ISO 13485 Documents Checklist: Quality Manual, Device Files and Traceability Records

Your auditor walks in, asks for your documents, and you have about ten seconds before they form an opinion. Not about your device. About your system. The good news: ISO 13485 does not ask for a mountain of paper. The bad news: most device makers either write far too much or far too little, and both fail in exactly the same way — the auditor cannot see the system working.

The short answer: ISO 13485:2016 asks for a small set of named documents — a quality manual, policy and objectives, a medical device file for each device, and procedures for document control, record control, design, purchasing, production and corrective action — plus the records that prove you follow them. No fixed count exists; a single-site maker usually has twenty to forty in total.

Documents vs records — the split that saves you half the work

Everything an auditor asks for falls into one of two buckets, and mixing them up is the first mistake most makers make.

A document says how the work should be done. A record proves it was done, on a particular day, by a particular person, for a particular device. Think of a hospital: the treatment protocol pinned on the wall is the document; the patient's case sheet — temperature at 2 pm, dose given, signed by the nurse — is the record. One tells you the method. The other proves the method happened.

Why does this matter? The two are controlled differently. A document needs a version number, an approval, and a way to make sure the old version stops circulating. A record needs to be filled in honestly and stored where you can find it. Rewrite a record after the fact and you have destroyed evidence. Auditors notice that fast.

The 7 documents the standard actually names

ISO 13485:2016 is a paywalled standard, so I am working from the clause mapping that independent guides agree on. Here is the core set, with the clause each one answers to.

1. The quality manual (clause 4.2.2). The one document ISO 13485 still demands and ISO 9001:2015 dropped. It states the scope of your quality system — which device categories it covers — describes how your processes interact, and justifies any permitted exclusions from clause 7. One note: guides cite the manual as 4.2.1 or 4.2.2 — the first is the general documentation clause that lists it, the second is the clause devoted to it. Either citation points at the same document. Keep it short. An auditor reads it first and uses it as the map for the audit.

2. The quality policy (clause 5.3). A short statement, signed by top management, committing the organisation to meeting regulatory requirements — not just customer requirements. That wording is deliberate.

3. Quality objectives (clause 5.4.1). Measurable targets with a plan behind them. "Reduce customer complaints" is a wish. "Cut sterile-pack seal failures from 4 a month to 1 a month by June" is an objective. Pick numbers you actually measure.

4. The roles you play (clause 4.1.1). A short written statement of the roles your organisation undertakes under the applicable regulations — manufacturer, importer, distributor, service provider, or a mix. This matters most for own-label importers. If you put your name on the box, the auditor wants to see, in writing, which responsibilities you accept.

5. Document control procedure (clause 4.2.4). Who approves a document, how versions are numbered, how the current version reaches the shop floor, and how the old version is withdrawn. A procedure nobody follows is worse than no procedure.

6. Record control procedure (clause 4.2.5). How records are identified, stored, protected, retrieved, and eventually disposed of. This is also where your retention rule lives — and the standard does fix a floor here: keep records for at least the lifetime of the device, and never less than two years from the date of release, whichever is longer.

7. A named management representative (clause 5.5.2). One person, named in writing, responsible for making sure the quality system is established, maintained, and reported to top management. ISO 9001 dropped this requirement; ISO 13485 kept it. It cannot be a committee.

The medical device file — one folder per device

Clause 4.2.3 asks for a file for each medical device type or device family — the device's own case file: its design history, its risk file, its labelling and instructions for use, and the regulatory submissions that cover it, all in one place or referenced from one place.

This is the file the auditor reaches for first, and the one most first-time makers get wrong, because they scatter its contents — design history with R&D, risk file with quality, labelling with marketing, submissions with regulatory affairs. Build it as a folder, physical or digital, with an index: every document either sits inside or is named in the index with its exact location. A missing document then shows as a gap you can close, not a surprise. And note: the device file is not the design history file. The design file is one thing inside it; the device file is the whole case folder.

The design file, piece by piece

Clause 7.3 is the most audited section of the standard, and where most first certifications are delayed. It asks for a chain of documented evidence, and the auditor traces it from beginning to end. The chain has eight links, and the design and development file — the DHF, clause 7.3.10 — is the master record that holds them all.

