QMSR & ISO 13485 Gap Audit for Medical Device Manufacturers
Is your medical device quality management system ready for the US FDA's Quality Management System Regulation (QMSR) and ISO 13485:2016 requirements? The QMSR & ISO 13485 Gap Audit from Cosmetic Compliance Nest helps medical device businesses evaluate their existing quality management processes, identify potential compliance gaps, and plan corrective improvements.
Effective February 2, 2026, the FDA's QMSR incorporates ISO 13485:2016 by reference, with additional FDA-specific requirements and provisions. Medical device manufacturers need to understand how these requirements apply to their operations, documentation, and quality processes.
Our gap audit service provides a structured review of your existing quality management system against the applicable requirements, helping you identify areas that may need attention before an FDA inspection, internal audit, or other quality compliance activity.
What Is a QMSR & ISO 13485 Gap Audit?
A QMSR and ISO 13485 gap audit is a systematic assessment of an organisation's existing quality management system against selected applicable regulatory and quality management requirements.
The review helps identify differences between your current procedures and the requirements relevant to your medical device operations. These may include document control, risk management, design and development, supplier controls, production processes, complaint handling, corrective and preventive action, and record management.
The objective is to provide a clearer picture of your current compliance position and support the development of a practical action plan to address identified gaps.
What Does the Gap Audit Cover?
- QMSR Requirements Review: Assess relevant FDA Quality Management System Regulation requirements applicable to your organisation and activities.
- ISO 13485:2016 Assessment: Review relevant quality management system processes against the applicable ISO 13485 requirements.
- Document Control: Examine applicable procedures for document approval, revision control, distribution, and retention.
- Management Responsibility: Review relevant quality responsibilities, management oversight, and quality planning processes.
- Risk Management: Assess how applicable risk management activities are integrated into relevant quality processes and product lifecycle activities.
- Design and Development Controls: Review applicable design planning, design inputs and outputs, verification, validation, and change control processes.
- Supplier and Purchasing Controls: Assess relevant supplier evaluation, purchasing controls, and monitoring procedures.
- Production and Process Controls: Review applicable manufacturing controls, process validation, identification, traceability, and related records.
- Complaint Handling and Feedback: Examine relevant procedures for customer feedback, complaint evaluation, investigation, and escalation.
- Nonconformity and Corrective Action: Assess processes for managing nonconforming products, investigating causes, implementing corrective actions, and checking effectiveness.
- Records and Regulatory Documentation: Review applicable quality records and documentation against the agreed audit scope.
The specific audit criteria depend on your organisation's activities, device types, existing quality management system, and applicable regulatory requirements.
Who Should Consider This Service?
- Medical device manufacturers supplying or planning to supply the US market.
- Organisations reviewing their quality management system against the FDA's QMSR.
- Businesses implementing or maintaining an ISO 13485:2016-based quality management system.
- Manufacturers preparing for an internal audit or regulatory inspection.
- Companies seeking to identify quality system weaknesses before implementing corrective improvements.
- Medical device businesses reviewing existing procedures following regulatory or operational changes.
Our QMSR & ISO 13485 Gap Audit Process
- Initial Assessment: Understand your organisation, device types, manufacturing or service activities, and existing quality management system.
- Scope Definition: Agree on the applicable audit criteria, processes, locations, and documentation to be reviewed.
- Documentation Review: Examine relevant quality manuals, procedures, records, and supporting documentation within the agreed scope.
- Requirements Assessment: Compare the available evidence against applicable QMSR and ISO 13485:2016 requirements.
- Gap Identification: Identify potential nonconformities, documentation gaps, and processes that may need improvement.
- Findings and Recommendations: Present the findings and practical recommendations in accordance with the agreed deliverables.
- Corrective Action Planning: Help prioritise improvement activities and establish a plan for addressing the identified gaps.
What Are the Benefits of a Gap Audit?
- Improved Regulatory Awareness: Understand the QMSR and ISO 13485 requirements relevant to your operations.
- Early Gap Identification: Identify potential weaknesses before they lead to more significant compliance issues.
- Structured Improvement Planning: Use documented findings to organise corrective and preventive activities.
- Better Documentation Control: Identify areas where quality procedures and records may need to be reviewed or updated.
- Risk-Based Prioritisation: Focus improvement efforts on issues relevant to product quality, patient safety, and regulatory compliance.
- Inspection Preparation: Support preparation for applicable regulatory inspections through improved awareness and organisation of quality system evidence.
Documents and Information You May Need
Depending on the agreed audit scope, the following information may be requested:
- Quality manual and quality management system overview.
- Document control and record management procedures.
- Risk management procedures and relevant records.
- Design and development documentation, where applicable.
- Supplier qualification and purchasing control records.
- Production, process validation, and traceability records, where applicable.
- Complaint handling, nonconformity, and corrective action procedures.
- Internal audit records and management review documentation.
- Applicable regulatory procedures and previous audit findings.
Not every document will apply to every organisation. The required evidence depends on the device, business activities, applicable exclusions or exceptions, and the agreed audit criteria.
QMSR and ISO 13485: Understanding the Relationship
ISO 13485:2016 establishes quality management system requirements for organisations involved in medical devices and related services. The FDA's QMSR incorporates ISO 13485:2016 by reference while retaining additional FDA-specific requirements and provisions.
Meeting ISO 13485 requirements should not automatically be treated as proof that every FDA obligation has been met. A suitable assessment must also consider the applicable provisions of the QMSR and other relevant FDA regulations.
Frequently Asked Questions About QMSR & ISO 13485 Gap Audits
Visit our dedicated Frequently Asked Questions page for further information about QMSR requirements, ISO 13485, audit preparation, documentation, and quality management system improvement.
Assess Your Quality Management System
Take a structured approach to reviewing your medical device quality management system. The QMSR & ISO 13485 Gap Audit from Cosmetic Compliance Nest can help your organisation identify potential gaps, understand applicable requirements, and plan the next steps towards improving its quality processes.
Important Disclaimer
Cosmetic Compliance Nest provides independent quality and regulatory consultancy services and is not affiliated with or endorsed by the US Food and Drug Administration (FDA) or the International Organization for Standardization (ISO). A gap audit is an assessment against the agreed criteria and available evidence; it does not guarantee regulatory compliance, successful certification, or a favourable inspection outcome. Formal certification, where required, must be conducted by an appropriately accredited certification body. Audit scope, deliverables, and any follow-up support are subject to the agreed service terms.