MDR compliance audits: How to manage risk, records and corrective action

Passing an audit alone does not make a medical device compliant. MDR compliance audits assess whether a manufacturer’s quality management system and records support compliance, identify gaps, and show where corrective action is needed. An audit examines evidence and system effectiveness; it does not replace meeting applicable requirements.

An effective audit looks beyond policies and procedures. It traces risk controls and lifecycle records through day-to-day operations and checks whether incidents, nonconformities, and corrective actions are documented and addressed consistently.

This article explains how audit reviews connect risk management with design, manufacture, and ongoing performance. You’ll learn what evidence supports traceability, how corrective actions and incident records are assessed, and how surveillance reviews test whether a quality system remains effective. Understanding what auditors examine and how to address gaps can make preparation more predictable.

How to prioritize MDR audit risks across the device lifecycle

The European Union’s Medical Device Regulation is Regulation (EU) 2017/745. Its requirements sit within a broader regulatory compliance system. Device manufacturers should prioritize audit work by tracing significant risks from design inputs through production and post-market information. This connects each control to evidence showing how it was selected, implemented, and reviewed.

Start with the device’s intended purpose, design, and foreseeable hazards. Under MDR Article 10, manufacturers must maintain a risk management system. ISO 14971 provides a framework for managing device risks throughout the lifecycle. Auditors assess whether the process remains current as design changes, supplier issues, complaints, or incident information emerge. A risk record that stops at product launch leaves later decisions without a clear rationale.

Use the significance of each risk to decide which processes need closer audit attention. For example, a change to a critical supplier may affect component conformity, production controls, and finished-device performance. Trace the change through supplier qualification, purchasing records, incoming checks, production documentation, and related risk-file updates. If a control depends on staff training, connect the procedure to training evidence and observed practice. Findings are most significant when they reveal a break in that chain.

ISO 13485-aligned quality management systems provide a foundation for EU MDR compliance. Internal audits assess whether the management system is implemented and effective, not merely documented. Prioritize processes using risk assessments, previous audit results, regulatory changes, and recurring nonconformities or complaints. A low-impact issue can still warrant attention if it repeats or reveals a weak control.

Notified bodies are required to follow ISO 17021 for MDR. Their assessment considers whether the quality management system consistently supports safe device design, manufacture, and ongoing performance. Manufacturers can make traceability clearer by linking each identified risk to its control, responsible process, supporting record, and review trigger. This helps an auditor follow the evidence from a risk decision to routine operations.

• Map: Connect each significant hazard to its controls and lifecycle records.
• Prioritize: Give greater audit attention to high-risk processes, recurring findings, and recent changes.
• Trace: Follow a sample from risk assessment through production evidence and post-market review.
• Reassess: Update risk documentation when new information challenges an existing control.

Corrective action after a failed audit

An audit finding identifies evidence that needs assessment. Corrective action addresses the cause and helps prevent recurrence. The response depends on the finding’s significance, the affected processes, and the notified body’s instructions.

Audit Findings and Corrective Actions

An audit finding records a gap between observed evidence and an applicable requirement or documented process. For example, an auditor may find that a production record does not show a required inspection was completed. The manufacturer should assess the scope of the finding, identify affected devices or records, and develop a response supported by objective evidence. A documented correction alone may not show that the underlying process is effective.

Nonconformities and Corrective Action

A nonconformity is a failure to meet a requirement, such as an incomplete device history record or an ineffective risk control. Distinguish immediate correction from corrective action: first contain the issue, then investigate its cause and address the process that allowed it. If product safety or performance could be affected, link the response to risk management and retain evidence of implementation and effectiveness.

After an MDR or IVDR unannounced audit identifies nonconformities, the certificate holder receives specific requirements and defined timelines for corrective action. Plans can extend six to 12 months. Record each finding, its cause, containment, action owner, evidence, and effectiveness review; prioritize critical product or process risks instead of postponing action.

MDR audits form part of EU conformity assessment, while FDA inspections assess compliance with US requirements and MDSAP audits use a shared audit model. The FDA’s Quality System Regulation is set out in 21 CFR Part 820. MDSAP allows one audit to satisfy regulators in five jurisdictions: the US, EU, Canada, Australia, and Brazil.

Medical device manufacturers placing devices on the EU market undergo conformity assessment under the MDR, which may include an audit supporting CE certification. The audit scope depends on the device and the manufacturer’s quality management system, not simply on a product category.

Manufacturers, importers, and distributors have different supply-chain roles, so audit evidence should reflect each organization’s processes and responsibilities. For example, records may show how a manufacturer controls production or how an importer handles relevant device documentation.

US manufacturers selling devices in the EU must meet applicable EU MDR requirements. Manufacturers based outside the EU must appoint an authorized representative established within the EU before placing devices on the market, under Article 11.

The audit price depends on the case and is provided after a quote request; factors include device scope, process complexity, sites, and audit duration.

Incident response documentation and audit trails

To prepare for an MDR audit, organize incident records, technical documentation, and internal reports so each can be traced to a device and decision. Review a sample trail from the initial report through investigation, action, and closure to spot missing links before the notified body requests evidence.

For each complaint or incident, record the device identifier, event details, date received, assessment, decisions, and follow-up. Link related investigation records and corrective actions, including the reasoning behind decisions. For example, if a complaint leads to a production change, connect the complaint and investigation to the approved change and updated records. This helps reviewers understand what happened and why.

Keep technical documentation organized around the device and its lifecycle evidence. Clinical evaluation reports, design records, manufacturing information, and relevant post-market reports should be retrievable with clear versions. In one MDR audit example, auditors requested full evidence chains for 10-15 product samples. A consistent index helps teams locate comparable records without relying on individual staff members.

The European Union requires clinical evaluation reports under Annex XIV of the MDR. Article 61 addresses the clinical evidence supporting a device’s safety, performance, and intended use. Keep the clinical evaluation linked to the relevant device version and supporting evidence. If a new incident affects an existing conclusion, document the review, decision, and any resulting update to the technical documentation.

A centralized audit repository can bring together controlled procedures, incident reports, investigation records, technical documentation, and corrective-action evidence. Use a clear folder structure or index organized by device, record type, and revision. Assign record owners and limit editing to authorized roles, while ensuring relevant personnel can retrieve approved versions during an audit.

• Trace: Connect each incident to its assessment, decision, and follow-up record.
• Control: Keep approved technical-document versions distinct from superseded files.
• Sample: Test whether a device record can be followed from report to closure.
• Reconcile: Link clinical conclusions to supporting evidence and relevant device versions.

Before an audit, use an internal review to test whether records are easy to retrieve and consistent. For example, compare an incident report with its investigation, related clinical evaluation, and corrective-action documentation. Resolve gaps in ownership, version control, or traceability, and retain the review record as evidence of preparation.

Operational observation and record review

During an MDR or IVDR unannounced audit, assessment teams compare routine work with the manufacturer’s quality management system and technical documentation. They may observe manufacturing or service activities, examine operational records, and discuss tasks with the personnel performing them. This helps determine whether documented controls match actual practice.

For example, an auditor observing a production step can compare the operator’s actions with the approved procedure and batch records. If the procedure requires a recorded inspection, the auditor may trace the result to the relevant device or production record. Differences between observed work and records can point to a control or implementation gap.

Employee training records help show that assigned personnel understand the procedures relevant to their work. Each record should connect the employee, training content, applicable procedure, and evidence of completion. For instance, if a manufacturing instruction changes, the training trail should show that affected employees received the updated information before using it.

Internal audit evidence can include records, photographs, and notes that document the area reviewed and the evidence sampled. Manufacturers should maintain an audit plan, findings, reports, and follow-up records so reviewers can trace identified issues to their resolution. Internal auditors should understand ISO 19011 auditing principles and avoid auditing areas under their direct responsibility.

A full-system internal audit should be conducted at least once per year. Set audit priorities using risk assessments, previous results, regulatory changes, and patterns in nonconformities or complaints. This directs attention to processes with relevant risk signals instead of treating every area as equally critical.

Notified bodies may review internal audit plans and reports, CAPA records, and management reviews. A CAPA record should connect the issue to its investigation, assigned action, implementation evidence, and effectiveness review. For example, repeated incomplete production records may call for investigation of the process cause, not just correction of individual entries.

Management reviews can record whether training needs and new regulations were considered, including when no change was identified. Recording that decision creates a traceable record rather than leaving the topic unaddressed. Together, observation, training evidence, audit reports, and CAPA records help show how the quality system works beyond its written procedures.

• Observe: Compare actual work with the applicable procedure and technical records.
• Trace: Connect employee training to current work instructions.
• Prioritize: Use risk, prior findings, and complaint history to focus internal audits.
• Follow through: Link each CAPA to evidence of implementation and effectiveness.

MDR and IVDR surveillance audit cycles

Medical device manufacturers remain subject to notified body surveillance after conformity assessment, including unannounced audit visits. These reviews examine whether the organization continues to meet applicable requirements and support the device’s certification.

An MDR notified body audit may include Stage 1 and Stage 2 assessments. The on-site audit can last three to five days, depending on company size. The stages and overall timeline depend on the conformity assessment and the device under review.

Surveillance continues after certification; it is not a one-time assessment. Notified bodies conduct regular surveillance activities under the EU MDR and IVDR, and unannounced visits may take place at any time. An unannounced visit typically covers a full working day, while audit methods can vary by product class and device.

During an unannounced visit, the audit team arrives at the manufacturer’s site and presents its credentials. The team explains the purpose of the visit and requests access to operational areas. A QMS assessor and Technical Specialist typically participate. They may observe routine production, review records, and speak with the personnel doing the work.

Manufacturers with CE certification under the MDR or IVDR should be ready to cooperate promptly. Keep relevant processes, records, and personnel accessible, including during planned activities or temporary staff absences. Inform the notified body in advance about planned shutdowns, holidays, or significant operational changes. This helps coordinate access when an audit visit occurs.

Surveillance review can include post-market surveillance under Article 83, production validation, and vigilance. These areas warrant focused attention because they connect device performance in use with manufacturing controls and safety monitoring. A complaint trend, for example, may prompt review of the related vigilance records and production evidence.

At the visit’s close, the audit team prepares a summary of observations and recommends whether certification should continue. The organization should assign owners to resulting actions, preserve supporting evidence, and track follow-up through its established processes. For legacy devices under notified body review, MDCG 2022-4 encourages combining MDD and MDR audits where appropriate.

To strengthen audit readiness, develop team competence through lead auditor training, so audit activities are planned and documented consistently.

International Associates Limited: Social Accountability Audits

International Associates Limited provides Social Accountability Audits and management system certification for organizations with distinct assurance needs. These services can complement a medical device compliance programme, but they serve a different purpose from an MDR conformity assessment. The right next step depends on whether the organization needs an independent social accountability review or certification against a relevant management system standard.

Choose a Social Accountability Audit when your organization needs an assessment focused on social accountability practices. It may be relevant when responsible workplace practices form part of supplier oversight or stakeholder assurance. Define the audit scope around the organization’s activities and the records available for review. It does not replace a notified body’s assessment of medical device conformity or resolve product-specific regulatory findings.

ISO 13485 Medical Devices Certification may be relevant when a manufacturer seeks independent assessment of its medical device quality management system against ISO 13485. This certification concerns the management system; it is not an MDR certificate or a substitute for device conformity assessment. Organizations should distinguish the system certification they seek from the regulatory assessment required for market access.

Other certifications address different operational priorities. ISO 9001 Quality Management System Certification may suit organizations seeking certification of a quality management system. ISO 14001 Environmental Management System Certification relates to environmental management, while ISO 45001 Occupational Health and Safety addresses occupational health and safety management. These options are not interchangeable. Select according to the management system and assurance objective the organization needs to address.

A practical decision starts with the issue to be independently assessed. If the concern is device quality management, ISO 13485 may be relevant. If the priority is broader quality, environmental, or occupational health and safety management, the corresponding ISO certification may fit better. If social accountability is the focus, consider a Social Accountability Audit. In each case, define the scope, relevant sites or processes, and records that demonstrate how the system operates.