Design planning (7.3.2). A written plan for each device: stages, review points, responsibilities, and how outputs will be verified and validated.

Design inputs (7.3.3). The functional, performance, usability, safety, regulatory and labelling requirements — written down and formally reviewed before design work begins.

Design outputs (7.3.4). Specifications, drawings and manufacturing procedures derived from the inputs, stated so they can be verified against them.

Design review (7.3.5). Formal, recorded reviews at the planned stages, with representatives from the functions involved.

Design verification (7.3.6) and validation (7.3.7). The pair everyone confuses. Verification answers "did we build the product right?" — testing outputs against inputs. Validation answers "did we build the right product?" — confirming the finished device meets its intended use in real conditions. Both are required. Neither substitutes for the other.

Design transfer (7.3.8). Documented confirmation that the production process derived from the validated design can consistently make a conforming device. Validating a prototype and then quietly changing production is one of the most common reasons a first certification stalls.

Design changes (7.3.9). Every change after release, assessed for impact on safety and performance, re-verified or re-validated where needed, and recorded in the DHF. Undocumented changes are the other common reason.

If you design nothing — you import finished devices under your own label, for instance — clause 7.3 can be excluded, but only with a written justification in the quality manual, and only if the exclusion does not affect your ability to meet regulatory requirements. An exclusion is a decision, not an omission.

The risk management file — the document that runs through everything

Clause 7.1 requires risk management to be built into product realization planning, not bolted on afterwards. The referenced standard is ISO 14971, and the risk management file it asks for covers each device family across the full lifecycle — design, production, and post-market. What the auditor looks for is a file, not a feeling: hazards identified, risks estimated, controls applied, residual risk judged acceptable, and the whole thing updated when post-market data says otherwise. A risk file that stops at the design review is a photograph of a moving target. We take ISO 14971 apart in the next post in this series.

Production and traceability records — the proof the device was made right

Clause 7.5 is where the system meets the shop floor. Five record sets matter most.

The device history record, the DHR (clause 7.5.1). A record for each device or batch — what was made, from which materials, by whom, on which equipment, and who released it. No device leaves without a DHR. No exceptions.

Traceability (clause 7.5.9). A documented procedure for tracing every device, and for implantable devices, component-level traceability — enough to find every unit in the field if a correction is ever needed. If you cannot trace a device, you cannot recall it.

Process validation (clause 7.5.6). For processes whose output cannot be verified by later inspection — sterilization and some cleanroom processes are the usual examples — the process itself must be validated before production release. Software used in production or in the quality system needs the same treatment.

Sterilization records (clause 7.5.7). For devices supplied sterile: sterilization validation, batch records, and the sterility assurance level.

Calibration records (clause 7.6). For every piece of monitoring and measuring equipment: the standard used, the date, the result, and the next due date. Equipment found out of calibration triggers a documented evaluation of every measurement since its last good calibration — the record auditors ask for most, and the one most often missing.

Then the suppliers. Clause 7.4 asks for an approved supplier list with documented evaluation criteria, purchasing information detailed enough to describe what you are buying, and incoming inspection records (clause 7.4.3). Control follows risk: a critical component supplier gets far more scrutiny than a stationery vendor. If a supplier's part can hurt a patient, your records have to show you checked it.

The improvement loop — complaints, CAPA, audits and reviews

Clause 8 closes the loop, and it is where auditors decide whether your system works or only exists on paper:

Complaints (clause 8.2.2). Every complaint recorded, investigated, and evaluated for whether it is an adverse event that must be reported to the regulator. A complaint log with no reportability assessment is an open finding.

Post-market surveillance (clause 8.2.1). An active system for gathering field data — complaints, service records, published literature, regulatory databases — and feeding it back into risk management and corrective action. Passive complaint handling does not satisfy it.

Corrective and preventive action (clauses 8.5.2 and 8.5.3). Both, as separate documented processes. Corrective action fixes a nonconformity that happened; preventive action addresses one before it happens. ISO 13485 keeps preventive action explicit — unlike ISO 9001:2015, where it is folded away. Root cause analysis is required, and effectiveness must be verified before the record is closed.

Internal audit (clause 8.2.4) and management review (clause 5.6). A documented audit schedule covering all processes, auditors independent of the areas they audit, findings recorded with corrective actions and due dates, effectiveness verified before closure. And a management review with documented inputs — audit results, complaint data, process performance, CAPA status — and documented outputs. Minutes that say "all good" are not a review.

The India layer — your CDSCO licence already built half of this

Here is the part most guides skip, and the one that saves Indian makers the most work. Under the Medical Devices Rules, 2017, making a device in India needs a CDSCO licence — classes A to D by risk — and the Fifth Schedule to those Rules sets out a quality management system that mirrors ISO 13485:2016 closely. If you already hold a manufacturing licence, you have built much of what an ISO 13485 auditor asks for.

The two are still different things. The licence is mandatory — without it, you cannot legally make or sell the device in India. The certificate is voluntary — audited proof, to a hospital chain, a tender board or an overseas buyer, that your system meets the international standard. One is permission. The other is proof. Our ISO 13485 and CDSCO guide sets out where the licence stops and the certificate starts, including your device's licence class.

So start your document build from your Fifth Schedule system, not from a blank page. Map each Fifth Schedule requirement to its ISO 13485 clause, fill the gaps — design controls and the risk management file are the usual ones — and the checklist is shorter than the kit sellers told you.

The 2026 change — the FDA's QMSR makes these documents do double duty

On 2 February 2026, the US FDA's Quality Management System Regulation — the QMSR — took effect, replacing the old Quality System Regulation under 21 CFR Part 820. The new rule incorporates ISO 13485:2016 by reference. The practical consequence: the same documents you build for ISO 13485 certification are now the baseline documents for selling into the United States.

It is not equivalence. The FDA kept a handful of its own requirements in Part 820 — on record control, labelling and packaging — and it will not require or issue ISO 13485 certificates. A certificate does not, by itself, demonstrate FDA compliance. But for a maker who already holds one, the QMSR means one document set serves two markets. Build your documents once, to the standard, and check the FDA-specific additions separately. The old QSIT inspection technique was withdrawn the same day.

Writing order — which document first

Most makers start with the quality manual and stall. Start somewhere else. First, the scope and the roles (clauses 4.2.2 and 4.1.1). Decide what the system covers and who you are — changing these later means rewriting half the set. Second, the product descriptions and flow diagrams. What you make, what goes into it, and how it moves through your unit. Third, the risk management file. Before you write procedures, know what can go wrong — the risk file decides which controls matter. Fourth, the procedures themselves — document control, record control, purchasing, production control, complaints, CAPA, internal audit. Write each one from the process as it actually runs. Fifth, the design file — built device by device. Last, the quality manual. It describes the system, and you cannot describe a system that does not exist yet. Write it last and keep it short.

Ready-for-audit checklist

Run through this before you invite the certification body. Fifteen points, each one tied to a clause the auditor will check.

1. Quality manual written, scope stated, exclusions justified — clause 4.2.2.
2. Quality policy signed by top management, communicated to staff — clause 5.3.
3. Quality objectives measurable, tracked, reviewed — clause 5.4.1.
4. Management representative named in writing — clause 5.5.2.
5. Roles under the regulations documented — clause 4.1.1.
6. Medical device file exists for every device type, with an index — clause 4.2.3.
7. Document and record control procedures in use, with a retention rule written down — clauses 4.2.4 and 4.2.5.
8. Design file complete for each device — plan to changes, DHF assembled — clauses 7.3.2 to 7.3.10.
9. Risk management file per device family, current, linked to post-market data — clause 7.1 and ISO 14971.
10. Approved supplier list with evaluation criteria and incoming inspection records — clauses 7.4.1 and 7.4.3.
11. Device history record for every batch, traceability tested end to end — clauses 7.5.1 and 7.5.9.
12. Process validation and sterilization records current where they apply — clauses 7.5.6 and 7.5.7.
13. Calibration records current, out-of-calibration evaluations on file — clause 7.6.
14. Complaints logged with reportability assessed; CAPA records closed only after effectiveness verified — clauses 8.2.2, 8.5.2 and 8.5.3.
15. At least one internal audit and one management review completed, with minutes — clauses 8.2.4 and 5.6.

