISO 13485:2016 would result in two findings with a grading of “4.” This would not result in a five-day notice, but the absence of a third required procedure would result in a five-day notice.

The duration of your Stage 1 audit will be one or two days, but a 1.5-day audit is quite common for MDSAP Stage 1 audits. The reason for the 1.5-day Stage 1 audit is that it is challenging to assess readiness for Stage 2 in one day, and if the total duration of Stage 1 and Stage 2 is 5.5 days, then the Stage 2 audit could be completed in four days. The four-day audit is more convenient than a three-day audit for a two-person audit team.

After your Stage 1 audit, you will receive an audit report, and you should expect findings. You should initiate corrective actions for each finding immediately, to make sure the findings are corrected and prevented from repeat occurrence before the Stage 2 audit. The duration between the audits is typically about 4-6 weeks. That does not leave much time for you to initiate a CAPA, perform an investigation of the root cause, and implement corrective action. At a minimum, you must submit a corrective action plan for each finding to your MDSAP auditing organization (AO) within 15 calendar days of receiving the finding. For any findings graded as a “4” or higher, you will need to provide evidence of implementing the corrective action plan to the AO within 30 calendar days of receiving the finding. You are also unlikely to have enough time to conduct an effectiveness check prior to the Stage 2 audit.

Step 6 – Stage 2, Initial ISO 13485 Certification Audit

The Stage 2 initial ISO 13485 certification audit will verify that all regulatory requirements have been met for any market you plan to distribute in. The auditor will complete an MDSAP checklist that includes all of the regulatory requirements for each of the countries that recognize MDSAP: 1) the USA, 2) Canada, 3) Brazil, 4) Austria, and 5) Japan. The auditor will also sample records from every process in your quality system to verify that the procedures and processes are fully implemented. This audit will typically be at least four days in duration unless multiple auditors are working in an audit team.

The audit objectives for the Stage 2 ISO 13485 certification audit specifically include evaluating the effectiveness of your quality system in the following areas:

1. Applicable regulatory requirements
2. Product and process-related technologies
3. Technical documentation

All procedures will be reviewed for compliance with ISO 13485:2016 and the applicable regulations. The auditor will also sample records from each process. If the auditor identifies any nonconformities during the audit, it is important to record the findings and begin planning corrective actions immediately. If you have any questions regarding the expectations for the investigation of the root cause, corrections, corrective actions, and effectiveness checks, you should ask the auditor during the audit or the closing meeting. At a minimum, you must submit a corrective action plan for each finding to your MDSAP auditing organization (AO) within 15 calendar days of receiving the finding. For any findings graded as a “4” or higher, you will need to provide evidence of implementing the corrective action plan to the AO within 30 calendar days of receiving the finding. The auditor will not be able to recommend you for ISO 13485 certification until your corrective action plans are accepted.

If you receive a finding with a grading of “5,” or three or more findings graded as “4,” then the MDSAP auditor is required to issue a five-day notification to the regulators. The auditor will also need to return to your facility for a follow-up audit to close as many findings as they can. It is not necessary to eliminate all of the findings in order to be recommended for ISO 13485 certification, but the grading of the findings must be reduced to at least a “3” before recommending the company for certification. The number of findings also determines whether the auditor recommends your company for certification.

In addition to reviewing the findings and conclusions of the audit during the closing meeting, the auditor will also review the plan for the annual surveillance and re-certification with you. Each certification cycle is three years in duration. There will be two surveillance audits of approximately one-third of the duration of the combined duration of stage 1 and stage 2 initial certification audits, and the first surveillance audit must be completed within 12 months of the initial certification audit. In the third year, there will be a re-certification audit for two-thirds of the duration of the combined duration of stage 1 and stage 2 initial certification audits. The initial ISO 13485 certificate will be issued with a three-year expiration, and the certificate is typically received about one month after the acceptance of your corrective action plan.

Q&A

There are no stupid questions, and we can save you weeks of wasted time if you just ask for help. We are always looking for new ideas for blogs, webinars, and videos on our YouTube channel. If you have any general questions about obtaining ISO 13485:2016 certification, please email Rob Packard at rob@fdaestar.com. If you have a suggestion for new ISO 13485 training materials, you can also use our “Suggestion Portal.” You can also schedule an initial free consultation with Rob using his calendly link.

About Your Instructor

Rob Packard is a regulatory consultant with 30+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Rob was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certifications. From 2009 to 2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Rob’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510k submissions. The most favorite part of his job is training others. He can be reached via phone at +1.802.258.1881 or by email. You can also follow him on YouTube, LinkedIn, or Instagram.

90% of usability testing submitted to the FDA is unacceptable and the root cause is simply a failure to understand the human factors process.

Human factors process inadequate?

