5 Hidden ISO 13485 Nonconformities That Auditors Often Miss

A medical device quality management system can look compliant on paper while hiding serious weaknesses in practice.

Procedures are approved. Training records are complete. Internal audits are conducted on schedule. Yet critical nonconformities can remain undetected.

The challenge for ISO 13485 auditors is not simply checking whether documentation exists. It is determining whether processes are effectively implemented and meet the requirements.

Here are five commonly overlooked ISO 13485 nonconformities that deserve closer attention.

1. Supplier Approval Without Effective Monitoring

Relevant clauses: ISO 13485:2016 – 7.4.1 and 7.4.3

A supplier may have an approved status, a signed agreement and valid certification. But does that mean their performance is being effectively monitored?

Example: A manufacturer continues purchasing critical components from an approved supplier despite repeated delivery defects. The supplier's approval remains unchanged, and no documented reassessment has been performed.

What auditors should investigate:

• Are suppliers evaluated and re-evaluated based on their performance and associated risks?

• Are supplier nonconformities analysed and addressed?

• Are purchasing verification activities appropriate to the risks?

The hidden risk: Supplier approval becomes an administrative exercise rather than an effective quality control process.

2. Training Records That Don't Demonstrate Competence

Relevant clause: ISO 13485:2016 – 6.2

A completed training record does not necessarily demonstrate that an employee is competent.

Example: Production operators have completed training on a revised assembly procedure. However, during the audit, several operators cannot correctly demonstrate a critical inspection step.

What auditors should investigate:

• How does the organisation determine the competence required for each role?

• How is the effectiveness of training evaluated?

• Can employees demonstrate the required knowledge and skills?

The hidden risk: Training is treated as evidence of competence without confirming that employees can perform their assigned tasks correctly.

3. Corrective Actions That Fix Symptoms, Not Root Causes

Relevant clause: ISO 13485:2016 – 8.5.2

Closing a corrective action does not automatically mean the underlying problem has been eliminated.

Example: A manufacturer repeatedly identifies incorrect product labelling. Each incident is addressed through staff retraining, but the same issue continues to occur.

What auditors should investigate:

• Has the actual cause of the nonconformity been investigated?

• Are corrective actions appropriate to the effects of the issue?

• Has the effectiveness of the corrective action been verified?

The hidden risk: The organisation continues correcting individual errors without addressing weaknesses in the system.

4. Traceability Records That Cannot Support a Product Recall

Relevant clauses: ISO 13485:2016 – 7.5.8 and 7.5.9

Traceability is particularly important in the medical device industry, where identifying affected products can be critical to patient safety.

Example: A manufacturer can identify the batch number of a finished medical device but cannot reliably link it to a specific batch of a critical component used during production.

What auditors should investigate:

• Are identification and traceability requirements clearly defined?

• Can relevant components and finished products be traced as required?

• Are traceability records accurate, accessible and maintained?

The hidden risk: Inadequate traceability can delay investigations and complicate product recalls or field safety corrective actions.

5. Process Validation That Has Not Kept Up with Changes

Relevant clause: ISO 13485:2016 – 7.5.6

Some manufacturing processes require validation because their outputs cannot be fully verified through subsequent monitoring or measurement.

But validation is not necessarily a one-time activity.

Example: A manufacturer changes critical production equipment settings but continues relying on validation results obtained before the change. No documented assessment has determined whether revalidation is necessary.

What auditors should investigate:

• Have changes affecting validated processes been evaluated?

• Are validation records and acceptance criteria appropriate?

• Has the need for revalidation been assessed and addressed?

The hidden risk: Previously validated processes may no longer consistently achieve the required results.

The Difference Between Checking Compliance and Auditing Effectiveness

An effective ISO 13485 audit goes beyond reviewing procedures and checking completed forms.

A competent auditor follows the audit trail, evaluates objective evidence and asks whether the quality management system is achieving its intended results.

For example, instead of simply asking whether a corrective action procedure exists, an auditor should examine whether corrective actions have actually prevented problems from recurring.

The key question is not just "Is the process documented?" but "Can the organisation demonstrate that the process works?"

Strengthen Your ISO 13485 Auditing Skills with LMS TRG

Identifying hidden nonconformities requires technical knowledge, critical thinking and effective auditing skills.

At LMS TRG, our ISO 13485 Lead Auditor Training helps professionals develop the knowledge needed to plan, conduct, lead and report audits of medical device quality management systems.

Our course is 100% online and self-paced, allowing you to develop your auditing skills around your professional commitments.

About LMS TRG

LMS TRG is an Australian-based Auditor Training Provider and Exemplar Global Recognised Training Provider, delivering high-quality, practical and industry-focused ISO training across Australia and internationally.

We provide professional auditor training to individuals, businesses and large organisations. We also have established partnerships with leading certification bodies, delivering auditor training on their behalf as part of their training services.

Our 100% online, self-paced courses cover ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 13485 and Integrated Management Systems (IMS), offering Foundation, Internal Auditor and Lead Auditor Training to suit different levels of experience and professional development needs.

Our training helps professionals develop auditing skills, achieve recognised competencies and advance their careers, while supporting organisations in building capable, confident and competent audit teams.