ISO 13485 Internal Auditor Training in USA
ISO 13485:2016 Medical Device Quality Management System Internal Auditor Course — Practical Auditing, FDA QMSR Awareness and Medical Device Quality Assurance
Develop practical skills to plan, conduct, report and follow up internal audits of medical device Quality Management Systems. Learn how to evaluate design and development, supplier controls, manufacturing, validation, traceability, complaints, CAPA and documented information under ISO 13485:2016, and understand how internal audits differ from FDA inspections.
Recognition: EAS-certified internal auditor course, as listed by IAS. Not CQI-IRCA or Exemplar Global accredited; PR369 belongs to the separate Lead Auditor course.
Current standard
Understand the current ISO 13485 medical device QMS standard
ISO 13485:2016 is current and was confirmed by ISO in 2025; there is no 2026 edition and no transition program. It uses Clauses 4–8, not the ISO 9001 Clauses 4–10 structure. ISO 14971 provides risk management context but does not replace QMS requirements.
| Document | Status | What it means for internal auditors |
|---|---|---|
| ISO 13485:2016 | Current; confirmed by ISO in 2025 | The requirements audited; Clauses 4–8 structure |
| ISO 19011:2026 | Current | Guidance for auditing management systems |
| ISO 14971:2019 | Current risk management standard | Context for risk management; does not replace ISO 13485 |
| FDA QMSR (21 CFR Part 820) | Effective February 2, 2026 | Incorporates ISO 13485:2016 by reference plus additional FDA requirements |
| ISO 13485:2026 | Not published | No transition program exists |
ISO: ISO 13485:2016 (opens in a new tab) · ISO: ISO 19011 (opens in a new tab)
US regulation
ISO 13485 and FDA QMSR: the current US regulatory framework
Since February 2, 2026, FDA’s Quality Management System Regulation (21 CFR Part 820) incorporates ISO 13485:2016 by reference and keeps additional FDA requirements. ISO 13485 certification is not FDA approval, does not establish full FDA compliance and does not replace inspection. Internal audit and management review records are no longer exempt from FDA inspection.
- Purpose
- Sets quality system requirements for medical device manufacturers subject to FDA’s device rules.
- Incorporation by reference
- ISO 13485:2016 Clauses 4–8 (with Clause 3 definitions) are part of the regulation; FDA definitions and the Act control where they conflict.
- Additional FDA requirements
- For example 820.10 (scope, including design controls for devices that need them), 820.35 (control of records, including complaint and servicing records and UDI), 820.45 (labeling and packaging controls).
- Related FDA rules
- Medical Device Reporting (Part 803), corrections and removals (Part 806), device tracking (Part 821, where ordered), UDI (Part 830).
- Inspections
- FDA no longer uses QSIT; it inspects manufacturers under Compliance Program 7382.850.
- Certificates
- FDA does not issue or require ISO 13485 certificates, and certification does not exempt anyone from inspection.
FDA: QMSR (opens in a new tab) · eCFR: 21 CFR Part 820 (opens in a new tab) · FDA: Medical Device Reporting (opens in a new tab)
Course recognition
Understand the recognition of ISO 13485 internal auditor training
IAS lists this course as EAS certified, two days / 16 hours. The ISO 13485 Lead Auditor course is separately listed under CQI-IRCA PR369. Attendance, course achievement, internal auditor competence, professional registration and third-party auditor qualification are different things.
| Item | IAS listing | Other source | Status |
|---|---|---|---|
| Internal Auditor (this course) | EAS certified, two days / 16 hours (IAS accreditation page) | No CQI-IRCA or Exemplar Global reference | Confirm certificate issuer and wording |
| Lead Auditor (separate) | CQI-IRCA PR369 (IAS list) | PR369 in EAS’s list | Not used for this course |
| Live page wording | “Accredited” certificate of completion; “aligns with” CQI-IRCA and Exemplar Global | — | Remove “accredited” and alignment claims |
| Course achievement vs competence | Certificate shows you met the course assessment | Competence, registration and third-party qualification are separate | Stated on this page |
The course
Build practical medical device quality management auditing skills
An ISO 13485 internal audit is not an FDA inspection, product certification, safety testing, clinical evaluation, a 510(k) or PMA review, an MDSAP audit or a third-party certification audit. Course completion does not authorize any of them.
