Becoming ISO 13485 certified takes more than assembling a set of procedures. Your processes must fit the work your organization actually performs, your teams must use them consistently, and your records must show that the quality management system is operating as intended.
Elexes helps medical device companies assess, design, implement, repair, and maintain an ISO 13485:2016 quality management system. Support can begin with a first QMS for a startup, a focused QMS gap assessment before certification, or QMS remediation support for an established system.
We work with legal manufacturers, specification developers, contract manufacturers, suppliers, importers, distributors, and other organizations in the medical device supply chain. The scope is tailored to the organization’s role, products, activities, target markets, and existing level of QMS maturity.
ISO 13485:2016 is the current international quality management system standard written specifically for organizations involved in medical devices. It establishes requirements for a controlled system that can consistently support applicable regulatory and customer requirements across the device lifecycle.
An ISO 13485 certificate is issued by an independent certification body after its audit process. As explained in ISO’s certification guidance, ISO itself does not certify organizations. Our role is to help your organization build credible processes, put them into use, test whether they are working, and prepare the people and evidence needed for an external audit.
Certification is also not the same as regulatory approval. A certificate may support commercial, customer, or regulatory objectives, but each market can impose additional obligations. For example, organizations subject to the FDA Quality Management System Regulation must address the current requirements in 21 CFR Part 820, including FDA-specific provisions, even when their QMS is aligned with ISO 13485. Elexes provides dedicated FDA QMSR compliance consulting when US requirements are part of the scope.
Organizations usually contact Elexes when they are facing a practical deadline or a system problem, not because they want more quality theory. Typical situations include:
⦿ Building a first medical device QMS through structured QMS implementation services before design transfer, manufacturing scale-up, or market entry
⦿ Preparing for an initial certification audit or adding a new site or activity to the certification scope
⦿ Determining whether an existing QMS reflects the organization’s legal and operational responsibilities
⦿ Bringing outsourced design, manufacturing, sterilization, testing, warehousing, or service activities under effective control
⦿ Correcting audit findings, recurring CAPAs, weak supplier controls, or inconsistent records through focused CAPA and QMS remediation
⦿ Integrating a newly acquired product, site, or business unit into the QMS
⦿ Adapting an ISO 13485 system to overlapping market requirements, including the FDA QMSR where applicable
⦿ Maintaining the system after certification as products, personnel, suppliers, software, and regulatory expectations change
The appropriate starting point depends upon the current state of affairs. A company without any form of controlled process requires QMS architectural design and implementation plans. However, a company with a fully established system requires only a limited assessment, testing of evidence, or fixing of certain ineffective processes.
The process starts with determining the role of the organization, products, locations, regulated activities, outsourced operations, and target markets. It helps define the scope of the QMS and determines the relevant requirements. Non-applicable requirements should have adequate justification and should not impair the capability or responsibility of the organization to fulfill relevant requirements.
A gap analysis of existing processes, documents, accountabilities, tools, and real-world practices against ISO 13485:2016 and the defined scope helps distinguish the lack of documented procedures from the lack of implementation. The difference is crucial because a procedure can be already in place, while its approval, training, traceability, monitoring, and follow-through can be inconsistent. The result is an implementation plan prioritizing key dependencies, responsible parties, evidences, and potential certification schedule issues.
The QMS structure should be easy to navigate and proportionate to the organization. Elexes can help organize the quality manual, process map, medical device file structure, procedures, work instructions, templates, and records so that responsibilities and information flow are clear. Documentation is written around the client’s operating model. A specification developer that outsources manufacturing needs a different control structure from a vertically integrated manufacturer. A distributor or component supplier may also have a narrower scope and different applicable processes.
Documentation becomes valuable when people know when to use them, how much evidence to collect, and when the decisions have to be escalated. We can help with training people based on their roles, implementation through a controlled roll-out or pilots, documentation review, and process owner working sessions. Implementation validation involves checking if the process generates reliable evidence. Examples of these would be validated supplier decisions, design review trails, completion of acceptance records, complaint assessments, CAPA follow-through, and management review input which reflect performance.
Internal audits and evidence sampling determine if the system is functioning among the different departments and locations. Elexes can arrange or perform internal audits in line with the scope agreed upon, document the results, support root cause investigation, and assist in corrective action planning. Prior to conducting the certification audit, activities may include document sampling, interviewing preparations, open action review, process owner training, and the confirmation of control of recent changes. Readiness support helps in avoiding any unnecessary surprises but does not guarantee a certificate or audit outcome.
Even though the certification means the implementation process is complete, changes in the surveillance audits, products changes, suppliers, customer complaints, trends in the processes, and market needs may all uncover some weak areas. The ongoing support may encompass assistance with internal audits, management review preparation, document revision, CAPA coaching, supplier quality support, impact of change assessment, and corrective actions.
Clause 4 establishes the foundation of the QMS. It covers the processes the organization needs, how those processes interact, the documentation structure, quality manual, medical device files, and control of documents and records. It also addresses control of outsourced processes and validation of software used in the QMS where applicable. Elexes can assist in making this foundation a working process architecture, structure of documentation, responsibility assignment, retention strategy, and chain of evidence. Read more about ISO 13485 Clause 4 QMS and documentation controls
Clause 5 identifies the accountability for the QMS with leaders. The management has to give direction, assign responsibilities and authorities, ensure communication, and regularly evaluate if the QMS is still suitable and effective. Help can involve aligning the QMS with the quality policy, establishing objective indicators, designing governance, management review planning, and improvement of input, decision making, and records. Read more about ISO 13485 Clause 5 management responsibility.
Clause 6 addresses the people, infrastructure, work environment, and contamination controls needed for product and process requirements. The applicable controls depend on the organization’s activities and the nature of the product. Elexes can help define competency requirements, training evidence, facility and equipment controls, and responsibilities for work-environment or contamination controls where these are relevant. Read more about ISO 13485 Clause 6 resource management.
Clause 7 covers the controlled path from planning and customer requirements through design and development, purchasing, production, service, identification, traceability, preservation, monitoring equipment, and process validation. Not every subclause applies to every organization, but exclusions or non-applicability must be justified within the permitted scope. We provide support in the following areas which have interface failure points: design transfer, supplier control, manufacturing subcontracting, planning for validation, acceptance criteria, change control, traceability, and product risk controls. Read more about ISO 13485 Clause 7 product realization
Clause 8 is where the QMS demonstrates that it can detect and respond to problems. It includes feedback, complaint handling, regulatory reporting where applicable, internal audits, monitoring, nonconforming product, data analysis, corrective action, and preventive action. Elexes can assist in improving investigation effectiveness, data inputs, escalation process, CAPA rigor, effectiveness evaluation, and the link between repetitive indicators and management actions. Learn more about ISO 13485 Clause 8 measurement, analysis, and improvement.
ISO 13485 expects risk-based thinking in the control of QMS processes and requires risk-management activities during product realization. ISO 14971:2019 provides the medical device risk-management process used to identify hazards, evaluate and control risks, and monitor production and post-production information.
The two standards function synergistically; however, they are not inter-changeable. The ISO 14971 standard is not a substitute for ISO 13485, while an ISO 13485 quality management system does not supersede the need for a product-based risk management approach. Using risk management consulting for medical devices from Elexes, one can align risk management outcomes with design control, supplier control, production control, complaints, change management, and corrective action/preventive action processes.
Just because an activity is outsourced doesn’t mean that responsibility for controlling it is outsourced as well. The organization must find the right balance when it comes to choosing, assessing, monitoring and reassessing third parties and establishing responsibilities for purchasing agreements on information and quality when necessary.
The level of control should reflect the effect of the outsourced process on product conformity and applicable regulatory requirements. A sterilization provider, critical software developer, contract manufacturer, calibration laboratory, or complaint-handling partner will not necessarily be controlled in the same way as a low-risk office supplier.
Elexes can help map outsourced processes, classify supplier risk, define controls, review agreements, establish monitoring methods, and connect supplier issues to nonconformance, change, complaint, and CAPA processes. More focused support can be provided through supplier quality management services.
When software is used to operate or monitor a QMS process, the organization should determine whether validation is required and apply an approach proportionate to the risk associated with that use. This can include electronic document control, training systems, eQMS platforms, spreadsheets, complaint databases, production systems, or other tools that influence quality records or decisions.
Elexes can help inventory QMS software, define intended use, assess risk, plan validation, establish change controls, and organize evidence. Product software and software used in production or service may trigger different or additional requirements, so the assessment must follow the software’s actual function. Where the software forms part of the medical device, the work should also be coordinated with the relevant medical device software and SaMD services.
Depending on the agreed scope, ISO 13485 consulting support may include:
⦿ Determination of applicability and scope of the QMS
⦿ ISO 13485 gap analysis and prioritized roadmap
⦿ Process mapping and QMS architecture
⦿ Quality manual and medical device file structure
⦿ Procedures, work instructions, forms, and record templates
⦿ Risk-based process and supplier controls
⦿ Outsourced-process governance
⦿ QMS software inventory, risk assessment, and validation support
⦿ Role-based training and implementation workshops
⦿ Internal audits and evidence sampling
⦿ CAPA and audit-finding remediation
⦿ Certification-readiness review and process-owner preparation
⦿ Ongoing QMS maintenance and improvement support
The engagement will be defined according to the products, business models and timelines of the client as well as its existing QMS. Elexes provides consulting and implementation support as part of its broader QMS standards and compliance services. The client owns its QMS, products and decisions concerning compliance, while the certification body owns certification decisions.
