Key Takeaways
A QMS aligned to ISO 13485:2016 now satisfies both EU MDR and FDA QMSR (effective February 2, 2026), making a single integrated system the audit-proof standard.
Four subsystems — validation, CAPA, traceability, and post-market surveillance (PMS) — account for the majority of audit nonconformities and inspector observations across notified body and FDA inspections.
Audit readiness is not a sprint before an inspection; it is a daily operating discipline embedded into SOPs, records, and management review cycles.
Overseas distributors vetting OEM partners should request objective evidence packages for each subsystem, not just a copy of a certificate.
SLK Medical’s validation protocols and closed-loop CAPA metrics demonstrate what a document-ready, inspection-grade QMS looks like at a manufacturer level.
Introduction: Why Most QMS Files Fail Under Real Audit Conditions
Medical device quality management systems fail audits for a predictable reason: they were built to pass certification, not to survive scrutiny. An ISO 13485 certificate on the wall tells you the system existed at a point in time. It does not tell you whether validation protocols are current, whether CAPA files are actually closed with evidence of effectiveness, whether traceability runs from raw material lot to distribution record, or whether post-market surveillance data has fed back into the risk management file in the last quarter.
For overseas distributors of advanced wound care products — particularly those operating in regulated markets under EU MDR, FDA QMSR, and equivalent frameworks — this distinction is commercially critical. A single major nonconformity at a notified body audit, or a Form 483 observation from an FDA inspector, can trigger a hold on product that cascades into missed hospital tenders, broken supply contracts, and regulatory standing damage that takes years to repair.
This guide provides a comprehensive, clause-referenced framework for building and evaluating a QMS that does not just meet the standard — it withstands the audit.
Part 1: The Regulatory Landscape in 2026
1.1 FDA QMSR: ISO 13485 Is Now U.S. Law
On February 2, 2024, the FDA finalized the Quality Management System Regulation (QMSR), which amends 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. The rule took effect on February 2, 2026, replacing the decades-old QS Regulation as the governing framework for finished device manufacturers distributing in the United States.
The practical consequence for manufacturers and their distribution partners:
Dimension | Old QSR (21 CFR Part 820) | QMSR (in force Feb 2026) |
|---|---|---|
Core framework | FDA-specific cGMP text | ISO 13485:2016 incorporated by reference |
Risk management | Limited, prescriptive clauses | Lifecycle-wide, consistent with ISO 14971 |
Documentation | DHR/DMR/DHF terminology | ISO 13485 structure + FDA-specific additions |
Management review | Not subject to FDA inspection | Now inspectable |
Internal audit records | Largely exempt | Now inspectable |
Importantly, ISO 13485 certification is not required — compliance with the regulation is. But manufacturers who hold a current ISO 13485 certificate from an accredited body are in the best position for QMSR inspections, provided the underlying QMS is genuinely functional, not ceremonial.
1.2 EU MDR: Continuous Evidence, Not One-Time Submission
EU Regulation 2017/745 (MDR) raises the bar beyond predecessor MDD requirements in ways that directly affect wound care product manufacturers. Under MDR:
Clinical evaluation must be an ongoing, systematic process — not a one-time pre-market document.
Post-market clinical follow-up (PMCF) must be defined and conducted, with results feeding the clinical evaluation report.
Post-market surveillance must actively collect and trend field data, complaint data, and real-world performance evidence.
Traceability requirements are reinforced through UDI obligations and enhanced economic operator responsibilities.
For silicone foam, silver antimicrobial, and super-absorbent wound dressings, notified bodies conducting MDR audits under Article 56 and Annex IX are specifically examining whether the PMS plan, PMCF plan, and periodic safety update report (PSUR) are internally consistent and properly maintained.
1.3 ISO 13485:2016: The Universal Foundation
ISO 13485 remains the universal baseline. It is required for CE marking, referenced by FDA QMSR, recognized by MDSAP participating countries, and demanded as table stakes by procurement and hospital tender committees in virtually every regulated market.