Keep the boundaries clear: no single management system certification automatically demonstrates compliance with every MDR requirement. Manufacturers must still address applicable device-specific regulatory obligations through the relevant conformity assessment process. International Associates Limited’s audit and certification services can support related assurance objectives, without replacing technical or regulatory responsibilities.

For an independent assessment of social accountability practices, contact International Associates Limited.

Make audit readiness part of ongoing governance

Make audit readiness an ongoing governance priority by assigning responsibility for reviewing changes that could affect regulatory evidence. A defined review point helps teams bring emerging issues to the appropriate decision-makers before they fall outside routine oversight. This keeps preparation aligned with organizational responsibilities instead of making it a last-minute exercise.

Use the next planning cycle to identify the independent assessment or certification objective that best supports your organization’s priorities. MDR compliance audits address device-related regulatory assessment; other assurance needs should have a clearly defined scope of their own. Separating these objectives keeps the purpose of each review clear.

If you want to discuss an audit or certification objective, contact International Associates Limited. A clear starting point can help shape a focused next step.

Frequently Asked Questions

Does MDR help with compliance requirements?

Yes. The MDR provides a regulatory framework for assessing medical devices intended for the EU market. Its practical value lies in translating requirements into controls, evidence, and product decisions. For example, a design or supplier change can prompt a review of whether existing evidence still supports the device’s conformity. The regulation sets requirements; the manufacturer remains responsible for carrying out that assessment.

Does MDR make my organization compliant with regulatory frameworks?

No. Following the MDR does not establish compliance with every framework that may apply to an organization. Requirements depend on the product, market, and the organization’s role. A manufacturer selling in the EU and United States must consider each market’s applicable framework separately. Treating an EU assessment as proof of compliance elsewhere risks overlooking distinct obligations, even when some quality processes support multiple systems.

What are the Consequences of Failing an Audit?

Consequences depend on the finding and its effect on conformity. An unresolved issue can affect a certification decision; serious EU MDR audit failures can lead to fines or, in the worst case, removal of the CE certificate and product from the market. The key distinction is between an isolated documentation gap and a finding that calls the device’s conformity into question. The audit outcome and required response reflect that distinction.

What is an MDR compliance audit under EU Medical Device Regulation 2017/745?

An MDR audit assesses evidence relevant to a manufacturer’s conformity with EU medical device rules. It may support the conformity assessment needed for CE certification, but it is not a separate product approval. The reviewer considers the applicable device and assessment scope. Manufacturers should distinguish an audit of their quality processes from the broader regulatory decision about a particular device.

What documents and records should manufacturers prepare for an MDR audit?

Prepare records that let a reviewer trace a device decision back to its source. For example, keep the approved procedure, relevant device or batch record, and review evidence accessible together. Check that document versions match across the systems used by quality, production, and regulatory teams. This consistency helps avoid delays caused by duplicate files, unclear ownership, or records that cannot be matched to the device under review.

What are the main MDR quality management system audit criteria, including ISO 13485?

ISO 13485 is relevant to a medical device quality management system, but an audit also considers whether the system works in practice. Reviewers may look at how responsibilities and process controls connect across design, purchasing, production, and post-market work. A useful internal test is whether staff can explain the records they create and how those records support decisions, rather than relying only on written procedures.

How often are MDR surveillance audits and unannounced audits conducted?

Notified bodies conduct ongoing surveillance under the MDR and IVDR, including unannounced visits. These audits may occur at any time, so plan access to key staff and operational areas without assuming a visit date. Surveillance methods and timing depend on the notified body’s process and the device under review. Communicate planned shutdowns, holidays, and significant operational changes in advance.

What are common MDR audit findings, nonconformities, and corrective action deadlines?

Findings can arise when records do not support a decision, procedures are not followed, or required controls are ineffective. The notified body defines the response requirements and timelines for identified nonconformities; corrective action plans can extend six to 12 months. Use the finding’s wording to set the response scope, then retain evidence that addresses the specific gap. A broad response that misses the stated issue may not resolve it.