ISO 9001 Audits
We Help Companies Conduct ISO 9001 Audits for FDA Compliance Purposes
ISO 9001 Audits Team Lead
ISO 9001 Audits Team Lead
Former DOJ Attorney
ISO 9001 Audits Team Lead
Former Senior DOJ Trial Attorney
With the adoption of its new Quality System Management Regulation (QMSR), the U.S. Food and Drug Administration (FDA) has finally incorporated ISO 13485 into its regulatory standards for medical products. While the QMSR doesn’t take effect until early 2026, the FDA has indicated that companies can start focusing on QMSR compliance—provided that they maintain compliance with the outgoing Quality System Regulation (QSR) as well. ISO 13485 is based on (and expands upon) ISO 9001, so companies that need to comply with the QSMR must also address ISO 9001 compliance.
Among other things, this means conducting ISO 9001 audits.
As the International Organization for Standardization explains, “ISO 9001 is a globally recognized standard for quality management. . . . Its requirements define how to establish, implement, maintain, and continually improve a quality management system (QMS).” While international regulators have long required ISO 9001 compliance within the medical products industry (among many Others), the FDA has previously resisted adopting ISO 9001. Now that this has changed, medical device manufacturers and other companies doing business in the United States must ensure that they will be prepared to demonstrate ISO 9001 compliance to the FDA when necessary.
ISO 9001 Auditing for Medical Product Manufacturers and Other FDA-Regulated Companies
For companies that need to maintain ISO 9001 compliance, auditing their compliance efforts is a critical part of the process. Under the FDA’s new QMSR, conducting periodic internal ISO 9001 audits serves two primary purposes:
- Purpose #1: Assessing compliance with the ISO 9001 standards and determining whether improvements are needed (and, if so, where).
- Purpose #2: Documenting compliance with the ISO 9001 standards so that the company can withstand scrutiny from the FDA (and other regulators) when necessary.
Although “ISO 9001” is often referred to as a single entity, within ISO 9001 there are more than 350 specific requirements. While establishing compliance with these requirements can be challenging in its own right, managing compliance with the hundreds of specific standards in ISO 9001 on an ongoing basis can prove much more difficult. A structured, informed, and proactive approach is key—and the internal audit process for conducting these periodic ISO 9001 audits is an essential part of this process.
At Oberheiden P.C., we assist medical product manufacturers and other FDA-regulated companies with effectively managing ISO 9001 compliance by helping them conduct organized and efficient ISO 9001 audits. Our FDA compliance team, which includes former FDA personnel, is intimately familiar with ISO 9001 and has conducted numerous audits under this and other standards. We take a custom-tailored approach in this auditing process focused on helping our clients understand their specific risks and needs, and then our internal auditors help our clients implement additional ISO 9001 compliance solutions and process improvement as necessary so that they are fully prepared to withstand any scrutiny from the FDA.
7 Key Aspects of ISO 9001 Auditing and Compliance
ISO 9001 focuses on ensuring that medical device manufacturers and other companies have sufficient quality management systems in place to prevent the sale of adulterated, misbranded, and otherwise non-conforming medical products. There are two important documents to utilize during the audits, and they are the audit checklist and the audit report form. The specific standards within ISO 9001 fall into several broad categories; and, when conducting ISO 9001 internal and external audits, focusing on each of these broad categories in succession can help to facilitate a structured and comprehensive approach.
This is the approach we take when conducting ISO 9001 audits (and other types of internal auditing), and it has proven to consistently produce reliable results. With this in mind, some of our primary areas of focus when conducting ISO 9001 audits for our FDA-regulated clients include:
1. Record and Document Control
Record and document control are essential to effective quality management. ISO 9001 establishes various specific requirements for record and document control, and we prioritize ensuring not only that our clients have all required records and documentation, but also that they have adequate access to all required records and documentation for purposes of demonstrating compliance to the FDA during a premarket or postmarket inspection.
2. Management Commitment
Like many other federal and international standards, ISO 9001 requires a top-down approach to compliance. Companies must be able to clearly demonstrate a due commitment to compliance at the leadership level, and they must have policies and procedures in place to ensure that their managerial teams duly prioritize ISO 9001 compliance.
3. Preventive Action
A key aspect of any quality management system is prevention. A company’s ISO 9001 QMS should be designed to prevent non-conforming medical products from entering the stream of commerce. This is among the FDA’s top priorities as well; and, as a result, it is something we prioritize when assisting our clients with their ISO 9001 audits.
4. Process-Based Approach
To effectively manage ISO 9001 (and QMSR) compliance, FDA-regulated companies need to take a process-based approach to both adopting appropriate safeguards and auditing their compliance efforts. During the audit process, we work closely with our clients’ leaders and key stakeholders to ensure that their processes and systems are sufficient for both effectively managing their risk and meeting the FDA’s expectations.
