ISO 13485 Surveillance and Renewal: Post-Market Surveillance in the Audit Cycle

Your ISO 13485 certificate lasts three years. In years one and two, a surveillance audit checks the system still works. In year three, recertification re-examines the whole thing before expiry. The auditor's main question at a surveillance visit: your post-market surveillance — what your devices have done in patients' hands since the last audit, and what you did about it.

What is an ISO 13485 surveillance audit?

A surveillance audit is the certification body's yearly check that your quality management system still meets ISO 13485:2016 and still works in practice. It is not a repeat of the initial certification audit. The auditor samples — they pick a slice of the system, follow it through, and test whether the records match reality. The first surveillance audit must happen no later than 12 months after the last day of your Stage 2 audit, and after that at least once in every calendar year. Miss the window and the certification body can suspend the certificate. The expiry date never moves. A late surveillance audit only squeezes the time you have left before recertification.

That table is the whole cycle. Everything below is about surviving the two middle rows — because that is where most certificates quietly die. In a slow drift: complaints logged but never trended, a CAPA closed without proof it worked, a risk file nobody has touched since certification day.

What a surveillance audit actually checks

The standard does not let the auditor wander. Every surveillance audit must look at the same backbone, then sample the rest. If you keep these eight things clean, the visit stays calm.

1. Complaints — every one, with a reportability decision

Clause 8.2.2 says every complaint gets evaluated for whether it is a reportable adverse event. The auditor will pull a handful of complaints and ask three questions: was it logged, was the reportability decision recorded, and did anything happen as a result? A complaint that sits in a spreadsheet with no decision is a finding waiting to happen. The decision matters as much as the complaint — a written "not reportable, because…" is evidence. Silence is not.

2. Post-market surveillance data — the file the auditor reads first

Clause 8.2.1 requires a feedback system that gathers experience from devices already on the market and feeds it back into risk management. This is the part that makes a 13485 surveillance audit different from, say, a 9001 one. A 9001 auditor asks whether customers are happy. A 13485 auditor asks whether your devices are hurting anyone, and whether you would know if they were.

3. CAPA — and whether the fix actually worked

Corrective action (8.5.2) and preventive action (8.5.3) are both mandatory in 13485 — unlike ISO 9001:2015, which dropped preventive action. The auditor checks two things: did you close the corrective actions from the last audit, and did you verify the fix worked before closing them? A CAPA closed on the day the new form was issued, with no follow-up data, is not closed. It is postponed. Unresolved minor nonconformities from the last audit get re-issued at the next one — and an unresolved minor escalates to a major.

4. The risk file — updated, or frozen since certification?

Risk management sits under clause 7.1, and ISO 14971 expects production and post-production information to feed back into the risk file (clause 10 of 14971). The auditor will ask what has changed in your risk file since the last visit. A new hazard from a complaint, a severity revised after a field incident, a risk control added after a design change — that is a living file. A risk file with the same date stamp as certification day tells the auditor the system is decorative. If you want the full picture of how the risk file works, read our ISO 14971 risk management guide.

5. Design changes and the device file

Design changes go through clause 7.3.9, and the medical device file (4.2.3) must reflect the device as it is sold today, not as it was designed two years ago. The auditor picks one change — a material substitution, a supplier switch, a software update — and traces it from the change request through verification or validation to the updated file. A change with no record is, for audit purposes, a change that never happened. Which is worse than a badly documented one.

6. Traceability, validation and calibration

Traceability (7.5.9), process validation (7.5.6), sterilization validation (7.5.7) and calibration (7.6) are the production spine. The auditor samples: pick a batch, trace it forward to the customer and back to its raw materials; check that a validated process still runs inside its validated window; check that the instruments that measured it were calibrated when the measurement was taken. These are the checks that catch a system running on habit instead of records.

7. Suppliers and outsourced processes

Purchasing controls (7.4.1/7.4.3) get sampled every year: was the supplier re-evaluated, did incoming inspection catch anything, is the quality agreement current? For an own-label importer, this is where the audit lives — your QMS is largely your control over the actual manufacturer. Our guide for importers and private labels covers that arrangement in detail.

8. Internal audit, management review and regulatory reporting

Internal audit results (8.2.4), management review (5.6) and reporting to regulatory authorities (8.2.3) close the loop. The auditor wants to see that your own internal audit found something — an internal audit that finds nothing, year after year, reads as an audit that looked at nothing. And management review must show decisions, not just attendance. If the review minutes say "system is effective" with no numbers behind it, expect a question.

Post-market surveillance: the spine of the audit

Think of a surgeon's follow-up. The operation went well — that was certification day. The follow-up visits are where a slow bleed shows up. Post-market surveillance is the follow-up. It is the systematic collection and analysis of data on a device after it reaches the market — and under ISO 13485 it is not optional. Clause 8.2.1 requires a feedback system, and clause 10 of ISO 14971 requires production and post-production information to flow back into risk management. The two clauses are one loop: what happens in the field changes what you know about the device, and what you know changes the risk file, the design, or the instructions.

A working PMS system has four parts, and the auditor will look for all four.