- Medical device QMS and regulatory purposes
- Audit objectives, programs, scope and criteria
- Medical device lifecycle
- Quality records and technical documentation
- Interviews and objective evidence
- Nonconformities and reporting
- Corrective action and follow-up
Who should attend
Who should attend?
Choose a role to see relevance, recommended knowledge and next steps.
Prerequisites
Is ISO 13485 internal auditor training suitable for beginners?
IAS and EAS describe basic ISO 13485 awareness as helpful but not mandatory, and no audit experience is required. Nothing you enter here is stored or sent.
Two-day syllabus
Explore the two-day ISO 13485 internal auditor training course
A proposed expanded syllabus for the advertised two-day, 16-hour course, to be verified against the EAS program. No pass mark is stated.
EAS’s current course topics
- ISO 13485 requirements from an auditor’s perspective
- Auditor attributes, roles and responsibilities
- Planning and preparing internal audits
- Reporting and documenting audit findings
- Identifying nonconformities and writing nonconformity reports
Requirements explorer
Understand every major ISO 13485 quality management requirement
The five main clauses of ISO 13485:2016 in our own words, with FDA considerations. Preventive action stays a separate requirement. Not the standard’s text.
ISO 13485 and QMSR
ISO 13485 requirement, FDA QMSR consideration and audit evidence
Educational mappings only. Not every provision applies to every device or manufacturer, and nothing here is a compliance decision.
Risk management lab
Practice reviewing medical device risk management evidence
A fictional electronic monitor, with ISO 14971:2019 as context. Judge each risk record. No risk acceptability decision or design approval is made.
| Record | What it shows | Your view |
|---|---|---|
| Hazard analysis | Battery overheating identified as a hazard for the monitor (fictional). | |
| Risk control | Thermal cut-off added; verification test planned. | |
| Residual risk | “Acceptable” recorded with no criteria reference. | |
| Design change | New battery supplier; risk file not updated. | |
| Post-production information | Two complaints of hot casing; no review in the risk file. | |
| Integration | Risk management procedure referenced in design and purchasing procedures. |
Design control simulator
Learn to audit medical device design controls
A fictional non-implantable wearable monitor. Follow the design file from user needs to changes. Design control applicability under FDA depends on device class (820.10(c)); nothing here approves a design.
Supplier workshop
How internal auditors evaluate medical device suppliers
Six fictional suppliers. Not every supplier must hold ISO 13485, and a certificate does not prove every purchased product conforms.
True or false?
| Statement | Your view |
|---|---|
| All suppliers must hold ISO 13485 certification. | |
| A supplier certificate proves every purchased product conforms. | |
| Outsourced processes stay under the manufacturer’s QMS control. | |
| Supplier evaluation criteria should reflect risk. |
Process validation
Auditing production process validation and operational controls
Fictional processes. Not every process needs the same validation approach, and no acceptance criteria or release decisions are given.
Sterile devices
Understanding sterile medical device quality audit evidence
A fictional sterile single-use device with outsourced sterilization. No cycles, lethality parameters or release approvals are given, and not every device is sterile.
Traceability and UDI
Learn to audit medical device identification and traceability
Component lot → batch → finished device → label → distribution. UDI (21 CFR Part 830) and tracking (Part 821) apply only where required, and a lot trace does not prove device safety.
Complaints and MDR
Auditing complaints, feedback and regulatory reporting processes
A fictional device malfunction complaint. Auditors check the process; they do not decide whether an event is reportable under 21 CFR Part 803. No medical advice is given.
Field actions
Audit evidence for advisory notices and field actions
21 CFR Part 806 applies to certain corrections and removals. No recall classifications or release decisions are given.
CAPA and nonconforming product
How internal auditors evaluate medical device CAPA and product nonconformity
A fictional process with repeated inspection failures. Not every complaint needs a separate CAPA, and no disposition or corrective action is approved here.
| Record | What it shows | Your view |
|---|---|---|
| Nonconforming product | Housings failing inspection, segregated and labeled. | |
| Disposition | Rework approved without documented rework instructions. | |
| Investigation | Root cause: mold wear. | |
| Corrective action | Mold maintenance interval changed; no verification that it works. | |
| Preventive action | Same mold type on another line not checked. | |
| Complaint-to-CAPA | Every complaint opens a CAPA. |
CAPA workflow
Fictional examples
Correction, corrective, preventive or effectiveness?
