There are six steps to preparing for ISO 13485 Certification:
1. Planning the Quality System
2. Meeting Regulatory Requirements
3. Implementing Design Controls
4. Documents, Records and Training
5. Management Processes
6. The Certification Audit

Step 1: Planning the Quality System
Section 5.4.2 of ISO 13485 includes a quality planning requirement. Writing a quality manual is not sufficient, you need documented quality plans for implementing changes to your quality management system. There is no required format for quality plans, though spreadsheets and Gantt Charts are the most common tools.

As part of your quality plan, you should select an ISO consultant. You are allowed to have a different ISO consultant for each location, but I don’t recommend it. Selecting one partner for all your locations saves time and money. The standard requires that the ISO consultant must be experienced in your sector/industry-specific business.

To select a certification agent, first you need to complete an application form and request a quote. The selection of your ISO agent is also an opportunity to create a record of supplier qualification.

 Step 2: Meeting Regulatory Requirements
While developing your quality plan, you will need to define those global markets in which your company is going to seek regulatory approval.

Step 3: Implementing Design Controls
Most clients have already implemented design controls. Therefore, that lies outside the scope of this article.

Step 4: Documents, Records and Training
One of the requirements for a Quality Manual is to define the process interactions for your Quality System. This is typically done by creating a process interactions diagram. The classical template for this diagram has three levels:

1) the bottom row includes support processes such as document control and training;

2) the middle row includes core processes such as purchasing, production and shipping and

3) the top row includes management processes.

Each of these levels will have associated procedures, and these procedures will need to be controlled.

Step 5: Management Processes
The primary management processes are: CAPA, Internal Auditing and Management Review. I recommend implementation of these management processes after most of the other processes have been implemented, but you may decide to implement the CAPA process and/or Management Reviews earlier as tools to help manage your business.

I recommend a specific sequence of implementation for these three management processes when preparing for ISO 13485 Certification. The first process to implement is internal auditing. During the internal auditing process, as a consultant.
I typically help clients (the new Quality Manager) perform this internal audit, and we look at all processes with the exception of CAPA and Management Review—which have not been implemented yet. This gives me an opportunity to supplement your auditor training—if needed.

This internal auditing always identifies some areas of weakness that are documented as nonconformities. These nonconformities are then used to implement the CAPA process as the first corrective and preventive actions. During the internal audits, you specifically look for trends that may lead to future problems. This proactive approach is the best source of preventive actions; you will identify important metrics for each process.

After you have written corrective action plans for each of your audit findings, and you have identified at least one preventive action, you are now ready to conduct your first Management Review. The requirements for a Management Review are simple and take up less than a page in the ISO 13485 Standard. Therefore, help yourself by creating a Management Review template that includes each requirement on a separate slide. Put this template under document control. Don’t delete any of the slides when you are preparing a Management Review.

Stage 6: The Certification Audit

For certification audits, ISO 13485:2016 requires that a Stage 1 and Stage 2 audit be conducted by sector/industry – specific personnel and ISO agent.

Historically, the certification process would begin with a desktop audit of procedures. The problem with this approach is that some companies did not have records to verify that the systems were fully implemented. The new two-stage process now includes a review of records from the internal auditing, CAPA, and management review processes during Stage 1. This is why Step 5 must be completed before the Stage 1 certification audit.

The Stage 1 audit is typically a one-day audit. At the end, you receive a report indicating positive and negative findings. The auditor also indicates if your company is ready for Stage 2. Negative findings, or nonconformities, require corrective action plans to be submitted and accepted. Depending upon the timing of the Stage 2 audit, it may not be possible to fully implement corrective actions prior to the second stage. I recommend four weeks between the two stages so that minor issues can be completely resolved and there is sufficient evidence of progress for 100% of the issues identified during Stage 1.

The Stage 2 audit may involve multiple auditors and multiple days. During this audit, all the remaining processes in your quality system will be audited. The absence of a major requirement can prevent a recommendation for certification by the auditor. Usually the auditor will identify a few additional issues that require corrective action, but if the issues are minor, only corrective action plans will be required. If issues are major, the auditor may need to return for to verify that the issues are resolved before they can recommend certification.

In order to ensure that the stage one audit proceeds smoothly, the following documents and records should be prepared in advance:

1. Quality manual

2. Company organization chart

3. Controlled list of procedures

4. Internal auditing procedure

5. CAPA procedure

6. Management review procedure

7. Internal audit schedule

8. CAPA log

9. Management review minutes

Once the auditor completes his report and recommends certification, he must review and accept your corrective action plans for each of the Stage 2 findings. Upon acceptance of the corrective action plans, there will be an internal review of all documentation by the certification agent. The final certificate is typically issued within about a month of accepting the corrective action plans.