ISO 13485 Internal Auditor Training: Audit a Medical Device Quality Management System

Opens with a self-check: what is ISO 13485, how does it differ from ISO 9001, and do you recall a recent medical device recall? Presents three cases and the auditor's question each raises: the June 2021 Philips Respironics recall of sleep therapy machines and ventilators whose foam could break down, Exactech's February 2022 expanded recall of knee and ankle implants packed in bags missing an oxygen barrier layer, and the December 2021 FDA warning letter to Medtronic's diabetes business over complaints about a retainer ring in MiniMed 600 series insulin pumps. Explains that an internal audit is worth what it finds: real evidence and findings management acts on. Introduces Harbour Medical in Dublin, which makes sterile single-use urinary and central venous catheters. Ends with the twenty-six modules in three parts, the exam and a recap.

What you will be able to do

• Explain what complaint, packaging and CAPA failures teach an internal auditor
• Describe what makes an internal audit worth doing
• Outline how the course audits Harbour Medical from clause 4 to clause 8

Why it matters

Sample the records, not only the procedures; real cases show what a device QMS internal audit is there to find.

Practice: Practice: Welcome: why device QMS internal audit matters · 3 questions

Starts at Harbour Medical in Dublin, where a new internal auditor arrives with the checklist from her last ISO 9001 company and spends a day missing the medical device file, complaint handling and reporting to regulators. Explains the regulatory purpose of the standard: roles identified, regulations identified, and both built into the quality management system, with a blood glucose meter maker in Los Angeles launching a new meter. Covers the structure, with requirements in clauses 4 to 8, based on ISO 9001:2008 and not the same as ISO 9001. Then covers the words that decide what is required: the terms of clause 3, such as a complaint that can be a nurse's phone call, the five phrases of 0.2 including as appropriate, and the two routes of exclusion and non-application. Ends with a recap.

What you will be able to do

• Explain how ISO 13485 differs from ISO 9001 for an auditor
• Identify the organisation's regulatory roles and applicable regulations
• Apply the terms of clause 3 and the phrases of 0.2

Why it matters

Auditing this standard in its own words stops a borrowed ISO 9001 checklist from missing device-specific requirements.

Practice: Practice: The standard through an auditor's eyes · 3 questions

Opens with last year's internal audit of production at Harbour, carried out by the production manager with every line marked conforms, until the certification body finds missing line clearance records for two batches. Explains clause 8.2.4: audits at planned intervals against four sets of requirements and for effectiveness, with a documented procedure, a programme, records and follow-up. Covers how the standard says audits are run and the types of audit, such as Harbour auditing its contract steriliser in Frankfurt as a second-party audit. Then introduces the foundations of ISO 19011:2026: the chain of criteria, evidence, finding and conclusion behind every finding, and seven principles that make an audit trustworthy, with four shown at Harbour, and the rule that auditors shall not audit their own work. Ends with a quick check on the principles and a recap.

What you will be able to do

• Explain what clause 8.2.4 requires for internal audits
• Build a finding from criteria, evidence and conclusion
• Apply the seven principles of auditing, including independence

Why it matters

No criteria and no evidence means no finding; independence is what makes an internal audit result trustworthy.

Practice: Practice: The internal auditor and ISO 19011:2026 · 3 questions

Starts in Harbour's quality office, where the complaint database was upgraded in March and the quality engineer says the vendor validated it, although nobody tested how Harbour uses it with its own settings. Explains how to audit clauses 4.1.1 to 4.1.3: the system documented, roles documented and every process run to criteria with a risk based approach, shown in one Harbour process the way the training documents it. Covers clause 4.1.4: changes evaluated for their impact on the system and the devices, then controlled, following one trail at Harbour. Then covers clauses 4.1.5 and 4.1.6: outsourced processes controlled through written quality agreements, shown at two companies, and software used in the system validated for the way it is used. Ends with the mistake of raising a finding over an agreement's format, and a recap.

What you will be able to do

• Audit processes, roles and the risk-based approach under clause 4.1
• Check that outsourced processes are controlled by quality agreements
• Verify that QMS software is validated for its actual use

Why it matters

Outsourced is never handed over; checking software and supplier controls catches gaps a vendor's own testing leaves.

Practice: Practice: General requirements: roles, processes, software · 3 questions

Opens at Harbour's regulatory affairs desk with the medical device file for the urinary catheter family, whose index lists the packaging specification at revision C while the packing line works to revision D, which changed the pouch size. Explains clause 4.2.1: five sources of required documentation, and why documented always means working too, not only written. Covers clause 4.2.2: a quality manual with the scope and justified exclusions, the procedures or references, and how the processes interact. Then covers clause 4.2.3: a medical device file for each type or family, items a) to f), maintained as the device changes, with labelling in item a) checked from the label printer template to the pouches and instructions in the box. Shows how to test the file against the floor and the regulatory register. Ends with a recap.

What you will be able to do

• Identify the five sources of required documentation
• Audit a quality manual for scope, exclusions and process interaction
• Test a medical device file against documents in use on the floor

Why it matters

If you audit only one thing in documentation, audit a device file; out-of-date files mean products made to the wrong specification.

Practice: Practice: Documentation and the medical device file · 3 questions

Starts beside the pouch sealers in Harbour's cleanroom, where a stained work instruction at revision 3 is taped to sealer two while the current revision 4 raised the sealing temperature after a validation study. Explains clause 4.2.4: eight document controls, changes approved by people with the right background, and obsolete documents kept but never used by mistake, with a blank form as a document and a completed form as a record. Covers clause 4.2.5: records legible, identifiable and retrievable, with changes visible and confidential health information protected. Then covers retention of at least the device lifetime or what regulations specify, never less than two years from release, using a record control matrix and testing it. Ends with a finding on lens power results retyped after release, records locked once complete with a change log, and a recap.