If you submitted no usability testing to the FDA in your 510(k) submission, it would be obvious why the FDA reviewer identified usability as a major deficiency. However, you spent tens of thousands of dollars on usability testing that delayed the 510(k) submission by six months. Despite all of the time and money your company invested in the human factors process, it appears that you need to start over and repeat the entire process again. The CEO is furious, and he wants you to show him where in the 49-page FDA guidance it says that you have to do things differently.

Benefits from the human factors process

1. Use errors result in serious injuries and death
2. Easy-to-use products sell
3. You will prevent delays in regulatory approval

Why was your rationale for no usability testing rejected?

Unlike CE Marking technical files, the FDA does not require a usability engineering file for all products. Instead, the FDA determines if usability testing is required based on a comparison of your device’s user interface and a competitor’s user interface (i.e. predicate device user interface). If the user interface is identical, then usability testing may not be required. Instead, your company should be able to write a rationale for not doing usability testing based on equivalence with the predicate device. If there are differences in your user interface, you will need to provide use-related risk analysis (URRA), identify critical tasks, implement risk controls, and provide verification testing to demonstrate the effectiveness of the risk controls. Even if your device is “easier to use” or “simpler”, you still need to provide the documentation to support this claim in your submission. The FDA also does not allow comparative claims in your marketing for 510(k) cleared devices. Comparative claims require the support of clinical data.

What is the 10-step human factors process?

1. Define human factors for your device or IVD
2. Identify use errors
3. Conduct a use-related risk analysis (URRA)
4. Perform a critical task analysis
5. Conduct a risk control option analysis
6. Conduct formative usability testing
7. Implement risk controls
8. Conduct summative usability testing
9. Prepare HFE/UE documentation
10. Collect post-market surveillance data specific to use errors

There is a YouTube video describing these 10 steps at the bottom of this blog posting.

Usability Engineering & Human Factors Training Webinars

• Human Factors Training Series – $950
• Formative Usability Testing Webinar & Template Bundle – $79
• Use Error and Abnormal Use Decision Tree Training – $79
• Use Specification Template & Webinar Bundle – $79
• Known Use Errors Search Webinar – $129
• Task Analysis Template & Webinar Bundle – $129 
• Use-Related Risk Analysis (URRA) Template & Webinar Bundle – $299
• Participant Screening & Data Collection Forms – $79 
• Summative Usability Testing Protocol & Webinar Bundle – $199 
• Summative Usability Testing Report – Live-streaming Free Webinar

Why is formative testing needed?

• Observational study to identify unforeseen use errors
• Observational study to evaluate risk control options
• What are the other types of studies?
• Development of indications for use
• Development of training materials

Why is the human factors process crazy expensive to outsource?

• Human factors consultants need time to learn about your device
• Consultants are more conservative because they cannot afford to fail
• Justifying your choice of risk controls is difficult because you started too late
• Your instructions for use (IFU) are inadequate
• Consultants need to explain the human factors process to you
• Recruiting subjects is marketing (which may not be their expertise)
• You are paying for infrastructure (specialized testing facilities)
• This is a team effort that requires many consulting hours collectively

Why was your Usability Engineering File refused?

1. Your company provided an application failure modes and effects analysis (aFMEA) to support your justification that residual risks are acceptable. The FDA guidance suggests using risk analysis tools such as an FMEA or fault-tree analysis, but deficiency letters from FDA reviewers recommend a use-related risk analysis (URRA) format that is totally different.

   

   The primary problem with using an FMEA or Fault-Tree risk analysis tool is that these tools involve the estimation of the severity of harm and the probability of occurrence of harm, while the FDA does not feel it is appropriate to estimate the probability of occurrence of harm. Instead, the FDA instructs companies to assume that use errors will occur and to implement risk controls to mitigate those risks (see URRA example above). Although “mitigation” is unlikely, and use risks will only be reduced, this is the approach the FDA wants companies to use. In addition, the FDA expects your company to provide traceability of risk control implementation to each use-related risk you identified and the FDA expects documentation of verification testing (i.e. usability testing) that shows your risk controls are effective. Finally, the FDA (and ISO 14971, Clause 10) expects you to collect and perform a trend analysis of use errors. Any use errors that are reported should be evaluated for the need to implement additional corrective actions to prevent future use errors. Blaming “user error” is not an acceptable approach. 

2. You provided risk analysis and human factors testing in your 510(k) submission, but the FDA reviewer said you need to identify critical tasks and provide traceability to each critical task in your summative validation report. – Critical tasks are specifically mentioned in section 3.2 of the FDA guidance on applying human factors and usability engineering–and a total of 49 times throughout the guidance. However, “critical tasks” are not mentioned even once in ISO 14971:2019 or ISO/TR 24971:2020. The term “critical tasks” is not even found in IEC 62366-1:2015. There is mention of “tasks”, and “task” is a formal definition (i.e. Definition 3.14, “Task – one or more USER interactions with a MEDICAL DEVICE to achieve a desired result”). Therefore, companies that are familiar with the ISO Standards and CE Marking process frequently need training on the FDA requirements for the human factors process. After receiving training, then your company will be prepared to modify your usability engineering file documentation to comply with the FDA requirements for human factors.
3. You completed a summative validation protocol, but the FDA disagrees with your definition of user groups. – Each user has a different level of experience, training, and competency. Therefore, if you define the intended user population too broadly (e.g. healthcare practitioners), the FDA may not accept your summative usability testing. This is the reason that the human factors process begins with defining the human factors for your IVD or device. Radiologists, for example, have the following training pathway:
   • graduate from medical school;
   • complete an internship;
   • pass state licensing exam;
   • complete a residency in radiology;
   • become board certified; and
   • complete an optional fellowship.

Therefore, if you are developing imaging software, you need to make sure your user group includes radiologists that cover the entire range of competencies. In addition, most radiology images are taken by radiology technicians and then reviewed by the radiologist. Therefore, radiology technicians should be considered a completely different user group due to the differences in experience, training, and competency when compared to a radiologist. This simple example doubles the number of users needed because you have two user groups instead of one.

1. You evaluated 15 users, but the FDA reviewer is asking you to evaluate a larger number of users based on a special controls guidance document. – The FDA guidance on human factors testing specifies a minimum of 15 users for each user group–not a minimum of 15 users. Therefore, for a device that is for Rx-only and OTC use, you will have at least two user groups that need to be evaluated independently. In addition, some devices have special controls guidance documents that specify usability testing requirements. For example, an OTC blood glucose meter must pass a 350-person lay-user study. Covid-19 self-tests are expected to pass a 30-person lay-user study as another example.
2. Your usability study was conducted in Australia, but the FDA insists that your usability study must be repeated in the USA. – Most people think of language being the primary difference between two countries, and therefore the author of a study protocol may not perceive any difference between the USA and Australia, Ireland, Canada, or the UK. However, this lack of ability to identify differences between cultural norms shows our own ignorance of cultural differences. International travelers learn quickly about the differences in the interface used for electrical outlets between the USA and other countries. There are also more subtle differences between cultures, such as in which direction do you toggle a light switch to turn on a light, up or down? For devices that are used in a hospital environment, it is critical to understand how your device will interact with other devices and how different hospital protocols might impact human factors.
3. The FDA reviewer indicated that your usability engineering file does not assess the ability of laypersons to self-select whether your OTC device is appropriate for them. – Devices and IVD devices may have contraindications or indications for use that are specific to an intended patient population or intended user population. In these cases, the user of the device or IVD needs to be able to “self-select” as included or excluded from use. The ability to self-select should be assessed as part of any OTC usability study. The ability to identify suitable and unsuitable patients for treatment is also a common criterion for a usability study involving prescription devices where a physician is the subject of the study.
4. The FDA reviewer indicated that you did not provide raw data collected by the study moderator. – Data collected during a human factors study is usually subjective in nature, and the FDA may want to conduct its own review and analysis of your data. Therefore, you cannot provide only a testing report that summarizes the results of your study. You must also provide the raw data for the study. It is permitted to provide the data in a tabular format that has been transcribed from paper case report forms or was recorded electronically. You should also consider scanning any paper forms for permanent retention or retaining the paper forms in case there is any question of accuracy in the transcription of the data collected. Finally, it is best practice to record videos of the study participants performing each task and answering interview questions. This will help in filling any gaps in the notes recorded by the moderator, and the recording provides additional objective evidence of the study results.
5. The FDA reviewer indicated that your study is not valid, because the training provided by moderators was not scripted and training decay was not considered in the design of the study. – Summative usability testing requires that users complete all of the critical tasks identified in your critical task analysis without assistance. It is permitted to provide training to the user prior to conducting the study if the device or IVD is for prescription use and healthcare practitioners are responsible for providing instruction to the user. However, any training provided must be scripted in advance and approved as part of the summative usability testing protocol. This ensures that every subject in the study receives consistent training. Unfortunately, the FDA may still not be satisfied with the design of your study if you do not allow sufficient time to pass between the time that training is provided to the user and when the subject uses the device or IVD for the first time. In general, one hour is the minimum amount of time that should pass between providing user training and when the device or IVD is used for the first time. This is referred to as “training decay” and the duration of time between your scripted training and the user performing critical tasks for the first time should be specified in your summative usability protocol. One solution to address both issues is to provide a video of the instructions to each subject 24-hours in advance of participation in the study.

Additional resources for the human factors process and usability testing

• IEC 62366-1:2015
• FDA guidance
• SYS-048
• human factors testing webinar
• 10x 2023 Slide Deck