How do MedTech and IVD manufacturers achieve ISO 13485 certification without delays in the audit?
We guide medical device and IVD companies through the complete path to ISO 13485:2016 certification: from the gap analysis through building the quality management system and the internal audit to the certification audit conducted by the accredited certification body. The real stumbling block is rarely the standard itself, but the sequence: those who first implement processes for real and only then schedule the internal audit enter the certification audit without the nonconformities that would otherwise force a second round of auditing.
- MedTech
- IVD
Overview
Why is ISO 13485 effectively mandatory for MedTech and IVD manufacturers?
Support from the gap analysis to the certificate · ISO 13485:2016, aligned with MDR (EU 2017/745) and IVDR (EU 2017/746)
Last updated: 2026-06-13
ISO 13485:2016 is the international standard for quality management systems in the medical device industry. Legally it is not mandatory, but in practice it is the prerequisite for EU market access. The points where it makes or breaks the case:
- Notified bodies require a certified QM system in accordance with ISO 13485:2016 as the basis for conformity assessment under MDR (EU 2017/745) and IVDR (EU 2017/746); without this foundation, CE certification of the product cannot be achieved.
- Distributors, importers, and OEM partners increasingly demand proof of certification as a condition for supplier qualification; without a certificate, tenders and partnerships are lost.
- The ISO 13485:2016 QM system requires proof of processes that are actually applied, not merely documented; in the audit, the certification body assesses real-world application, not just the existence of the procedures.
- Risk management in accordance with ISO 14971 is closely interlinked with ISO 13485 through the QM system; a QMS without a robust risk management process stands out in the audit.
Services
How we support you
Gap analysis against ISO 13485:2016
A complete target-versus-actual comparison of the existing QM status against the requirements of ISO 13485:2016. The outcome is a prioritized gap report with an action list, a realistic timeline, and resource requirements.
QMS setup & documentation
Building all required QMS elements in accordance with ISO 13485:2016: process landscape, procedural instructions, quality manual, forms, and records. We provide document templates and tailor them to your specific organization.
QMS training & roll-out
Training the staff affected on the new processes with the goal of lasting integration into daily operations, not merely audit preparation. Building internal audit competence for your own QM system.
Internal audit & certification audit
Conducting a complete internal audit before the external audit, coordinating the accredited certification body, and supporting the certification audit through to closing out the findings and obtaining the certificate.
Learn more →Integration with ISO 9001
Building an integrated QM system that covers ISO 13485:2016 and ISO 9001 together, so that an integrated audit of both standards becomes possible instead of two separate certifications.
Surveillance & recertification
Support for the annual surveillance audits over the term of the certificate and preparation for the recertification audit, so that the certificate is maintained without any gap.
How we work together
What it comes down to
ISO 13485:2016 does not primarily call for more documents, but for proof that the documented processes are actually applied in practice. This is precisely where the sequence determines the effort: those who first implement and train the quality management system for real after the gap analysis, before scheduling the internal audit, uncover the nonconformities where correcting them is cheap. If the internal audit is skipped or treated as a formality, those same nonconformities migrate into the certification audit conducted by the accredited certification body and force a second round of auditing there. Risk management in accordance with ISO 14971 does not belong in a separate file, but within the QMS processes, because the standard interlinks the two closely.
For MedTech and IVD manufacturers, the certified QM system is, moreover, not an end in itself but the foundation of product approval: the notified body builds the conformity assessment under MDR (EU 2017/745) or IVDR (EU 2017/746) on a QMS certified to ISO 13485:2016. Those who plan certification and product approval as separate projects lose time at the interface; those who align both strands early build the QM system from the outset so that it supports the later conformity assessment.
Our approach
Our approach
Step
Result
Gap analysis
Prioritized gap report against ISO 13485:2016: where the QMS stands, what is critical, and what entails effort.
QMS setup & documentation
Complete QMS documentation: processes, procedural instructions, quality manual, and records in accordance with ISO 13485:2016.
Training & roll-out
Trained staff, processes implemented for real, and internal audit competence built up.
Internal audit
Internal audit conducted, with nonconformities uncovered and resolved before the external audit.
Certification audit
Supported audit by the certification body, structured close-out of the findings, and certificate issued.
Surveillance & recertification
Surveillance audits passed over the term and recertification prepared.
Common pitfalls
Where projects commonly fail
The QM system is documented for the audit but not implemented for real.
Under ISO 13485:2016, the certification body assesses the actual application of the processes; procedures that exist only on paper lead to nonconformities rather than to the certificate.
The internal audit is skipped or carried out too superficially.
ISO 13485:2016 requires the internal audit as a process in its own right; treating it as a formality leaves open precisely the nonconformities that the external audit will then uncover.
Risk management in accordance with ISO 14971 is run separately from the QM system.
ISO 13485 interlinks risk management with the QMS processes; an isolated risk management file with no connection to development, procurement, and production stands out in the audit.
The certification body's capacity is planned too late.
Contract conclusion and audit slots have lead times; an audit date scheduled without a mature, implemented QMS produces a second round of auditing instead of a straight path to the certificate.
ISO 13485:2016 and ISO 9001 are built separately even though both are being pursued.
Those who merge the integrated QM system only after the fact forgo the integrated audit and pay for two separate certifications.
FAQ
Frequently asked questions
Sources
- ISO 13485:2016 - Medical devices, quality management systems, requirements for regulatory purposes
- ISO 9001 - Quality management systems, requirements
- ISO 14971 - Application of risk management to medical devices
- Regulation (EU) 2017/745 (MDR) - primary text
- Regulation (EU) 2017/746 (IVDR) - primary text
- https://theentourage.de/expertise/iso-13485-zertifizierung/ (existing page content, revised)
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Related insights
All insights →Regulations & standards considered
- ISO 13485:2016 (QM system for medical devices)
- ISO 9001 (general QM system)
- ISO 14971 (risk management for medical devices)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
Related topics
ISO Audits (13485 & 9001) →
Internal audits and audit preparation as a standalone service
Quality Management →
Building and maintaining the QM system beyond certification
MDR Conformity →
ISO 13485 as the QM foundation of MDR certification under EU 2017/745
IVDR Readiness →
ISO 13485 as the QM foundation of conformity assessment under EU 2017/746
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences