Implementation Guide - The Standards Navigator

ESG vs ISO 14001: What’s the Difference and Do You Need Both in 2026?

ESG vs ISO 14001 is one of the most misunderstood comparisons in manufacturing compliance. This guide breaks down what each actually requires, how ISO 14001 supports ESG reporting without replacing it, and how to decide whether your operation needs certification, reporting, or both in 2026.

How environmental management certification relates to ESG reporting obligations for manufacturers

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Your Customer Asked for Your ESG Report. Your ISO 14001 Certificate Isn’t the Answer.

A procurement manager emails asking for your company’s ESG disclosure. You forward your ISO 14001 certificate and move on. Three weeks later the same customer comes back asking for Scope 1 and Scope 2 emissions data, a materiality assessment, and governance disclosures your certificate never touched.

Short answer: ISO 14001 certifies that you have a functioning environmental management system. ESG reporting discloses specific environmental, social, and governance data to regulators, investors, or customers. One is a certified process; the other is a public disclosure — and certification alone doesn’t satisfy a disclosure request.

This mix-up is common, and it’s expensive. ESG vs ISO 14001 is not a debate between two competing standards — it’s a comparison between a certifiable management system and a reporting framework that runs on entirely different logic. Confusing the two costs manufacturers real time during customer audits, investor due diligence, and supply chain qualification reviews.

If you’re trying to figure out whether ISO 14001 satisfies your ESG obligations, or whether you need to build a separate reporting process on top of it, this ESG vs ISO 14001 guide breaks down exactly where the two overlap and where they don’t.

From the Floor: I’ve sat across the table from a customer quality team that assumed our ISO 14001 certification meant we already had emissions data ready for their supplier ESG questionnaire. It didn’t — the certificate confirmed we had a functioning environmental management system, not a Scope 1/Scope 2 inventory. We ended up building that reporting layer from scratch, using our existing EMS records as the data source. That’s the relationship between the two: one gives you the system, the other asks you to report numbers out of it.

ESG vs ISO 14001 decision tree showing when manufacturers should provide an ISO 14001 certificate, an ESG report, or both based on customer requirements. — Customer requests determine whether an organization needs to provide ISO 14001 certification, ESG reporting, or both to demonstrate environmental performance and compliance.

Most teams miss the fact that an internal audit gap check on your EMS is the fastest way to find out whether your data infrastructure can even support an ESG questionnaire. Before you commit to a reporting platform or consultant, run a gap assessment on your current environmental management system →

In This Guide

What ESG reporting actually requires and who enforces it
What ISO 14001 certifies — and what it explicitly does not cover
Whether ISO 14001 counts as ESG reporting
A side-by-side comparison of ESG vs ISO 14001 requirements
How ISO 14001 supports ESG reporting without replacing it
The most common mistake manufacturers make when a customer asks for both
A decision framework for whether you need certification, reporting, or both
Certification and reporting cost considerations

👉 Start Here (Top Resources)

ISO 14001:2026 — Official Standard — the current certifiable edition, published April 15, 2026, direct from ANSI Webstore.
ISO 14001 Training — ISOQAR — for teams building internal EMS auditor capability.
ISO 14001 Training — BSI Group — alternative training and certification-body option.
9001Simplified — pre-built EMS documentation templates if you’re building your environmental management system from scratch rather than retrofitting ESG data collection onto an existing one.

What ESG Reporting Covers

Understanding ESG vs ISO 14001 starts with understanding what ESG actually is. ESG stands for Environmental, Social, and Governance — a reporting category, not a single standard. Depending on where you operate and who’s asking, “ESG reporting” could mean the EU’s Corporate Sustainability Reporting Directive (CSRD), the Global Reporting Initiative (GRI), the Sustainability Accounting Standards Board (SASB), or investor-driven climate disclosures aligned with the IFRS Sustainability Standards.

CSRD requires companies to disclose material environmental, social, and governance impacts, risks, and opportunities using detailed European Sustainability Reporting Standards, with mandatory third-party assurance. A 2025 simplification package narrowed the scope considerably, cutting mandatory CSRD reporting by roughly 80% of previously in-scope companies, and a “stop-the-clock” mechanism delayed the directive’s application by two years for many of them.

In the U.S., there’s no single ESG law. The SEC’s proposed 2024 climate disclosure rule was effectively withdrawn in early 2025, but earlier SEC interpretive guidance on climate-related risk still requires public companies to address material climate risks in 10-K filings. Several states also have supply-chain emissions disclosure laws with revenue-based thresholds that can reach private manufacturers through customer questionnaires.

The common thread: every ESG framework asks you to report — emissions, governance structure, workforce metrics, supply chain risk — not to run a certified system. There’s no accredited body that issues an “ESG certificate.” Compliance is judged on the accuracy and completeness of your disclosure, not a third-party audit against a management system standard.

What ISO 14001 Actually Certifies

ISO 14001 is a certifiable environmental management system (EMS) standard. It defines the structure your organization needs — policy, planning, operational controls, monitoring, internal audit, and management review — to systematically identify and manage your environmental impacts. An accredited registrar audits your EMS against the standard’s clauses and issues a certificate if you conform. The full clause structure and scope of the standard are maintained by ISO.org.

Critically, ISO 14001 does not specify emissions targets, require public disclosure, or dictate a reporting format. It certifies that you have a system for managing environmental aspects — legal compliance, pollution prevention, resource use, waste management — not that you’ve hit a particular sustainability outcome or published a particular set of numbers. In the U.S., the underlying legal compliance obligations an EMS is built to track are set by EPA.gov, independent of any ISO certification. Two companies can both hold valid ISO 14001 certificates while having completely different environmental footprints, because the standard certifies the management process, not the result. Keep that distinction in mind any time the ESG vs ISO 14001 question comes up in a customer meeting.

This is the single most important distinction in the ESG vs ISO 14001 conversation: certification proves you manage your environmental impacts systematically. ESG reporting proves — to a regulator, investor, or customer — what those impacts actually are.

Does ISO 14001 Count as ESG?

No — in the ESG vs ISO 14001 comparison, certification does not count as ESG reporting, and it isn’t accepted as a substitute for it. Certification confirms an accredited environmental management system is in place. It doesn’t disclose emissions figures, workforce data, or governance structure, and no framework — CSRD, GRI, SASB, or an investor questionnaire — treats a certificate as meeting its requirements.

Where ISO 14001 does count: some ESG questionnaires ask whether you hold environmental certifications as a qualitative indicator, and a current certificate is a legitimate answer to that one line item. It just doesn’t complete the rest of the form.

ESG vs ISO 14001 comparison infographic showing ISO 14001 as a certified environmental management system and ESG as a sustainability reporting framework for public disclosure. — While ISO 14001 certification validates how an organization manages environmental impacts, ESG reporting communicates environmental, social, and governance performance to external stakeholders.

ESG vs ISO 14001: Key Differences

The table below lays out the ESG vs ISO 14001 comparison side by side so you can see exactly where the two diverge.

Category	ESG Reporting	ISO 14001
What it is	A disclosure obligation or voluntary framework	A certifiable management system standard
Who enforces it	Regulators (CSRD, SEC guidance, state laws), stock exchanges, investors, customers	Accredited third-party registrars
What you get	A published report or completed questionnaire	A certificate valid for a defined audit cycle
Scope	Environmental, social, and governance metrics	Environmental management only
Measures	Outcomes — emissions, workforce data, governance structure	Process — planning, controls, monitoring, audit, review
Standardization	Fragmented across CSRD, GRI, SASB, IFRS S1/S2, state laws	Single global standard, one current edition
Assurance	Third-party assurance increasingly required for large filers	Third-party certification audit, every cycle

The overlap that confuses people: both frameworks care about environmental data. ISO 14001 requires you to identify and monitor environmental aspects as part of your management system. ESG frameworks require you to report a subset of that same data — often emissions and resource use — to an external audience. The data can be the same. The obligation and the audience are not — which is the core of the ESG vs ISO 14001 distinction manufacturers need to keep straight.

How ISO 14001 Supports ESG Reporting (Without Replacing It)

ESG vs ISO 14001 infographic illustrating how an ISO 14001 environmental management system creates operational data that supports ESG reporting for customers, investors, and regulators. — An ISO 14001 environmental management system provides the operational data foundation that organizations use to support ESG reporting and sustainability disclosures.

This is where ESG vs ISO 14001 stops being a source of confusion and starts being an advantage. A functioning ISO 14001 EMS already requires you to track environmental aspects, legal compliance obligations, and performance against objectives — the exact raw material ESG frameworks ask you to disclose.

If your EMS monitoring program tracks energy consumption, waste generation, water use, and compliance status, you already have most of the data infrastructure an ESG questionnaire or CSRD filing needs. Whether that monitoring data actually exists in a usable form usually comes down to how your EMS documentation is structured in the first place. What’s usually missing is the reporting layer: converting internal EMS metrics into the specific format a framework requires, adding governance and social data your EMS never touched, and in some cases securing third-party assurance on the numbers.

Manufacturers who treat ISO 14001 and ESG reporting as one continuous data pipeline — rather than two disconnected obligations — cut the reporting burden significantly, because they’re not building a parallel data collection system from zero.

The Common Mistake: Certification ≠ Compliance

Objection: “We’re ISO 14001 certified — doesn’t that cover ESG?” No, and this is the ESG vs ISO 14001 mistake that costs manufacturers the most time. Certification tells a customer or auditor that you have a functioning environmental management process. It does not, by itself, satisfy a CSRD filing requirement, a customer’s Scope 3 emissions questionnaire, or an investor’s governance disclosure request. Registrars audit your EMS against ISO 14001’s clauses — they do not verify or publish your emissions figures to a regulator or the public.

Most common finding: teams that assume certification equals compliance discover the gap only when a customer or investor asks for specific numbers the certificate never required them to calculate. By then, the data collection process is happening under deadline pressure instead of on a planned schedule.

Do You Need Both? A Decision Framework

Once you understand the ESG vs ISO 14001 relationship, the decision framework gets simpler.

If you are supplying large public companies or operating in the EU → customers or regulators may require ESG disclosure regardless of your certification status. Start mapping data gaps now, not after the first questionnaire arrives.

If you are already ISO 14001 certified → audit your existing EMS records against whatever ESG framework your customers are asking about. You likely have 60–80% of the raw data already; the gap is usually format and assurance, not collection.

If you are not yet certified and facing ESG pressure → build the EMS first. It gives you the monitoring infrastructure ESG reporting depends on, and it’s a system your customers already recognize. Budget realistically for the build — the EMS implementation timeline runs longer than most teams initially plan for.

If you have no ESG pressure today → ISO 14001 still stands on its own. It reduces regulatory risk and increasingly shows up as a supplier qualification requirement even where formal ESG reporting isn’t in play yet.

Certification and Reporting Cost Considerations

Cost is where the ESG vs ISO 14001 question becomes very concrete very fast. ISO 14001 certification costs vary by facility size and registrar, typically running from a few thousand dollars for a small single-site operation to well into five figures for larger, multi-site manufacturers, once you include the standard document, gap assessment, implementation time, and the certification audit itself.

ESG reporting costs scale with framework complexity rather than facility size — a CSRD filing with third-party assurance costs considerably more than an internal GRI-aligned disclosure with no assurance requirement. If you’re evaluating ISO 14001 alongside other management system standards, buying the standards together saves meaningfully compared to purchasing separately — worth checking before buying each document individually.

Quick Reference Checklist

Use this checklist to keep the ESG vs ISO 14001 distinction straight during any customer or audit conversation.

✅ Confirm which specific ESG framework your customer or regulator is actually asking about — CSRD, GRI, SASB, and investor questionnaires all have different data requirements

✅ Map your current ISO 14001 EMS data (or lack of one) against that framework’s disclosure requirements

✅ Identify the gap: usually governance and social metrics, plus assurance-ready formatting

✅ Don’t publish ISO 14001 certification as a substitute for a requested ESG disclosure — it will not satisfy the request

✅ If you’re not yet certified and ESG pressure is building, treat EMS implementation as the foundation, not an afterthought

⚠️ Don’t wait for a customer deadline to discover your EMS records aren’t in a reportable format

FAQ

ESG vs ISO 14001 — does certification satisfy ESG reporting requirements?

No — see “Does ISO 14001 Count as ESG?” above. Certification confirms a functioning environmental management system; it doesn’t disclose the data ESG frameworks require.

Is ESG reporting mandatory for manufacturers?

It depends on your size, location, and customer base. Large companies operating in the EU may fall under CSRD. In the U.S., there’s no single federal ESG law, but SEC guidance on material climate risk still applies to public companies, and several states have their own supply-chain disclosure requirements that can reach private manufacturers through customer questionnaires.

Can I use my ISO 14001 data for ESG reporting?

Yes, and you should. Your EMS monitoring records — energy use, waste, water, compliance status — are the same raw data most ESG frameworks ask for. The gap is usually converting that internal data into the specific format and assurance level a given framework requires.

What’s the difference between ESG and sustainability reporting?

They’re often used interchangeably, but ESG specifically covers environmental, social, and governance metrics as a structured disclosure category, often tied to investor or regulatory requirements. “Sustainability reporting” is a broader term that can include voluntary frameworks like GRI without the same regulatory or investor-driven structure.

Do I need ISO 14001 before I can do ESG reporting?

No — the ESG vs ISO 14001 relationship isn’t a prerequisite chain. You can report ESG data without holding ISO 14001 certification. But without an EMS in place, you’re usually building a parallel data collection process from scratch, which takes longer and is harder to keep consistent year over year.

Which ESG framework applies to my company?

That depends on where you operate, who your customers are, and whether you’re publicly traded. Large EU-connected companies may face CSRD. U.S. public companies should review SEC guidance on climate risk disclosure. Private manufacturers most often encounter ESG requirements indirectly, through customer questionnaires.

Does ISO 14001 require emissions disclosure?

No. ISO 14001 requires you to identify and manage significant environmental aspects, which often includes emissions-related monitoring, but it does not require public disclosure of emissions figures. That reporting step, if required, comes from a separate ESG framework or customer request.

How long does it take to build ESG reporting on top of an existing EMS?

It varies by framework complexity, but manufacturers with a mature ISO 14001 EMS typically move faster because the data collection infrastructure already exists. The added time usually goes toward governance and social data collection, plus preparing for any required third-party assurance.

Not Sure What to Do Next?

Wherever you land on the ESG vs ISO 14001 question, here’s where to go next based on where you are.

📥 Free Resources

ISO 9001 Roadmap — a step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — a practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — an evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.

🔹 Still researching? Read ISO 14001 vs ISO 45001 and ISO 14001 Documentation Requirements to understand the full scope of what an EMS involves before you commit to a framework.

🔹 Ready to start building your EMS? Get the Manufacturing Compliance Checklist and map your current environmental controls against it before your first gap assessment.

🔹 Need to buy the standard? Purchase the current ISO 14001:2026 edition through ANSI Webstore — use code CC2026 for 5% off through December 31, 2026.

The ESG vs ISO 14001 question isn’t really a choice between two competing paths — it’s understanding that one builds the system and the other reports what that system finds. Manufacturers who get this right treat their EMS as the data foundation for whatever ESG obligation shows up next, instead of scrambling to build both at once under deadline pressure.

Stay Ahead of Environmental Compliance Requirements

Most manufacturers only discover the gap between certification and disclosure when a customer questionnaire or investor request lands with a deadline attached. Organizations that map their EMS data against ESG requirements early spend a few hours on a gap review; organizations that wait spend weeks reconstructing data that should have already been tracked.

The Standards Navigator covers the full environmental compliance landscape — from ISO 14001 certification requirements to how that data connects to ESG and regulatory reporting obligations.

👉 Get updates on environmental management and ESG-adjacent compliance topics
👉 Be first to access new EMS and environmental audit resources

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

Validation & Verification Requirements: What ISO 13485 and the New FDA QMSR Actually Demand (2026 Guide)

ISO 13485 Clause 7.3 requires distinct verification and validation evidence — and the FDA’s new QMSR, effective February 2, 2026, makes the distinction matter more than ever. This guide breaks down design verification, design validation, process validation, and software validation requirements, and shows manufacturers how to build a traceability matrix that survives an audit or inspection.

ISO 13485 verification and validation requirements explained for medical device manufacturers navigating the QMSR transition

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Documentation Gap That Fails Design History Files

A design verification report that confirms the device meets its own specifications is not the same thing as a validation report that confirms the device meets the user’s actual needs. Auditors know the difference. Regulatory affairs teams sometimes don’t find out until an FDA inspector or notified body assessor pulls the Design History File and asks for both — and only one exists.

That gap has gotten more consequential, not less. The FDA’s Quality Management System Regulation took effect February 2, 2026, formally incorporating ISO 13485:2016 into 21 CFR Part 820 by reference. Verification and validation records that used to satisfy QSR expectations are now being evaluated against ISO 13485 Clause 7.3 directly — and the two frameworks don’t document V&V identically.

From the Floor: As a certified ISO 9001 Internal Auditor, I’ve sat across the table from teams who could produce a stack of test reports but couldn’t answer a simple question: which of these prove the design meets the specification, and which prove it meets the user’s need? Verification and validation get treated as interchangeable paperwork until an auditor separates them — and by then it’s a finding, not a conversation. The QMS documentation discipline that catches this before an audit is the same discipline that catches it before a submission.

If your last internal audit didn’t clearly separate verification evidence from validation evidence, that’s the gap worth closing first.

Run a clause-by-clause gap check before your next surveillance audit or FDA inspection — the ISO 13485 Gap Assessment Checklist below is built for exactly this kind of documentation review. Most teams miss the verification/validation split until it’s flagged.

👉 ISO 13485 Gap Assessment Checklist

In This Guide

What verification and validation mean under ISO 13485 Clause 7.3, and why they are not interchangeable
How process validation (Clause 7.5.6) differs from design validation
Software validation requirements for devices and manufacturing/QMS software
What changed under the FDA QMSR effective February 2, 2026
The most common V&V documentation failures found in audits and inspections
How to structure a verification and validation plan that survives scrutiny

👉 Start Here (Top Resources)

If you’re building or auditing a verification and validation process, these are the two resources worth starting with:

Get ISO 13485 training from BSI Group — BSI’s ISO 13485 training programs walk quality and regulatory teams through Clause 7.3 requirements in detail, including how design controls map to verification and validation evidence.
Purchase the official ISO 13485:2016 standard from ANSI Webstore — the authoritative source for Clause 7.3 language. ANSI Webstore serves international buyers and offers the standard in multiple formats. Use code CC2026 for 5% off.

Verification vs. Validation: The Core Distinction

Comparison infographic explaining the differences between ISO 13485 verification and validation requirements under ISO 13485:2016, including design inputs, intended use, testing methods, timing, applicable clauses, and common audit findings. — This comparison illustrates how verification and validation serve different purposes under ISO 13485 and why both are required for compliant medical device design controls.

Verification confirms that design outputs meet design inputs. Validation confirms that the finished device meets user needs and intended use. That one-sentence distinction is where most documentation failures start, because the two activities can look procedurally similar — testing, measuring, comparing results against criteria — while answering completely different questions.

Element	Design Verification	Design Validation
Question answered	Did we build the design correctly?	Did we build the correct design?
Compared against	Design inputs / specifications	User needs / intended use
Typical methods	Bench testing, inspection, analysis, comparison to similar designs	Clinical evaluation, simulated use testing, human factors studies
Timing	Throughout design and development	Under defined operating conditions, on initial production units or equivalent
ISO 13485 clause	7.3.6	7.3.7
Common failure	Testing against internal spec only, no traceability to input	Validating on prototypes instead of production-equivalent units

Most common finding: auditors and FDA investigators repeatedly cite validation performed on non-representative units — bench prototypes, early builds, or units built on equipment that doesn’t match production. ISO 13485 Clause 7.3.7 specifically requires validation on production or production-equivalent units, under defined operating conditions.

Verification and Validation in Practice: An Infusion Pump Example

Take a manufacturer developing an infusion pump. Design verification confirms the device meets its own engineering specifications:

✅ Flow rate accuracy within the specified tolerance
✅ Battery life meets the stated runtime under load
✅ Alarm volume meets the decibel specification

Design validation confirms something different — that the device works safely in the hands of the people who will actually use it:

✅ Nurses can operate the pump correctly and safely during simulated or actual clinical use
✅ The alarm is audible and distinguishable in a realistic hospital environment, not a quiet test lab
✅ Labeling and instructions for use are understood by the intended users without additional training

A pump can pass every verification test and still fail validation — accurate flow rate and long battery life mean nothing if a nurse under time pressure misreads the alarm or misinterprets the instructions. That’s the gap Clause 7.3.7 is built to catch, and it’s why validation has to happen on production-equivalent units under conditions that resemble actual use.

Design Verification Requirements

Clause 7.3.6 requires that design verification confirms outputs meet input requirements, with results and conclusions recorded, including the methods, dates, and individuals performing the verification. In practice, that means every design input needs a traceable verification activity — not a general statement that “the device was tested.”

If you are building a Design History File from scratch → start with a traceability matrix that maps every design input to its verification method and result before writing a single test protocol. Retrofitting traceability after testing is where most rework happens.

If you are already ISO 9001 certified and adding ISO 13485 → your existing design control process likely covers verification structurally, but it almost certainly lacks the input-to-output traceability rigor ISO 13485 auditors expect. That’s the gap to close first, not the documentation format.

👉 Before You Build Another Test Protocol

Most verification failures aren’t testing failures — they’re traceability failures. Run your design inputs against your current verification records now and find the gaps before an assessor does. →

Design Validation Requirements

Design validation under Clause 7.3.7 must be performed on production or production-equivalent units, under defined operating conditions, and must include risk analysis where applicable — which is where ISO 14971 risk management intersects directly with design controls. Validation isn’t complete until it addresses actual clinical or user-environment conditions, not lab conditions that approximate them.

Objection: “Our device is low-risk — do we really need formal simulated-use validation?” Even Class I and low-risk Class II devices need validation evidence proportional to risk, and “proportional” still means documented, traceable, and tied to intended use. A shorter validation plan is defensible. No validation plan is not.

Clinical evaluation, when required, and human factors/usability testing both fall under validation, not verification — a distinction that matters for regulatory submissions referencing FDA guidance on human factors engineering.

Process Validation Under Clause 7.5.6

Infographic explaining the three phases of process validation under ISO 13485, including Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ), with key activities, outputs, and compliance requirements. — This infographic explains the roles of IQ, OQ, and PQ in process validation, helping manufacturers understand how each qualification stage supports ISO 13485 and FDA QMSR compliance.

Separate from design validation, ISO 13485 Clause 7.5.6 requires validation of processes where the resulting output cannot be verified by subsequent monitoring or measurement — sterilization, certain sealing and bonding processes, injection molding parameters, and software used in production are the classic examples.

Process validation requires:

✅ Defined criteria for review and approval of the process
✅ Approval of equipment and qualification of personnel
✅ Use of specific methods, procedures, and acceptance criteria
✅ Requirements for records (Clause 4.2.5)
✅ Revalidation criteria, including criteria for triggering revalidation

Most auditors and FDA investigators expect this evidence structured around three stages: Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ).

Installation Qualification (IQ) confirms that equipment and supporting systems are installed correctly, according to the manufacturer’s specifications and the site’s own installation requirements — including verified utilities, calibration status, and documentation of the as-installed configuration, not just a checklist that the equipment arrived and was plugged in.

Operational Qualification (OQ) confirms that the equipment operates as intended across its full specified operating range, not just at a single nominal setting. For a sterilization process, that means testing at the upper and lower bounds of temperature, time, and pressure defined in the process specification — not only the target parameters.

Performance Qualification (PQ) confirms that the process consistently produces conforming output under actual production conditions, typically across multiple runs and, where risk warrants it, multiple operators, shifts, or lots. PQ is where most revalidation triggers get defined, since it establishes the baseline the process must continue to meet.

If you are validating a sterilization or bonding process for the first time → build your IQ/OQ/PQ protocol before ordering test units. Retrofitting an IQ after OQ testing has already started is a common finding, and it undermines the traceability an assessor is looking for.

If your process hasn’t changed but your equipment or facility has → IQ typically needs to be repeated even when OQ and PQ parameters stay the same, since IQ is tied to the specific installation, not the process design.

Skipping straight to PQ — running production and calling the passing output “validation” — is one of the most common shortcuts auditors flag, because it skips the evidence that the equipment itself is capable of consistently meeting the operating range the process depends on.

If you are outsourcing sterilization or bonding processes → your supplier controls documentation needs to show that you’ve verified the supplier’s process validation, not just received a certificate of conformance.

Software Validation Requirements

Software validation shows up in two places under ISO 13485, and conflating them is a recurring audit finding: software that is part of the device (or used in its production) versus software used for quality management purposes, such as electronic QMS platforms or CAPA tracking tools. Both require validation appropriate to their use, application, and risk — but the depth and method differ substantially, and design-control software validation should be traceable back to the same input/output structure as hardware verification.

What the FDA QMSR Changed for U.S. Manufacturers

The FDA’s Quality Management System Regulation replaced the legacy Quality System Regulation under 21 CFR Part 820, effective February 2, 2026, incorporating ISO 13485:2016 by reference rather than maintaining a separately worded U.S. regulation. For manufacturers who were already ISO 13485 certified, the operational impact on verification and validation practices is smaller than the documentation-mapping impact: DHF, DMR, and DHR content doesn’t necessarily need renaming, but it does need a clear mapping showing where ISO 13485 Clause 7.3 requirements are satisfied within existing U.S. records.

If you were operating under legacy QSR language only → this is the trigger to formally adopt ISO 13485 Clause 7.3 verification/validation terminology and structure, since FDA inspectors are now trained against the ISO clause structure, not the old Part 820 subparts.

Common V&V Documentation Failures

The same handful of gaps show up repeatedly in ISO 13485 QMS audits:

No traceability matrix linking design inputs to verification methods and results
Validation performed on prototypes rather than production-equivalent units
Missing revalidation criteria for processes that later change equipment, materials, or parameters
Software validation treated as one-size-fits-all instead of scaled to risk and application
Verification and validation dates, methods, and personnel not fully recorded, leaving conclusions without traceable support

👉 Before Your Next Notified Body Assessment

If you’re not confident your traceability matrix would hold up under document review, that’s the exact gap the ISO 13485 Gap Assessment Checklist was built to catch — in under 45 minutes. →

Building a Verification & Validation Plan That Holds Up

A defensible V&V plan starts with the traceability matrix, not the test protocols. Build it in this order:

List every design input and requirement
Map each input to a specific verification method and acceptance criterion
Identify which requirements also require validation evidence, and under what conditions
Define production-equivalent unit criteria before validation begins
Build revalidation triggers into the plan up front — not as an afterthought after a process change

This structure is what turns a stack of individual test reports into a Design History File that answers an assessor’s questions instead of prompting more of them.

Workflow infographic illustrating how verification and validation fit into the ISO 13485 design control process, from user needs and design inputs through production-equivalent units, validation, and Design History File documentation. — This workflow shows how verification and validation integrate into ISO 13485 design controls to produce a complete, traceable Design History File for regulatory compliance.

Quick Audit Checklist

✅ Every design input has a documented verification method and result
✅ Validation was performed on production or production-equivalent units
✅ Risk analysis is referenced in the validation rationale
✅ Process validation records include revalidation criteria
✅ Software validation is scaled to intended use and risk
✅ Verification and validation records include dates, methods, and personnel
⚠️ Watch for validation evidence copied from an earlier device without device-specific justification

FAQ

What is the difference between verification and validation in ISO 13485?

Verification confirms design outputs meet design inputs — did we build it correctly. Validation confirms the finished device meets user needs and intended use — did we build the correct thing. They require separate evidence and cannot substitute for each other.

Does ISO 13485 require validation on production units?

Yes. Clause 7.3.7 requires design validation on production or production-equivalent units under defined operating conditions, not on early prototypes or bench models that don’t reflect final manufacturing.

What processes require process validation under Clause 7.5.6?

Any process where output cannot be fully verified by later inspection or testing — common examples include sterilization, certain welding and bonding processes, injection molding, and adhesive curing.

How did the FDA QMSR affect verification and validation requirements?

The QMSR, effective February 2, 2026, incorporates ISO 13485:2016 into 21 CFR Part 820 by reference. Manufacturers now need documentation that maps clearly to ISO 13485 Clause 7.3, even if internal DHF/DMR/DHR naming stays the same.

Do low-risk devices still need design validation?

Yes, though the depth can scale with risk. A shorter, risk-justified validation plan is acceptable; skipping validation entirely is not.

Does software need separate validation from the device it’s part of?

Software validation is required both for software that’s part of or used in producing the device, and for software used for quality management purposes — but the required depth and method differ by application and risk.

What’s the most common finding auditors cite for validation?

Validation conducted on non-representative units — prototypes or early builds that don’t match production configuration or manufacturing conditions.

Where does risk management fit into verification and validation?

ISO 14971 risk management activities feed directly into what needs validation and how rigorously, particularly for design validation rationale and process revalidation triggers.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, including design control and V&V documentation gaps
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching your V&V documentation gaps? Start with the ISO 13485 Gap Assessment Checklist — it maps directly to Clause 7.3 verification and validation requirements.

🔹 Ready to build a compliant V&V process? BSI Group’s ISO 13485 training covers Clause 7.3 requirements in the depth a design control rebuild needs.

🔹 Need the standard itself to build your traceability matrix against? Get ISO 13485:2016 from ANSI Webstore — code CC2026 takes 5% off, and international formats are available.

Verification proves your engineers met the specification. Validation proves your customers can safely use the product. Auditors expect both. Regulators require both. A complete Design History File demonstrates both through traceable evidence — not one comprehensive-sounding report that tries to do both jobs at once.

Stay Ahead of the Next V&V Finding

Design History File gaps rarely surface during routine work — they surface during an audit or inspection, when there’s no time left to fix them. Manufacturers who catch the verification/validation split early walk into assessments with a traceability matrix that answers questions before they’re asked. Manufacturers who don’t spend the assessment explaining why validation was performed on a prototype.

The Standards Navigator tracks ISO 13485, QMSR, and medical device compliance requirements as they develop — including changes that affect how verification and validation get documented.

👉 Get updates on ISO 13485 and QMSR compliance changes
👉 Be first to access new medical device gap assessment tools and checklists

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO Implementation Packages vs. Consultants: Which Is Right for Your Manufacturing Business in 2026?

Manufacturers choosing between an ISO 9001 consultant and a documentation package face a real cost and timeline tradeoff. This guide compares both paths side by side — cost ranges, typical timelines, and which businesses fit each option — plus a hybrid approach for mid-sized operations, and the most common mistake that causes either path to fail an audit.

How small and mid-sized manufacturers can build a certifiable QMS without overpaying for help they don’t need

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Picking the Wrong Path Costs You Months — Not Just Money

ISO implementation packages vs consultants? Most manufacturers don’t fail their ISO 9001 implementation because they picked a bad option. They fail because they picked the wrong option for their operation — a $30,000 consultant engagement for a 12-person shop, or a self-serve documentation kit for a 400-employee multi-site operation that actually needed hands-on guidance.

Either mistake burns budget and burns time. And in a manufacturing environment, time is the one thing you can’t buy back before a customer-mandated certification deadline.

There are really only two paths to a certifiable quality management system (QMS): hire a consultant, or use a structured implementation package. Both work. Neither is universally right. The decision comes down to your headcount, your process complexity, and how much internal quality bandwidth you already have.

From the Floor: I’ve lived both sides of this decision. At a five-person coatings company, we built our ANSI 51 certification entirely from a documentation package — no consultant, just someone on staff who understood our processes well enough to adapt the templates to how we actually manufactured coatings. At a mid-size weld supply company I worked with pursuing ISO 9001, a consultant wasn’t optional — building a certifiable QMS wasn’t a skill set anyone in that organization had, and no template was going to close that gap. Same certification goal, two completely different starting points — and the right path followed from that, not from company size alone.

If you are not sure about choosing if ISO implementation packages vs consultants fits your operation, run the ISO 9001 Roadmap first — it lays out exactly what your QMS needs before you spend a dollar on either option →

In This Guide

What ISO 9001 implementation actually requires, clause by clause
The real cost and timeline of hiring a consultant
The real cost and timeline of using a documentation/implementation package
A side-by-side comparison to help you decide
A cost reality check anchored to company size
A decision tree to point you to the right path in under a minute
Real failure modes when the wrong path is under-resourced
Common misconceptions about ISO implementation
A hybrid approach that works for mid-sized operations

👉 Start Here (Top Resources)

Build your QMS with a structured documentation package — 9001Simplified — Prebuilt manuals, procedures, and forms mapped to ISO 9001:2015 clauses, without a $20,000+ consulting invoice.
Purchase the official ISO 9001:2015 standard — ANSI Webstore — You need the actual clause text regardless of which implementation path you choose. Use code CC2026 for 5% off.

What Implementation Actually Requires

Before comparing routes, it helps to know what you’re actually building. ISO 9001:2015 requires a documented QMS covering ten clauses — but only clauses 4 through 10 require operational action; clauses 1–3 are scope, references, and terms.

Clause	Focus Area	Typical Documentation Needed
Clause 4–5	Context, leadership, scope	Quality policy, scope statement, org chart
Clause 6	Planning	Risk register, quality objectives
Clause 7	Support	Competence records, calibration program, document control
Clause 8	Operation	Work instructions, production controls, supplier evaluation
Clause 9	Performance evaluation	Internal audit program, management review records
Clause 10	Improvement	Corrective action (CAPA) log, nonconformance tracking

Whether you build this with a consultant sitting across the table or a documentation package on your desktop, the deliverable is the same. What differs is cost, speed, and how much of the thinking gets done for you versus by you.

For the full clause-by-clause breakdown, see our ISO 9001 Certification Guide.

The Consultant Route

Most common finding: Consultants earn their fee on complexity, not on paperwork. If your operation has multiple product lines, multiple sites, or a workforce that has never operated under a formal QMS, a consultant’s ability to translate the standard into your specific processes is worth the premium.

Typical cost: $8,000–$30,000+ depending on company size, number of sites, and scope. Larger multi-site manufacturers routinely see six-figure engagements.

Typical timeline: 4–9 months, driven by consultant availability and how much internal change management is required.

What you get: A dedicated point of contact, custom-built documentation reflecting your actual processes (not generic templates), on-site gap assessments, and — often — a working relationship through your first surveillance audit.

What you don’t get: Speed or budget predictability. Consultants bill by scope creep as often as by hours, and a mid-project change in facility leadership or production schedule can stretch a 4-month engagement into 8.

If certification body selection is also on your radar, our Best ISO Certification Bodies guide walks through registrar selection separately from implementation — they’re two different decisions many manufacturers conflate.

The Implementation Package Route

Most common finding: Documentation packages fail when a company treats them as “buy and forget.” They succeed when a company treats them as a structured starting point that still requires internal ownership — someone has to actually adapt the templates to real production processes.

Typical cost: $500–$2,500 for a complete kit, depending on scope and whether industry-specific templates (aerospace, automotive, medical device) are included.

Typical timeline: 6 weeks–4 months, depending on internal bandwidth. A dedicated quality manager can move faster than a plant manager doing it on nights and weekends.

What you get: Prebuilt manuals, procedures, forms, and audit checklists mapped directly to ISO 9001:2015 clauses — built to be edited, not started from a blank page.

If you are not 100% certain your current documentation covers every required clause, 9001Simplified’s documentation kits are built specifically to close that gap without a six-figure invoice →

What you don’t get: Someone else doing the thinking for you. A package gives you the structure; you still need someone internally who understands your production floor well enough to adapt it correctly. Skip that step and you end up with a manual that reads well but doesn’t match what actually happens on the shop floor — which is exactly what an auditor flags first.

We reviewed the platform in detail here: 9001Simplified Review (2026).

Consultant vs. Package: Side-by-Side

Factor	Consultant	Implementation Package
Typical cost	$8,000–$30,000+	$500–$2,500
Typical timeline	4–9 months	6 weeks–4 months
Best fit	Multi-site, complex, or first-time QMS builds	Single-site shops with quality-literate staff
Customization	Fully custom to your processes	Template-based, requires internal adaptation
Ongoing support	Often included through first audit	Varies by provider
Internal effort required	Lower	Higher
Budget predictability	Lower (scope creep risk)	Higher (fixed cost)

If you are already ISO 9001 certified and are simply refreshing documentation ahead of a transition period, a package is almost always the more efficient choice — you’re not starting from zero, you’re updating what exists.

ISO 9001 implementation cost comparison infographic showing documentation packages, consultants, and hybrid approaches with typical costs, timelines, and best-fit scenarios for manufacturers. — Compare the costs, implementation timelines, and advantages of ISO documentation packages, consultants, and hybrid approaches to choose the best ISO 9001 implementation strategy.

Cost Reality Check

Cost comparisons only mean something once you attach them to your actual company size. Here’s the reality check most manufacturers skip before they sign anything.

If you’re a 20-person shop, a $30,000 consulting engagement is not just unnecessary — it’s a misallocation of capital. It delays certification without improving audit outcomes, and it ties up budget that could have funded a documentation package, a professional gap assessment, and two years of internal audit training, with money left over.

Flip it around: if you’re a 300-employee, multi-site operation, a $1,500 documentation kit alone is a false economy, not a cost-saving move. Without someone validating how the standard translates across facilities with different equipment, shifts, and process variations, you end up with a documentation set that reads consistently on paper and falls apart the moment a registrar audits more than one site.

The real question isn’t “which option is cheaper?” It’s “which option is cheaper for an operation my size, at my level of complexity?” Those are two very different answers — and the decision tree below exists to get you to the right one fast.

Which Path Fits Your Business

Use this decision tree first. It won’t cover every edge case, but it will get most manufacturers to the right starting point in under a minute.

Your Situation	Recommended Path
Single-site, under 100 employees, quality-literate staff	Documentation Package
Multi-site or multiple distinct product lines	Consultant
Hard customer deadline + no internal QMS experience	Consultant
Budget-sensitive + flexible timeline	Documentation Package
Internal bandwidth available but high process complexity	Hybrid

If you are a single-site shop under 100 employees with at least one person who understands your processes in detail → start with a documentation package. You have the internal knowledge; you just need the structure.
If you are under customer pressure to certify quickly and don’t have anyone internally who’s built a QMS before → a consultant’s speed and hand-holding is worth the premium, even at a higher price point.
If you are a multi-site operation or run several distinct product lines under one certificate → a consultant (or a hybrid engagement) will save you more in avoided rework than it costs upfront.

ISO implementation packages vs consultants decision tree infographic helping manufacturers determine whether a documentation package, consultant, or hybrid approach best fits their business. — Use this ISO 9001 implementation decision tree to determine whether your manufacturing business should choose a documentation package, consultant, or hybrid implementation strategy.

The Mistake Most Manufacturers Make

The most common failure point isn’t picking the “wrong” option — it’s picking the right option and then under-resourcing it. Shops buy a documentation package and hand it to whoever has the lightest workload that quarter, instead of someone who actually understands the production floor. Or they hire a consultant and assume the engagement replaces internal ownership entirely, so when the consultant leaves, nobody can maintain the system.

Either way, the audit finding looks the same: documentation that doesn’t match practice. Auditors don’t care which path you took to get there — they care whether what’s on paper matches what’s happening on the floor.

Two examples make this concrete:

A 35-person fabrication shop bought a documentation kit but never adapted the Clause 8 work instructions to match its actual production steps. The manual read well. The audit found a nonconformity in the first hour, because operators weren’t following procedures that never described what they actually did on the floor.
A three-site contract manufacturer tried to build its QMS entirely in-house, across all locations, with no outside validation. Documentation looked consistent on paper, but each site had quietly adapted its own version of the work instructions over time. The registrar cited major nonconformities for inconsistent document control across sites — exactly the failure mode a consultant’s cross-site validation exists to catch.

Before committing budget to either path, most operations managers miss this step — run a Manufacturing Compliance Checklist against your current state first, so you know exactly how big a gap you’re actually closing →

Split-screen infographic comparing ISO 9001 documentation with actual manufacturing practices, illustrating how auditors identify nonconformities when documented procedures do not match production. — Successful ISO 9001 audits depend on documented procedures matching what actually happens on the production floor, not simply having complete documentation.

Common Misconceptions

A few beliefs cause more bad decisions in this space than anything else. Worth naming directly:

“ISO requires you to use a consultant.” It doesn’t. The standard specifies what your QMS must accomplish, not how you build it. You can implement entirely in-house, provided the result is audit-ready.
“Documentation templates are plug-and-play.” They’re not. Every package — including a strong one — still requires someone internally to adapt the templates to your actual production steps. Skip that step and you’ve built a manual that describes a process you don’t actually run.
“Registrars care how you built your QMS.” They don’t. A certification body audits against the standard’s clause requirements. Whether your documentation came from a consultant, a package, or a blank Word document you wrote yourself makes no difference to the audit outcome — only whether it matches your practice.

The Hybrid Approach

For mid-sized manufacturers, this is usually the sweet spot — more risk reduction than a package alone, without paying for a full custom consulting build.

When hybrid works:

Roughly 100–300 employees, single site, moderate process complexity
Some internal quality knowledge, but not full confidence in audit readiness
No hard multi-site consistency problem to solve — just a need for validation before the audit
Budget that supports more than a package but doesn’t justify a full consulting engagement

What hybrid looks like in practice:

Use an implementation package for the documentation backbone — this is where 9001Simplified’s documentation kits do the heavy lifting at a fraction of consultant pricing.
Bring in a professional for a focused gap assessment against your actual production processes — not a full build, just validation.
Add a short, limited-scope consulting engagement (a few days, not a few months) focused specifically on training your internal auditor and reviewing documentation before your certification audit.

Typical combined cost: $3,000–$12,000 — a fraction of a full consulting engagement, with meaningfully more risk reduction than a package used on its own.

This gets you most of the cost savings of a package with a meaningful chunk of the risk reduction a consultant provides — without paying for a full custom build.

For a realistic sense of how long either path takes end to end, see How Long Does ISO Certification Take? and our broader ISO Implementation Timeline for Manufacturers.

Quick Decision Checklist

✅ Do you have someone internally who understands your production processes clause-by-clause?
✅ Do you have a hard certification deadline driven by a customer contract?
✅ Have you operated under any formal quality system before (even informally)?
✅ Is your operation single-site, or does it span multiple facilities?

⚠️ Have you budgeted for ongoing maintenance, not just initial certification? ⚠️ Have you confirmed your registrar’s audit timeline against your chosen implementation timeline?

FAQ

Is a documentation package enough to pass an ISO 9001 audit on its own?

No. A package gives you the framework, but auditors are checking whether your documentation reflects what actually happens in production. You still need someone internally to adapt the templates and run the system day to day.

How much cheaper is a package compared to a consultant?

Typically 80–95% cheaper on direct cost. A complete documentation kit runs $500–$2,500, while consultant engagements commonly range from $8,000 to $30,000 or more depending on company size and scope.

Can I switch from a package to a consultant partway through if I get stuck?

Yes, and it’s common. Many manufacturers start with a package, hit a specific gap — usually risk-based thinking under Clause 6 or internal audit program design under Clause 9 — and bring in limited consulting help for just that piece.

Do larger companies ever use documentation packages instead of consultants?

Occasionally, for single-site divisions within a larger corporate structure that already has quality expertise elsewhere in the organization. It’s less common for first-time, multi-site QMS builds.

Does ISO require me to use a consultant or an accredited implementation partner?

No. ISO does not mandate how you build your QMS — only that it meets the clause requirements. You can build one entirely in-house with no outside help at all, provided it’s audit-ready. See ISO.org for the standard’s official scope and intent.

What happens if I choose the wrong path and it doesn’t work?

You lose time, not certification eligibility. If a documentation package isn’t working, you can bring in a consultant mid-stream. If a consultant engagement stalls, you can supplement with a package for the sections still outstanding. Neither choice is permanent.

Will my certification body care which path I used?

No. Registrars and accreditation bodies — including those operating under ANAB accreditation — audit against the standard’s requirements, not against how you built your documentation.

Is a consultant worth it just for the first internal audit?

Sometimes. If nobody on staff has run an internal audit before, a short consulting engagement focused solely on training your internal auditor can be more cost-effective than a full implementation contract.

📥 Free Resources

ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.

Not Sure What to Do Next?

🔹 Still researching your options? Get the ISO 9001 Roadmap first — it maps out exactly what your QMS needs before you commit budget to either path.

🔹 Ready to start building your documentation? 9001Simplified’s implementation packages give you a structured starting point at a fraction of consultant pricing.

🔹 Need to buy the standard itself first? Get the official ISO 9001:2015 text from ANSI Webstore — use code CC2026 for 5% off before you build against clause requirements you haven’t actually read.

Neither path is inherently better — the wrong fit is what costs you months. Whichever route your operation is built for, The Standards Navigator will keep walking you through it, clause by clause.

Struggling to Know If Your QMS Is Actually Audit-Ready?

Most manufacturers don’t get flagged for picking a documentation package over a consultant, or the other way around. They get flagged because whichever path they chose was never fully finished — a clause left half-documented, a gap assessment skipped to save time.

Operations that skip the gap-check step going into an audit tend to find out the hard way, mid-audit, in front of the registrar. Operations that run one six weeks out walk in already knowing where they stand.

The Standards Navigator covers ISO 9001 implementation, documentation, and audit readiness for manufacturers building or maintaining a certifiable QMS.

👉 Get updates on ISO 9001 implementation and documentation strategy
👉 Be first to access new gap assessment checklists and implementation resources

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

Risk Management in Medical Devices: How to Build an ISO 14971-Compliant Process in 2026

Medical device risk management is the thread that connects every element of your ISO 13485 QMS — and the first place an auditor looks. This guide covers all five stages of the ISO 14971:2019 process, required documentation at each step, how to set defensible acceptability criteria, and the most common findings in notified body and FDA audits.

A step-by-step implementation guide for medical device manufacturers building or strengthening a risk management framework under ISO 14971:2019 and ISO 13485:2016

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Your Risk Management File Is the First Thing an Auditor Opens

Not your QMS manual. Not your SOPs. Your risk management file.

That is where a notified body auditor or FDA inspector starts — because risk management in medical devices is the thread that connects every other element of your quality system. If your risk file is thin, incomplete, or disconnected from your design and production controls, the rest of your documentation will not save you.

Most medical device companies understand that ISO 14971:2019 requires a risk management process. Fewer understand what that process actually looks like when it is fully implemented — the outputs required, the decisions that must be documented, and the points where ISO 13485:2016 Clause 7.1 and ISO 14971 intersect in ways that catch teams off guard during audits.

This article walks through the complete risk management process for medical devices: what ISO 14971 requires at each stage, how those requirements connect to your QMS, and where most teams fall short.

I have spent 25 years in heavy industrial manufacturing running quality systems under ISO 9001, managing nonconformances, and building risk-based approaches to process control. When I transitioned into the ISO 13485 space, the discipline was familiar — but the regulatory stakes were different. In manufacturing, a process failure costs you time and scrap. In medical devices, the same gap in your risk file can cost you a 483 observation, a warning letter, or a market withdrawal. The rigor required is not optional, and it is not theoretical. Every output described in this article is something auditors actively look for.

Before you read further: If you have not yet assessed where your current risk management process stands against ISO 14971:2019 requirements, start there. A structured gap assessment takes less time than an audit finding.

📥 Download the ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, including risk management obligations under Clause 7.1.

In This Guide

What ISO 14971:2019 actually requires — the full process, not just the outputs
How ISO 13485 Clause 7.1 connects to your risk management file
The five stages of the ISO 14971 process with required documentation at each step
How to set acceptable risk criteria — the decision most teams get wrong
Post-production surveillance and why it feeds back into your risk file
The most common audit findings in risk management reviews
Training options for teams building or rebuilding a compliant process

👉 Start Here: Top Resources for Medical Device Risk Management

If you are building or rebuilding your risk management process, these are the resources that will move you fastest:

ISO 14971:2019 — ANSI Webstore — The current edition of the standard. Required reading for anyone responsible for a device risk management file. Use code CC2026 for 5% off at checkout.
ISO 13485 Training — BSI Group — BSI offers ISO 13485 implementation and auditor training that covers risk management integration in depth.
ISO 13485 Training — ISOQAR — ISOQAR provides training and certification services for ISO 13485, with risk-based thinking woven throughout their courses.

What ISO 14971:2019 Requires

ISO 14971 risk management lifecycle infographic showing the seven stages of risk management in medical devices and required outputs from planning through post-production surveillance. — A visual overview of the ISO 14971 risk management lifecycle and the documentation outputs auditors expect to see.

ISO 14971:2019 is the international standard for the application of risk management to medical devices. It applies throughout the full device lifecycle — from concept through post-market surveillance.

The standard does not prescribe a specific risk analysis method. It does not tell you to use FMEA, FTA, or a risk matrix of a particular format. What it requires is a documented, systematic process that produces specific outputs at each stage.

The core framework in ISO 14971:2019 includes:

Stage	What ISO 14971 Requires
Risk management plan	Define scope, responsibilities, criteria for risk acceptability, and review activities
Risk analysis	Identify intended use, reasonably foreseeable misuse, and associated hazards and hazardous situations
Risk evaluation	Compare estimated risk against criteria — determine if risk reduction is required
Risk control	Select and implement controls; verify effectiveness; assess residual risk and any new risks introduced
Benefit-risk analysis	Where residual risk remains, evaluate whether the overall benefit outweighs remaining risk
Risk management report	Summarize the process and confirm residual risks are acceptable
Post-production information	Collect and review field data; feed findings back into risk management

Every output — the plan, the analysis, the controls, the report — must be captured in a risk management file.

How ISO 13485 Clause 7.1 Connects

ISO 13485:2016 Clause 7.1 requires that your organization document risk management requirements throughout product realization. This is not a standalone obligation — it is a QMS-level requirement that ties your risk file to your design controls, supplier management, production processes, and CAPA system.

The key connection points:

Design and development (Clause 7.3): Risk management inputs and outputs must be included in design planning. Design reviews, verification, and validation activities must all reference and be consistent with the risk management file.

Purchasing and supplier controls (Clause 7.4): Supplier-introduced risks must be identified and addressed. If a supplier failure creates a patient hazard, that scenario belongs in your risk analysis.

Production and service provision (Clause 7.5): Special processes — sterilization, labeling, software-dependent controls — require risk-based validation. Your risk file should identify where these controls are critical and what happens if they fail.

CAPA (Clause 8.5): Post-market findings, complaints, and nonconformances are data sources for your risk management process. A complaint that reveals a hazardous situation not previously identified in your risk analysis must trigger a risk file update.

Most common finding: Auditors frequently cite a disconnect between the CAPA system and the risk management file — complaints and CAPAs are processed and closed without evaluating whether the risk file needs to be updated.

If you are evaluating your current QMS against these connection points, the gap assessment checklist above covers all of them.

The Five-Stage Risk Management Process

Stage 1: Risk Management Plan

Your risk management plan is not a form — it is a governing document for the entire risk process for a specific device. It must define:

The scope of activities (which device, which lifecycle phases)
Roles and responsibilities for risk management activities
Requirements for review of risk management activities
Criteria for risk acceptability — what level of residual risk is acceptable and on what basis

The last item is where most teams take shortcuts. Acceptability criteria cannot simply reference “ALARP” or “as low as reasonably practicable” without defining what that means for your device and patient population. Auditors will push on this.

Stage 2: Risk Analysis

Risk analysis begins with a thorough description of the device — its intended use, intended users, and reasonably foreseeable misuse. From there, you identify:

Hazards (potential sources of harm)
Hazardous situations (circumstances in which people could be exposed to a hazard)
Harm sequences (how the hazardous situation leads to harm)

ISO 14971 Annex C provides a non-exhaustive list of hazard categories: energy hazards, biological hazards, environmental hazards, hazards related to incorrect output, and others. Use it as a prompt, not as a complete list.

Common analysis methods include FMEA (Failure Mode and Effects Analysis), FTA (Fault Tree Analysis), and HAZOP. Most device teams use FMEA as the primary tool. None of these methods is required by the standard — but whatever method you use must be documented and consistently applied.

Stage 3: Risk Evaluation

Once you have estimated the probability and severity of each harm, you evaluate whether each risk requires reduction. This evaluation is made against the acceptability criteria defined in your risk management plan.

If a risk exceeds your acceptable threshold, risk reduction is required. If it falls below the threshold, you still need to document the evaluation decision — not just assume silence means acceptable.

📥 If you are not confident your current risk file covers these evaluation decisions consistently, download the ISO 13485 Gap Assessment Checklist and work through Section 7 — it maps directly to these requirements.

Stage 4: Risk Control

ISO 14971 infographic showing the risk control hierarchy and residual risk evaluation process for medical device risk management. — ISO 14971 requires organizations to prioritize design controls first, verify effectiveness, and document residual risk decisions before closing risk.

ISO 14971 requires you to follow a three-level hierarchy when selecting controls:

Inherent safety by design — eliminate or reduce the hazard through design choices
Protective measures — add guards, alarms, or protective barriers in the device or manufacturing process
Information for safety — labeling, instructions for use, training requirements

You must implement controls in this order of preference. You cannot jump to warnings and labeling as your primary control if a design solution is practicable.

After implementing each control:

Verify the control was implemented as intended
Verify the control is effective at reducing risk
Assess whether the control introduces any new hazards
Re-evaluate residual risk after all controls are applied

Stage 5: Residual Risk and Benefit-Risk Analysis

After controls are in place, residual risk will remain for most devices. If residual risk exceeds your acceptability criteria even after all practicable controls have been applied, you must perform a benefit-risk analysis: does the clinical benefit of the device outweigh the remaining risk?

This analysis must be documented. “We believe the benefit outweighs the risk” is not documentation. The analysis must reference clinical evidence, intended use, and the nature and magnitude of remaining harm.

Setting Acceptable Risk Criteria

This is the decision most risk management teams get wrong, and it is the one auditors examine most carefully.

Your risk acceptability criteria must be:

Defined before you begin risk analysis — not after you have already seen your risk estimates
Based on relevant policy, standards, and guidance applicable to your device category
Specific enough to make clear decisions — a matrix with defined severity and probability ranges, not a narrative statement

What Auditors See	What They Want to See
“We aim to reduce risk ALARP”	A defined matrix with probability/severity scales and explicit acceptable/unacceptable zones
Criteria defined after the analysis was completed	Criteria established in the risk management plan before analysis began
One set of criteria applied across all device types	Criteria appropriate to the specific device and patient population
No documented basis for the criteria chosen	Reference to applicable guidance documents (IMDRF, EU MDR, FDA guidance)

Reference points that support defensible criteria include FDA guidance on risk management for device software, IMDRF guidance documents, and the introductory notes in ISO 14971:2019 itself.

Risk Control Options and Residual Risk

One of the most common gaps in risk files is incomplete residual risk documentation. Teams identify hazards, apply controls, and then fail to document the post-control risk estimate.

Every control must have:

A documented implementation record (the control was actually applied)
A verification record (the control works as intended)
A post-control risk re-estimate (residual probability × severity)
An evaluation of residual risk against acceptability criteria

If your controls introduce new hazards — which software controls, sterilization processes, and combination products frequently do — those new hazards must be analyzed through the full process. There is no shortcut.

If you are preparing for your first ISO 13485 certification audit, verify that every risk control in your file has all four of these elements documented before your Stage 1 audit. Incomplete residual risk documentation is one of the most common major nonconformances found in initial certification audits.

BSI Group offers ISO 13485 implementation training that specifically addresses risk file documentation structure, including residual risk evaluation requirements. ISOQAR provides similar training with a certification pathway.

The Risk Management File

The risk management file is not a single document. It is a collection of records that demonstrates the complete risk management process was followed for a specific device. What it must contain:

Risk management plan
Risk analysis outputs (hazard list, probability/severity estimates)
Risk evaluation records (acceptability decisions)
Risk control records (implementation, verification, new hazard assessment)
Residual risk evaluation
Benefit-risk analysis (where required)
Risk management report
Post-production information review records

The risk management report is the capstone document. It confirms that the risk management plan was followed, all residual risks are acceptable, and appropriate methods were used to obtain relevant production and post-production information.

Your risk management file must be maintained and updated throughout the product lifecycle. It is not a one-time certification exercise.

ISO 14971 risk management file infographic showing required records and how the file integrates with ISO 13485 quality management requirements. — The risk management file is the central evidence package that demonstrates ISO 14971 compliance across the medical device lifecycle.

Post-Production Information and Surveillance

ISO 14971 Clause 9 requires a systematic process to collect and review post-production information. This includes:

Customer complaints and feedback
Field service and repair reports
Medical device reports (MDRs) and vigilance reports
Published literature and adverse event databases
Post-market clinical data

This information must be evaluated to determine whether it:

Indicates previously unidentified hazards
Changes the estimated probability or severity of a known harm
Invalidates earlier risk control decisions

If it does, your risk file must be updated. Your CAPA process must have a defined trigger for escalating post-market findings to the risk management team.

Most common finding: Post-market surveillance is treated as a regulatory reporting obligation rather than a risk management input. Complaints are processed through CAPA, but the risk file is never reviewed against complaint trends. This is a major nonconformance under both ISO 13485 Clause 8.2.1 and ISO 14971 Clause 9.

Common Audit Findings in Risk Management Reviews

These are the findings that appear most frequently in ISO 13485 and EU MDR notified body audits:

✅ Incomplete risk analysis scope — Reasonably foreseeable misuse not identified or analyzed. Risk analysis covers intended use only.

⚠️ Acceptability criteria defined after the analysis — Criteria were back-filled to match the estimates, rather than established as the decision framework before analysis began.

⚠️ Missing residual risk evaluation — Controls were implemented and verified, but no post-control risk estimate was documented.

✅ Disconnected CAPA and risk file — Complaints and CAPAs processed and closed without triggering a risk file review.

⚠️ Labeling used as the primary control — Instructions for use are cited as the risk control when a design solution was practicable.

✅ Risk file not maintained post-launch — The risk file was complete at certification but has not been updated since. Design changes, new complaint data, and field findings are not reflected.

⚠️ No benefit-risk analysis where residual risk is above acceptability threshold — Teams acknowledge residual risk exceeds their criteria but do not formally document the benefit-risk justification.

Training for Your Risk Management Team

Risk management competence is a requirement, not a preference. Your team members responsible for risk management activities must be trained — and that training must be documented.

Both BSI Group and ISOQAR offer ISO 13485 training that covers risk management integration. BSI also offers a dedicated Risk Management — Requirements (ISO 14971) e-learning course for teams who need focused training on the standard itself.

If you are already certified under ISO 13485 and preparing for a surveillance audit:

If your risk team has not been formally trained on ISO 14971:2019 since the 2019 edition was published, now is the time to close that gap. The 2019 edition introduced changes to state-of-the-art requirements and manufacturer benefit-risk responsibilities that differ from the 2007 edition.

If you are building your QMS from scratch and need structured implementation support across all 8 clauses:

If you are evaluating implementation support options, review what documentation a compliant ISO 13485 QMS requires before investing in training. It will help you scope what your team actually needs to build.

FAQ

What is the difference between ISO 14971 and ISO 13485 for risk management?

ISO 13485:2016 Clause 7.1 requires that risk management be applied throughout product realization. ISO 14971:2019 is the standard that defines how to do it — the process, the required outputs, and the documentation. ISO 13485 tells you that you must manage risk. ISO 14971 tells you how. Most medical device manufacturers must comply with both.

Is ISO 14971 mandatory?

ISO 14971 is not directly mandated by law in most markets, but it is referenced as a harmonized standard under the EU MDR 2017/745 and EU IVDR 2017/746. For FDA-regulated devices in the US, compliance with ISO 14971 supports conformance with 21 CFR Part 820 design controls requirements. As a practical matter, no notified body or FDA inspection team will accept a risk management process that does not align with ISO 14971.

What is a risk management file?

A risk management file is the complete collection of records that documents the risk management process for a specific device. It includes the risk management plan, risk analysis outputs, evaluation records, control records, residual risk documentation, benefit-risk analysis (where required), the risk management report, and post-production surveillance records. The file must be maintained and updated throughout the device lifecycle.

How often should a risk management file be updated?

Your risk management file must be updated whenever there is a change to the device, its intended use, or new information that could affect risk estimates — including complaints, adverse events, published literature, or design changes. Many organizations establish a formal periodic review (annually or at defined product lifecycle milestones) as part of their post-market surveillance process.

What risk analysis methods does ISO 14971 require?

ISO 14971 does not mandate a specific method. FMEA, FTA, HAZOP, and preliminary hazard analysis are all acceptable approaches. What the standard requires is that the method be documented, systematic, and capable of identifying hazards and estimating risk. Most medical device manufacturers use FMEA as their primary method.

What is the difference between a hazard, a hazardous situation, and harm in ISO 14971?

A hazard is a potential source of harm — for example, excessive electrical energy in a device. A hazardous situation is a circumstance in which people, property, or the environment could be exposed to the hazard — for example, a patient contact point that can carry excessive current under a specific failure condition. Harm is the physical injury or damage to health that results. ISO 14971 requires that you trace the full sequence from hazard to harm for each risk identified.

How does ISO 14971 relate to CAPA in ISO 13485?

Your CAPA process should have a defined trigger for escalating complaints, adverse events, and nonconformances to the risk management team for evaluation. If a post-market finding reveals a previously unidentified hazard or changes the estimated probability of an existing risk, your risk file must be updated. Closing a CAPA without evaluating its implications for the risk file is one of the most common major findings in ISO 13485 surveillance audits.

What changed in ISO 14971:2019 compared to the 2007 edition?

ISO 14971:2019 introduced several substantive changes: clarified the concept of state-of-the-art and how manufacturers must use it; expanded and clarified the benefit-risk analysis process; updated the overall residual risk evaluation process; and revised the structure of the standard to align with ISO management system high-level structure conventions. Teams trained only on the 2007 edition may have gaps in their current process.

📥 Free Resources

These tools are available at no cost to support your ISO 13485 and risk management implementation:

ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, including risk management obligations under Clause 7.1
ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still building your understanding of ISO 13485 requirements? Start with the ISO 13485 Implementation Roadmap — it walks through all 8 clauses and how they connect before you invest in building documentation.

🔹 Ready to implement and need training for your risk management team? Both BSI Group and ISOQAR offer ISO 13485 training with risk management integration. BSI also has a dedicated ISO 14971 e-learning course.

🔹 Need to purchase ISO 14971:2019 for your quality team? Get it from the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026.

Risk management is not a documentation exercise you complete before certification and revisit every few years. It is the living framework that keeps your device safe, your quality system defensible, and your audits clean. Build it right from the start — and maintain it like the regulatory asset it is.

The Standards Navigator covers ISO 13485, ISO 14971, FDA requirements, and medical device quality management in depth. Use the resources above to move from gap to compliant.

Stay Current on Medical Device Compliance

Most teams that struggle with ISO 13485 audits are not missing knowledge — they are missing a system for keeping their risk files, documentation, and compliance processes current as requirements evolve.

Organizations that pass surveillance audits consistently have one thing in common: their quality teams are not surprised by what auditors look for. They have a process for staying ahead of requirement changes, notified body expectations, and post-market obligations.

The Standards Navigator covers ISO 13485, ISO 14971, FDA QMSR, and medical device compliance requirements in plain language for quality professionals and regulatory teams.

👉 Get updates on the medical device compliance cluster — new articles, requirement changes, and implementation guidance delivered directly to your inbox.

👉 Be first to access new free resources, including the ISO 13485 Documentation Starter Kit when it launches.

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

AS9100 vs ISO 9001: Key Differences for Aerospace Suppliers (2026 Guide)

AS9100 and ISO 9001 are both quality management system standards — but they serve fundamentally different purposes. AS9100 Rev D incorporates every ISO 9001 requirement and adds over 100 aerospace-specific requirements covering product safety, configuration management, first article inspection, and counterfeit parts prevention. This guide explains exactly where the standards differ, who needs AS9100, and how ISO 9001 certification reduces your implementation timeline.

How AS9100 Rev D builds on ISO 9001 — and what aerospace suppliers need to know before choosing a certification path

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Question Every Aerospace Supplier Asks Eventually

You are ISO 9001 certified — or you are thinking about getting there. Then a prime contractor drops a supplier questionnaire on your desk with one question that changes the conversation: Are you AS9100 certified?

Those four letters carry weight in aerospace. They signal that your quality management system has been evaluated against requirements that go well beyond general manufacturing. Traceability, configuration management, first article inspection, counterfeit parts prevention — these are not optional considerations in aerospace. They are audited requirements.

The difference between AS9100 and ISO 9001 is not just a longer checklist. It is a fundamentally different level of risk tolerance built into the standard itself. Understanding that distinction before you invest in certification is the difference between a smooth implementation and a year of unexpected rework.

This guide breaks down exactly where AS9100 expands on ISO 9001, who needs which standard, and how to navigate certification if you are coming from an ISO 9001 foundation.

⚠️ Not sure where your QMS stands against AS9100 requirements? Most aerospace suppliers don’t fail certification audits because they don’t understand the standard. They fail because they assumed their ISO 9001 foundation covered more than it did. Run a clause-by-clause gap check before you commit to an implementation timeline.

👉 Download the free AS9100 Rev D Gap Assessment Checklist →

In This Guide

What AS9100 is and how it relates to ISO 9001
The four AS9100-specific requirement areas that have no ISO 9001 equivalent
A clause-by-clause comparison table
Who needs AS9100 vs. who can stay with ISO 9001
How to use an existing ISO 9001 certification as a foundation
Certification cost and timeline comparison

👉 Start Here — Top Resources for This Topic

Buy the AS9100 Rev D Standard — ANSI Webstore — Official SAE/AS9100 document. Use code CC2026 for 5% off.
AS9100 Training — BSI Group — Aerospace-specific lead auditor and implementation courses.
Buy ISO 9001:2015 — ANSI Webstore — Required reading if you are building your AS9100 foundation on ISO 9001.

What Is AS9100 Rev D?

AS9100 is the quality management system standard for the aerospace, aviation, and defense industries. It is published by SAE International and managed by the International Aerospace Quality Group (IAQG).

Rev D — the current revision — was released in 2016 and aligned AS9100 with the ISO 9001:2015 structure. Every requirement in ISO 9001:2015 is incorporated directly into AS9100 Rev D. The aerospace-specific additions sit on top of that foundation — often embedded within the same clause structure.

The standard uses the term Aerospace Quality Management System (AQMS) rather than QMS — a minor but document-important distinction if your QMS manual language needs to align with the standard.

2026 update: The IAQG is developing IA9100, a globally harmonized successor that will replace regional variants including AS9100 (Americas), EN 9100 (Europe), and JISQ 9100 (Asia-Pacific). Final publication is targeted for Q4 2026 with a 24–36 month transition window. Organizations certifying today should certify to AS9100 Rev D — IAQG guidance confirms this is the correct path now.

For the full scope of AS9100 before comparing it to ISO 9001, see What Is AS9100? — The Complete Guide.

How AS9100 Builds on ISO 9001

ISO 9001:2015 provides the quality management framework. AS9100 Rev D starts there and expands.

Layer	Standard	What It Covers
Foundation	ISO 9001:2015	Quality management system — any industry
Aerospace additions	AS9100 Rev D	100+ aerospace-specific requirements on top
Combined	AS9100 Rev D full	Complete aerospace quality management system

You cannot hold an AS9100 certification without meeting every ISO 9001 requirement. The reverse is not true — ISO 9001 certification does not satisfy AS9100 requirements.

In practical terms: if you are already ISO 9001 certified, your QMS covers roughly 70–75% of what AS9100 requires. The remaining 25–30% is where most implementation effort concentrates — and where most audit findings are issued.

The Four Key Differences Between AS9100 and ISO 9001

Infographic comparing the four major differences between AS9100 and ISO 9001, including product safety, configuration management, first article inspection, and counterfeit parts prevention. — AS9100 builds on ISO 9001 by adding aerospace-specific requirements for safety, configuration control, first article inspection, and counterfeit parts prevention.

1. Product Safety and Risk Management

ISO 9001 requires risk-based thinking throughout the QMS. AS9100 goes further — it requires explicit, documented product safety considerations and assigns responsibility for communicating safety-critical requirements throughout the supply chain.

Where ISO 9001 says “consider risk,” AS9100 says “identify critical items, establish controls for key characteristics, and document how safety requirements flow to every affected process.”

In a fabrication or machining environment, this means identifying which dimensions, materials, or process parameters are safety-critical — and creating documented evidence that those specific requirements are controlled and verified at every step.

Most common finding: Organizations carrying over their ISO 9001 risk register without adding the AS9100-required safety-criticality designation to individual product characteristics.

2. Configuration Management

ISO 9001 has no equivalent requirement. AS9100 requires a formal configuration management process that controls the definition of a product throughout its lifecycle — including design documentation, approved deviations, and change control.

Your QMS must include a documented process for managing engineering changes, maintaining configuration baselines, and controlling which revision of a drawing, specification, or process document applies to any given production lot.

If you manufacture to customer-furnished drawings in aerospace, your configuration management process must trace which revision was active at time of manufacture — and any deviations from that revision must be formally approved.

3. First Article Inspection (FAI) Requirements

AS9100 requires that organizations establish, document, and implement a first article inspection process — verifying that the product realization process can produce conforming product before full production begins.

The governing document for FAI in aerospace is AS9102. AS9100 does not replicate all of AS9102’s requirements, but it does require that an FAI process exists and is maintained. If your prime contractor flows down AS9102 requirements, you need to address those specifics as well.

ISO 9001 has no first article inspection requirement. This is one of the clearest examples of the risk gap between the two standards.

If you are already ISO 9001 certified → review your current first article or pre-production verification process. It likely needs formal documentation, defined acceptance criteria, and records retention aligned with AS9100 before your Stage 1 audit.

4. Counterfeit Parts Prevention

AS9100 requires a documented process to detect and prevent the use of counterfeit or unapproved parts in aerospace products. This includes supplier controls, parts identification verification, and handling procedures for suspect material.

ISO 9001 addresses supplier controls but makes no mention of counterfeit parts. In aerospace, this is not a theoretical risk — counterfeit electronic components, fasteners, and raw materials have caused documented failures. AS9100 treats it as an auditable requirement.

Your QMS must include counterfeit part risk mitigation in the procurement process, suspect parts handling procedures, and evidence that your suppliers understand and comply with the requirement.

AS9100 vs ISO 9001: Clause-by-Clause Comparison

Both standards share the same high-level clause structure (Clauses 4–10). The table below shows where AS9100 adds requirements within that structure.

Aerospace engineering drawing with revision control block, quality approval stamp, precision-machined component, and mechanical pencil illustrating AS9100 configuration management and document control requirements. — Configuration management in AS9100 requires organizations to control engineering revisions, document changes, and maintain traceability throughout the product lifecycle.

Clause	ISO 9001:2015 Requirement	AS9100 Rev D Addition
4 — Context	Determine internal/external issues	Add: identify applicable statutory/regulatory requirements for aerospace
5 — Leadership	Top management QMS commitment	Add: communicate importance of meeting aerospace customer requirements
6 — Planning	Risk and opportunity assessment	Add: product safety risk — identify safety-critical items explicitly
7 — Support	Competence, awareness, communication	Add: employee awareness of contribution to product safety and conformity
8.1 — Operations	Plan production/service provision	Add: configuration management, counterfeit parts prevention, FAI process
8.4 — External providers	Supplier evaluation and monitoring	Add: AS9100 flow-down; approved supplier list management
8.5 — Production control	Process controls and identification	Add: key characteristics, critical items, lot/serial traceability
8.6 — Release	Verification of conformity	Add: documented authority for concessions/deviations; objective evidence retention
9 — Performance	Internal audits, management review	Add: trend analysis of quality data; corrective action effectiveness review
10 — Improvement	Nonconformance and corrective action	Add: escape point analysis; prevent recurrence at supply chain level

Who Needs AS9100 vs. ISO 9001?

You need AS9100 if:

✅ You manufacture, overhaul, or maintain aerospace or defense components
✅ Your customer is a prime contractor (Boeing, Airbus, Lockheed Martin, Raytheon, L3Harris, etc.)
✅ Your purchase orders or supplier agreements specify AS9100 certification
✅ You are pursuing DCMA oversight or government contract qualification
✅ You are on — or want to be on — an Approved Supplier List (ASL) for an aerospace customer

ISO 9001 alone is sufficient if:

✅ You manufacture for non-aerospace industries only
✅ Your customer requires ISO 9001 but does not specify AS9100
✅ You are a commercial manufacturer considering AS9100 as a future growth target

The gray area — Tier 2 and Tier 3 suppliers:

Not every supplier in the aerospace supply chain is required to hold AS9100. Some Tier 2 and Tier 3 suppliers hold ISO 9001 — but the trend is toward AS9100 flow-down requirements going deeper into supply chains. If your prime contractor has added AS9100 to their supplier qualification requirements in the last two years, that is a signal.

Check the IAQG OASIS database to verify certification status of suppliers you are evaluating — and to understand what your prime contractor is likely to require.

If you are evaluating whether AS9100 applies to your organization → review the supplier flow-down requirements in your prime contractor agreement first. The answer is almost always in the purchase order or the Supplier Quality Requirements (SQR) document.

⚠️ Waiting until a customer audit to discover your AS9100 gaps is a costly mistake. Most findings at Stage 1 audits come from undocumented FAI processes, missing configuration management records, and supplier flow-down gaps — all addressable before the auditor walks in the door.

👉 Run the AS9100 Rev D Gap Assessment now — it takes under 45 minutes →

Can ISO 9001 Certification Serve as a Foundation?

Yes — and it is the most efficient path to AS9100.

If you are already ISO 9001 certified, your QMS infrastructure is in place. Document control, internal audit, CAPA, and management review all carry over. The transition work focuses on the AS9100-specific additions.

👉 Run the AS9100 Rev D Gap Assessment before you build your implementation plan — clause-by-clause, free, takes under 45 minutes →

Realistic scope of the gap for an ISO 9001-certified organization:

Area	ISO 9001 Status	AS9100 Gap Work Required
Document control	Compliant	Minimal — add configuration management layer
Risk management	Compliant	Moderate — add product safety and critical item designation
Supplier controls	Compliant	Significant — add AS9100 flow-down, approved supplier list, counterfeit prevention
Production controls	Compliant	Moderate — add key characteristics, lot/serial traceability
First article inspection	Not addressed	New process — build from scratch or formalize existing practice
Internal audit program	Compliant	Minimal — add aerospace-specific audit criteria

Split-panel aerospace quality management graphic showing ISO 9001 as the foundation on the left and expanded AS9100 requirements, including first article inspection and configuration management documentation, on the right. — ISO 9001 provides a strong quality management foundation, but AS9100 adds aerospace-specific requirements for configuration management, first article inspection, product safety, and counterfeit parts prevention.

Most ISO 9001-certified organizations completing AS9100 gap remediation report 6–12 months of active implementation before Stage 1 audit readiness. Organizations starting from scratch typically need 12–18 months.

If you are already ISO 9001 certified → focus your implementation effort on the four AS9100-specific requirements that have no ISO 9001 equivalent: product safety documentation, configuration management, first article inspection, and counterfeit parts prevention.

Certification Cost and Timeline Comparison

Factor	ISO 9001	AS9100 Rev D
Standard document cost	~$175 (ANSI Webstore) — or buy AS9100 and ISO 9001 together and save	~$140 (SAE/ANSI)
Implementation timeline (from scratch)	9–12 months	12–18 months
Implementation timeline (from ISO 9001)	N/A	6–12 months
Stage 1 audit cost	$1,500–$3,000	$2,000–$4,500
Stage 2 audit cost	$3,000–$8,000	$5,000–$12,000
Annual surveillance audit	$2,000–$5,000	$3,000–$6,500
Consultant support (optional)	$5,000–$25,000	$10,000–$40,000
Certification body options	Wide choice	Must be IAQG-approved

For a full breakdown by company size and scope, see How Much Does AS9100 Certification Cost?

One critical distinction: AS9100 auditors must be approved through the IAQG certification scheme. Not every ISO 9001 registrar is authorized to issue AS9100 certificates. BSI Group and ISOQAR are both IAQG-approved — BSI Group offers AS9100-specific audit preparation and lead auditor training if you want to build internal competency before your Stage 2 audit. Verify your certification body’s IAQG approval status before engaging.

How to Get Certified: Next Steps

If you are starting from an ISO 9001 foundation:

Download the gap assessment checklist and work through it clause by clause

If your documentation infrastructure needs rebuilding around the AS9100-specific additions, 9001Simplified’s QMS documentation kits provide the ISO 9001 foundation layer that maps directly into AS9100 implementation — cutting initial document build time by 40–60% compared to starting from blank procedures.

Identify your critical items — flag which product characteristics carry safety implications
Build your configuration management process — a documented change control log is a starting point
Formalize your FAI process — if you already do first article checks informally, document them to AS9102 framework
Update your supplier controls — add AS9100 flow-down language to purchase orders and supplier questionnaires
Select an IAQG-approved certification body — get quotes from at least two before committing
Complete your internal audit against the full AS9100 requirements
Schedule your Stage 1 audit — confirm documentation readiness before Stage 2 is booked

If you are starting without ISO 9001:

Consider building to AS9100 directly — you will need to meet every ISO 9001 requirement anyway. Starting with ISO 9001 as an intermediate milestone adds cost and time without a corresponding benefit unless your customer base genuinely splits between ISO 9001 and AS9100 requirements.

If under customer pressure to certify quickly → prioritize training and select your certification body before building documentation. Audit scheduling lead times at major certification bodies currently run 2–4 months.

📥 Free Resources

AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts

AS9100 Rev D gap assessment checklist showing aerospace quality management requirements, audit readiness evaluation, and certification preparation for aerospace manufacturers and suppliers. — Use an AS9100 Rev D gap assessment checklist to identify quality management system weaknesses before your certification audit.

📬 Stay Ahead of Your Next Audit

AS9100 auditors find the same gaps year after year — configuration management records, FAI documentation, and supplier flow-down evidence. We track what is actually being flagged in the field and send it directly to your inbox.

Subscribe and get the AS9100 Rev D Gap Assessment Checklist delivered immediately.

FAQ

Is AS9100 the same as ISO 9001?

No. AS9100 contains every requirement in ISO 9001:2015 but adds more than 100 aerospace-specific requirements covering product safety, configuration management, first article inspection, counterfeit parts prevention, and traceability. ISO 9001 is a general-industry standard; AS9100 is specific to aerospace, aviation, and defense.

Can I be certified to both AS9100 and ISO 9001?

AS9100 certification already incorporates all ISO 9001 requirements, so holding an AS9100 certificate demonstrates compliance with both. Many organizations hold a single AS9100 certificate. Some certification bodies will issue both certificates simultaneously if your customer base specifically requires the ISO 9001 certificate by name.

Does ISO 9001 certification help with AS9100 certification?

Yes, significantly. An existing ISO 9001 QMS provides the document control, internal audit, CAPA, and management review infrastructure that AS9100 builds on. Most ISO 9001-certified organizations can reach AS9100 audit readiness in 6–12 months rather than the 12–18 months typically required from scratch.

Who manages AS9100?

AS9100 is published by SAE International and managed by the International Aerospace Quality Group (IAQG), a consortium of aerospace manufacturers including Boeing, Airbus, and Lockheed Martin. Certification auditors must be approved through the IAQG scheme.

What is IA9100 and does it replace AS9100?

IA9100 is the globally harmonized successor to AS9100 currently being developed by the IAQG. It will replace regional variants including AS9100, EN 9100, and JISQ 9100. Final publication is targeted for Q4 2026 with a 24–36 month transition window. Organizations should certify to AS9100 Rev D now — IAQG guidance confirms this is the correct path.

Do all aerospace suppliers need AS9100?

Not all — but the requirement is flowing deeper into supply chains. Tier 1 suppliers to major primes almost universally require AS9100. Tier 2 and Tier 3 suppliers are increasingly seeing it added to supplier qualification requirements. Verify your specific requirements by reviewing your purchase orders, Supplier Quality Requirements documents, and any flow-down clauses from your prime contractor.

How long does AS9100 certification take?

From a standing start with no existing QMS: 12–18 months. From an existing ISO 9001 certification: 6–12 months. Timeline depends on scope, number of sites, and the extent of gap remediation required after your initial assessment.

What is the difference between AS9100 and NADCAP?

AS9100 is a quality management system standard covering the organization’s overall AQMS. NADCAP (National Aerospace and Defense Contractors Accreditation Program) is a process-specific accreditation program covering special processes — heat treatment, NDT, chemical processing, welding, and others. Many aerospace suppliers hold both. They are complementary, not competing certifications.

Not Sure What to Do Next?

🔹 Need the AS9100 Rev D standard document → Buy AS9100 Rev D — ANSI Webstore. Use code CC2026 for 5% off.

🔹 Need training before your audit → AS9100 Lead Auditor and Implementation Courses — BSI Group

🔹 Building your ISO 9001 foundation first → Buy ISO 9001:2015 — ANSI Webstore and review the ISO 9001 Certification Guide before committing to an AS9100 timeline.

The gap between ISO 9001 and AS9100 is real — but it is not insurmountable. Aerospace suppliers make this transition every day. The ones who do it efficiently run their gap assessment first, build their implementation plan around the actual findings, and select a certification body before they start writing procedures. The Standards Navigator covers every step of that process. Start with the gap assessment — everything else follows.

AS9100 vs ISO 9001: The Gap Is Closeable. Start with the Right Information.

The aerospace suppliers that struggle with AS9100 transition are almost always the ones working from assumptions — assuming their ISO 9001 foundation covers more than it does, assuming FAI is informal enough to pass, assuming their supplier flow-down language is sufficient.

The ones that pass their first AS9100 Stage 1 audit without major findings are the ones who ran the gap assessment before they called a consultant.

At The Standards Navigator, AS9100, ISO 9001, and the full aerospace compliance landscape are covered in plain-language, field-level detail — from the standard itself to implementation strategy, audit preparation, and certification body selection.

👉 Get updates on aerospace quality standards, implementation guidance, and compliance insights delivered directly.

👉 Be first to access new AS9100 guides, checklists, and tools as they publish.

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO 14001, ISO 9001, and ISO 45001 Transition (2026) Guide

ISO 14001:2026 is published. ISO 9001:2026 arrives in September. ISO 45001:2027 has its DIS ballot open. Three major management system standard revisions landing within 18 months of each other — what the changes mean, why the overlapping transition deadlines create a planning problem most manufacturers haven’t solved yet, and four actions to take now before the window tightens.

Three major management system standards are revising within three years of each other. What manufacturers need to plan for now — before the window gets tight.

Last Updated: July 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

Three Standards. Three Transition Clocks. One Planning Problem Most Manufacturers Haven’t Solved Yet.

In heavy industrial manufacturing, the worst compliance situations are rarely the ones that arrive without warning. They’re the ones where the warning was visible months in advance — and nobody acted on it because each individual deadline felt manageable on its own.

That’s the situation most manufacturers managing ISO 9001, ISO 14001, and ISO 45001 certifications are in right now.

ISO 14001:2026 published in April 2026. ISO 9001:2026 is expected in September 2026 — the FDIS ballot closes July 9, 2026, the last formal checkpoint before publication. ISO 45001:2027 has its DIS ballot open as of March 2026, with publication expected mid-2027. Three major management system standard revisions landing within roughly 18 months of each other.

Each one individually is manageable. Each one comes with a three-year transition period. Each one, evaluated in isolation, looks like something you can handle when the time comes.

The problem is they’re not arriving in isolation. For manufacturers running integrated management systems — or running three separate QMS, EMS, and OH&S programs that share auditors, procedures, and personnel — the transition timelines overlap in a way that most planning cycles haven’t accounted for.

This article covers the timeline, what’s changing in each standard, and four actions to take now before the window tightens.

In This Guide

The current status and timeline for all three standard revisions
What is changing in ISO 14001:2026 — the key updates
What is expected in ISO 9001:2026 — the FDIS direction
What is emerging in ISO 45001:2027 — early DIS signals
The integrated management system advantage in a triple transition
Four actions to take now before the transition window tightens
Decision-stage guidance for organizations at different points in their certification journey

Start Here (Top Resources)

🔖 Get ISO 14001:2026 → ANSI Webstore — ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

🔖 Train your team on ISO 14001, ISO 9001, and ISO 45001 → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Build compliant management system documentation → 9001Simplified — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

🔖 Pursue or maintain ISO certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the Standards Library or explore standards by compliance area to identify which standards apply to your organization.

The Triple Transition Timeline

Infographic timeline comparing ISO 14001:2026, ISO 9001:2026, and projected ISO 45001:2027 revisions, including publication dates and expected certification transition deadlines through 2030. — The Triple Transition Timeline illustrates how ISO 14001, ISO 9001, and ISO 45001 revisions are unfolding between 2026 and 2030, helping organizations plan integrated management system updates.

Standard	Current Version	New Version	Publication	Transition Deadline
ISO 14001	ISO 14001:2015	ISO 14001:2026	April 2026 ✓ Published	April 2029 (expected)
ISO 9001	ISO 9001:2015	ISO 9001:2026	September 2026 (FDIS submitted)	September 2029 (expected)
ISO 45001	ISO 45001:2018	ISO 45001:2027	2027 (DIS stage — TBC)	~2030 (projected)

Three-year transition periods mean organizations have time — but not unlimited time. The clock on ISO 14001 started in April 2026. The ISO 9001 clock starts in September. ISO 45001 follows in 2027, though no confirmed publication date has been issued.

Sources: BSI Group and SGS confirm September 2026 as the ISO 9001:2026 publication target.

For an organization managing all three certifications, the transition window runs from now through approximately 2030. That sounds comfortable until you factor in what transition actually requires: gap analysis against each new standard, internal audit updates, procedure revisions, management review inputs, and surveillance audits that will eventually evaluate the new requirements.

⚠️ Certification bodies must be trained and accredited to new standards before they can issue certificates. For ISO 9001:2026, GACI accreditation guidance will be issued after publication — based on typical 9–12 month accreditation cycles, Q3 2027 is a reasonable industry projection for first certificates, though no confirmed date has been issued. Plan your transition timeline around certification body readiness, not just publication dates.

ISO 14001:2026 — What Changed

ISO 14001:2026 published in April 2026 — the first revision since 2015. The revision builds on the 2024 climate change amendment (ISO 14001:2015/Amd 1:2024) and goes further in several areas that matter for manufacturing operations.

Climate change is now fully embedded. The 2024 amendment required organizations to consider climate change in their environmental management systems. ISO 14001:2026 integrates that requirement more deeply — climate-related risks and opportunities are now explicitly part of the planning and risk management process, not an optional consideration.

Life-cycle perspective is strengthened. Environmental aspects must now be assessed more holistically across the product life cycle — from raw material sourcing through end-of-life disposal. For manufacturers, this means environmental assessment can no longer stop at the facility gate. Upstream supplier impacts and downstream customer use are in scope.

Biodiversity and pollution prevention are more explicit. The revision sharpens language around pollution prevention, resource use efficiency, and biodiversity considerations. Organizations in industries with direct environmental footprints — coatings, fabrication, chemical processing — will see more specific audit scrutiny in these areas.

Planning clauses are reorganized. The structure around risks, opportunities, and change management is clearer in the 2026 version. For organizations that have always treated environmental risk management as a compliance checklist rather than a genuine planning input, this is the revision that makes that gap visible.

At this point, most EHS managers should: → Pull your current ISO 14001:2015 environmental aspects register and evaluate it against the life-cycle and climate requirements of the 2026 revision. If your aspects assessment stops at your facility boundary, it needs to be expanded. Get ISO 14001:2026 from ANSI Webstore — use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits.

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

ISO 9001:2026 — What’s Coming

ISO 9001:2026 infographic highlighting upcoming quality management system changes including quality culture, ethical leadership, risk and opportunity management, supply chain resilience, and the 2026 to 2029 transition timeline. — ISO 9001:2026 builds on the existing framework while introducing stronger expectations for quality culture, ethical leadership, risk management, and supply chain resilience.

ISO 9001:2026 is not published yet — ISO/FDIS 9001 reached stage 50.20 as of April 2026, confirming the FDIS ballot has been initiated — confirmed on ISO’s official standards page and reported by DQS Global, a DAKKS-accredited certification body. ⚠️ The ballot closes July 9, 2026. Only editorial changes are possible after that point — the technical content of ISO 9001:2026 is effectively locked. The direction is clear enough to plan against.

The revision is evolutionary, not revolutionary. The core Annex SL structure remains. Clause numbering stays intact. Organizations certified to ISO 9001:2015 are not facing a rebuild — they’re facing a targeted update.

Quality culture and ethical conduct are new emphasis areas. The 2026 version introduces more explicit expectations around leadership’s role in establishing a culture of quality — not just documenting a quality policy, but demonstrating that quality values are embedded in how the organization operates. Ethical conduct and integrity within leadership are specifically called out.

Risk and opportunity management is sharpened. Risks and opportunities are expected to be addressed more distinctly in the 2026 version — with clearer guidance on how each is identified, evaluated, and acted upon. Organizations that have treated Clause 6.1 as a one-time planning exercise rather than an ongoing process will find the 2026 expectations more demanding.

Supply chain resilience enters the picture. The disruptions of recent years are reflected in 2026’s increased emphasis on supply chain management and organizational resilience. Clause 8.4 language around external providers is expected to be more specific about resilience and continuity considerations.

The transition timeline is specific. Publication in September 2026 triggers a three-year transition period — organizations will need to be certified to ISO 9001:2026 by September 2029. First certificates will follow — certification bodies must complete training and receive accreditation guidance from GACI after publication. Based on typical 9–12 month accreditation cycles, Q3 2027 is a reasonable industry projection, though no confirmed date has been issued.

If you are currently implementing ISO 9001:2015 for the first time → Proceed. Your 2015 certificate remains valid through September 2029 and the transition to 2026 is not a rebuild. The ISO 9001 Implementation Roadmap covers the full 5-phase process from gap assessment to Stage 2 audit clearance.

➡️ BSI Group ISO 9001 and ISO 14001 Training — Transition training for ISO 9001:2026 and ISO 14001:2026 covering gap analysis, new requirements, and audit preparation. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

ISO 45001:2027 — Early Signals

ISO 45001:2027 is the furthest out — but the revision entered the DIS stage in early 2026, and the direction of the revision is visible in the committee draft material. Publication is expected mid-2027, with a three‑year transition period expected, likely running through 2030.

Worker wellbeing expands beyond physical safety. The current ISO 45001:2018 standard focuses on occupational health and safety in a traditional sense. The 2027 revision explicitly expands scope to include psychosocial hazards — stress, burnout, workplace violence, mental health — as core OH&S considerations. This is a meaningful shift for manufacturers whose safety programs have focused primarily on physical hazard controls.

Climate change is integrated as an OH&S requirement. Climate-related risks — heat stress, extreme weather events, air quality impacts — are being incorporated into the OH&S risk framework. For operations in industries with outdoor or climate-exposed work environments, this will require new hazard identification and control measures.

New working models are addressed. Remote work, hybrid arrangements, and contractor-heavy operations are explicitly considered in the 2027 revision. The definition of “workplace” is expanding, and with it, the scope of OH&S responsibility.

Leadership accountability is stronger. Management’s active role in safety culture — not just policy sign-off — is a recurring theme across the 2027 draft. The expectation is demonstrable leadership engagement, not just documented commitment.

ESG and supply chain responsibility. The revision extends OH&S considerations to the supply chain, consistent with the direction ISO 9001:2026 and ISO 14001:2026 are also taking. For manufacturers with complex supplier networks, this creates new audit scope.

The Common Thread Across All Three

Reading the three revisions together, a consistent direction emerges — and it matters for how organizations approach transition planning.

All three standards are moving from compliance to performance. The 2026/2027 revisions across quality, environmental, and safety management systems reflect a shared expectation: that management systems demonstrate real outcomes, not just documented processes. Certification bodies auditing against these revised standards will be looking for evidence of genuine system effectiveness, not procedure compliance.

All three embed climate and sustainability more explicitly. ISO 14001:2026 integrates climate requirements into its planning clauses. ISO 9001:2026 adds resilience and supply chain sustainability language. ISO 45001:2027 adds climate-related OH&S risks. Organizations that have managed these as separate environmental compliance obligations are going to find them converging into a single integrated requirement set.

All three strengthen leadership expectations. Quality culture in ISO 9001:2026, environmental leadership in ISO 14001:2026, safety culture in ISO 45001:2027. Leadership’s role is not just policy ownership — it’s demonstrated behavioral commitment. That is an audit finding waiting for organizations whose top management signs off on policy documents but isn’t visible in the management system.

All three align with the updated Annex SL high-level structure. This means integration across the three standards is structurally easier in the revised versions than it was in the 2015/2018 versions. For organizations running integrated management systems, the 2026/2027 revisions are actually an opportunity — the common structure means a single integrated gap assessment covers significant ground across all three.

The Integrated Management System Advantage

Integrated Management System diagram showing ISO 9001, ISO 14001, and ISO 45001 overlap for quality, environmental, and safety management — A visual representation of how ISO 9001, ISO 14001, and ISO 45001 integrate into a single management system to improve quality, environmental performance, and workplace safety.

Organizations managing ISO 9001, ISO 14001, and ISO 45001 as separate programs face the triple transition as three independent projects. Organizations managing them as an integrated management system (IMS) face it as one.

The practical difference is significant. An IMS shares a single management review process — one review covers QMS, EMS, and OH&S inputs and outputs. It shares an internal audit program — one audit cycle covers all three standards. It shares document control, training records, and corrective action systems. When revisions land, an IMS organization updates one system. A siloed organization updates three.

The 2026/2027 revisions accelerate this advantage because of the common thematic direction across all three standards. A gap analysis that covers climate integration, leadership requirements, and supply chain scope serves all three transitions simultaneously. A management review that adds resilience and sustainability performance inputs serves ISO 9001, ISO 14001, and ISO 45001 at the same time.

If your organization manages the three standards in separate programs, the triple transition is a legitimate reason to evaluate IMS consolidation now — not because it’s required, but because the administrative burden of three independent transition projects under overlapping deadlines is the kind of thing that creates compliance gaps.

Approach	Gap Analysis	Internal Audit	Management Review	Procedure Updates	Transition Risk
Siloed programs	3 separate assessments	3 separate cycles	3 separate reviews	3 separate update projects	High — deadline convergence
Integrated IMS	1 integrated assessment	1 combined cycle	1 combined review	1 coordinated update	Lower — shared infrastructure

Four Actions to Take Now

Infographic outlining four actions organizations should take now to prepare for ISO 14001:2026, ISO 9001:2026, and ISO 45001 transition requirements, including gap assessments, audit planning, management review evaluation, and internal audit integration. — Four practical actions organizations can take today to prepare for upcoming ISO 14001, ISO 9001, and ISO 45001 transition requirements and avoid last-minute certification challenges.

1. Get ISO 14001:2026 and run a gap assessment against your current EMS.

The clock is running on ISO 14001. Your 2015 certification remains valid through approximately April 2029 — but the gap assessment takes time, procedure updates take time, and your surveillance audit schedule may not align with your ideal transition timeline. Start the gap assessment now while you have room to plan. Get the standard from ANSI Webstore — use CC2026 for 5% off.

For the full ISO 9001:2026 transition timeline including certification body accreditation milestones, 9001Simplified’s revision guide is the most detailed publicly available planning reference.

2. Map your surveillance audit schedule against the transition deadlines.

Your certification body will eventually conduct a transition audit for each standard. Knowing when your next surveillance audit is scheduled — and whether it falls before or after each publication date — tells you when you need to have your transition work complete. A surveillance audit in early 2027 for ISO 14001 means your 14001 transition needs to be done before that visit, not by 2029.

3. Evaluate your management review process against the new common requirements.

Climate change, resilience, supply chain performance, and leadership accountability are showing up across all three revisions. Adding these as management review inputs now — before the standards require it — positions your organization to demonstrate proactive compliance rather than reactive scrambling. It also means your management review minutes start building a record of these considerations before your first transition audit.

4. Consolidate your internal audit program if you haven’t already.

If you’re running separate audit cycles for quality, environmental, and safety, consider whether an integrated audit program would serve all three transitions more efficiently. A single annual audit cycle that covers ISO 9001, ISO 14001, and ISO 45001 in one planned program gives you a single update project when the revised standards require audit checklist changes. It also means your internal auditors need transition training once, not three times.

At this point, most operations and EHS managers overseeing all three certifications should: → Start with the Manufacturing Compliance Checklist — it covers ISO 9001, 14001, 45001 and OSHA across 50 items with gap scoring. It gives you a current-state baseline across all three systems before you invest in transition-specific gap analysis tools.

Why Organizations Delay Transition Planning

“We have until 2029 — there’s no urgency.”

The three-year transition period is real. The urgency is not about the deadline — it’s about the gap between when a transition deadline is announced and when certification bodies can actually audit against the new standard. For ISO 9001:2026, first certificates aren’t expected until Q3 2027 at the earliest, because certification bodies need 9–12 months after publication to complete training and accreditation. If your next ISO 9001 surveillance audit falls in late 2027, you may be audited against the 2026 standard whether you planned for it or not.

“Each transition is manageable — we’ll handle them one at a time.”

Handling ISO 14001:2026 now, ISO 9001:2026 in late 2026, and ISO 45001:2027 in 2027–2028 as three sequential projects is a reasonable approach — if your internal audit program, management review schedule, and quality personnel capacity can absorb three consecutive transition projects. Organizations with lean QMS teams consistently discover that sequential transition management creates a permanent state of transition, where the team finishes one standard’s update cycle and immediately starts the next. Integrated planning reduces that burden significantly.

“We don’t know enough about ISO 9001:2026 and ISO 45001:2027 yet to plan.”

You know enough. The FDIS direction for ISO 9001:2026 is clear — quality culture, ethics, resilience, supply chain. The DIS signals for ISO 45001:2027 are clear — wellbeing, climate, new working models, leadership accountability. Waiting for final publication to start thinking about these themes means your gap assessment starts at zero when the standard publishes. Starting now means your gap assessment starts from a position of partial readiness.

Frequently Asked Questions

Do I need to transition all three standards at the same time?

No — each standard has its own transition deadline and you can manage them sequentially. The case for coordinated planning is efficiency, not obligation. ISO 14001:2026 is already published, so that transition clock is running. ISO 9001:2026 publishes in September 2026. ISO 45001:2027 publishes mid-2027. Three separate deadlines — but organizations that plan them together avoid three separate periods of transition disruption.

Will my current certifications become invalid when the new standards publish?

No. Your current ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018 certificates remain valid through their respective transition deadlines — approximately 2029, 2029, and 2030. You do not need to take immediate action on certification. You do need to plan for transition before those deadlines.

What is the transition period for ISO 14001:2026?

The transition period is expected to be three years from publication — approximately April 2029. Your certification body will confirm the exact transition deadline once IAF guidance is issued. Plan against April 2029 as the working assumption.

When will certification bodies start auditing against ISO 9001:2026?

Not immediately after publication. Certification bodies must complete training and accreditation to the new standard — a process that typically takes 9–12 months. First ISO 9001:2026 certificates are not expected until at least Q3 2027. This means organizations pursuing ISO 9001 certification for the first time should implement ISO 9001:2015 now — it remains the auditable standard through the transition period.

What does the ISO 45001:2027 revision mean for manufacturers with mostly physical hazard environments?

The 2027 revision expands OH&S scope to include psychosocial hazards and climate-related risks — which will require manufacturers to broaden their hazard identification processes. For facilities with outdoor operations, heat stress and extreme weather become OH&S planning inputs. For all facilities, psychosocial hazard assessment becomes an expected element of the risk identification process.

Should we pursue an integrated management system before the triple transition?

If your organization manages ISO 9001, ISO 14001, and ISO 45001 as separate programs, the triple transition is a legitimate trigger to evaluate IMS consolidation. It is not required — but the efficiency gains during three overlapping transition projects are real. The decision depends on your internal resource capacity and how much administrative redundancy your current siloed programs create. BSI Group offers integrated management system training that covers all three standards simultaneously. BSI Group training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

What are the key changes in ISO 14001:2026 for manufacturers?

Climate change fully embedded in planning requirements, life-cycle perspective extended beyond facility boundaries, stronger biodiversity and pollution prevention language, and reorganized planning clauses around risks and opportunities. For manufacturers in industries with direct environmental footprints — coatings, fabrication, chemical processing — the life-cycle and climate requirements are the most operationally significant changes.

Do ISO 9001:2026 and ISO 45001:2027 change the Annex SL structure?

No. All three revised standards maintain the Annex SL high-level structure — the common clause framework that enables integrated management systems. This is by design: ISO intends the common structure to make multi-standard integration easier, and the 2026/2027 revisions maintain that compatibility.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need ISO 14001:2026 now → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to train your team on the revised standards → BSI Group Training — ISO 14001, ISO 9001, and ISO 45001 transition training available. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You need to build or update management system documentation → 9001Simplified Documentation Kits — ready-to-use documentation kits for ISO 9001, 14001, and integrated management systems.

→ You are ready to pursue or maintain ISO certification → ISOQAR — UKAS-accredited, one of the most recognized certification bodies in the industry.

→ You need to understand what changed specifically in ISO 14001:2026 → What’s New in ISO 14001:2026

→ You need a current-state baseline across all three systems → Manufacturing Compliance Checklist — free, 50 items covering ISO 9001, 14001, 45001 and OSHA.

→ You need to understand ISO 9001 implementation from the ground up → ISO 9001 Implementation Roadmap

→ You want to understand how ISO 9001 and ISO 14001 relate to each other → explore standards by compliance area

→ You want to browse all manufacturing standards in one place → Standards Library

Still figuring out where to start?

The best first step for most organizations managing all three certifications: → Download the free Manufacturing Compliance Checklist — 50 items across ISO 9001, 14001, 45001 and OSHA with gap scoring. It gives you a current-state picture across all three systems in 20 minutes, before you spend anything on transition planning.

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

The Window Is Open. It Won’t Stay That Way.

Three-year transition periods create the illusion of distance. They don’t.

The organizations that handle standard transitions well are not the ones that wait for the final published standard and then scramble to close gaps. They’re the ones that track the direction of the revision, run a preliminary gap assessment while the draft is still in ballot, update management review inputs before the standard requires it, and arrive at their first transition audit with documented evidence of preparation — not a stack of recently revised procedures.

ISO 14001:2026 is published. The ISO 9001:2026 FDIS is in ballot. The ISO 45001:2027 DIS ballot is open. All three revision directions are clear enough to plan against right now.

For manufacturers running all three certifications, the planning decision isn’t whether to prepare. It’s whether to prepare for one integrated transition or three sequential ones.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO 13485 Documentation Requirements (2026)

Every document and record ISO 13485 requires — with clause references, document control requirements under Section 4.2, record retention rules, how QMSR changed the documentation landscape, and the seven gaps auditors find most consistently. Built as a reference document quality managers can use before their next audit.

Every document your QMS must have, what auditors check first, and why the gaps between your procedures and your records are where most findings live.

Last Updated: May 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Binder on the Shelf Is Not a QMS

Years ago, working in a nuclear component facility, I watched a certification audit go sideways in the first thirty minutes. The quality manager had spent six months building what looked like a complete quality management system — binders, procedures, forms, the works. The auditor asked to see the document register. The quality manager pointed to the binder. The auditor asked how documents were controlled at the point of use. The quality manager pointed to the binder again.

The binder was the system. It sat on a shelf in the quality office. The machinists on the floor had printed copies of procedures from three years prior. Nobody had a current revision of anything. The audit did not go well.

ISO 13485 documentation is not about having paperwork. It is about having the right documents, in the right format, accessible to the right people, at the right time — and being able to prove all of that during an audit. The standard is specific about what must be documented, what must be retained as records, and what that documentation must demonstrate.

Under QMSR, which took effect February 2, 2026, FDA now evaluates ISO 13485 documentation requirements against the framework directly. Organizations that treat documentation as a filing exercise rather than a quality system function are finding that gap at inspection.

This article covers every documentation requirement ISO 13485 imposes, where auditors look first, and what a compliant documentation system actually looks like in practice.

In This Guide

The difference between documents and records under ISO 13485 — and why it matters for audits
Every mandatory document the standard requires
Every mandatory record the standard requires
Document control requirements under Section 4.2
Record retention rules under Section 4.2.5
The most common documentation gaps auditors find
How QMSR changed the documentation landscape for U.S. medical device manufacturers
Decision-stage guidance for organizations at different points in their documentation journey

Start Here (Top Resources)

🔖 Get ISO 13485:2016 → ANSI Webstore — ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

🔖 Build compliant QMS documentation → 9001Simplified — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

🔖 Train your team on ISO 13485 documentation requirements → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Pursue or maintain ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the What Is ISO 13485? pillar article for full clause context, or use the ISO 13485 Gap Assessment Checklist to identify your specific documentation gaps before your next audit.

Documents vs. Records: The Distinction That Drives Compliance

ISO 13485 treats documents and records as separate categories with different requirements. Confusing them is one of the most consistent sources of documentation findings in surveillance audits.

Documents are instructions, procedures, specifications, and plans — the things that tell people what to do. They are living documents: they can be revised, updated, and superseded. Section 4.2.4 governs their control.

Records are evidence that something was done — completed forms, test results, inspection reports, calibration data, training sign-offs. They are fixed in time: once a record is created, it cannot be altered without creating a documented amendment. Section 4.2.5 governs their control.

The practical distinction matters for two reasons. First, the control requirements differ. Documents need revision control, approval, distribution, and obsolescence management. Records need legibility, identification, storage protection, retrieval, and defined retention periods. A documentation system that applies the same controls to both will have gaps in one or the other.

Second, auditors evaluate them separately. When an auditor asks for a procedure, they are asking for a document. When they ask for evidence, they are asking for a record. Handing an auditor a completed form when they asked for a procedure — or a procedure when they asked for evidence — signals a documentation system that does not understand its own structure.

At this point, most quality managers building or auditing a documentation system should: → Map your document inventory against your record inventory separately. If your document register includes completed forms alongside controlled procedures, your system architecture has a structural problem. 9001Simplified’s documentation kits include pre-structured document and record registers built for ISO 13485 compliance. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

Mandatory Documents Under ISO 13485

ISO 13485 requires specific documented procedures and plans across multiple clauses. These are not optional — certification bodies audit for their existence and their content.

ISO 13485 documentation infographic illustrating mandatory quality management system documents with interconnected process icons for quality manuals, risk management, design planning, procedures, records retention, purchasing controls, and document control requirements. — Certification bodies expect documented procedures, controlled records, and defined plans that demonstrate the quality system operates consistently and remains audit ready — see the full list in the table below.

Document	Clause	What It Must Cover
Quality Manual	4.2.2	Scope of the QMS, exclusions with justification, documented procedures or references, description of QMS process interactions
Document Control Procedure	4.2.4	Approval, review, revision control, distribution, obsolescence management, external documents
Records Control Procedure	4.2.5	Identification, storage, protection, retrieval, retention periods, disposition
Management Review Procedure	5.6	Inputs, outputs, frequency, documentation requirements
Competence, Training & Awareness Procedure	6.2	How competence is determined, how training is delivered, how competence is evaluated and recorded
Infrastructure Procedure	6.3	Maintenance of buildings, equipment, and supporting services affecting product quality
Work Environment Procedure	6.4	Control of work environment conditions where required for product conformity
Risk Management Procedure	7.1	Risk management process across the product lifecycle, per ISO 14971
Customer-Related Processes Procedure	7.2	Requirements determination, review, and customer communication
Design & Development Procedure	7.3	Planning, inputs, outputs, review, verification, validation, transfer, changes (if design is not excluded)
Purchasing Procedure	7.4	Supplier evaluation, selection, monitoring, and purchasing information
Production & Service Controls Procedure	7.5	Control of production and service provision, cleanliness, installation, and servicing
Identification & Traceability Procedure	7.5.3	Product identification throughout realization and traceability requirements
Customer Property Procedure	7.5.4	Control and safeguarding of customer-supplied product or data
Preservation Procedure	7.5.5	Preservation of product during processing and delivery
Monitoring & Measurement Equipment Procedure	7.6	Calibration, verification, and control of measuring equipment
Feedback Procedure	8.2.1	Post-market surveillance and feedback collection
Complaint Handling Procedure	8.2.2	Complaint receipt, investigation, and regulatory reporting decisions
Internal Audit Procedure	8.2.4	Audit planning, conduct, reporting, and follow-up
Nonconforming Product Procedure	8.3	Identification, segregation, evaluation, and disposition
CAPA Procedure	8.5.2 / 8.5.3	Corrective and preventive action process, including root cause analysis and effectiveness verification

⚠️ If your organization excludes design and development under Clause 7.3, that exclusion must be justified in the Quality Manual and documented. Exclusions without documented justification are a consistent finding in initial certification audits.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Mandatory Records Under ISO 13485

Records are the evidence your QMS operated as documented. The standard specifies which records must be maintained — these are the minimum. Your procedures may require additional records.

Record	Clause	What It Must Demonstrate
Management Review Minutes	5.6.3	Inputs reviewed, decisions made, actions assigned with owners and timelines
Education, Training, Skills & Experience	6.2	Competence evaluated, training completed, results recorded
Infrastructure Maintenance	6.3	Maintenance activities and results for quality-critical equipment
Risk Management Records	7.1	Risk analysis, risk evaluation, risk control, residual risk assessment, post-production monitoring
Customer Requirements Review	7.2.2	Requirements determined and confirmed before commitment
Design & Development Records	7.3	Inputs, outputs, reviews, verifications, validations, transfer, and changes (if not excluded)
Design & Development Changes	7.3.9	Change description, evaluation, verification, validation, approval
Supplier Evaluation Records	7.4.1	Evaluation criteria, results, and re-evaluation decisions
Production Process Validation	7.5.2	Validation protocols, results, equipment qualifications
Traceability Records	7.5.3.2	Unique device identification and traceability through production
Customer Property Records	7.5.4	Receipt, condition assessment, and disposition of customer property
Calibration Records	7.6	Equipment identification, calibration standard, results, next due date
Internal Audit Records	8.2.4	Audit plans, findings, nonconformances, corrective actions, follow-up
Product Monitoring & Measurement	8.2.6	Evidence of conformity and identification of release authority
Nonconforming Product Records	8.3	Nature of nonconformity, disposition decision, concession records if applicable
CAPA Records	8.5.2 / 8.5.3	Root cause analysis, action taken, effectiveness verification with criteria and evidence

➡️ 9001Simplified Documentation Kits — Pre-built ISO 13485 procedures, forms, and record templates covering every mandatory document and record listed above. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

Document Control: What Section 4.2.4 Actually Requires

Section 4.2.4 sets out seven specific requirements for document control. Each one has a practical implementation implication — and each one is evaluated individually during audits.

1. Documents must be approved before use. Approval must be by authorized personnel. Your document control procedure must define who has approval authority for each document type. A document approved by someone outside that authority — or with no documented approval at all — is a nonconformance.

2. Documents must be reviewed, updated as necessary, and re-approved. Review frequency should be defined in your procedure. Documents that have never been reviewed since initial creation are a finding in surveillance audits — particularly if the regulatory environment or production process has changed.

3. Changes and current revision status must be identified. Every controlled document needs a revision identifier — a number, letter, or date — and your document register needs to reflect current revision status. Auditors check this against what is in use.

4. Relevant versions must be available at points of use. This is the binder-on-the-shelf failure. Current controlled versions must be accessible where work is performed. If people work from printed copies, you need a controlled printing process. If work is performed on a production floor, current procedures must be accessible there — not only in the quality office.

5. Documents must be legible and identifiable. This sounds obvious. It is consistently violated by organizations that allow handwritten annotations, informal updates, or degraded printed copies to remain in service.

6. External documents must be identified and controlled. This includes customer drawings, regulatory guidance documents, referenced standards, and supplier specifications. External documents that affect product quality must be listed in your document control system and their current version verified.

7. Obsolete documents must be prevented from unintended use. Obsolete documents must either be removed from all points of use or clearly marked as obsolete. Finding an active workstation with a superseded procedure is a major nonconformance — regardless of whether anyone was actually using it.

If you are under active FDA inspection pressure → BSI Group ISO 13485 Training covers document control implementation and audit preparation in depth. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

Record Retention: What Section 4.2.5 Actually Requires

Section 4.2.5 requires that records be retained for a period at least equal to the lifetime of the medical device, but not less than two years from the date of product release by the organization.

That two-year floor is the minimum. In practice, most medical device records should be retained significantly longer:

Implantable devices — the device lifetime may span decades. Records need to match.
Devices with long service lives — the same logic applies.
FDA QMSR requirements — align with ISO 13485 on the two-year minimum but your complaint handling procedure may require longer retention for MDR-related records.
Customer contractual requirements — OEM customers increasingly specify record retention periods in their supplier quality agreements. These requirements take precedence where they are more stringent than the standard’s minimum.

Your records control procedure must define retention periods for each record type. A blanket “two years” policy applied to all records — including design history files and risk management records for long-life devices — is not compliant.

Provider	What You Get	Best For
ANSI Webstore	ISO 13485:2016 official standard	Any organization needing the controlled, compliant version of the standard
9001Simplif i ed	QMS documentation kits with record templates	Organizations building documentation from scratch or rebuilding after a major finding
BSI Group	ISO 13485 training courses	Teams implementing documentation systems or preparing for initial certification
ISOQAR	ISO 13485 certification	Organizations ready to pursue or maintain certification

Most organizations building documentation systems from scratch need all three:

The standard from ANSI Webstore (use CC2026 for 5% off)
Lead implementer training from BSI Group
A documentation kit from 9001Simplified

This combination covers the standard, the knowledge, and the implementation infrastructure.

The Most Common Documentation Gaps

ISO 13485 documentation gaps infographic illustrating seven common audit findings, including outdated document registers, incomplete supplier records, weak CAPA evidence, missing procedures, and disconnected risk management records within medical device quality systems. — Documentation failures rarely appear as isolated findings. They create chains of audit problems across CAPA, supplier controls, training, management review, and risk management. The gap is usually discovered long after it was created.

These are the findings that appear most consistently in ISO 13485 surveillance audits and QMSR inspections. Each one points to a specific procedure or record requirement.

The Quality Manual references procedures that don’t exist. A common initial certification shortcut is writing a Quality Manual that references a full set of documented procedures — then discovering during the surveillance audit that several of those procedures were never finalized. The Quality Manual and the document register must be synchronized.

The document register is not current. Document registers that haven’t been updated in months, that show revision numbers inconsistent with what is in use, or that are missing entire document categories are a consistent finding. The register is the first thing many auditors check.

Risk management records stop at design transfer. ISO 14971 requires risk management across the product lifecycle. Design-phase risk files with no post-production updates — no connection to complaint data, service reports, or CAPA findings — are incomplete regardless of how thorough the original analysis was. See ISO 14971 vs ISO 13485 for the full lifecycle requirement.

CAPA records close without effectiveness verification evidence. A CAPA record that reads “action implemented — problem resolved” with no supporting data is not a closed CAPA — it is an open finding waiting to be issued. For the complete breakdown of what effectiveness verification requires, see CAPA Requirements in ISO 13485.

Supplier qualification records are incomplete or outdated. An approved supplier list without corresponding qualification evidence, or qualification records for suppliers whose scope has changed without requalification, are consistently cited findings under Clause 7.4.

Training records prove attendance, not competence. Sign-off sheets showing who attended a training session are not competence records. The record must show what competence was evaluated, by what method, and what the result was. See Common Mistakes in ISO 13485 QMS for the full breakdown of this finding.

Management review minutes record presentations, not decisions. Minutes that describe what was presented in management review without documenting what was decided are a major finding under Section 5.6.3. Every input reviewed must produce a documented output — a decision, an action, or a rationale for no action.

How QMSR Changed the Documentation Landscape

FDA’s Quality Management System Regulation, effective February 2, 2026, aligns U.S. medical device QMS requirements with ISO 13485:2016. For documentation, the practical changes are significant.

The Device Master Record (DMR) structure is now explicitly required. Under QMSR, the DMR — which must include device specifications, production process specifications, quality assurance procedures, packaging and labeling specifications, and installation and maintenance procedures — is a specific documentation requirement that ISO 13485 certification alone does not fully address.

Complaint files under 21 CFR 820.198 remain a separate requirement. ISO 13485 requires a complaint handling procedure. QMSR additionally requires that complaint files contain specific elements — including the decision on whether the complaint required investigation and, if so, the results of that investigation — that go beyond what most ISO 13485 complaint procedures specify.

MDR procedures must be documented separately. Medical Device Reporting obligations are a regulatory requirement that sits outside ISO 13485 but must be addressed in your QMS documentation under QMSR.

⚠️ FDA QMSR compliance date was February 2, 2026. If your documentation system has not been reviewed against the four QMSR-specific bridge requirements since that date, that review is overdue. The ISO 13485 Gap Assessment Checklist covers all four QMSR bridge requirements explicitly alongside the standard ISO 13485 clause requirements.

For the full regulatory alignment picture, see FDA QSR vs ISO 13485.

Infographic explaining the major operational and regulatory changes introduced under the FDA QMSR, including terminology alignment, expanded risk management, inspection changes, and ISO 13485 document control requirements. — The FDA’s QMSR transition introduced major changes beyond terminology — expanding risk management expectations, changing inspection structure, and aligning medical device quality systems directly with ISO 13485.

Why Organizations Delay Getting Documentation Right

“We’ll clean it up before the surveillance audit.”

This is the most common delay rationalization — and it consistently produces the worst outcomes. Documentation gaps that accumulate over 11 months cannot be credibly remediated in the 30 days before a surveillance visit. Auditors can identify recently created records. A CAPA file dated three weeks before the audit for a problem that complaint data shows has existed for eight months is not evidence of a functioning QMS — it is evidence of audit preparation, which auditors treat as a different category of finding.

“Our documentation was good enough for initial certification.”

Initial certification evaluates documentation at a point in time against a system that was built to be audited. Surveillance audits evaluate whether that system has been maintained — which means they look at records created since the last audit, not at procedures written before it. Organizations that passed initial certification and then stopped maintaining their documentation systems often face multiple major nonconformances at the first surveillance visit.

“We don’t have the internal resources to build this properly.”

This objection is real — but the cost of building documentation properly before certification is substantially lower than the cost of remediation after a major nonconformance. A documentation kit from 9001Simplified covers every mandatory document and record template in a ready-to-use format. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch. The internal labor required to customize a pre-built kit is a fraction of what is required to build from scratch — and a fraction of what remediation costs after a finding.

Frequently Asked Questions

What documents are required by ISO 13485?

ISO 13485 requires documented procedures covering quality manual, document control, records control, management review, training and competence, risk management, customer requirements, purchasing, production controls, identification and traceability, calibration, feedback, complaint handling, internal audit, nonconforming product, and CAPA. The full list with clause references is in the Mandatory Documents table above.

What records are required by ISO 13485?

ISO 13485 requires records covering management reviews, training and competence evaluations, risk management activities, design and development (if not excluded), supplier evaluations, calibration, internal audits, product monitoring, nonconforming product dispositions, and CAPA activities. The full list with clause references is in the Mandatory Records table above.

How long must ISO 13485 records be retained?

The standard requires retention for at least the lifetime of the device, with a minimum of two years from product release. For implantable devices and devices with long service lives, the retention period is typically longer and should be defined in your records control procedure. FDA QMSR aligns with this minimum but specific record types — particularly MDR-related records — may require longer retention.

Does ISO 13485 require a Quality Manual?

Yes. Section 4.2.2 requires a Quality Manual that defines the scope of the QMS, documents or references procedures, and describes the interactions between QMS processes. The Quality Manual is one of the first documents an auditor requests.

Can we use electronic records to meet ISO 13485 requirements?

Yes — electronic records are acceptable provided your document control system ensures they are controlled, legible, retrievable, and protected from unauthorized modification. Electronic systems used to manage controlled documents must themselves be validated if they affect product quality.

What is the difference between a controlled document and a record under ISO 13485?

A controlled document is an instruction, procedure, or specification that tells people what to do — it can be revised and must be version-controlled. A record is evidence that something was done — it is fixed in time and must be retained according to your records control procedure. Section 4.2.4 governs controlled documents; Section 4.2.5 governs records. The distinction is fundamental to building a compliant documentation system.

Does design and development documentation apply to all medical device manufacturers?

Only if the manufacturer performs design and development activities. If your organization manufactures to customer specifications and does not perform design activities, you may be eligible to exclude Clause 7.3 — but that exclusion must be documented and justified in your Quality Manual. Contract manufacturers who claim a 7.3 exclusion without justification are consistently cited at initial certification.

How do FDA QMSR documentation requirements differ from ISO 13485?

QMSR aligns with ISO 13485 but adds four specific requirements: the Device Master Record structure, complaint files under 21 CFR 820.198, Medical Device Reporting procedures, and corrections and removals procedures. ISO 13485 certification alone does not cover these four requirements. The ISO 13485 Gap Assessment Checklist addresses all four explicitly.

What is the first thing an auditor looks at for ISO 13485 documentation?

Most auditors start with the document register — to verify that controlled documents are listed, revision levels are current, and the register reflects what is actually in use. From there they move to the Quality Manual to verify scope and procedure references. Gaps in either of those two items typically expand the audit’s scope significantly.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need the official ISO 13485:2016 standard → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to build ISO 13485 documentation from scratch → 9001Simplified Documentation Kits — ready-to-use procedures, forms, and record templates for every mandatory document.

→ You need to train your team on documentation requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You are ready to pursue ISO 13485 certification → ISOQAR — UKAS-accredited, one of the most recognized certification bodies in the industry.

→ You need to assess your documentation gaps before your next audit → ISO 13485 Gap Assessment Checklist — free, 64 items.

→ You need to understand how QMSR changed your documentation obligations → FDA QSR vs ISO 13485

→ You need to understand CAPA record requirements in depth → CAPA Requirements in ISO 13485

→ You need to understand the most common documentation audit findings → Common Mistakes in ISO 13485 QMS

→ You need to understand how risk management documentation connects to your QMS → ISO 14971 vs ISO 13485

→ You need to understand the full ISO 13485 clause structure → What Is ISO 13485?

→ You want to buy ISO 13485 → Buy ISO 13485

→ You want to browse all medical device standards → explore standards by compliance area

Still figuring out where to start?

If you are not ready to commit to a documentation build yet — that is normal. Most organizations spend several weeks between identifying gaps and starting remediation.

The best next step: → Download the free ISO 13485 Gap Assessment Checklist — it takes 20 minutes and tells you exactly which documents and records you are missing before you spend anything.

Feature image promoting an ISO 13485 Gap Assessment Checklist for medical device manufacturers, contract manufacturers, and component suppliers preparing for certification and FDA QMSR compliance. — ISO 13485 Gap Assessment Checklist designed to help medical device manufacturers identify compliance gaps, prioritize actions, and prepare for certification and FDA QMSR requirements.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Binder Is Not the System

Documentation is not ISO 13485’s most technically demanding requirement. But it is the foundation every other requirement rests on. Without controlled documents, procedures cannot be consistently followed. Without records, there is no evidence that procedures were followed at all. Without a document control system that connects what is written to what people actually use, the gap between those two things grows quietly — until an auditor measures it.

The organizations that handle documentation audits well are not the ones with the most sophisticated quality management software or the thickest procedure binders. They are the ones whose documentation reflects how work actually gets done — current, accessible, and connected to the records that prove it.

That alignment takes discipline to build and discipline to maintain. It does not take complexity.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

Subscribe below to stay ahead.

Common Mistakes in ISO 13485 QMS (2026)

Seven ISO 13485 QMS mistakes that consistently produce major nonconformances — document control drift, management review gaps, supplier qualification failures, CAPA records closed without verification, risk management treated as a one-time activity, competence records that prove attendance not ability, and internal audits that never find anything. With clause references and fixes for each.

The audit findings that derail medical device manufacturers — and the fixes that prevent them.

Last Updated: May 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Your QMS Passed Initial Certification. Now the Surveillance Audit Found Three Major Nonconformances.

This scenario plays out more often than most quality managers expect.

Initial certification audits are thorough — but they happen at a fixed point in time, against a QMS that was built specifically to pass them. Surveillance audits arrive 12 months later and evaluate how the system actually operates day to day. That gap between what was built and what runs is where most findings live.

The mistakes in this article are not obscure edge cases. They are the findings that certification bodies issue most consistently, that FDA investigators flag most frequently under QMSR, and that experienced quality practitioners see repeated across organizations of every size. Some of them look like documentation failures. Most of them are process failures wearing documentation’s clothes.

If you are preparing for a first certification audit, a surveillance visit, or an FDA QMSR inspection, this list tells you where to look before the auditor does.

In This Guide

The most common mistakes in ISO 13485 QMS by clause
Why document control failures are almost never about documents
The management review gap that catches organizations by surprise
How supplier qualification problems compound over time
What auditors find when they look at CAPA records
The risk management connection most QMS procedures miss
Decision-stage guidance for organizations at different points in their compliance journey

Start Here (Top Resources)

🔖 Train your team on ISO 13485 → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Pursue or maintain ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the What Is ISO 13485? pillar article for full clause context, or use the ISO 13485 Gap Assessment Checklist to identify your specific gaps before your next audit.

Mistake 1: Document Control That Controls Nothing

The clause: ISO 13485 Section 4.2 — Document Control

What auditors find: Obsolete procedures still accessible in shared drives. Forms in use that don’t match the current controlled version. Employees working from printed copies with no revision date. Documents approved by someone whose role no longer includes that authority.

Document control failures are the most consistently cited finding in ISO 13485 surveillance audits — not because organizations don’t have document control procedures, but because those procedures don’t match how people actually access and use documents day to day.

The standard requires that documents be reviewed and approved before use, that current versions are available at points of use, and that obsolete documents are prevented from unintended use. Each of those three requirements has failed in organizations that had a document control procedure on file.

The fix: Document control is an access problem, not a paperwork problem. The question is not “do we have a procedure?” — it’s “can an employee working right now reach a document that has been superseded?” If the answer is yes, your document control system is not functioning regardless of what your procedure says.

Audit your access architecture — shared drives, QMS software, printed SOPs at workstations — before an auditor does. Every document a user can reach should be the current controlled version. Everything else should require deliberate action to retrieve.

At this point, most quality managers in this position should: → Pull your document control procedure and map it against actual employee access. If those two things don’t match, 9001Simplified’s documentation kits include document control templates built specifically for ISO 13485 compliance. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

Mistake 2: Management Review Without Documented Outputs

The clause: ISO 13485 Section 5.6 — Management Review

What auditors find: Meeting minutes that record attendance and agenda items but contain no documented decisions. Review inputs listed without evidence they were actually analyzed. Action items described without owners, deadlines, or follow-up records. Reviews conducted annually when the organization’s risk profile warranted more frequent review.

ISO 13485 Section 5.6.3 is explicit: management review outputs must include decisions and actions related to improvement of the QMS, improvement of product to meet customer requirements, and resource needs. A management review that happened but produced no documented decisions is a nonconformance — regardless of what was discussed in the room.

This finding catches organizations off guard because the review itself felt thorough. Leadership reviewed quality objectives, discussed complaint trends, walked through audit results. But the meeting minutes read like a summary of what was presented, not a record of what was decided.

The fix: Management review outputs need to look like decisions, not summaries. For each input reviewed, the record should show: what the data indicated, what conclusion was reached, and what — if anything — will be done about it. “Complaint trend reviewed — no action required” is a decision. “Complaint data presented” is not.

⚠️ Under QMSR, FDA inspectors now evaluate management review as part of every inspection. Inspectors who find management reviews without documented outputs routinely cite this as a systemic QMS failure, not an administrative lapse.

Mistake 3: Supplier Qualification on Paper Only

ISO 13485 supplier qualification infographic illustrating risk-based supplier controls under Clause 7.4, featuring a supplier risk tier matrix, qualification lifecycle process, ongoing monitoring activities, and common supplier management mistakes. — Supplier qualification under ISO 13485 is not a one-time approval exercise. Risk classification, qualification activities, performance monitoring, and periodic re-evaluation must work as a continuous lifecycle.

The clause: ISO 13485 Section 7.4 — Purchasing / Supplier Controls

What auditors find: An approved supplier list that has not been updated in years. Suppliers qualified based on a questionnaire with no follow-up evaluation. Critical suppliers with no documented performance monitoring. Qualification records for suppliers whose scope of supply has expanded beyond what was originally evaluated.

Supplier qualification failures compound over time in a way that most other QMS failures don’t. A supplier that was qualified five years ago may have changed ownership, changed manufacturing processes, changed subcontractors, or expanded into new product categories — none of which triggered a requalification because the procedure didn’t require one.

ISO 13485 requires that purchasing controls be proportionate to the risk the supplier presents to product quality and patient safety. That proportionality has to be reflected in your qualification criteria, your monitoring frequency, and your records. An approved supplier list populated with names and no evaluation data is not a supplier qualification program.

The fix: Supplier qualification is a living process, not a one-time gate. Your procedure should define evaluation criteria by supplier risk tier, monitoring frequency, requalification triggers, and what happens when a supplier fails to meet performance criteria. If you are using the Supplier Quality Checklist, the ISO 13485 Clause 7.4 section identifies every supplier control element auditors evaluate — including the ones most procedures leave undocumented.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Mistake 4: CAPA Records That Close Without Verification

ISO 13485 CAPA infographic comparing incorrect and correct closure methods, showing the difference between closing corrective actions without effectiveness verification and closing them with documented objective evidence under Clause 8.5.2. — CAPA is not complete when action is implemented. Under ISO 13485 Clause 8.5.2, closure requires effectiveness verification supported by defined criteria, monitoring, objective evidence, and documented results.

The clause: ISO 13485 Section 8.5.2 — Corrective Action

What auditors find: CAPAs closed at implementation with no effectiveness check. Effectiveness verifications that consist of a single sentence — “action implemented, problem resolved” — with no supporting data. Criteria for effectiveness that were defined after the action was taken rather than before. The same problem recurring in a subsequent audit cycle.

Closing a CAPA without effectiveness verification is one of the most consistently cited major nonconformances in ISO 13485 audits. The standard requires that corrective actions be reviewed for effectiveness — and that review must be documented, must use defined criteria, and must be supported by evidence.

The pattern most organizations fall into is treating CAPA closure as an administrative step rather than a quality decision. Someone implements the action, marks the record complete, and moves on. The question “did this actually work?” never gets formally answered.

The fix: Effectiveness verification criteria must be established before the corrective action is implemented — not after. The criteria should be specific enough that a different person reviewing the record could objectively determine whether they were met. “No recurrence for 90 days” is a criterion. “Situation improved” is not.

For a complete breakdown of CAPA requirements under ISO 13485 Clause 8.5.2 — including the InfuTronix case study and the six mandatory data inputs under Section 8.4 — see CAPA Requirements in ISO 13485.

➡️ BSI Group ISO 13485 Training — Covers CAPA, supplier controls, management review, and all major ISO 13485 clauses. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

Mistake 5: Risk Management Treated as a One-Time Activity

The clause: ISO 13485 Section 7.1 / ISO 14971

What auditors find: Risk files created during design and never updated. Post-market surveillance data that has no documented connection to risk management. Field failures that triggered a CAPA but never prompted a review of the corresponding risk file. Risk management plans that reference ISO 14971 but contain no evidence of post-production monitoring.

Risk management documentation under Clause 7.1 is now the top QMSR inspection finding — 25 citations in the first three months of QMSR inspection data, ahead of CAPA. That displacement reflects a systematic failure in how most organizations treat risk: as a design-phase activity rather than a lifecycle responsibility.

ISO 14971 is explicit that risk management extends across the entire product lifecycle. Post-market surveillance data, complaint trends, service reports, and CAPA findings are all risk management inputs. When those data sources exist in separate systems with no documented connection to the risk file, the risk management process is incomplete — regardless of how thorough the original risk analysis was.

The fix: Your risk management procedure should define how post-production information feeds back into risk files. When a complaint trend reaches a defined threshold, when a CAPA is opened for a field failure, when a service report pattern emerges — each of those events should trigger a documented review of the relevant risk analysis. That review should produce a documented decision: residual risk is still acceptable, or risk control measures need updating.

For the full picture of how ISO 14971 and ISO 13485 interact at the clause level, see ISO 14971 vs ISO 13485.

Mistake 6: Training Records That Prove Attendance, Not Competence

The clause: ISO 13485 Section 6.2 — Human Resources / Competence

What auditors find: Training records that show who attended a session and when, with no evidence of what was covered or whether it was understood. Competence assessments that consist of a supervisor signature with no evaluation criteria. Personnel performing quality-critical tasks without documented evidence that they are qualified to do so. New employees signed off on procedures they completed training on — but with no record of how competence was evaluated.

ISO 13485 Section 6.2 requires that personnel performing work affecting product quality are competent — and that competence is evaluated and the results are recorded. Attendance is not competence. Completing a training module is not competence. Competence is the demonstrated ability to apply knowledge and skills to produce the required outcome.

This distinction becomes a major finding when an auditor pulls the training record for someone who made a quality-critical decision and finds a sign-off sheet.

The fix: Competence evaluation needs defined criteria for each quality-critical role — what knowledge and skill is required, and how it will be evaluated. That evaluation can be a practical demonstration, a written assessment, a supervised work period with documented sign-off, or another method appropriate to the task. The key is that the record shows what was evaluated and what the result was — not just that training occurred.

If you are building competence frameworks from scratch, BSI Group’s ISO 13485 training courses include role-based competency models that align with Section 6.2 requirements. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

Mistake 7: Internal Audits That Don’t Find Anything

The clause: ISO 13485 Section 8.2.4 — Internal Audit

What auditors find: Internal audit programs that audit the same low-risk processes repeatedly while avoiding the areas where problems actually exist. Audit reports that describe observations as “satisfactory” or “no issues found” across every clause. Internal auditors who have never issued a nonconformance. Audit findings that are consistently minor and never escalate to CAPA.

An internal audit program that finds nothing is either auditing the wrong things or auditing them incorrectly. Certification bodies and FDA investigators specifically look at the output of your internal audit program — not just whether audits were conducted on schedule. If your internal audit findings never trigger a CAPA and never surface anything your surveillance audit finds, that incongruence is a finding in itself.

ISO 13485 requires that the internal audit program take into account the status and importance of the processes to be audited and the results of previous audits. A risk-based audit program will allocate more frequency and depth to high-risk processes — CAPA, supplier controls, complaint handling, design controls — and less to lower-risk administrative processes.

The fix: Evaluate your internal audit program against what your surveillance audits and FDA inspections have actually found. If there is a consistent gap — if surveillance audits find things your internal audits missed — that gap is the finding. Your audit program needs to be harder on the areas that matter most, not easier.

If you need to develop your internal audit capability, ISOQAR offers ISO 13485 internal auditor training and certification support. ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

At this point, most quality managers preparing for their next audit should: → Cross-reference your last three internal audit reports against your last surveillance audit finding. If the surveillance audit found something your internal audits missed, that’s the gap to close first. Get the ISO 13485 Gap Assessment Checklist to run a structured review across all clauses.

Common Misconceptions About ISO 13485 QMS

ISO 13485 infographic illustrating common misconceptions about quality management systems, comparing myths versus reality around certification, QMSR alignment, and major nonconformances in medical device quality systems. — Some of the most expensive ISO 13485 mistakes begin as assumptions. Certification is not a finish line, ISO 13485 and QMSR are not identical, and a major nonconformance does not automatically mean certification loss.

“Passing initial certification means the QMS is compliant.”

Initial certification confirms that a QMS met the standard’s requirements at a specific point in time, as evaluated against a specific set of records. Surveillance audits evaluate whether the system continues to operate as documented. Organizations that build a QMS to pass initial certification and then don’t maintain it operationally consistently accumulate findings by the first surveillance audit. Certification is not a destination — it is a recurring obligation.

“ISO 13485 and FDA QMSR requirements are now the same thing.”

QMSR, which took effect February 2, 2026, aligns FDA’s device QMS requirements with ISO 13485 — but does not make them identical. Four FDA-specific requirements exist in QMSR that ISO 13485 certification alone does not cover: complaint files under 21 CFR 820.198, MDR procedures, corrections and removals, and the device master record structure. An organization that is ISO 13485 certified is not automatically QMSR compliant. The ISO 13485 Gap Assessment Checklist covers all four QMSR bridge requirements explicitly.

“A major nonconformance means we will lose certification.”

A major nonconformance means the certification body has identified a significant gap in the QMS — one that has the potential to affect product quality or patient safety. It does not automatically result in suspension or withdrawal of certification. It triggers a corrective action requirement with a defined response timeline. Organizations that respond with a documented root cause analysis and credible corrective action plan typically resolve major nonconformances without losing certification. The risk is not the finding — it is the failure to respond adequately.

Frequently Asked Questions

What is the most common ISO 13485 audit finding?

Document control failures under Section 4.2 are consistently the most common finding in surveillance audits. CAPA effectiveness verification failures and management review output gaps follow closely. Under QMSR inspections, risk management documentation under Clause 7.1 is now the leading finding.

How many nonconformances are typical in an ISO 13485 surveillance audit?

There is no typical number. A mature QMS with active internal audit and CAPA programs may receive zero nonconformances. A QMS that has been maintained administratively rather than operationally may receive multiple majors. What matters is whether findings from one audit cycle are genuinely closed before the next one.

What is the difference between a major and minor nonconformance in ISO 13485?

A major nonconformance indicates a systematic failure that has the potential to affect product quality or patient safety — or the complete absence of a required process. A minor nonconformance indicates an isolated lapse or a process weakness that does not constitute a systematic failure. Major nonconformances require a documented corrective action plan with a defined response timeline. Minor nonconformances are typically addressed at the next surveillance audit.

Can we self-declare ISO 13485 compliance without certification?

Self-declaration against ISO 13485 is not recognized in the medical device industry in the way it is sometimes used in other sectors. Customers, regulatory bodies, and OEMs expect third-party certification from an accredited body. Self-declaration provides no audit trail and no independent verification of compliance. If you are building toward certification, ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

How long does it take to fix a major nonconformance?

Certification bodies typically allow 30 to 90 days to respond to a major nonconformance with a documented corrective action plan, evidence of root cause analysis, and initial implementation evidence. Full closure — including effectiveness verification — may take longer depending on the nature of the finding. The timeline should be proposed by the organization and accepted by the certification body.

What is the best way to prepare for an ISO 13485 surveillance audit?

Run a structured internal audit against the clauses most likely to surface findings — Section 4.2 (document control), Section 5.6 (management review), Section 7.4 (supplier controls), Section 8.2.4 (internal audit), and Section 8.5.2 (CAPA). Pull a sample of CAPA records and verify that effectiveness verifications are complete. Review your management review minutes for documented outputs. Check that your approved supplier list reflects current qualification status. The ISO 13485 Gap Assessment Checklist covers all of this in 64 structured items.

Do these mistakes also apply under FDA QMSR?

Yes — and in some cases the stakes are higher. QMSR inspections evaluate every subsystem, every inspection. Document control failures, CAPA gaps, and management review deficiencies that might result in a minor nonconformance from a certification body can result in a 483 observation or warning letter from FDA. See FDA QSR vs ISO 13485 for the full regulatory alignment picture.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need the official ISO 13485:2016 standard → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to assess your QMS gaps before your next audit → ISO 13485 Gap Assessment Checklist — free, 64 items

→ You need to build or rebuild QMS documentation → 9001Simplified Documentation Kits — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

→ You need to train your team on ISO 13485 requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You are ready to pursue or maintain ISO 13485 certification → ISOQAR — UKAS-accredited, one of the most recognized certification bodies in the industry.

→ You need to understand CAPA requirements in depth → CAPA Requirements in ISO 13485

→ You need to understand how risk management connects to your QMS → ISO 14971 vs ISO 13485 and What Is ISO 14971?

→ You need to understand how QMSR changed your compliance obligations → FDA QSR vs ISO 13485

→ You need to understand what ISO 13485 covers at the clause level → What Is ISO 13485?

→ You need to understand the cost of ISO 13485 certification → How Much Does ISO 13485 Cost?

→ You want to buy ISO 13485 → Buy ISO 13485

→ You want to browse all medical device standards → explore standards by compliance area

Still figuring out where to start?

If you are not ready to invest in training or documentation yet — that is normal. Most organizations take several weeks to move from identifying gaps to committing to a remediation plan.

The best next step for most organizations at this stage: → Download the free ISO 13485 Gap Assessment Checklist — it takes 20 minutes and tells you exactly where your QMS has gaps before you spend anything.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Gap Between What Was Built and What Runs

Most ISO 13485 QMS failures are not failures of intent. The organizations that receive major nonconformances typically built their systems with genuine effort. What they built, however, was optimized for initial certification — not for the ongoing operational reality that surveillance audits and FDA inspections evaluate.

Document control systems that work at go-live drift as people find workarounds. CAPA programs that close records efficiently lose track of effectiveness. Management reviews that felt thorough produce minutes that record what was presented rather than what was decided. None of these failures are dramatic. They accumulate quietly, and they surface at the worst possible time.

The difference between a QMS that passes surveillance audits consistently and one that doesn’t is not sophistication. It is the discipline to evaluate what the system actually does — not just what the procedures say it does — on a regular basis.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

Subscribe below to stay ahead.

CAPA Requirements in ISO 13485 (2026)

CAPA under ISO 13485 is more than corrective action paperwork. Learn what auditors and FDA investigators actually evaluate, common CAPA failures, Clause 8.5 requirements, effectiveness verification expectations, and how CAPA now fits into modern QMSR inspection strategy.

What the FDA’s newest inspection data reveals about where medical device manufacturers are still getting it wrong — and how to close the gaps before your next audit.

Last Updated: May 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The FDA Just Changed How It Measures Your CAPA System — And Most Manufacturers Haven’t Noticed

CAPA was the undisputed number-one FDA 483 finding for years. Not close. Not rotating with other subsystems. Every year, far and away.

That changed in 2026.

Three months of QMSR inspection data is in. Risk management documentation under Clause 7.1 now sits at number one — 25 citations. CAPA-related findings come in at 19 combined. On paper, that looks like good news. It isn’t — at least not entirely.

Here’s the nuance that matters: the inspection model changed. Under the old QSIT system, abbreviated inspections hit CAPA almost every single time. Other subsystems cycled in less frequently. CAPA’s dominance was partly an artifact of inspection structure, not a clean picture of where the industry actually struggled.

The new model looks at everything — every subsystem, every inspection. The categorization changed too. Under the old QSR, all CAPA requirements bundled into one code. Now they fragment. Two separate 8.5.2 entries already appear in the first dataset. CAPA didn’t disappear. The field just got wider.

If you’re managing a QMS for a medical device manufacturer, that means more exposure, not less.

In This Guide

What ISO 13485 Clause 8.5.2 actually requires — and what most procedures miss
The six mandatory data inputs for your CAPA process under Section 8.4
Why the InfuTronix case is the most instructive FDA enforcement example in recent years
The difference between measurement and analysis — and why confusing them causes most failures
How horizontal analysis works and why auditors look for it specifically
Common misconceptions that lead to major nonconformances
What to do before your next surveillance audit

Start Here (Top Resources)

🔖 Get ISO 13485 training → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Build your CAPA documentation → 9001Simplified — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

🔖 Pursue or maintain ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the Standards Library to identify which standards apply to your compliance area, or view the most widely used standards in medical devices and manufacturing.

What Is CAPA Under ISO 13485?

CAPA cycle diagram showing ISO 13485 Clause 8.5.2 corrective action and Clause 8.5.3 preventive action steps: Identify, Prevent, Monitor, Improve, Correct, Root Cause — CAPA under ISO 13485 follows a closed-loop process: identify issues, determine root cause, implement corrective action, monitor effectiveness, and prevent recurrence through continual improvement.

CAPA — Corrective and Preventive Action — is the mechanism your QMS uses to identify problems, trace them to root cause, and prevent recurrence. Under ISO 13485:2016, CAPA spans two clauses: Clause 8.5.2 (corrective action) and Clause 8.5.3 (preventive action). They operate differently and auditors evaluate them separately.

Corrective action addresses a nonconformity that has already occurred. Preventive action addresses a potential nonconformity that has not yet materialized. The distinction matters because the procedures, triggers, and documentation requirements differ between them.

ISO 13485 places CAPA in the broader context of Clause 8.5, which also covers continual improvement. But the practical application of CAPA runs deeper — it pulls from data collected across Clause 8.4 (analysis of data) and connects to management review, internal audits, and post-market surveillance. A CAPA procedure that treats the clause as standalone almost always fails at audit.

Under the QMSR (Quality Management System Regulation), which took effect February 2, 2026, FDA now explicitly harmonizes its device QMS requirements with ISO 13485. CAPA requirements that previously lived in 21 CFR Part 820.100 now map directly to ISO 13485 Clause 8.5.2. FDA expects those requirements to be met — and QMSR inspections are actively evaluating them.

What Clause 8.5.2 Actually Requires

Clause 8.5.2 sets out six specific requirements for corrective action. Each one has a documentation implication.

1. Review nonconformities — including customer complaints. This means your CAPA trigger list must include complaint data, not just internal defect records. If complaints are logged in one system and CAPA is managed in another, there needs to be a formal connection between them. Auditors check that connection.

2. Determine the causes of nonconformities — root cause analysis is not optional. Documenting “operator error” or “process deviation” without supporting evidence of how that conclusion was reached is a common major nonconformance. You need a documented methodology — 5 Whys, fishbone, fault tree — and evidence it was applied.

3. Evaluate the need for corrective action — not every nonconformity requires a CAPA. The standard requires you to evaluate and document that decision. Organizations that open a CAPA for every minor deviation create administrative burden; organizations that never document the decision to not open a CAPA create audit vulnerability.

4. Determine and implement corrective action — the action must be proportionate to the effects of the nonconformity. This means documented implementation, not just a description of what was planned.

5. Record results of corrective action — effectiveness verification is required. You must demonstrate that the action you took actually resolved the problem. A corrective action record that closes without verification evidence is not compliant.

6. Review corrective action and its effectiveness — this step loops back into your data analysis process. If the same problem recurs, your record should capture that recurrence and the updated response.

The 2026 QMSR inspection data showing two separate 8.5.2 citations reflects how inspectors are now parsing these requirements individually. A finding against root cause determination is a different citation from a finding against effectiveness verification.

At this point, most quality managers in this position should: → Confirm your CAPA procedure addresses all six elements explicitly — and that your records can demonstrate compliance with each one. Get the ISO 13485 Gap Assessment Checklist to verify your current gaps across all 13485 clauses.

The Six Data Inputs for Section 8.4

Clause 8.4 requires you to analyze data from specific sources to drive CAPA and continual improvement. The standard names six:

Data Source	What It Covers
Feedback	Customer complaints, post-market surveillance data, service reports flagged by users
Product conformity	Inspection results, test data, nonconforming product records
Process and product trends	Statistical process control, yield trends, recurring deviations
Supplier performance	Supplier nonconformances, delivery performance, qualification data
Audit results	Internal audit findings, certification body findings, customer audits
Service reports	Field service records, repair data, failure modes reported post-delivery

Your CAPA procedure must document how data from each of these sources is collected, reviewed, and used to make CAPA decisions. The piece most manufacturers skip entirely is what experienced quality practitioners call horizontal analysis — looking across your data sources, not just within them.

The Analysis Failure: What InfuTronix Got Wrong

The InfuTronix case is the most instructive CAPA enforcement example to come out of FDA inspection activity in recent years. It illustrates the most common failure mode — and it isn’t what most people expect.

InfuTronix had a rule written directly into their CAPA procedure: ten complaints in a rolling 12-month window triggers a CAPA. Simple enough. Documented. Auditable on its face.

Between September 2020 and August 2021, they received 80 complaints reporting power issues, 31 for battery failures, and 67 for leaking administration sets. Not one CAPA was opened.

This was not a data collection failure. The complaints were logged. The threshold was documented. The system simply never connected what was being measured to what that data actually meant.

That is an analysis failure — and it is the most common one FDA finds.

Measurement gets you the number. Analysis tells you what to do with it.

ISO 13485 Section 8.4 requires both, and your procedure needs to address the full cycle: collect the data, analyze it against defined criteria, and produce a documented decision. The decision can be: open a CAPA, escalate to management review, or continue monitoring. All three are defensible. No decision — or a decision made without documentation — is not.

FDA found all of this during inspection. The warning letter that followed cited failure to establish and maintain procedures for implementing corrective action under 21 CFR 820.100(a). Under QMSR, that same finding maps directly to ISO 13485 Clause 8.5.2.

Source: FDA Warning Letter, InfuTronix LLC, June 16, 2022. Available at fda.gov.

ISO 13485 Section 8.4 infographic showing the measurement and analysis cycle with a process flow from data collection to analysis, documented decision making, and outcomes including CAPA, management review, or continued monitoring. — Measurement gets you the number. Analysis determines the response. Under ISO 13485 Section 8.4, organizations must collect data, analyze it against defined criteria, and document a defensible decision.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Horizontal Analysis: The Step Most QMS Procedures Skip

Vertical analysis — reviewing data within a single source — is what most CAPA procedures are built around. You run through complaints. You run through audit findings. You check supplier nonconformances. Each in its own silo.

Horizontal analysis means looking across those sources simultaneously — specifically for patterns that only become visible when you connect the data.

A complaint spike in Q2 means something different when it aligns with a supplier nonconformance from the same quarter. A field failure pattern means something different when it correlates with a process change implemented three months prior. A rising service report trend means something different when internal inspection data for the same product shows clean numbers — because that combination suggests the problem is post-delivery, not in-process.

These cross-source connections are where real problems get caught before FDA finds them. They are also where most QMS procedures have no documented methodology whatsoever.

Your CAPA procedure should require a formal cross-source review at defined intervals — typically aligned with management review. The review should produce a documented output: either a CAPA trigger, a decision to continue monitoring with rationale, or escalation to a different quality subsystem.

Certification bodies increasingly audit for this specifically. The question is not just “do you have a CAPA procedure?” It’s “does your analysis process look across all six data sources and produce a documented decision?”

➡️ ANSI Webstore — Get ISO 13485:2016, the standard your CAPA procedure must align with. ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

Common CAPA Misconceptions

“A CAPA is only needed when something goes seriously wrong.”

The standard doesn’t set a severity threshold for opening a CAPA — it requires a documented decision about whether a nonconformity warrants one. The mistake isn’t opening too many CAPAs. It’s failing to document the evaluation. Auditors don’t penalize organizations for opening few CAPAs; they penalize organizations that can’t show they evaluated the data and made a deliberate decision.

“Closing the CAPA once the action is implemented is sufficient.”

Clause 8.5.2 requires effectiveness verification — evidence that the corrective action actually resolved the problem. Closing a CAPA at implementation is one of the most consistently cited findings in ISO 13485 surveillance audits. Effectiveness verification must be documented, must use defined criteria, and must happen at a point in time when there is enough post-implementation data to draw a conclusion.

“Our CAPA system is separate from complaint handling and that’s fine.”

It isn’t. The connection between complaint data and CAPA decisions must be explicit and documented. A complaint handling procedure that logs data and a CAPA procedure that never receives it create exactly the kind of system failure the InfuTronix case illustrates. If there is no formal handoff between your complaint system and your CAPA trigger evaluation, that gap will be found.

What Auditors Look For in CAPA Reviews

Whether the auditor is from a certification body or an FDA investigator conducting a QMSR inspection, the CAPA review follows a consistent pattern. Understanding it in advance is the most effective preparation.

They start with your procedure. They read it. They look for whether it covers all six elements of Clause 8.5.2 and whether it explicitly addresses the six data inputs from Clause 8.4. Gaps in the procedure are flagged before they look at a single record.

They pull a sample of CAPA records. Typically 3–5 for a surveillance audit, more for initial certification or for-cause inspections. They are looking for: documented root cause methodology, proportionality between the action and the finding, effectiveness verification with criteria and evidence, and closure only after verification.

They look for records that should exist but don’t. This is where analysis failures surface. If complaint data shows a spike and no CAPA was opened, the auditor will ask for the documented decision that concluded no CAPA was needed. If that document doesn’t exist, that is a finding — regardless of whether the decision was actually reasonable.

They check the connection between data sources. Does your management review input include CAPA status? Does your internal audit program look at CAPA effectiveness? Does complaint data flow into your trend analysis? These connections are evaluated systematically.

They review effectiveness verifications. A CAPA closed with “action implemented — problem resolved” and no supporting data is a major nonconformance. Effectiveness verification requires defined criteria established before the action is taken, a monitoring period, and data that demonstrates the criteria were met.

ISO 13485 CAPA audit review infographic showing the key areas auditors evaluate during certification and FDA inspections, including procedures, CAPA records, missing records, data connections, and effectiveness verification. — CAPA audits follow a predictable path. Auditors review procedures, sample records, process connections, and effectiveness evidence to determine whether your system is functioning as designed.

If you are preparing for a certification audit or a QMSR inspection, the FDA QSR vs ISO 13485 (QMSR Transition Guide) is the clearest resource available on how the two frameworks now align.

If you are building CAPA procedures from scratch or rewriting existing ones, the What Is ISO 13485? pillar article covers the full clause-by-clause context you need before the documentation work begins. For a complete breakdown of how ISO 13485 and FDA QMSR requirements interact at the clause level, see ISO 9001 vs ISO 13485.

If you are under active FDA inspection pressure → Get BSI Group ISO 13485 training and ISOQAR certification support immediately. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally. ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Provider	What You Get	Best For
ANSI Webstore	ISO 13485:2016 official standard document	Any organization needing the controlled, compliant version of the standard
BSI Group	ISO 13485 training courses	Teams preparing for implementation, audit readiness, or CAPA procedure development
9001Simplified	QMS documentation kits	Organizations building CAPA and QMS documentation from scratch
ISOQAR	ISO 13485 certification	Organizations ready to pursue or maintain certification

Most organizations at this stage need all three:

The standard from ANSI Webstore (use CC2026 for 5% off)
Lead implementer training from BSI Group
A documentation kit from 9001Simplified

This combination covers the standard, the knowledge, and the implementation infrastructure.

Frequently Asked Questions

What does ISO 13485 require for CAPA?

ISO 13485 Clause 8.5.2 requires a documented procedure that covers reviewing nonconformities, determining root causes, evaluating the need for action, implementing corrective action proportionate to the problem, recording results, and verifying effectiveness. Preventive action under Clause 8.5.3 follows a parallel structure for potential — not actual — nonconformities.

What is the most common CAPA finding in ISO 13485 audits?

Failure to verify the effectiveness of corrective actions is consistently the most common major nonconformance in surveillance audits. The second most frequent is incomplete root cause analysis — particularly records that name a root cause without showing the methodology used to reach that conclusion.

How many CAPAs should a medical device manufacturer open per year?

There is no target number. A small manufacturer with a mature QMS might open fewer than ten CAPAs annually and pass every audit. What auditors evaluate is whether the documented decision-making process is defensible — not the volume of CAPAs opened. If you are in a situation where your data shows patterns and no CAPAs are being opened, the risk is high regardless of company size.

Does CAPA under QMSR differ from CAPA under the old QSR?

The substance is largely the same. The significant change is that QMSR now explicitly adopts ISO 13485 Clause 8.5.2 as the governing framework, and inspections evaluate every subsystem — not just CAPA, as abbreviated QSIT inspections frequently did. Two separate 8.5.2 citations already appear in early QMSR inspection data, reflecting more granular evaluation of individual requirements within the clause. Read the full FDA QSR vs ISO 13485 Transition Guide for a complete breakdown.

What is the difference between corrective action and preventive action in ISO 13485?

Corrective action (Clause 8.5.2) addresses a nonconformity that has already occurred. Preventive action (Clause 8.5.3) addresses a potential nonconformity that trend data or risk analysis suggests may occur. The distinction is more than semantic — auditors evaluate them separately, the documentation requirements differ, and the trigger criteria for each should be explicit in your procedure.

Can we use a single CAPA form for both corrective and preventive actions?

Yes — many organizations use a combined form with fields that distinguish the type of action. What matters is that the record clearly identifies whether the action is corrective or preventive, that the corresponding clause requirements are addressed, and that the effectiveness verification criteria are appropriate for the action type.

What data sources must feed our CAPA process under ISO 13485?

Clause 8.4 identifies six: feedback (including complaints), product conformity data, process and product trends, supplier performance, audit results, and service reports. Your CAPA procedure should document how each source is reviewed, at what frequency, and how that review produces documented CAPA decisions. If you are using the ISO 13485 Gap Assessment Checklist, the data analysis section will identify exactly where your current procedure has gaps.

How long do we need to keep CAPA records?

ISO 13485 Section 4.2.5 requires records to be retained for a period at least equal to the lifetime of the device, but not less than two years from the date of product release. FDA QMSR requirements align with this. For implantable devices or devices with extended service life, the retention period is typically longer and should be specified in your records control procedure.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need the official ISO 13485:2016 standard → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to understand how your CAPA requirements changed under QMSR → FDA QSR vs ISO 13485 Transition Guide

→ You need to train your team on ISO 13485 CAPA requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You need to build CAPA documentation from scratch → 9001Simplified Documentation Kits — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS.

→ You are ready to pursue ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

→ You want to assess your full ISO 13485 gaps before spending anything → ISO 13485 Gap Assessment Checklist — free, 64 items

→ You need to understand what ISO 13485 covers before addressing CAPA specifically → What Is ISO 13485?

→ You need to understand how risk management connects to CAPA → What Is ISO 14971? and ISO 14971 vs ISO 13485

→ You need to compare ISO 13485 to ISO 9001 to understand CAPA differences → ISO 9001 vs ISO 13485

→ You want to buy ISO 13485 → Buy ISO 13485

→ You want to browse all medical device standards in one place → explore sector-specific standards or browse standards by compliance area

Still figuring out where to start?

If you are not ready to purchase yet — that is normal. ISO 13485 CAPA decisions typically take weeks from first research to implementation commitment.

The best next step for most organizations at this stage: → Download the free ISO 13485 Gap Assessment Checklist — it takes 20 minutes and tells you exactly where your CAPA and QMS gaps are before you spend anything.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Cost of an Analysis Failure

CAPA is not a form. It is not a procedure sitting in your document management system. It is the mechanism that connects everything your quality system measures to everything your quality system does about it. When that connection breaks — when data is collected, thresholds are documented, and no one asks what the numbers actually mean — FDA finds it. Certification bodies find it. And devices reach the field with problems that could have been caught.

The InfuTronix case isn’t an outlier. Organizations that receive 483 observations for CAPA failures almost always had a procedure. What they didn’t have was an analysis process that produced documented decisions. That gap is what inspection finds — and it’s the gap that costs the most to recover from after the fact.

Under QMSR, the inspection model is now broader. Every subsystem, every inspection. CAPA didn’t disappear from the top of the finding list — it fragmented into more specific citations. That means more exposure, not less.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

👉 Get updates on new standards, implementation strategies, and compliance insights 👉 Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

Buy ISO 14971:2019 — Official PDF & Print Sources (2026 Guide)

Where to buy the official ISO 14971:2019 standard, what formats are available, how much it costs, and why purchasing from an authorized source is non-negotiable for medical device risk management — including why the superseded 2007 edition still circulating online creates real certification and regulatory risk.

Where to buy the official ISO 14971:2019 standard, what formats are available, how much it costs, and why purchasing from an authorized source is non-negotiable for medical device risk management.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📥 Free ISO 13485 & ISO 14971 Implementation Checklist — Confirm you have every required risk management document before your first certification audit. → [Download Free Checklist]

ISO 14971 Is No Longer Optional for Medical Device Manufacturers

ISO 14971:2019 was already the international standard for medical device risk management. Since February 2, 2026, it carries additional weight: the FDA’s Quality Management System Regulation (QMSR) incorporated ISO 13485:2016 by reference — and ISO 13485 explicitly requires risk management per ISO 14971. That means ISO 14971 is now embedded in U.S. regulatory expectations for every manufacturer subject to 21 CFR Part 820.

FDA investigators operating under Compliance Program 7382.850 are expected to use the risk management file as their inspection roadmap — following risk documentation into design controls, CAPA, supplier qualification, and post-market surveillance. If your risk management program is not built on ISO 14971, that gap will surface under QMSR inspection.

This guide covers exactly where to buy the official ISO 14971:2019 standard, what formats are available, how much it costs, and what to watch out for when purchasing.

⚠️ The QMSR compliance date has passed (February 2, 2026). Organizations that have not yet integrated ISO 14971 across their quality system are operating with a gap that FDA inspectors are actively evaluating.

In This Guide

What ISO 14971:2019 is and what changed from the 2007 edition
Which edition you need — 2019 vs 2007
Where to buy the official standard from authorized sources
Available formats — PDF, print, multi-user, and bundles
How much ISO 14971:2019 costs
Who needs to purchase the standard
What ISO 14971 does NOT include
Common purchasing mistakes to avoid
Related standards you will also need

👉 Start Here (Top Resources)

👉 Purchase the official ISO 14971:2019 standard — the current edition for all medical device risk management programs → ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026. ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits.

👉 Purchase the required companion — ISO 13485:2016 → ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off. ISO 14971 cannot be implemented in isolation — it is a required companion to ISO 13485 and must be purchased and controlled as an external document within your QMS.

👉 Save up to 50% buying both standards together → ISO Standards Packages — ANSI Webstore — the most cost-effective option for organizations purchasing ISO 14971 alongside ISO 13485 and related standards.

👉 Get ISO 13485 training covering risk management requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

👉 Get ISO 13485 certified with an accredited certification body → ISOQAR ISO 13485 Certification — ISOQAR is a UKAS-accredited certification body, one of the most recognized in the industry for ISO 13485 certification.

What Is ISO 14971:2019?

Feature image for an ISO 14971 guide showing medical device risk management concepts, lifecycle risk controls, and the relationship between ISO 14971, ISO 13485, and FDA QMSR requirements. — ISO 14971 is the required risk management framework for medical devices, embedding risk analysis and control throughout the product lifecycle and supporting ISO 13485 and FDA QMSR compliance.

ISO 14971:2019 — Medical Devices: Application of Risk Management to Medical Devices — is the international standard defining the process for identifying hazards associated with medical devices, estimating and evaluating associated risks, controlling those risks, and monitoring the effectiveness of those controls throughout the device lifecycle.

The standard is published by the International Organization for Standardization and is recognized globally as the baseline risk management framework for medical device manufacturers. It applies to all device classes — from Class I low-risk devices through Class III implantables — and to every organization involved in the device lifecycle: manufacturers, component suppliers, contract manufacturers, and service providers.

ISO 14971 does one thing with precision: it defines a formal, documented, lifecycle-integrated process for managing risk in medical device development and manufacturing. Nothing else in the ISO 13485 framework tells you how to manage risk — that is ISO 14971’s job.

Key updates in the 2019 edition include clarified terminology aligned with ISO/IEC Guide 63, updated requirements for risk management plan documentation, strengthened requirements for production and post-production information, and enhanced guidance on benefit-risk analysis. The 2019 edition also removed references to ALARP (As Low As Reasonably Practicable) — replacing it with a more precise framework for determining risk acceptability. For the complete breakdown of what the standard requires, see What Is ISO 14971? — Complete Guide.

ISO 14971:2019 vs ISO 14971:2007 — Which Do You Need?

Situation	Edition to Purchase
New risk management program — first implementation	ISO 14971:2019
Currently using ISO 14971:2007 — planning update	ISO 14971:2019
Pursuing ISO 13485 certification	ISO 14971:2019
Subject to FDA QMSR (21 CFR Part 820)	ISO 14971:2019
EU MDR technical documentation	ISO 14971:2019
Researching risk management before committing	ISO 14971:2019

The answer in every case is ISO 14971:2019. The 2007 edition has been superseded. ISO 13485:2016 references ISO 14971 — and certification bodies audit against the current edition. The QMSR regulatory expectation is built on ISO 13485:2016, which requires current-edition conformance.

If your organization is still operating a risk management program built on ISO 14971:2007, purchasing the 2019 edition and conducting a gap assessment is your first step. The changes are substantive enough that a documented gap assessment is expected before your next certification audit.

→ ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

Where to Buy ISO 14971:2019 — Official Sources Only

ISO standards are copyrighted intellectual property. They are not available as free downloads and must be purchased from authorized distributors. Every “free ISO 14971 PDF” circulating online is an unauthorized copy — typically an outdated 2007 edition, an incomplete document, or an altered version. Using an unauthorized copy for risk management program development introduces certification risk and potential regulatory exposure simultaneously.

Certification bodies audit against the precise wording of the current official standard. A risk management file built from an outdated or incomplete copy will generate nonconformances — costing far more in audit findings and corrective action cycles than the official document.

Provider	What You Get	Price Range	Best For	Link
ANSI Webstore	Official current edition, immediate PDF delivery, audit-accepted	$150–$200	U.S.-based organizations — official distributor, CC2026 coupon available	Buy Here
ISO.org Store	Official current edition directly from publisher	$158–$198	International buyers outside the U.S.	iso.org/store
ANSI Bundle Package	ISO 14971 + ISO 13485 + related standards	$300–$500	Organizations purchasing multiple medical device standards — significant savings	Bundle Here

Where to buy ISO standards comparison showing ANSI Webstore, ISO Store, and other resellers with pros and risks — Compare ANSI, ISO, and other sources to safely buy ISO standards for certification and compliance

ANSI Webstore is the recommended source for U.S.-based organizations. ANSI is the official U.S. distributor of ISO standards — purchasing through ANSI guarantees the current edition, complete document, licensed PDF with immediate delivery, and a recognized distributor credential accepted by all certification bodies and regulatory authorities.

→ Use coupon code CC2026 for 5% off ISO and IEC standards at the ANSI Webstore through December 31, 2026

At this point, most organizations purchasing ISO 14971 for the first time should: → Purchase the bundle including ISO 13485:2016 and ISO 14971:2019 together from ANSI Standard Packages — the savings over individual purchases typically cover the cost of training materials, and you need both documents on hand before implementation begins.

ISO 14971 Formats Available

Format	Price Range	Best For	Notes
Single-user PDF	$150–$200	Individual quality managers and risk managers	Immediate delivery, searchable — cannot be shared simultaneously
Printed copy	$170–$220	Risk management teams, controlled document environments	Useful for annotating during implementation — slightly higher cost
Multi-user license	Contact ANSI	Organizations with multiple simultaneous users	Required if multiple team members need access at the same time
Bundle with ISO 13485	$300–$500	Any organization implementing ISO 13485	Best value — you need both; bundle saves 30–50% vs individual

Single-user PDF is the most common choice for quality managers implementing risk management programs. It is immediately accessible after purchase, searchable by clause number, and sufficient for a single implementer building the risk management framework.

Important licensing rule: A single-user PDF license cannot legally be shared across your organization. If your risk management team, design engineers, and regulatory affairs personnel all need simultaneous access, a multi-user license is required. Sharing a single-user PDF via email or shared drive violates the license terms — a detail that is often overlooked during implementation and can create legal exposure.

If you are implementing both ISO 14971 and ISO 13485, purchase them as a bundle. You will need both on hand from day one of your gap assessment — and the bundle consistently saves more than the coupon alone.

→ ISO Standards Packages — Save up to 50%

How Much Does ISO 14971:2019 Cost?

Item	Typical Price	Notes
Single-user PDF	$150–$200	Standard purchase from ANSI Webstore
Printed copy	$170–$220	Physical copy for reference
Multi-user license	Varies	Contact ANSI for pricing
Bundle: ISO 14971 + ISO 13485	$300–$500	Saves 30–50% vs individual purchase
Bundle: ISO 14971 + ISO 13485 + ISO 13485 collection	$350–$600	Full medical device standards set

Use coupon CC2026 for 5% off at ANSI through December 31, 2026 → Apply at ANSI

In the context of total ISO 13485 certification costs — which range from $15,000 to $100,000+ for most organizations — the ISO 14971 standard purchase is the lowest-cost line item in your entire budget. It is also the one with the highest leverage on audit outcomes. A risk management file built from the correct current edition is foundational. Everything else in your QMS depends on it.

For the complete ISO 13485 certification cost breakdown, see How Much Does ISO 13485 Cost?

Who Needs to Purchase ISO 14971?

ISO 14971:2019 must be purchased by anyone responsible for building, implementing, auditing, or maintaining a medical device risk management program. Specifically:

Risk managers and quality managers building a risk management program from scratch or updating from ISO 14971:2007 — the standard is the only authoritative source for what the process requires. Implementing from a summary or training slide deck rather than the official document is one of the most common reasons risk management files fail certification audits.

Design engineers and product development teams at organizations with design responsibility — risk management under ISO 14971 begins at design input and runs through every design stage. Engineers performing hazard analysis, risk estimation, and risk control selection need the standard directly.

Internal auditors conducting ISO 13485 internal audits — you cannot audit risk management effectiveness against a standard you have not read. Clause 7.1, 7.3, and the full risk management integration requirements across ISO 13485 require familiarity with ISO 14971 clause requirements.

Regulatory affairs professionals preparing FDA QMSR compliance documentation or EU MDR technical files — both regulatory frameworks expect ISO 14971 conformance, and regulatory submissions are evaluated against the standard’s exact requirements.

Organizations currently certified to ISO 14971:2007 planning their 2019 edition gap assessment — purchasing the 2019 edition is step one. The gap assessment cannot be conducted without it.

If you are at this stage:

If you are a quality manager building your first ISO 14971-based risk management program → purchase ISO 14971:2019 and ISO 13485:2016 together from ANSI Standard Packages, then enroll your team in BSI Group ISO 13485 Training before documentation development begins.

If you are currently ISO 14971:2007 compliant and planning your 2019 transition → purchase the 2019 edition, conduct a documented gap assessment focused on the ALARP removal, updated risk acceptability criteria, and post-production information requirements, and update your risk management plan before your next surveillance audit.

If you are a component supplier entering the medical device supply chain → your OEM customer will require ISO 14971-aligned risk management as part of supplier qualification. Purchase the standard before your first supplier audit.

What ISO 14971 Does NOT Include

Understanding what you are not buying is as important as understanding what you are.

ISO 14971 does not provide device-specific risk acceptability criteria. The standard defines the process for determining risk acceptability — it does not tell you what the acceptable residual risk level is for your specific device. That determination is your organization’s responsibility, informed by applicable regulations, clinical data, and the state of the art.

ISO 14971 does not replace clinical evaluation. Risk management and clinical evaluation are complementary but distinct requirements under ISO 13485 and EU MDR. ISO 14971 covers the risk management process — clinical evaluation has its own standards and guidance documents.

ISO 14971 does not provide implementation templates. The standard defines requirements — your organization must build the risk management plan, hazard identification tools, risk estimation worksheets, and risk control documentation. For ready-to-use ISO 13485 QMS documentation including risk management templates, see 9001Simplified Documentation Kits. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

ISO 14971 does not satisfy IEC 62304. Organizations developing medical device software need IEC 62304 — software lifecycle processes for medical devices — in addition to ISO 14971. The two standards work together but address different scopes.

Common Purchasing Mistakes to Avoid

Buying ISO 14971:2007 instead of ISO 14971:2019. The 2007 edition is superseded. Third-party sellers frequently carry outdated editions without clear disclosure. Always verify the edition year before completing a purchase. If a price seems unusually low, check the edition.

Downloading unauthorized copies. Every “free ISO 14971 PDF” found through a search engine is an unauthorized copy — typically the 2007 edition, an incomplete document, or an altered version. Using it for risk management program development introduces certification risk. The standard costs $150–$200. A major nonconformance at Stage 2 costs multiples of that in re-audit fees and timeline delays.

Purchasing without checking the edition date. Even on legitimate platforms, searching “ISO 14971” can surface the 2007 edition alongside the 2019 edition. Always confirm “ISO 14971:2019” before adding to cart.

Treating ISO 14971 as a design-only requirement. The most common QMSR and ISO 13485 gap is a risk management program that lives only in design files. Under QMSR, risk-based thinking extends across supplier qualification, production processes, CAPA, complaint handling, and post-market surveillance. Purchasing the standard is step one — reading Clauses 3, 8, and 9 in their entirety is what reveals the full scope of implementation required.

Sharing a single-user PDF with your team. A single-user license covers one user. Sharing via email or shared drive violates the license terms. If multiple team members need simultaneous access, purchase a multi-user license.

Purchasing ISO 14971 without ISO 13485. ISO 14971 does not stand alone in a medical device QMS context. It is a required companion to ISO 13485 — and you need both documents to implement either correctly. Purchase them together.

At this point, most organizations who have identified they need ISO 14971 should: → Purchase the ISO Standards Bundle including ISO 14971:2019 and ISO 13485:2016 together — this is the lowest-cost, most operationally complete starting point for any medical device risk management implementation.

Why Organizations Delay This — And What It Costs Them

The most common reason manufacturers delay purchasing ISO 14971 and building a compliant risk management program is the belief that it can be addressed “during the certification project.”

Here is what consistently happens instead:

Organizations that arrive at Stage 1 of their ISO 13485 certification audit without a documented, ISO 14971-based risk management program receive a major nonconformance — delaying Stage 2 by 3–6 months and adding $5,000–$15,000 in re-audit fees and consultant costs. The risk management file is one of the first things a certification body auditor reviews.

Under QMSR, the stakes are higher. FDA investigators under CP 7382.850 use the risk management file as their inspection roadmap. An absent or inadequate risk management program does not just generate a finding — it gives the inspector a thread to pull through design controls, CAPA, and supplier qualification simultaneously.

The organizations that move first — purchasing the standard, conducting the gap assessment, and building ISO 14971 integration across the QMS before the certification audit — consistently report shorter audit cycles, fewer findings, and lower total certification costs. The ones that treat risk management as a later step discover that it is actually the foundation everything else is audited against.

📥 Free ISO 13485 & ISO 14971 Implementation Checklist — Identify your top 5 risk management gaps before your certification audit. → [Download Free Checklist]

ISO 14971 does not operate in isolation. Organizations building a medical device QMS will need these companion standards:

Standard	Purpose	Relationship to ISO 14971	Where to Buy
ISO 13485:2016	Medical device QMS requirements	Requires ISO 14971 throughout — cannot be implemented without it	ANSI Webstore
ISO/TR 24971:2020	Guidance on ISO 14971 application	Non-mandatory companion — practical guidance on applying ISO 14971 requirements	ANSI Webstore
IEC 62304	Software lifecycle for medical devices	Complements ISO 14971 for software risk management	ANSI Webstore
ISO 9001:2015	General QMS foundation	Useful reference for organizations building ISO 13485 on an existing ISO 9001 foundation	ANSI Webstore

Organizations implementing ISO 13485 for the first time should prioritize: ISO 14971:2019 + ISO 13485:2016. These two documents together define what your QMS must do and how risk must be managed within it.

→ Save up to 50% on ISO Standards Packages — ANSI Webstore

Frequently Asked Questions

What is ISO 14971:2019?

ISO 14971:2019 is the current edition of the international standard for risk management for medical devices. It defines the process for identifying hazards associated with medical devices, estimating and evaluating risks, implementing risk controls, and monitoring effectiveness throughout the device lifecycle. It is a required companion standard to ISO 13485:2016.

Is ISO 14971 required for ISO 13485 certification?

Yes — ISO 13485 explicitly requires risk management per ISO 14971 throughout the QMS. Certification bodies audit risk management processes against ISO 14971 requirements. Under the FDA’s QMSR, ISO 14971 conformance is embedded in U.S. regulatory expectations for all manufacturers subject to 21 CFR Part 820.

What is the difference between ISO 14971:2019 and ISO 14971:2007?

The 2019 edition clarified terminology, updated the risk acceptability framework by removing ALARP references, strengthened post-production information requirements, and enhanced benefit-risk analysis guidance. Any organization currently using the 2007 edition should conduct a gap assessment and transition to the 2019 edition before their next certification audit.

Where is the best place to buy ISO 14971:2019?

The ANSI Webstore is the recommended source for U.S. organizations — it is the authorized U.S. distributor for ISO standards and guarantees the current edition. Use coupon CC2026 for 5% off through December 31, 2026. → ISO 14971:2019 — ANSI Webstore

Can I share my ISO 14971 PDF with my design team?

No — a single-user PDF license cannot be shared simultaneously. If multiple team members need access at the same time, purchase a multi-user license or individual copies. Physically sharing a printed copy sequentially is permitted.

Do I need both ISO 14971 and ISO 13485?

Yes. ISO 14971 and ISO 13485 are required companions — neither can be fully implemented without the other. ISO 13485 defines your QMS framework; ISO 14971 defines how risk must be managed within it. Purchase them together for the best value. → ISO Standards Packages — Save up to 50%

Does ISO 14971 apply to software?

ISO 14971 applies to risk management for medical devices including software as a medical device (SaMD). For the software development lifecycle specifically, IEC 62304 is the companion standard. Risk management under ISO 14971 and software lifecycle management under IEC 62304 are intended to be implemented together.

What is ISO/TR 24971?

ISO/TR 24971:2020 is a technical report providing guidance on the application of ISO 14971. It is not a requirement — it is a non-mandatory companion document offering practical interpretation and application examples. Organizations new to ISO 14971 often find it valuable alongside the standard itself.

How much does ISO 14971:2019 cost?

A single-user PDF typically costs $150–$200 from the ANSI Webstore. Use coupon CC2026 for 5% off through December 31, 2026. Bundles including ISO 14971 with ISO 13485 offer savings of 30–50% compared to individual purchases.

📥 Free Resources

👉 Free ISO 13485 & ISO 14971 Implementation Checklist — Verify every required risk management document is in place before your certification audit 👉 Manufacturing Compliance Checklist — Assess your current compliance status across quality, environmental, and safety requirements 👉 Supplier Quality Checklist — Supplier qualification requirements applicable to medical device supply chains

Not Sure What to Do Next?

◆ You need the official ISO 14971:2019 standard → ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

◆ You need the required companion standard ISO 13485:2016 → ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

◆ You want to save buying both standards together → Save up to 50% on ISO Standards Packages — ANSI Webstore

◆ You need ISO 13485 training covering risk management requirements → BSI Group ISO 13485 Training

◆ You are ready to pursue ISO 13485 certification → ISOQAR ISO 13485 Certification

◆ You want to understand what ISO 14971 requires → What Is ISO 14971? — Complete Guide

◆ You want to understand the full FDA QMSR transition → FDA QSR vs ISO 13485: The Complete QMSR Transition Guide

◆ You want to understand how ISO 9001 and ISO 13485 differ → ISO 9001 vs ISO 13485 — Key Differences

◆ You want to understand what ISO 13485 requires → What Is ISO 13485? — Complete Guide

◆ You want to understand certification costs → How Much Does ISO 13485 Cost? → ISO Certification Cost Calculator

◆ You want to choose the right certification body → Best ISO Certification Bodies — Ranked & Reviewed

Still figuring out where to start?

If you are not ready to purchase yet — that is normal. ISO 14971 implementation decisions typically take 2–4 weeks from first research to commitment as organizations assess their current risk management program against what certification auditors expect.

The best next step for most organizations at this stage: → Download the free ISO 13485 & ISO 14971 Implementation Checklist — it takes 20 minutes and tells you exactly where your gaps are before you spend anything.

📥 [Download Free Checklist]

The Standard That Makes Everything Else Auditable

ISO 14971 is not a box to check. It is the document that makes every other part of your medical device QMS auditable — design controls, CAPA, supplier qualification, complaint handling, and post-market surveillance all connect back to the risk management file when a certification auditor or FDA investigator starts pulling threads.

Organizations that purchase the official standard, read it completely, and build their risk management program against its actual requirements consistently report fewer findings, shorter audit cycles, and lower total certification costs. The ones that work from summaries, training slides, or outdated editions discover those shortcuts at the worst possible moment.

The standard costs $150–$200. A failed Stage 2 audit costs multiples of that. Buy the official edition.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

👉 Get updates on new standards, implementation strategies, and compliance insights 👉 Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

Your Customer Asked for Your ESG Report. Your ISO 14001 Certificate Isn’t the Answer.

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What ESG Reporting Covers

What ISO 14001 Actually Certifies

Does ISO 14001 Count as ESG?

ESG vs ISO 14001: Key Differences

How ISO 14001 Supports ESG Reporting (Without Replacing It)

The Common Mistake: Certification ≠ Compliance

Do You Need Both? A Decision Framework

Certification and Reporting Cost Considerations

Quick Reference Checklist

FAQ

ESG vs ISO 14001 — does certification satisfy ESG reporting requirements?

Is ESG reporting mandatory for manufacturers?

Can I use my ISO 14001 data for ESG reporting?

What’s the difference between ESG and sustainability reporting?

Do I need ISO 14001 before I can do ESG reporting?

Which ESG framework applies to my company?

Does ISO 14001 require emissions disclosure?

How long does it take to build ESG reporting on top of an existing EMS?

Not Sure What to Do Next?

📥 Free Resources

Stay Ahead of Environmental Compliance Requirements

Subscribe

The Documentation Gap That Fails Design History Files

In This Guide

Table of Contents

👉 Start Here (Top Resources)

Verification vs. Validation: The Core Distinction

Verification and Validation in Practice: An Infusion Pump Example

Design Verification Requirements

👉 Before You Build Another Test Protocol

Design Validation Requirements

Process Validation Under Clause 7.5.6

Software Validation Requirements

What the FDA QMSR Changed for U.S. Manufacturers

Common V&V Documentation Failures

👉 Before Your Next Notified Body Assessment

Building a Verification & Validation Plan That Holds Up

Quick Audit Checklist

FAQ

What is the difference between verification and validation in ISO 13485?

Does ISO 13485 require validation on production units?

What processes require process validation under Clause 7.5.6?

How did the FDA QMSR affect verification and validation requirements?

Do low-risk devices still need design validation?

Does software need separate validation from the device it’s part of?

What’s the most common finding auditors cite for validation?

Where does risk management fit into verification and validation?

📥 Free Resources

Not Sure What to Do Next?

Stay Ahead of the Next V&V Finding

Subscribe

Picking the Wrong Path Costs You Months — Not Just Money

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Implementation Actually Requires

The Consultant Route

The Implementation Package Route

Consultant vs. Package: Side-by-Side

Cost Reality Check

Which Path Fits Your Business

The Mistake Most Manufacturers Make

Common Misconceptions

The Hybrid Approach

Quick Decision Checklist

FAQ

Is a documentation package enough to pass an ISO 9001 audit on its own?

How much cheaper is a package compared to a consultant?

Can I switch from a package to a consultant partway through if I get stuck?

Do larger companies ever use documentation packages instead of consultants?

Does ISO require me to use a consultant or an accredited implementation partner?

What happens if I choose the wrong path and it doesn’t work?

Will my certification body care which path I used?

Is a consultant worth it just for the first internal audit?

📥 Free Resources

Not Sure What to Do Next?