Obtaining ISO 13485 certification is a milestone. Keeping it requires a genuinely operational QMS between surveillance audits, and this is where many organisations fall behind.
Certification draws on energy for months. Once the audit is over, the pressure eases off. Indicators are no longer tracked, internal audits slip, nonconformities pile up. As the surveillance audit approaches, six months of QMS have to be reconstructed in three weeks. The auditor does not see a living system, they see a system switched back on for the occasion. And it shows.
Five routines that keep a QMS in motion
Routine 1: indicators recorded every month. Each key process carries at least one indicator monitored monthly: product nonconformity rate, number of customer complaints, corrective action closure times, calibration overdue rate. Five to ten well-chosen, genuinely monitored indicators are enough. This is the raw material for the monitoring and measurement of processes and product (clauses 8.2.5 and 8.2.6) and for the analysis of data (clause 8.4). Stopping the monthly monitoring is the first symptom of a QMS falling asleep.
Routine 2: internal audits held on the scheduled dates. Clause 8.2.4 requires a planned internal audit programme and a documented procedure. An audit postponed twice ends up being skipped altogether. Blocking out the dates in calendars from January, with designated auditors, remains the most effective safeguard. A modest programme that is respected is worth more than an ambitious one that is never held.
Routine 3: handling nonconformities without delay. A nonconformity detected between two audits enters the process within a few days, not a few months. ISO 13485 in fact distinguishes two processes that the term CAPA groups together for convenience: corrective action (clause 8.5.2), which addresses a confirmed cause, and preventive action (clause 8.5.3), which addresses a potential risk. A backlog of pending nonconformities is both a finding in an audit and a signal of operational dysfunction.
Routine 4: documentation kept up to date as you go. Any product, process or organisational change that affects the QMS triggers an immediate documentation update, under clause 4.2.4. Deferring these updates installs a growing gap between the documentation and the reality on the ground. That gap is exactly what an auditor looks for when they compare a procedure with actual practice.
Routine 5: a genuine annual management review. It takes place on the scheduled date, covers all the inputs listed in clause 5.6.2, feedback, complaints, reporting to authorities, audits, indicators, corrective and preventive actions, changes affecting the QMS, new regulatory requirements, and leads to decisions recorded under clause 5.6.3. A review drafted the day before the audit on reconstructed data fools no auditor.
The warning sign that should alert you
A QMS that no longer generates any nonconformities, any corrective actions, and whose indicators have all stayed green for months is not necessarily mature. It is often a system that has stopped measuring anything real. The right question is not whether the figures are good. It is whether the QMS still detects problems, or whether it has learned to stop seeing them.
A living system is prepared all year round, not three weeks before the auditor.