Confirm organizational roles, sites, product families, markets, outsourced activities, QMS boundaries, and current maturity.
Create the implementation roadmap, QMS architecture, documentation plan, process ownership, and evidence expectations.
Educate the team, run the process, produce documentation, solve any problems, and ensure controls function across the board.
Perform internal audits, review objective evidence, investigate gaps, complete corrective actions, and prepare process owners for the external audit.
Maintain audit coverage, management review, CAPA, supplier oversight, change control, and updates as the organization evolves.
Not sure whether your QMS is ready to be certified? Let's start from facts rather than guesses. At Elexes we will evaluate the scope, basic processes, documentation that is available, open quality questions, and implementation level; we will define what work should be done before external audit.
The timeframe required will depend upon the scope of the QMS, the size of the company, complexity of the products, processes already in place, availability of the records and the timeframe required for filling the gaps. There will be a very different timeframe required by a startup that needs to build its first system and by a company addressing specific issues.
Potentially, yes. The QMS must still reflect the organization’s real activities and produce enough evidence for the certification body to audit implementation. The appropriate timing and certification scope should be discussed with the selected certification body.
Not by itself. The FDA QMSR incorporates ISO 13485:2016 by reference and includes FDA-specific provisions and other applicable US requirements. Organizations marketing devices in the United States need a US-specific applicability review and evidence strategy. See Elexes’ FDA QMSR compliance consulting services for market-specific support.
Relevance is based on what the organization does and how. Some requirements may be considered not applicable only where the standard allows and where there is justification for it. The outsourced process will still require proper control.
Certification is done by the independent certification body. However, Elexes can help in evaluating the gaps, implementing the standard, testing the documentation, and getting ready for the audit.
Our experts will help you identify insufficiencies, determine inspection readiness, and evaluate risks, smoothing the inspection process and providing a greater chance of successful inspection. We will conduct periodic internal audits to ensure compliance with all the applicable ISO standards, cGMPs and internal regulations. Be it short targeted internal audits or more sustainable assessments across the quality management system (QMS), we have experts who can conduct a thorough audit and come up with any compliance gap that needs to be worked on.
Our process begins with an in-depth consultation where we learn about your medical device, its intended use, and your specific goals. This helps us tailor our assessment to your unique needs.
Our team of experts is well-versed in global medical device regulations, including FDA submissions, CE marking, TGA requirement, Health Canada approvals, ISO, and more. We stay up-to-date with the latest changes in the regulatory landscape.
We will conduct a comprehensive review of your existing documentation, including design files, clinical data, quality management systems, and risk assessments.
Our consultants will perform a gap analysis to identify any areas where your device may fall short of compliance. This forms the basis for our recommendations.
Based on our findings, we will provide you with detailed recommendations and a roadmap for achieving compliance. This may involve revising documentation, conducting additional testing, or making necessary design changes.
Our services don't stop with just the assessment. We offer ongoing support to guide you through the compliance process, helping you address any challenges that may arise.
Elexes offers a globally recognized ISO 13485 certification consultant who is renowned to enhancing your business credibility in the medical devices industry.
Our presence across the globe ensures audits are conducted by local-language auditors, facilitating clear communication and understanding.
Our experts provide guidance and consultants to help you adhere to necessary regulations, ensuring your products meet all legal requirements and is compliant to all necessary standards.
At Elexes, we offer to assist in securing additional local certifications, enabling you to manufacture and sell medical devices in various markets across the globe.
We offer complete confidentiality to all our clients which makes us one of the most trusted regulatory and quality compliance consulting.
We offer different services that will help you not only keep your product well in boundaries of regulations but also speed up the entire approval process. Some of these services are -
CEO Masterlink, Arizona
CEO Novasignal, Los Angeles
President ViDava, Florida
Sr. Exe Treedental, Hong Kong
Manager Outset Medical, California
CTO Jana Care, Massachusetts
MD Blackrock Pharma, England
VP Regulatory AliveCor, California
Owner Liz Inc., Arizona
CEO Radformation, New York
Never miss out on any important update on the regulatory & compliance industry across the globe. Subscribe to our newsletter now.
Copyright 2025, Elexes Medical Consulting Pvt. Ltd. All Rights Reserved
Working Hours : Monday to Friday 9:00 AM - 7:00 PM
Team Elexes 