If any point is blank, that is your next job. Do not invite the auditor until the list is green — a Stage 1 audit that finds the system half-built costs you the fee and the timetable.

What it costs and how long it takes

Certification has two bills. The consultancy — gap analysis, documentation, training, internal audit support — is one. The certification body's audit fee is the other, quoted per unit after the body sees your scope; no fixed tariff exists. On the consultancy side, our ISO 13485 packages are ₹14,999 for a Standard single-site unit and ₹29,999 for Growth, with certification-body fees extra at actuals — the detail is in our ISO 13485 cost guide, and our ISO 13485 certification page sets out the process end to end.

On time, published guides genuinely disagree: one puts a small manufacturer at 20 to 34 weeks, another says 6 to 12 months overall. Both can be right — it depends on how much of the system already exists and whether sterile or implantable devices are in scope. What the guides agree on is the running-in period: auditors expect the system to be operating, with real records, for roughly three months before the Stage 2 audit. A system with no history cannot be verified, so the three months are not a delay. They are the evidence.

5 mistakes that cost device makers their certificate

1. Buying a document kit and filing it unread. A kit gives you templates. An auditor gives you questions. If nobody in your unit can explain a procedure in their own words, the document is not yours, and the audit will show it. Use templates as a starting point, then rewrite them in your own process.

2. A design file built backwards. Writing the DHF after the device is in the market, from memory, is the single most common design finding. Build the file as the design moves — plan, inputs, outputs, reviews — and the audit becomes a walkthrough, not a reconstruction.

3. Traceability that stops at the warehouse door. If you can trace a batch to your distributor but not to the hospital that fitted it, your traceability is incomplete. Test it: pick a serial number at random and follow it to the patient-side end. If the chain breaks, fix it before the auditor tests it.

4. CAPA records closed without checking they worked. A corrective action is not done when the fix is applied. It is done when you have evidence the fix worked. Closing a CAPA on the day of the fix is a finding, not a shortcut.

5. No records before the audit. A system with no history cannot be verified. Run it, log it, audit it internally, review it — then invite the certification body.

Frequently asked questions

What documents are required for ISO 13485 certification?
The standard names a core set: the quality manual, policy and objectives, the roles you undertake, a medical device file for each device type, procedures for document and record control, design controls with a design history file, a risk management file, purchasing and supplier controls, production and traceability records, and the improvement records — complaints, CAPA, internal audit and management review.

Is a quality manual mandatory for ISO 13485?
Yes. Unlike ISO 9001:2015, which dropped the requirement, ISO 13485:2016 still requires a quality manual. Clause 4.2.2 is the clause devoted to it, and clause 4.2.1 lists it among the documents your quality system must hold. It must state the scope of the system, justify any permitted exclusions, and describe how your processes interact.

How many documents does ISO 13485 require?
The standard sets no number. One specialist guide puts it at over twenty procedures; kit sellers will sell you a hundred or more. The named documents plus the record set usually come to around twenty to forty for a single-site maker. Judge by coverage, not count.

How long must ISO 13485 records be kept?
At least the lifetime of the device, and never less than two years from the date of release, whichever is longer. Your own procedure must state the period, and you must follow it. Some regulations demand more — under the EU Medical Device Regulation, technical documentation must be kept for ten years after the last device was placed on the market, fifteen for implantables.

Does ISO 13485 replace my CDSCO licence?
No. The licence under the Medical Devices Rules, 2017 is mandatory — without it, you cannot legally make or sell the device in India. ISO 13485 certification is voluntary. The Fifth Schedule quality system mirrors much of ISO 13485, so a licensed manufacturer has already built a good part of the system — but the certificate is a separate, audited proof for buyers, tenders and export markets.

The documents are not the system. They are the map of it. Build the system first — the hazard thinking, the traceability discipline, the daily habit of writing things down as they happen — and the documents almost write themselves. Build the documents first and the system never arrives. If you want help turning your unit's real processes into a set that survives an audit, start with our ISO 13485 certification page, check a certificate you already hold with our guide to checking an ISO certificate, or run your numbers through the compliance fee calculator.