ISO 13485 Is Not Enough

The story · What an inspection actually looks like

Monday, 9:15 am.

The FDA investigator signs in at reception. Behind the desk, the ISO 13485 certificate hangs in a frame. Everything looks ready. The procedures exist. The records exist. The team has done this before.

Three days later, the company has eight observations.

Nothing was fake. Nothing was missing. Every system named in the 483 was certified, documented and audited.

The systems simply did not connect.

An auditor asksDo you have a procedure for this?

Conformity. Sampled. Announced. Scoped in advance.

An investigator asksShow me the record where you followed it — and the one where you didn't.

Evidence. Chosen by them. Traced across systems until something breaks.

Every year, ISO-certified manufacturers discover the same painful thing: passing the audit did not prepare them for the inspection.

The chain investigators walk

Nothing here is broken. The joins are.

An investigator does not audit systems one at a time. They pick one complaint and follow it until the trail stops. Certification proves each box exists. Inspection tests the arrows between them.

Complaint→CAPA→MDR→483→Warning Letter→Consent Decree

Every arrow is a decision that has to be recorded. A complaint that should have become a CAPA. A CAPA that should have been checked for effectiveness. An event that should have been filed within 30 days. Miss one arrow and the chain keeps moving — in the wrong direction.

Day 1Opening meeting

Scope set. They ask for your quality manual, org chart and complaint log.

Day 2The trace

One complaint is picked and followed across every system until the trail stops.

Day 3Form 483 issued

Observations read back to you at the closing meeting.

15 daysYour response

Fix the systemic cause, not the record they happened to pull.

45–90 daysClassification

NAI, VAI or OAI. The last one is where warning letters live.

The uncomfortable data

Your certificate made you easier to inspect, not harder.

A certified quality system is a well-documented one — which means an investigator can point at the exact clause you signed up to and did not fully meet.

~90%

of device observations now cite ISO 13485 clauses directly.

~30%

of citations are management oversight — the largest single category.

The seven · Where observations land

Seven places investigators still find observations inside ISO-certified companies.

Read each one and ask the honest question: could we produce that record this afternoon?

1Labeling & packaging controls

HIGH820.45

ISO 13485 folds labeling into general production controls. QMSR expects specific inspection, reconciliation and control — and labeling errors remain a leading cause of recalls.

Oh no"We have a labeling procedure" is not the same as "here is the reconciliation record for this batch."

2MDR reporting

CRITICAL21 CFR 803

This sits entirely outside ISO 13485. Evaluating every complaint for reportability and filing within 30 days is a US regulation, not a standard clause.

Oh noMost certified firms have no defensible reportability-decision trail. The decision was made — it was just never written down.

3Unique Device Identification

HIGH21 CFR 830

Also outside ISO 13485. UDI on the label and in the GUDID database is a US regulatory obligation your certificate never tested.

Oh noYour GUDID record was correct the day you filed it. The question is whether it survived three years of artwork revisions.

4US record constructs (DHF / DMR / DHR)

MEDIUM820.30 / .180

ISO 13485 frames records differently. Investigators still expect to trace a Design History File, Device Master Record and Device History Records in the US sense.

Oh noCertified teams usually have the content. What they lack is the construct an investigator asks for by name.

5Management responsibility & review

CRITICAL820.20

QMSR inspection puts management oversight under heavy scrutiny — now one of the largest citation categories.

Oh noA review that drove no decisions is a finding. The slide deck is not the evidence; the closed actions are.

6Complaint → CAPA → MDR linkage

CRITICAL820.198 / .100 / 803

The certificate proves each system exists. Inspection tests whether they talk to each other.

Oh noThis is the one that produces the eight-observation inspection. Nothing is missing. Nothing connects.

7Servicing & installation records

MEDIUM820.200

For devices requiring servicing, QMSR expects specific servicing records analysed as a quality signal.

Oh noISO 13485 covers this lightly, so certified firms under-document it — and never notice until asked.

The 12-point self-scorecard

Certified, or compliant? Your inspector already knows.

Twelve questions in the guide, answered with your actual records open — not from memory, and not from what the procedure says should happen. Y = 2 · P = 1 · N = 0, maximum 24.

20–24QMSR-ready

Your certificate and your reality match. Confirm with an independent pre-read and keep the linkages tight.

12–19Certified, not compliant

The gap between your certificate and QMSR is real and typical. Close the US-specific items in priority order.

0–11Exposed

A clean certificate is masking material gaps. Get outside eyes on the US-specific requirements this month.

The benchmark that actually matters

Nobody publishes an industry average. But the FDA publishes where it looks.

Across roughly 2,660 device 483 observations, citations concentrate in a handful of systems. Compare your weakest scorecard lines against this ranking — if they overlap, that is your real exposure. Not a feeling: a probability.

10.5%CAPA820.100 · Lines 03, 04

7.9%Complaints820.198 · 01, 02, 04

4.3%Suppliers820.50 · Line 08

3.6%Nonconforming820.90 · Line 12

3.5%Process val.820.75 · Line 11

Design controls is not at the top. The findings land on the systems that prove you react correctly when something goes wrong.

The cost · What it costs to be wrong

The scorecard takes ten minutes. Getting it wrong takes years.

$10m–$600mThe cost of a single recall event

Depending on scope and severity. Business disruption alone is close to half of it.

$2.5–5bnIndustry cost of non-routine quality events, yearly

Recalls, warning letters and consent decrees, with the warranties and lawsuits that follow.

1,059Device recall events in 2024

The highest in four years. Class I recalls reached their highest level in 15 years.

2–5 yrsRecovery time after a major recall

Long after remediation closes, the commercial effect is still being carried.

The cheapest inspection you will ever run is the one you run on yourself. Ten minutes, twelve questions — and you already have the records.

Also in the guide

Three assumptions that have cost manufacturers millions.

“We're ISO 13485 certified, so we're QMSR-ready.” “QMSR is just a rename of QSR.” “We have time.” Each one is answered in full — QMSR has been law since February 2026, and inspections already run under it.

check_circleThe full 12-point scorecard, with each line mapped to one of the seven gaps.
check_circleWhat ISO 13485 covers well versus what QMSR adds on top, side by side.
check_circleYour risk at a glance — the seven gaps ranked so you fix downward from red.
check_circleThe costs nobody models: launch delay, customers, legal, and your best engineers.

Get the free guide

Monday, 9:15 am.

Nothing here is broken. The joins are.

Your certificate made you easier to inspect, not harder.

Seven places investigators still find observations inside ISO-certified companies.

Certified, or compliant? Your inspector already knows.

Nobody publishes an industry average. But the FDA publishes where it looks.

The scorecard takes ten minutes. Getting it wrong takes years.

Three assumptions that have cost manufacturers millions.

Every company that received a 483 last year
believed it was ready that morning.

ISO 13485 Is Not Enough

Get the free guide

Monday, 9:15 am.

Nothing here is broken. The joins are.

Your certificate made you easier to inspect, not harder.

Seven places investigators still find observations inside ISO-certified companies.

Certified, or compliant? Your inspector already knows.

Nobody publishes an industry average. But the FDA publishes where it looks.

The scorecard takes ten minutes. Getting it wrong takes years.

Three assumptions that have cost manufacturers millions.

Every company that received a 483 last year believed it was ready that morning.

Every company that received a 483 last year
believed it was ready that morning.