The Ultimate Guide to ISO Audits

Learn Everything You Need to Know About Conducting ISO Audits for Purposes of Managing Federal Compliance in the United States

Countries around the world require manufacturers and other companies to comply with ISO standards. In the United States, companies can use ISO compliance to meet their federal obligations in many cases—including their obligations to the U.S. Food and Drug Administration (FDA) and other regulatory agencies.

For companies that need to maintain ISO compliance, conducting ISO audits (or undergoing third-party ISO audits) is a critical part of the process. By conducting or undergoing ISO audits, companies can ensure that they are effectively managing compliance on an ongoing basis, and undergoing annual audits is a requirement for maintaining ISO certification in some cases (including under ISO 13485:2016, which the FDA will begin enforcing under its new Quality Management System Regulation (QMSR) in early 2026).

ISO Audits: What Regulated Entities in the U.S. Need to Know

If your company needs to maintain ISO compliance, what do you need to know about the auditing process? Here is a comprehensive look at what it takes to conduct an effective ISO audit:

Compliance with ISO 19011

Manufacturers and other companies that need to conduct or undergo ISO audits may also need to comply with ISO 19011. As the International Organization for Standardization (ISO) explains:

“ISO 19011 is an international standard that provides guidelines for auditing management systems, including quality management systems (ISO 9001) and environmental management systems (ISO 14001). It outlines the principles of auditing, managing audit programs, and conducting management system audits.”

As it goes on to explain, “ISO 19011 is a critical standard for any organization looking to implement an audit program or manage external audits. It establishes a common framework for audits, ensuring they are conducted consistently and effectively.” The International Organization for Standardization describes ISO 19011 as “essential” for any company that needs to conduct ISO audits, whether for purposes of maintaining ISO certification or for purposes of managing compliance.

But, regardless of whether a company needs to comply with ISO 19011, adhering to the auditing standards in this ISO isn’t necessarily enough on its own. Companies may need to take additional steps as well—including steps that are specifically required by the FDA or another federal agency.

5 Key Steps in the ISO Audit Process

With this in mind, it is not possible to establish a single universal or uniform guide to conducting an ISO audit. Instead, to determine the specific steps they need to take, companies must work with their counsel to assess their specific legal and regulatory obligations. Broadly speaking, however, there are some overarching principles that will apply in nearly all circumstances. For example, in almost all cases, conducting an effective ISO audit will involve:

1. Identifying the Relevant ISOs, Laws, and Regulations

The first step when conducting or undergoing an ISO audit is to identify all relevant ISOs, laws, and regulations. While some companies may only need to comply with one set of standards, others will be subject to multiple international standards as well as other statutory and regulatory requirements. To effectively assess compliance and ensure that no compliance failures go overlooked, companies must begin the process by ensuring that they have a clear and comprehensive understanding of the areas they need to review.

2. Identifying and Locating All Relevant Documentation

Along with identifying all relevant ISOs, laws, and regulations, when preparing for an ISO audit companies must also identify all relevant documentation. This includes, but is by no means limited to, documentation such as:

• Compliance policies and procedures
• Training programs and certifications
• Job postings and descriptions
• Personnel records
• Cybersecurity records
• Quality system management protocols
• Facility sanitation and inspection records
• Inventory control records
• Storage, packaging, labeling, and shipping records
• Previous ISO audit results

Beyond simply identifying the relevant documentation, companies must locate this documentation as well. In many cases, this alone can be a significant undertaking. But, it is also an essential undertaking, as overlooking any relevant documents could potentially lead to inaccurate audit findings.

3. Developing an ISO Audit Plan and Strategy

Whether conducting an internal ISO audit or undergoing a third-party ISO audit for certification purposes, companies must have a clear ISO audit plan and strategy. This is essential for getting the most out of the process. Developing a plan involves carefully outlining the necessary steps in the process in light of the relevant ISOs, laws, and regulations, while developing a strategy involves making sure the audit process will be as comprehensive as necessary and efficient as possible.

4. Conducting Document Reviews, Interviews, and Assessments

With the planning steps out of the way, it’s time for the ISO audit to begin. Internal or external auditors will review the relevant documents, conduct interviews with relevant personnel, and assess the company’s facilities and protocols to determine whether they meet all relevant standards. Depending on the scope and nature of a company’s regulated operations, this could take anywhere from one day to several days. While efficiency is important (and it’s something we prioritize), companies ultimately need to ensure that the audit process provides them with the information they need to feel confident in their compliance programs.

5. Evaluating ISO Compliance and Determining Next Steps

After completing their ISO audits, companies should review the results with their compliance counsel to determine their next steps. Does the company need to update its compliance policies or procedures? Do any employees need training? Are any remediation measures necessary? These are all important answers that companies need to be able to answer—and that they should be able to answer confidently after completing an ISO audit.

Documenting Your Company’s ISO Audits to Demonstrate Compliance

When it comes to ISO compliance, documentation is key. Not only does this mean that companies need comprehensive and well-documented compliance policies and procedures, but it also means that they must document their efforts to maintain compliance on an ongoing basis.

With this in mind, thoroughly documenting ISO audits is critical. This is true for both internal audits and third-party audits. In the event that a company receives a question about its certification or faces scrutiny from the FDA or another federal regulatory agency, being prepared to provide documentation of both the audit process and an ISO audit’s results will be critical for avoiding unnecessary costs, complications, and other consequences.

Put our highly experienced team on your side

Dr. Nick Oberheiden

Founder

Attorney-at-Law

Lynette S. Byrd

Former DOJ Trial Attorney

Partner

Brian J. Kuester

Former U.S. Attorney

Hon. Kevin McCarthy

55th Speaker, U.S. House of Representatives (ret.)

Government Consultant

Mike Pompeo

Of Counsel

Former U.S. Secretary of State

John W. Sellers

Former Senior DOJ Trial Attorney

Linda Julin McNamara

Federal Appeals Attorney

Nicholas B. Johnson

Former Prosecutor

Roger Bach

Former Special Agent (DOJ)

Chris J. Quick

Former Special Agent (FBI & IRS-CI)

Michael S. Koslow

Former Supervisory Special Agent (DOD-OIG)

Ray Yuen

Former Supervisory Special Agent (FBI)

FAQs: Using ISO Audits to Measure, Document, and Improve Compliance

Discuss Your Company’s Next ISO Audit with a Lawyer or Consultant at Oberheiden P.C.

We hope you have found this guide to ISO audits useful. If you would like to speak with a lawyer or consultant at Oberheiden P.C. about your company’s next ISO audit, we invite you to get in touch. To schedule a complimentary initial consultation, call 888-680-1745 or tell us how we can help online today.