quality-manager-qms-iso13485

Start with a gap analysis against ISO 13485:2016 clauses, prioritize gaps by regulatory criticality and risk, then build a Quality Manual defining QMS scope and process interactions. Deploy the mandatory documented procedures for document control, records, internal audit, nonconformity, and CAPA with training.

Run the qms_audit_checklist.py script with a clause flag like --clause 7.3, a process flag like --process design-control, or --audit-type system for full coverage. It outputs text or JSON checklists with audit questions for every ISO 13485:2016 clause.

ISO 13485:2016 mandates documented procedures for document control (4.2.3), record control (4.2.4), internal audit (8.2.4), nonconforming product control (8.3), corrective action (8.5.2), and preventive action (8.5.3). Each must define approval, implementation, and record-keeping requirements.

Findings are classified as Major NC for system absence or breakdown requiring CAPA within 30 days, Minor NC for single lapses requiring CAPA within 60 days, and Observations for potential risks tracked in the next audit. Classification drives response timelines and escalation.

Validation is required when process output cannot be verified by inspection or deficiencies appear only in use, such as sterilization, welding, sealing, and software processes. It follows IQ, OQ, and PQ phases with documented protocols, acceptance criteria, and revalidation triggers.

Device Master Records, Device History Records, and Design History Files must be kept for the life of the device plus two years per 21 CFR 820. Audit and CAPA records are typically retained seven years, and training records for employment plus three years.