| Action | Your view |
|---|---|
| Segregating failed housings | |
| Changing the mold maintenance interval | |
| Checking the same mold type on another line | |
| Two months of inspection results | |
| Reopening the three complaints | |
| Clarifying the complaint procedure |
Documents and medical device file
Auditing medical device QMS documentation
Fictional documents. No specific software system is mandatory, and old QSR terms (such as DHR or DMR) do not map one-to-one onto the QMSR structure.
| Document | What it shows | Your view |
|---|---|---|
| Approved procedure SOP-12 rev C | Current, approved, available at the line. | |
| Superseded SOP-12 rev B | Found at a workstation. | |
| Device specification | Approved by engineering only; QA approval required by procedure. | |
| Production record | Electronic record with audit trail. | |
| Change approval | Change implemented before approval date. |
Audit program builder
Plan an effective ISO 13485 internal audit program
Clause 8.2.4 requires audits at planned intervals with objective auditors. No universal frequency applies; this is a fictional sample, not an approved program.
Competence and impartiality
Who can conduct medical device QMS internal audits?
Auditors need ISO 13485 knowledge, regulatory awareness, process knowledge and objectivity. A two-day certificate does not cover every device category, and CQI-IRCA registration is not required. A small manufacturer has a quality manager, design engineer, production supervisor and regulatory affairs officer.
| Assignment | Your view |
|---|---|
| The quality manager audits CAPA, which they approve | |
| The design engineer audits purchasing | |
| The production supervisor audits their own line | |
| The regulatory affairs officer audits design controls | |
| The quality manager audits management review they prepare | |
| An external contract auditor audits the full QMS |
Checklist builder
Develop medical device QMS audit questions
Educational examples only; not a compliance assessment or a clearance decision.
Interview simulator
Practice interviewing medical device QMS personnel
Choose a fictional role and the questions you would ask. No patient information, real production records or design files are used.
Mock medical device audit
Practice a complete medical device quality management internal audit
A fictional US device manufacturer with fifteen audit areas. Not an EAS examination, certification decision or device approval.
Findings laboratory
Write clear, evidence-based medical device audit findings
Never invent evidence; grade only under your organization’s defined criteria.
Audit evidence
What does effective ISO 13485 audit evidence look like?
Fictional comparisons; not IAS client data.
| Area | Strong evidence | Weak evidence |
|---|---|---|
| Design control | Plans, reviews with independent reviewer, verification and validation reports. | A design folder with drawings only. |
| Supplier qualification | Defined criteria and performance records. | An approved supplier list without evaluations. |
| Production validation | Validation protocols, reports and revalidation criteria. | A statement that “the process works”. |
| Traceability | Records linking components, batches, serials and distribution. | Invoices only. |
| Complaint handling | Evaluation, investigation or rationale, reportability decision. | A log with “closed”. |
| CAPA | Investigation, actions and effectiveness review. | Closed with no effectiveness review. |
| Management review | Defined inputs and recorded decisions. | Sales figures only. |
| Internal audit | Program, objective auditors, reports, follow-up. | A checklist with ticks. |
Assurance activities
FDA inspection vs certification audit vs internal audit vs MDSAP
This course does not authorize FDA inspections or MDSAP audits, and ISO 13485 certification is not MDSAP recognition.
| ISO 13485 internal audit | ISO 13485 certification audit | FDA inspection | MDSAP audit | |
|---|---|---|---|---|
| Purpose | Check your own QMS | Certify conformity to ISO 13485 | Enforce FDA law | Single audit for participating regulators |
| Authority | The organization | Accredited certification body | FDA under the FD&C Act | Recognized auditing organizations |
| Applicability | Voluntary method; required by 8.2.4 | Voluntary | Manufacturers subject to FDA rules | Voluntary participation |
| Criteria | ISO 13485 and own requirements | ISO 13485 | QMSR and other FDA rules | ISO 13485 plus participating countries’ requirements |
| Auditor qualification | Competent, objective employees or contractors | Certification body auditors | FDA investigators | Auditors of recognized organizations |
| Report | Internal report | Certification audit report | Inspectional observations (Form FDA 483) where issued | MDSAP audit report to regulators |
| Outcome | Corrective action | Certificate decision by the body | Regulatory action where needed | Regulators use the report |
| Does this course authorize it? | Supports it | No | No | No |
ISO 13485 vs ISO 9001
Which quality auditing course is appropriate for medical devices?