Key audit-sensitive clauses:
Clause | Subject | Common Audit Finding |
|---|---|---|
4.1.6 | QMS software validation | Software used for regulated records lacks validation evidence |
7.3.7 | Design validation | Validation done retrospectively or without approved protocol |
7.5.6 | Traceability | Implantable/tracked device traceability gaps |
8.5.2 | Corrective action | CAPA closed without documented effectiveness check |
8.5.3 | Preventive action | Preventive action not distinguishable from corrective action |
Part 2: Validation — Proving the Process Before the Inspector Asks
2.1 What Auditors Are Looking For
Design and process validation consistently appears in the top categories of ISO 13485 audit nonconformities and FDA Form 483 observations. Auditors are not looking for perfect results — they are looking for planned, controlled, documented, and linked execution.
A validation package that withstands audit contains:
Validation plan — approved before execution begins, with acceptance criteria, responsible parties, and scope definition
IQ/OQ/PQ protocols and reports for critical equipment and processes (sterilization, coating, adhesive bonding)
Representative product rationale — documented justification for why the selected product/lot represents the full production range
Linkage to design inputs — validation outputs must trace back to user needs and design input requirements
Deviation management — any deviations from the protocol addressed with formal documentation and approval
Revalidation triggers — defined criteria for when revalidation is required (equipment change, process parameter shift, facility change)
For wound care dressings specifically, sterilization validation (ISO 11135, ISO 11137, or ISO 25424 depending on method), package integrity validation, and shelf-life/accelerated aging studies are the most audit-sensitive validation categories.
2.2 Software Validation: The Overlooked Requirement
ISO 13485 Clause 4.1.6 requires validation of QMS software used for regulated records. This includes eQMS platforms, complaint management systems, CAPA tracking tools, training management systems, and electronic batch records. Under 21 CFR Part 11 (for FDA-regulated records), electronic signature controls and audit trail requirements add additional layers.
A defensible software validation package includes:
Validation plan with risk-based approach
User requirements specification (URS)
IQ evidence (installation verification)
OQ evidence (function per specification)
PQ evidence (performance in production environment)
Periodic review and change control records
2.3 The SLK Medical Validation Standard
SLK Medical’s validation approach for silicone foam dressing manufacturing is designed to meet the simultaneous requirements of CE MDR and FDA QMSR. For each critical process — silicone coating adhesion, wound contact layer lamination, and sterilization cycle — validation packages include pre-approved protocols with defined acceptance criteria, traceable test data, statistical sampling rationale, and a direct link to the design history file.
Revalidation is triggered by any of the following: equipment replacement or major maintenance, raw material supplier change, process parameter modification, or validated shelf-life extension requests. This mirrors what auditors expect: a live, controlled process, not a certificate filed once and never revisited.
Part 3: CAPA — The Audit Subsystem That Most Often Fails
3.1 Why CAPA Files Are Consistently a Major Finding
CAPA (Corrective and Preventive Action) is the most inspected subsystem in both ISO 13485 audits and FDA inspections. The reason is structural: CAPA is the mechanism by which a QMS proves it improves. An auditor reviewing a CAPA file is not just checking boxes — they are evaluating whether the organization can identify a real problem, find its root cause, fix it, and prove the fix worked.
The three most common CAPA failures:
Closure without effectiveness evidence — CAPA marked “closed” based on implementation of an action, not verification that the problem did not recur.
Root cause not adequately investigated — The stated root cause is a symptom or proximate factor, not the system-level cause that, if corrected, would prevent recurrence.
CAPA not triggered by complaint or nonconformance trends — Individual events investigated in isolation, without trend analysis identifying systemic issues.
3.2 Building a CAPA File That Withstands Audit
A compliant CAPA record under ISO 13485 §8.5.2 and FDA 21 CFR §820.100 contains the following elements in sequence:
Step 1 — Source identification Document the input that triggered the CAPA: complaint, internal audit finding, nonconforming product, management review output, or trend analysis result.
Step 2 — Problem statement Define the problem in objective, measurable terms. “Adhesion failure on wound contact layer” is actionable. “Quality issue” is not.
Step 3 — Root cause analysis Use a structured method: fishbone/Ishikawa, 5-Why, fault tree analysis, or equivalent. Document the method used, the team involved, and the conclusion. The conclusion must be specific enough to be actionable and verifiable.
Step 4 — Action plan Define corrective actions (eliminating the root cause of an existing nonconformity) and preventive actions (eliminating potential causes in similar processes). Each action requires an owner and a target date.
Step 5 — Implementation verification Document that each action was implemented as planned. This is not the effectiveness check — it is confirmation that the action occurred.
Step 6 — Effectiveness check (the most commonly missing element) Define — ideally at the time the CAPA is opened, not at closure — the specific criteria for effectiveness, the monitoring window, the data source, and the responsible reviewer. A CAPA is only effective if the root cause has been eliminated and the problem has not recurred within the defined window.
Step 7 — Closure Document the effectiveness check results, reviewer sign-off, risk reassessment (if applicable), and rationale for closure.
3.3 CAPA Metrics: What Good Looks Like
Distributors vetting OEM partners should ask for CAPA performance metrics as part of due diligence. Metrics that indicate a functional CAPA system include:
Metric | Target Benchmark | Red Flag |
|---|---|---|
CAPA cycle time (open to close) | 30–90 days (complexity-adjusted) | >180 days without documented justification |
First-time effectiveness rate | >85% | <70% suggests root cause investigation is weak |
Recurrence rate (same issue, re-opened CAPA) | <10% | >20% indicates systemic CAPA process failure |
Complaint-to-CAPA conversion rate | Trend-based, defined threshold | No complaints ever escalated to CAPA |
Preventive action ratio | >30% of CAPA records | Near-zero indicates reactive-only culture |
SLK Medical’s CAPA tracking system maintains closed-loop records with timestamps for each stage, effectiveness criteria defined at opening, and independent review at closure. When distributors request a CAPA log summary as part of supplier qualification, these metrics are available as documented evidence — not aggregated estimates.
Part 4: Traceability — The Chain of Evidence Auditors Follow
4.1 What Full Traceability Requires
Traceability in a medical device QMS is not simply the ability to recall a product by lot number. It is the documented ability to trace, in both directions, from:
User need → design input → design output → verification → validation
Raw material lot → production record → acceptance testing → finished device → distribution record
Complaint → investigation → CAPA → design/process change → re-verification
ISO 13485 §7.5.6 requires that traceability be implemented to the extent required by regulatory requirements and product risk. For wound care dressings, this typically means:
Lot/batch traceability from raw material through finished goods
UDI-DI and UDI-PI assignment and linkage to distribution records (EU MDR Article 27, FDA 21 CFR Part 830)
DHF/DMR/DHR linkage (design inputs, specifications, and history records cross-referenced)
Distribution records sufficient to support a targeted recall
4.2 The Traceability Matrix: Keeping It Live
The design traceability matrix — linking design inputs to design outputs, verification tests, and validation evidence — is one of the first documents requested in a notified body audit. The most common finding: the matrix exists but has not been updated after design changes.
A robust traceability matrix:
Is version-controlled and linked to the design history file
Is updated as part of the design change process (not after the fact)
Links each requirement to at least one verification or validation record (not just a document ID)
Is consistent with the current risk management file (ISO 14971)
Identifies any open verification gaps with rationale
For distributor due diligence purposes, ask the OEM manufacturer to confirm that their design traceability matrix is current to the last approved design change, and that UDI records are linked to distribution logs.
4.3 Production Traceability: The DHR Standard
The Device History Record (DHR) — or equivalent under ISO 13485 terminology — is the production-side traceability document. For a wound care dressing, a complete DHR includes:
Manufacturing date and quantity manufactured
Primary raw material lot numbers and supplier certificates
Critical process parameters (e.g., sterilization cycle data, coating line settings)
In-process inspection results and acceptance criteria
Final release test results
Finished goods lot/batch number and UDI
Distribution record (who received the lot, in what quantity, on what date)
Gaps in DHR completeness are among the most common observations in FDA inspections of device manufacturers.
Part 5: Post-Market Surveillance — The Closed Loop That Proves the QMS Works
5.1 PMS as an Active System, Not a Filing Cabinet
Post-market surveillance is the mechanism by which a QMS demonstrates it learns from real-world performance. Under EU MDR Article 83 and Annex III, PMS is a continuous, systematic process — not an annual report. Under FDA QMSR and 21 CFR Part 803, complaint handling and MDR reporting are mandatory elements of an operational quality system.
The distinction auditors draw: passive complaint recording versus active trend analysis. A PMS system that collects complaints but does not trend them, does not compare performance to pre-defined thresholds, and does not feed outputs into CAPA or risk management will receive a major finding.
5.2 PMS Plan and PSUR Requirements Under EU MDR
For EU MDR-regulated devices, the PMS plan must define:
Data sources to be monitored: complaints, warranty returns, field service reports, scientific literature, vigilance reports, registry data, sales and usage data
Trending methodology: how individual events are aggregated and analyzed for signals
Escalation thresholds: at what point does a trend trigger a CAPA, a field safety corrective action (FSCA), or a PMCF update
Review frequency: how often PMS data is formally reviewed and by whom
The Periodic Safety Update Report (PSUR) — required for Class IIa, IIb, and III devices — must summarize PMS findings, compare them to the benefit-risk assessment, and document any actions taken. This report must be kept current and available for notified body review.
For Class I devices, a periodic summary evaluation report is required instead.
5.3 The PMS → CAPA → Risk File Feedback Loop
The audit test for PMS is not whether the plan exists — it is whether PMS outputs are actually influencing product and process decisions. Auditors look for documented evidence that:
PMS data triggered at least one CAPA in the review period
PMS outputs were presented at management review
Risk management files were updated when PMS identified a new hazard or changed probability estimates
Labeling or IFU was updated if PMS identified a use error pattern
For wound care distributors, this feedback loop is also commercially relevant: a manufacturer whose PMS system identifies and resolves adhesion complaints faster than a competitor’s creates measurable supply reliability advantage. It is worth asking OEM partners how their PMS findings have been actioned in the past 12 months.
5.4 PMCF for Wound Dressings
Postmarket clinical follow-up under MDR Annex XIV Part B requires manufacturers to proactively gather clinical data on device performance in real-world use. For advanced wound care dressings, PMCF options include:
Structured literature surveillance with defined search protocol
Registry participation or registry-equivalent data collection
User surveys (clinicians, wound care specialists, distributors)
Case report collection programs
Post-market clinical studies where literature evidence is insufficient
The PMCF plan must explain why the chosen method is appropriate given the device’s risk class and clinical claims. A PMCF evaluation report must be updated at least annually and linked to the clinical evaluation report.
Part 6: Audit-Ready Documentation Architecture
6.1 The Document Retrieval Standard
Experienced auditors assess document control and retrieval speed as a proxy for QMS maturity. A QMS that requires hours to locate a specific validation protocol or CAPA file signals a system that is not used in daily operations. A QMS that can produce any requested record within minutes signals operational discipline.
The document retrieval standard for audit readiness:
Tier 1 documents (quality manual, SOPs, master list): retrievable in under 2 minutes
Tier 2 documents (product-specific procedures, work instructions): retrievable in under 5 minutes
Tier 3 records (DHR, CAPA files, validation reports, complaint records): retrievable by lot, product, or CAPA number in under 10 minutes
6.2 Mandatory Documentation Checklist
The following table summarizes the mandatory documentation that auditors will request across all four subsystems:
Subsystem | Key Documents | ISO 13485 Reference |
|---|---|---|
Validation | Validation plan, IQ/OQ/PQ protocols and reports, software validation packages, revalidation records | §7.3.7, §4.1.6, §7.5.6 |
CAPA | CAPA log, individual CAPA records (all stages), effectiveness check criteria and results, trend analysis inputs | §8.5.2, §8.5.3 |
Traceability | Design traceability matrix, DHF, DMR, DHR, UDI records, distribution records | §7.3, §7.5.6, §8.2.6 |
PMS | PMS plan, PSUR/periodic summary, PMCF plan and evaluation, complaint log, trend analysis, management review outputs | §8.2.1, MDR Annex III |
6.3 Internal Audit as Rehearsal
Internal audits are the most underutilized tool for maintaining audit readiness. Under ISO 13485 §8.2.4, internal audits must be planned, conducted by personnel not responsible for the areas being audited, and documented with findings and follow-up actions.
Under FDA QMSR, management review and internal audit records are now inspectable — a change from the previous QSR framework. This means auditors can evaluate whether internal audits are substantive, whether findings are being actioned, and whether management is engaged.
A robust internal audit program:
Covers all QMS processes on a defined, risk-based schedule
Uses clause-referenced checklists updated to current standards
Assigns findings by severity (major/minor/observation) with defined response timelines
Tracks CAPA generation from audit findings
Includes supplier audits and qualified person (QP) assessments
Part 7: Distributor Due Diligence — Evaluating Your OEM’s QMS
7.1 The Evidence Package Request
For overseas distributors operating in EU and US markets, the OEM manufacturer’s QMS is a direct component of your own regulatory risk exposure. Distributor obligations under EU MDR include registration, UDI cooperation, and complaint reporting — all of which depend on the manufacturer’s QMS being functional.
When qualifying a wound care OEM, request the following evidence package:
Certification and regulatory status
Current ISO 13485 certificate (scope, issuing body, expiry date)
CE certificate(s) and notified body name
FDA establishment registration and device listing confirmation
Validation evidence
Summary of sterilization validation status (method, standard, last revalidation date)
Shelf-life validation summary (accelerated aging, real-time confirmation status)
Package integrity validation summary
CAPA evidence
CAPA performance metrics (cycle time, first-time effectiveness rate, recurrence rate)
Summary of any CAPA related to the product category you are distributing
Traceability evidence
Confirmation that DHR records are maintained per ISO 13485 §7.5.6
UDI assignment and GS1 registration status
Lot traceability demonstration (ability to trace raw material lot to distribution record)
PMS evidence
Confirmation that a PMS plan and (where applicable) PSUR are maintained
Summary of complaint trends and CAPA escalations in the past 12 months
7.2 Reading the Signals: What a Mature QMS Looks Like
Beyond documentation, the following behaviors signal a QMS that operates as a genuine management tool rather than a compliance artifact:
Management review minutes that reference PMS data, CAPA trends, and supplier performance — not just a compliance checklist
CAPA files that are referenced and cross-linked to related events, not isolated records
Validation protocols that specify acceptance criteria before execution, not after
A traceability matrix that was updated within the last documented design change
Internal audit findings that generate CAPA records at a rate consistent with the complexity of the operation
SLK Medical’s quality infrastructure is structured around these principles. Validation packages, CAPA metrics, and traceability evidence are maintained as standing deliverables — available to distributors and procurement teams as part of a structured qualification package, not assembled on request before an audit.
Part 8: Common Audit Findings and How to Prevent Them
8.1 Top 10 ISO 13485 Nonconformities by Clause
Based on aggregated notified body and FDA inspection data:
Rank | Clause | Finding |
|---|---|---|
1 | 8.5.2 | CAPA effectiveness not verified before closure |
2 | 7.3.7 | Design validation retrospective or protocol missing |
3 | 8.2.1 | Feedback/complaint trending not systematic |
4 | 4.1.6 | QMS software not validated |
5 | 7.5.6 | Traceability gaps in DHR |
6 | 7.3.9 | Design changes not assessed for validation impact |
7 | 6.2 | Training records incomplete or competency not verified |
8 | 7.4 | Supplier qualification not maintained or re-evaluated |
9 | 8.2.4 | Internal audit program incomplete or findings not followed up |
10 | 5.6 | Management review minutes lack required inputs |
8.2 Prevention Measures by Category
Validation
Require an approved protocol with defined acceptance criteria before any validation activity begins
Build revalidation triggers into change control procedures
Schedule annual validation status reviews as a standing agenda item in management review
CAPA
At CAPA opening, complete a field specifying effectiveness criteria, monitoring window, and responsible reviewer
Train quality staff that “implementation verified” and “effectiveness verified” are two separate stages
Run quarterly CAPA trend reviews feeding directly into management review
Traceability
Treat the traceability matrix as a controlled document updated within the design change process, not as a standalone project artifact
Link UDI records to DHR at the point of production, not retroactively
Conduct annual traceability simulations — select a lot and trace it end-to-end in both directions
PMS
Define escalation thresholds numerically in the PMS plan, not qualitatively
Designate a PMS owner with calendar-based review obligations, not event-triggered review only
Document the linkage between each PMS review output and the corresponding management review discussion
Part 9: The Path to Audit Confidence
9.1 A Practical Implementation Roadmap
Building an audit-proof QMS is a sequenced program, not a simultaneous overhaul. A practical sequence:
Quarter 1 — Foundation
Conduct a gap assessment against ISO 13485:2016 / QMSR requirements
Identify which SOPs, validation packages, and records require updating
Prioritize CAPA and PMS subsystems for immediate improvement
Quarter 2 — Remediation
Update CAPA procedures to require effectiveness criteria at opening
Conduct a PMS review against the current plan; update thresholds if needed
Confirm software validation packages are current for all eQMS tools
Quarter 3 — Integration
Run a full internal audit across all four subsystems using updated checklists
Conduct a traceability simulation (raw material lot to distribution record, end-to-end)
Present integrated QMS performance data at management review
Quarter 4 — Maintenance and Readiness
Establish a standing audit readiness file with document retrieval index
Conduct a mock audit using external or cross-functional auditors
Confirm PSUR and PMCF plan currency for all EU MDR-regulated products
9.2 How SLK Medical Supports Distributor Compliance
SLK Medical’s QMS infrastructure is designed to support the compliance obligations of its distribution partners across regulated markets. The validation, CAPA, traceability, and PMS systems maintained at SLK Medical’s manufacturing facility are built to the same evidence standard that notified bodies and FDA inspectors apply — because our distributors’ supply agreements depend on it.
For distributors entering hospital tender or national procurement processes, SLK Medical can provide:
ISO 13485 and CE certification documentation
Validation summary packages (sterilization, shelf life, packaging)
CAPA performance metrics summary
Traceability confirmation for specified product lots
PMS summary reports for products under active distribution agreements
This is not a marketing commitment — it is a documented operating standard built into the supplier qualification expectations of the markets we serve.
Conclusion: Audit Readiness Is a Culture, Not a Certificate
The organizations that consistently pass audits without major findings share one characteristic: they treat their QMS as an operational tool, not a compliance artifact. Validation protocols are used to make real decisions about whether processes are under control. CAPA files reflect genuine investigations with traceable outcomes. Traceability records exist because they are maintained in daily operations, not reconstructed before each inspection. PMS data influences the next product decision.
For overseas distributors of medical wound care products, the quality of your supply partner’s QMS is inseparable from your own regulatory risk. Demand objective evidence — validation summaries, CAPA metrics, traceability confirmations, PMS outputs — not just certificates. The difference between a supplier who can provide these and one who cannot is the difference between a supply relationship that survives audit pressure and one that does not.
Frequently Asked Questions
Q: Does FDA require ISO 13485 certification for QMSR compliance? No. FDA requires compliance with the QMSR regulation (which incorporates ISO 13485:2016 by reference) — not third-party certification. However, certification through an accredited body provides strong audit-readiness evidence and is expected by most international procurement processes.
Q: How long should a CAPA effectiveness monitoring window be? This depends on the nature and frequency of the nonconformity. For high-frequency events (daily production defects), a 30-day window with defined sample size may be sufficient. For low-frequency events (quarterly complaints), a 6- to 12-month window is typically required to demonstrate non-recurrence. The window must be defined when the CAPA is opened.
Q: What is the difference between a PMS plan and a PSUR under EU MDR? The PMS plan defines the ongoing data collection and analysis process — what sources will be monitored, how data will be trended, and when findings will be escalated. The PSUR (Periodic Safety Update Report) is the output document summarizing PMS findings, comparing them to the benefit-risk determination, and documenting actions taken. Both are required for Class IIa and above under EU MDR.
Q: Can a distributor be held responsible for a manufacturer’s QMS failure? Under EU MDR, distributors have defined obligations including registration, complaint reporting, and cooperation with corrective actions. While manufacturers bear primary regulatory responsibility, distributors who continue to supply a product from a manufacturer with a known compliance deficiency face increasing regulatory exposure. Supplier qualification is not a one-time activity — it is an ongoing obligation.
Q: What does a traceability simulation involve? A traceability simulation selects a specific finished goods lot and traces it in both directions: backward to raw material lots and supplier certificates, and forward to distribution records and (if applicable) end customer or hospital. The simulation measures how long it takes to retrieve complete records and identifies any gaps. It is the best internal rehearsal for a regulatory recall scenario.
SLK Medical is a leading manufacturer of advanced wound care dressings with CE, FDA, and ISO 13485 certification. For qualification documentation, validation package summaries, and compliance evidence for specific product lines, contact SLK Medical at slkmedical.com.