A plan. The PMS plan says what data you collect, from where, and how often you review it. For a device sold in Europe, the EU MDR is explicit: a PMS plan under Article 84, a PMS report under Article 85, and a Periodic Safety Update Report under Article 86. The PSUR rhythm is at least once a year for class IIb and III devices, and at least every two years for class IIa. ISO/TR 20416:2020 is the guidance most auditors expect you to have followed when building the plan.

Sources, not just complaints. Complaints are one source. The others matter just as much: service and repair records, returned goods, literature searches, registry data, distributor and user feedback, and data on similar devices. A PMS system that only counts complaints is a complaint system with a fancier name. The auditor will ask what you do with a service technician's note that a connector keeps cracking. If the answer is "nothing, it wasn't a complaint", the system has a hole.

Trend analysis. One incident is an event. Three of the same incident is a signal. The PMS review must look for meaningful increases in frequency or severity — the EU MDR's trend-reporting rule (Article 88) makes this explicit, and a good auditor will ask for your trend data even if you do not sell in Europe. Review minutes that show the same numbers quarter after quarter, with no comment, tell the auditor nobody read them.

Action. Surveillance that ends in a report nobody acts on is theatre. The loop closes when PMS data triggers a CAPA, a design change, a labelling update, a field safety corrective action, or a change to the risk file. The auditor traces one piece of PMS data to its outcome.

The three reporting clocks — FDA, EU and India

When a serious event happens, three different clocks can run at once. They are not the same, and the shortest one governs your week.

The FDA clock starts when any employee becomes aware of information that reasonably suggests a reportable event — not when a manager decides it is reportable. That detail is why complaint-intake escalation matters: the 30 days can be half gone before the file reaches the right desk. The 5-day clock is narrower — it starts when a manager over regulatory, scientific or technical staff recognises that remedial action is needed. For certain higher-risk devices, the FDA can also order a formal postmarket surveillance study under section 522 of the Food, Drug, and Cosmetic Act — a separate obligation on top of routine reporting.

India's position is messier than the brochures suggest. The binding duty is the licence condition in the Fifth Schedule of the Medical Devices Rules, 2017: the licence holder must inform the State or Central Licensing Authority of any suspected unexpected serious adverse event and take necessary action, including any recall, within 15 days of the event coming to notice. A recall itself falls under Rule 89, which requires the manufacturer to initiate a recall where a device is likely to pose a risk to patient health. Alongside that sits the Materiovigilance Programme of India (MvPI), run by the Indian Pharmacopoeia Commission since 2015 — the channel the regulator asks licence holders to use for reporting adverse events. In the five years to 2025, 46,593 medical device adverse events were reported through it. The honest part: the Drugs Technical Advisory Board, in August 2024, looked at a proposal to write mandatory reporting of reportable events into the Rules (amending Rules 3, 26, 38 and 65) and sent it back for a revisit — because, in its words, reporting of reportable events "is not clearly prescribed in the MDR and there is no mandatory requirement". As of November 2026, that amendment has not been notified. So, for an Indian manufacturer: the 15-day licence-condition intimation and Rule 89 recall are binding; MvPI reporting is the channel CDSCO asks you to use, and a surveillance auditor will ask whether you use it. Our CDSCO licensing guide covers how the licence and the certificate fit together.

One more date for exporters: the FDA's Quality Management System Regulation, which incorporates ISO 13485:2016 by reference, took effect on 2 February 2026. A surveillance audit now tests a system that serves both your Indian licence and the US market. That is the point of the certificate, really — one system, several regulators reading it.

What happens when the auditor finds something

Findings come in two sizes, and the difference is money and time. A minor nonconformity is a single lapse — one record missing, one procedure not followed once. It needs a corrective-action plan and evidence it was carried out. A major nonconformity is a systemic failure, or a minor that was never fixed. A major usually comes with a deadline to close it — the usual certification-body window is around 90 days — and if it is not closed, the certificate can be suspended. The 90-day figure is common practice among certification bodies, not a rule written in the standard, so your body's letter is the number that governs you.

Suspension is the step before withdrawal. A suspended certificate cannot be used — you cannot show it to a buyer or quote it in a tender. It stays suspended while you fix the problem and the body verifies the fix. If you do not, the certificate is withdrawn, and you start again from Stage 1. Most suspensions are not caused by a terrible audit. They are caused by a decent audit whose findings nobody answered in time.

What if you miss a surveillance audit?

Do not let it drift. The certification body's published procedure is blunt — one body's procedure says that if the client does not confirm the surveillance date within 7 days of the due date, it issues a suspension letter, then a cancellation letter. That 7-day timing is that body's own procedure, not a universal rule — but every body has a version of it. The audit date is not a meeting you can reschedule at will. The expiry date was fixed when the certificate was issued, and a missed surveillance audit does not extend it. It eats into your recertification window instead, and a recertification audit squeezed into the last weeks before expiry is the most expensive way to keep a certificate.