ISO 9001 certification does not replace ISO 13485 where it applies, and an ISO 9001 internal auditor certificate does not establish competence for medical device requirements.
| ISO 13485:2016 | ISO 9001:2026 | |
|---|---|---|
| Audience | Medical device organizations | Any organization |
| Structure | Clauses 4–8 | Clauses 4–10 |
| Regulatory context | Requirements for regulatory purposes | Not regulatory |
| Risk management | Throughout product realization | Risks and opportunities |
| Documentation | Medical device file and specified records | Documented information as needed |
| Design and production | Design controls, validation, sterilization where relevant | General controls |
| Traceability | Specific requirements, implantables stricter | As needed |
| Complaint handling | Specific, with regulatory reporting | Customer feedback |
| Training pathway | ISO 13485 Internal Auditor | ISO 9001 Internal Auditor |
Choosing a course
Which ISO 13485 auditor course should you choose?
PR369 is not used for the Internal Auditor course, and Lead Auditor completion does not authorize certification decisions.
| ISO 13485 Internal Auditor | ISO 13485 Lead Auditor | |
|---|---|---|
| Duration | Two days / 16 hours, as listed | Five days, where approved |
| Focus | First-party QMS auditing | Audit leadership and methodology |
| Content | Planning, evidence, checklists, findings, CAPA follow-up | Audit team management, certification audit stages |
| Recognition | EAS certified, as listed by IAS | CQI-IRCA certified (PR369) |
| Authorization | None beyond internal audits chosen by your organization | Does not authorize certification decisions |
Industries
US medical device industry applications
Obligations differ by business and device; choose a sector.
Delivery formats
Choose your ISO 13485 internal auditor training format
Formats may differ in assessment and certificate; we confirm before you enrol.
Training dates
Upcoming ISO 13485 internal auditor training dates in USA
The IAS schedule lists one ISO 13485:2016 Internal Auditor virtual session, 9:00–18:00 with no time zone. The November and December IRCA sessions are the separate Lead Auditor course.
| Course | Edition | Provider | Start | End | Time zone | Format | Duration | Fee | Status | Enquire |
|---|
Assessment and certificate
What happens after completing the course?
EAS says a certificate follows completion of the course and assessment; the live IAS page calls it an “accredited” certificate of completion. Neither names the issuer, and no pass mark, resit rule or validity is published. ISO does not issue it, no employer or certification body is obliged to accept it, and it does not prove full auditor competence.
EAS: training certificate search (opens in a new tab)
- Attendance
- To confirm.
- Practical exercises
- Tutor-led formats.
- Knowledge assessment
- End of course.
- Passing requirements
- Confirmed by EAS.
- Certificate
- Type and issuer to confirm; no accreditation claimed.
- Reassessment
- Where EAS rules permit.
Fees and corporate training
ISO 13485 internal auditor training fees in USA
Quoted in USD once approved. No fees or discounts are published. Corporate programs suit device manufacturers, QA, regulatory, design and supplier quality teams, contract manufacturers and multi-site groups.
- Classroom
- Request course fee
- Live virtual
- Request course fee
- Self-paced
- Request fee
- Corporate in-house
- Request a group quotation
- Confirmed with your quotation
- Materials, assessment, certificate, taxes, payment terms and refund policy
Registration
Register for ISO 13485 internal auditor training
Send a registration or information request. A coordinator confirms dates, fees, certificate and availability. You are registered only after written confirmation.
Enrollment journey
From enquiry to certificate
An enquiry does not reserve a seat.