5. Implementation and Support
One of the most common, and most costly, mistakes we see companies make when it comes to ISO 9001 compliance is failing to implement their compliance policies and procedures. Oftentimes, companies will go to great lengths to ensure that they have custom-tailored ISO compliance policies and procedures, but then they will fail to implement these policies and procedures effectively. Implementation is critical, and companies must ensure that they have adequate support functions to effectively manage ISO 9001 compliance on an ongoing basis as well. These are also issues that we prioritize during the ISO 9001 audit process.
6. Corrective Action
To effectively manage ISO 9001 compliance, companies must also have protocols in place to identify when corrective action is necessary—and then to take appropriate corrective action as efficiently as possible, with the aim of continuous improvement. With this in mind, an ISO 9001 audit should reveal that the company has protocols for developing (and implementing) a corrective action plan, and it should reveal that the company has used these protocols when (and if) necessary.
7. Control of Non-Conforming Medical Products
While an ISO 9001 quality management system should be designed to prevent the manufacture of non-conforming medical products, ISO 9001 also recognizes the possibility that non-conforming products will be produced from time to time. When working with our clients to conduct ISO 9001 audits, we carefully examine their policies, procedures, and protocols for controlling non-conforming medical products as well.
Put our highly experienced team on your side
Dr. Nick Oberheiden
Founder
Attorney-at-Law
Lynette S. Byrd
Former DOJ Trial Attorney
Partner
Brian J. Kuester
Former U.S. Attorney
Hon. Kevin McCarthy
55th Speaker, U.S. House of Representatives (ret.)
Government Consultant
Mike Pompeo
Of Counsel
Former U.S. Secretary of State
John W. Sellers
Former Senior DOJ Trial Attorney
Linda Julin McNamara
Federal Appeals Attorney
Nicholas B. Johnson
Former Prosecutor
Roger Bach
Former Special Agent (DOJ)
Chris J. Quick
Former Special Agent (FBI & IRS-CI)
Michael S. Koslow
Former Supervisory Special Agent (DOD-OIG)
Ray Yuen
Former Supervisory Special Agent (FBI)
FAQs: Conducting an Effective ISO 9001 Audit
Are FDA-Regulated Companies Required to Conduct ISO 9001 Audits?
The FDA does not require that medical product manufacturers and other regulated companies conduct ISO 9001 audits. However, under the FDA’s new QMSR, regulated companies will be required to comply with ISO 13485—which effectively also requires compliance with ISO 9001. Conducting internal audits is essential for managing (and demonstrating) compliance; so, while ISO 9001 audits are not strictly required, as a practical matter they will be necessary going forward.
What Are the Benefits of Conducting an ISO 9001 Audit?
Conducting periodic ISO 9001 audits has several benefits. Most importantly, assessing a company’s quality management system (QMS) is the only way to determine whether the company is ISO 9001-compliant. Failing to maintain ISO 9001 compliance can have several risks, so conducting ISO 9001 audits is essential for effective risk management.
What is the Process for Conducting an ISO 9001 Audit?
The process for conducting an ISO audit starts with outlining the specific steps that a company needs to take to assess the efficacy of its quality management system. These steps will be different for different companies, depending on the scope and structure of their operations, the specific products they sell, and other pertinent factors. After outlining the necessary steps and developing a custom-tailored ISO 9001 audit strategy, only then is it possible to conduct an effective audit that truly serves its intended purpose.
What if an ISO 9001 Audit Reveals that a Company’s Quality Management System (QMS) is Inadequate or Ineffective?
If an ISO 9001 audit reveals shortcomings in a company’s quality management system, the company should work with its counsel to address these shortcomings as efficiently as possible. The company should still maintain full documentation of its audit, and its remediation efforts, as this documentation could prove critical if the company faces scrutiny from the FDA or another federal or international agency.
Can (and Should) Companies Conduct Their ISO 9001 Audits In-House?
Most companies do not have the knowledge and other resources in-house that are necessary to manage an effective ISO 9001 audit program. As a result, most companies will need to rely on their outside counsel to help them manage ISO 9001 compliance and provide an internal auditor as part of their broader compliance initiatives.
Talk to a Lawyer or Consultant at Oberheiden P.C. About Your Company’s Next ISO 9001 Audit
If you would like to know more about how we help FDA-regulated companies (and other clients) conduct ISO 9001 audits and effectively manage ISO 9001 compliance, we invite you to get in touch. Call 888-680-1745 or contact us online to schedule a complimentary initial consultation today.