The recertification audit in year three

Recertification is a full re-evaluation of the whole management system — same scope as the initial Stage 2 audit, usually a little shorter because the certification body already holds your audit history. Start preparing three to six months before expiry. That is not a generous margin; it is the minimum that works, because the audit itself takes weeks to schedule, the report takes time to close, and the certification decision has to land before the old certificate expires. If the decision lands after expiry, there is a gap, and a gap means a period with no valid certificate — which is exactly the period a buyer or a tender will ask about.

What to assemble: the full document set from your documents checklist — quality manual, device files, design history files — plus the three years of evidence: internal audit reports and management reviews, CAPA records with effectiveness checks, complaint and PMS trend data, risk-file updates, supplier re-evaluations, calibration records, and the regulatory reporting log. The recertification auditor will read the surveillance history first. Two clean surveillance audits make the recertification visit shorter and cheaper. Two difficult ones make it longer.

What staying certified costs

There are two bills. Ours is fixed and published: ISO 13485 consultancy at ₹14,999 for the Standard tier and ₹29,999 for Growth, with certification-body audit fees extra at actuals. The body's fees vary with scope — number of sites, number of device families, audit days — and no certification body publishes a fixed tariff, so anyone quoting you a single number for a surveillance or recertification audit is guessing. A surveillance audit costs less than a recertification audit, because it samples instead of re-examining everything; and a certificate kept in good order costs less over three years than one rescued from suspension, because suspension means extra verification visits. The cheapest surveillance audit is the one where the auditor finds nothing to write up — and that comes from the routine below, run all year.

Five mistakes that lose certificates

1. Treating surveillance as a formality. The team that prepared heroically for Stage 2 and then relaxes is the team that fails year one. The audit is smaller, not easier.

2. Complaints with no reportability decision. Every complaint needs a recorded decision on whether it is reportable, including the ones you decide are not. An undecided complaint is an unmade decision, and auditors read it as a system that does not decide.

3. Closing CAPAs without proof. A corrective action is closed when the fix is verified effective, not when the form is filled in. Close it early and the next auditor re-opens it as a major.

4. A risk file frozen at certification. If nothing from the field has changed your risk file in a year, the auditor will conclude either that your PMS is not working or that your risk process is not listening to it. Both are findings.

5. Letting the audit date drift. The expiry date is fixed at issue. A surveillance audit that slips by a month does not buy you a month — it costs you one.

A simple year-by-year routine

Every month: log every complaint the day it arrives, with a reportability decision; review service and repair notes for signals that never became complaints; check calibration due dates for the coming month.

Every quarter: run the PMS trend review — complaint rates by device family, repeat failures, service patterns — and record the conclusion, even when the conclusion is "no signal"; review open CAPAs and chase the ones past their due date; confirm the next surveillance audit date with the certification body.

Every year: complete the internal audit programme and hold the management review with real numbers in front of the room; update the risk file from the year's PMS data; re-evaluate suppliers; run a mock traceability exercise — pick a batch, trace it both ways, time it; and in year three, start recertification preparation six months before expiry, not three.

There is no trick to passing a surveillance audit. There is only a system that was running the week before the auditor arrived, not assembled the night before.

Frequently asked questions

How long is an ISO 13485 certificate valid?

Three years from the certification decision. A surveillance audit takes place in year one and year two, and a full recertification audit must be completed before the expiry date. The expiry date is fixed at issue and does not move.

What does an ISO 13485 surveillance audit check?

It samples the system: complaints and their reportability decisions, post-market surveillance data, CAPA effectiveness, risk-file updates, design changes, traceability, validation, calibration, supplier controls, internal audit and management review. It is a sampling audit, not a full re-examination — that comes at recertification.

What is post-market surveillance under ISO 13485?

The systematic collection and analysis of data on a device after it reaches the market — complaints, service records, literature, registries and user feedback — required by clause 8.2.1 and fed back into risk management under ISO 14971. For Europe, the MDR adds a PMS plan, PMS report and Periodic Safety Update Report; ISO/TR 20416:2020 is the guidance manufacturers use to build the system.

How long do I have to report a serious incident?

To the FDA: 30 calendar days for a death, serious injury or reportable malfunction, or 5 work days when remedial action is needed to prevent an unreasonable risk of substantial harm. To the EU: 15 days for a serious incident, 10 days for a death or unanticipated serious deterioration, 2 days for a serious public health threat. In India: 15 days to the licensing authority for a suspected unexpected serious adverse event, under the licence condition in the Medical Devices Rules, 2017.

Can my ISO 13485 certificate be suspended?

Yes. A major nonconformity that is not closed within the certification body's deadline — usually around 90 days — can lead to suspension, and a suspended certificate that is not restored is withdrawn. Missing a surveillance audit can also trigger suspension. A suspended certificate cannot be used with buyers or in tenders until it is restored.

Certification day is the easy part. The three years after it are the certificate. Keep the complaints decided, the surveillance data trended, the CAPAs proven and the audit dates confirmed — and the renewal takes care of itself. If you want help keeping the system audit-ready through the cycle, our ISO 13485 certification service covers the full three years, not just the first audit. And if you are weighing the cost of the next three years, run the numbers on our compliance fee calculator first.