- 1
Understand ISO 13485
- 2
Review FDA QMSR context
- 3
Explore course recognition
- 4
Review the two-day syllabus
- 5
Learn medical device audit processes
- 6
Practice audit exercises
- 7
Choose a training format
- 8
Select a confirmed date
- 9
Review the course fee
- 10
Submit registration
- 11
Receive confirmation
- 12
Attend training
- 13
Complete the assessment
- 14
Receive the applicable certificate
- 15
Apply learning to internal QMS audits
Tutors and responsibilities
Learn from experienced medical device quality auditing professionals
Tutor profiles will appear once verified. IAS’s certification-body accreditation is not CQI-IRCA or Exemplar Global approval of this course.
| Responsibility | Organization | Status |
|---|---|---|
| Advertises the course | IAS and EAS | Confirmed |
| Delivers training | EAS | As advertised |
| Conducts assessments | EAS | Confirm rules |
| Issues certificates | Not named by IAS or EAS | Confirm |
| Provides online access | EAS portal | Confirm terms |
| Collects fees | IAS or EAS | Confirm |
| Handles complaints | IAS and EAS | Confirm |
| Handles resits | EAS | Confirm |
| Maintains training records | EAS | Confirm |
FAQ
ISO 13485 internal auditor training questions
87 answers. EAS confirms course rules when you enrol.
What is ISO 13485 Internal Auditor Training?
A two-day course that teaches you to plan, conduct, report and follow up internal audits of a medical device quality management system.
What is ISO 13485:2016?
The international standard for medical device quality management systems for regulatory purposes.
Is ISO 13485:2016 still current?
Yes. ISO confirmed it in 2025.
Is ISO 13485:2026 published?
No.
How is ISO 13485 different from ISO 9001?
ISO 13485 is specific to medical devices and regulatory purposes; ISO 9001 is general and does not replace it.
Why does ISO 13485 have Clauses 4–8?
The 2016 edition did not adopt the common structure used by ISO 9001, so its requirements sit in Clauses 4 to 8.
What is ISO 19011:2026?
The current guidelines for auditing management systems.
What is a medical device QMS?
The processes, documents and records a device organization uses to meet quality and regulatory requirements.
What is FDA QMSR?
The Quality Management System Regulation, 21 CFR Part 820, which replaced the Quality System Regulation.
When did FDA QMSR take effect?
February 2, 2026.
How does FDA QMSR incorporate ISO 13485?
It incorporates ISO 13485:2016 by reference and adds FDA-specific requirements; FDA definitions and the Act control where they conflict.
Does ISO 13485 certification satisfy every FDA requirement?
No.
Does FDA issue ISO 13485 certificates?
No.
Does ISO 13485 certification eliminate FDA inspections?
No.
What replaced FDA QSIT inspections?
FDA inspects device manufacturers under Compliance Program 7382.850.
What is 21 CFR Part 820?
The FDA regulation setting quality management system requirements for device manufacturers.
What are the additional FDA requirements?
For example 820.10 scope and design control applicability, 820.35 control of records and 820.45 labeling and packaging controls, plus related rules such as Parts 803, 806, 821 and 830.
What is ISO 14971?
The standard for applying risk management to medical devices; the current edition is ISO 14971:2019.
What is medical device risk management?
Identifying hazards, estimating and evaluating risks, controlling them and monitoring effectiveness across the lifecycle.
What is design and development control?
Planned control of design inputs, outputs, reviews, verification, validation, transfer and changes.
What is design verification?
Confirming design outputs meet design inputs.
What is design validation?
Confirming the device meets user needs and intended use.
What is process validation?
Establishing that a process consistently produces a result that cannot be fully verified afterwards.
What is supplier qualification?
Evaluating and selecting suppliers against criteria proportionate to risk.
What is medical device traceability?
The ability to trace components, batches and devices through production and distribution.
What is UDI?
Unique Device Identification under 21 CFR Part 830, where applicable.
What is a medical device file?
A file for each device type or family demonstrating conformity to requirements (4.2.3).
What is complaint handling?
Receiving, evaluating, investigating and recording complaints, and assessing regulatory reporting.
What is FDA Medical Device Reporting?
Reporting of certain adverse events and malfunctions under 21 CFR Part 803.
What are advisory notices?
Notices to users about using, modifying, returning or destroying a device.
What is CAPA?
Corrective and preventive action to address actual and potential nonconformities.
What is preventive action under ISO 13485?
Action on causes of potential nonconformities (8.5.3); ISO 13485 keeps it as a separate requirement.
What is a nonconforming product?
Product that does not meet requirements; it is identified, controlled and dispositioned.
What is an internal medical device QMS audit?
A first-party audit checking that the QMS conforms and is effectively implemented.
What does Clause 8.2.4 require?
Audits at planned intervals under a documented procedure, with objective auditors who do not audit their own work, and recorded results.
Who should attend?
Quality managers, QA engineers, regulatory affairs, internal auditors, design, production, supplier quality, CAPA and document control staff.
Is the course suitable for beginners?
Yes. Basic ISO 13485 awareness is helpful but not mandatory.
What are the prerequisites?
None mandatory; basic ISO 13485 awareness helps.
Is prior audit experience necessary?
No.
How long is the course?
Two days.
Is it two days?
Yes.
Is it 16 hours?
Yes, as listed by IAS and EAS for tutor-led delivery.
What does Day 1 cover?
ISO 13485 requirements, FDA QMSR context and audit planning.
What does Day 2 cover?
Conducting audits, auditing device processes, findings and corrective action.
Does it include practical exercises?
Yes, in tutor-led formats.
Does it include a mock medical device QMS audit?
Yes, with a fictional manufacturer.
Will I learn audit planning?
Yes.
Will I learn to prepare checklists?
Yes.
Does it cover design controls?
Yes, as audit topics.
Does it cover supplier audits?
It covers auditing your supplier controls; second-party supplier audits suit Lead Auditor training better.
Does it cover process validation?
Yes, as an audit topic.
Does it cover traceability?
Yes.
Does it cover complaints and CAPA?
Yes.
Does it teach FDA regulatory auditing?
It explains FDA context; it is not FDA regulatory training.
Does it qualify me to be an FDA investigator?
No.
Is the course EAS certified?
IAS lists it among EAS-certified two-day courses.
Is it CQI-IRCA certified?
No.
Is it Exemplar Global accredited?
No.
What is CQI-IRCA PR369?
The reference for the separate ISO 13485 Lead Auditor course listed by IAS. It does not apply to this course.
What is the difference between Internal Auditor and Lead Auditor Training?
Internal auditor training is two days for first-party audits; Lead Auditor is five days and covers audit leadership.
Who delivers the course?
EAS, IAS’s training partner.
Who issues the training certificate?
Neither IAS nor EAS names the issuer yet; we confirm before you enrol.
Is the certificate issued by ISO?
No.
Can the certificate be verified?
EAS offers a training certificate search; we confirm it covers this course.
Does it expire?
Confirmed with the certificate wording.
Does completion automatically establish auditor competence?
No. Your organization evaluates competence.
Does it authorize third-party certification audits?
No.
Does it qualify me as an MDSAP auditor?
No.
Is classroom training available?
Yes, as advertised; no public venue is published.
Is live virtual training available?
Yes. The IAS schedule lists November 7–8, 2026.
Is self-paced learning available?
EAS offers online 30-day self-learning.
Is 30-day portal access included?
For self-learning, as described by EAS. It is access to materials, not live instruction.
Do all formats offer the same certificate?
Not confirmed.
Is there an examination?
Yes, an assessment at the end.
What is the passing score?
Not published.
Can the assessment be retaken?
Where EAS rules permit.
What are the next USA training dates?
A virtual session on November 7–8, 2026 is listed on the IAS schedule. Confirm before registering.
What time zone applies?
The schedule lists 9:00–18:00 without a time zone. We confirm it.
How much does the course cost?
Request a fee. No price is published.
Is corporate training available?
Yes.
Can training be conducted at our facility?
Yes, as corporate in-house training.
Are discounts available?
None are published.
Can international delegates participate?
Usually yes for virtual sessions; confirm the time zone.
Does the course guarantee employment?
No.
What is the cancellation policy?
See the refund policy and your quotation.
How do I register?
Use the registration form. A coordinator confirms dates, fees and availability.
What happens after registration?
You receive confirmation and joining instructions once your place is confirmed in writing.
Related courses
Training and certification resources.
- ISO 13485 Lead Auditor
- ISO 13485 training
- ISO 13485 certification
- ISO 9001 Internal Auditor
- Internal Auditor training
- Lead Auditor training
- ISO training
- Foundation training
- Training schedule
- Accreditation information
- About IAS
- IAS Insights
- Contact IAS USA
- Training nomination form (DOC)
- Course or service brochure (PDF)
- ISO certification
- Frequently asked questions