What you will be able to do

• Check document revisions in use against the document system
• Audit records for legibility, retrieval, visible changes and retention
• Test a record control matrix against real records

Why it matters

Look where the work is done; an old instruction at a machine can mean product made outside its validated settings.

Practice: Practice: Control of documents and records · 3 questions

Opens in the managing director's office at Harbour Medical, where this year's quality objectives are three lines, the first reading improve quality, with no number, date or owner, while the complaint rate for central venous catheters has doubled since January. Explains how to audit clauses 5.1 and 5.2: commitment shown by evidence, with customer and regulatory requirements determined and met, and how to book time with top management and ask for minutes and figures in advance. Covers clause 5.3: a quality policy that fits, includes both commitments, frames the objectives, is understood and is reviewed. Then covers clauses 5.4.1 and 5.4.2: measurable objectives at relevant functions and levels, and a system that stays whole when it changes, with an imaging equipment maker in Tokyo that installs and services its scanners. Ends with a recap.

What you will be able to do

• Find evidence of top management commitment
• Audit a quality policy against clause 5.3
• Check that quality objectives are measurable and owned

Why it matters

Commitment shows in decisions; an objective with no number cannot drive action on a rising complaint rate.

Practice: Practice: Commitment, policy and quality objectives · 3 questions

Starts with the minutes of Harbour's March management review, which cover sales, audits, objectives and budget but nothing on complaints, reports to regulators or new labelling rules in one market. Explains clauses 5.5.1 and 5.5.2: responsibilities defined, documented and communicated, the interrelation and independence of those who manage, perform and verify work, shown in Harbour's pouch sealing process, and a management representative from management. Covers clause 5.5.3: communication that really reaches the people who must act, using a communication matrix of what, when, how, to whom and who is responsible. Then covers clause 5.6: documented planned intervals, at least twelve inputs, and recorded decisions on improvement, regulations and resources, tracing one input to one decision. Ends with the documents usually found, such as job descriptions and an action log, and a recap.

What you will be able to do

• Check that responsibilities and independence are documented
• Audit internal communication with a communication matrix
• Verify that management review covers every required input and output

Why it matters

Trace one input to one decision; a review that skips complaints and regulations leaves risks nobody has decided on.

Practice: Practice: Roles, communication and management review · 3 questions

Opens at the pouch sealers, where an operator who joined three weeks ago has a complete training record signed by his supervisor, but cannot show how to check a seal or what a bad seal looks like. Explains clause 6.1: resources determined and provided for the system and for customer and regulatory requirements, and how a backlog, a late study or an overloaded person is evidence about resources. Covers following resources into clause 5.1 e) and management review outputs, such as whether the new seal tester approved in March is installed or still in its box. Then covers clause 6.2: documented processes, competence determined, training or other actions, effectiveness evaluated in proportion to risk, awareness of why the work matters, and records of education, training, skills and experience. Ends with a recap.

What you will be able to do

• Find evidence that resources match quality and regulatory needs
• Test competence by asking to see the skill, not the signature
• Check that training effectiveness is evaluated in proportion to risk

Why it matters

A signed training record is not competence; watching the task shows whether people can actually spot a bad seal.

Practice: Practice: Resources and competence · 3 questions

Starts outside Harbour's cleanroom, where the pressure difference log is complete on weekdays but blank for four weekends on which production records show the lines ran. Explains clause 6.3: infrastructure that achieves conformity and prevents mix-up, with documented maintenance intervals and records where quality depends on them, such as the monthly-maintained pouch sealers and software used in production under clause 7.5.6. Covers clause 6.4.1: work environment requirements documented, monitored and controlled, with rules for people and for temporary work, checked through the cleanroom visitor and contractor log. Then covers clause 6.4.2: contaminated product controlled and cleanliness kept during assembly and packing of sterile devices. Shows how to compare maintenance intervals with record dates and how to write the finding on the pressure log. Ends with a recap.

What you will be able to do

• Compare maintenance intervals with the dates on records
• Audit work environment monitoring, including nights and weekends
• Check contamination control for sterile device assembly and packing

Why it matters

Check the nights and weekends; a blank environmental log on production days is a gap in control of a sterile product.

Practice: Practice: Infrastructure and the work environment · 3 questions

Opens in Harbour's design office with a thorough risk management file for central venous catheters, last updated in 2021, while eleven complaints this year about hubs cracking during flushing are missing from the hazard list. Explains clause 7.1: realisation planned to cover objectives, resources, verification and acceptance, and records, in a form the company chooses. Covers risk management as a documented process with records, linked to design inputs under clause 7.3.3, changes, feedback under clause 8.2.1 and corrective action, shown in a complete risk trail for the cracking hub. Then covers clause 7.2: requirements determined, including user training, reviewed before commitment, and communication arrangements with customers and regulators, with the quality plans and contract review checklists usually found. Ends with a recap: a risk file is never finished.

What you will be able to do

• Audit realisation planning for objectives, resources and acceptance
• Trace a complaint into the risk management file
• Check that requirements are reviewed before commitment

Why it matters

A risk file is never finished; linking complaints to risk management keeps known hazards from being missed.

Practice: Practice: Planning, risk and customer processes · 3 questions

Starts with the file for Harbour's new coated urinary catheter, where the second design review was attended only by five design engineers and the minutes do not say which version of the design was reviewed. Explains clauses 7.3.1 and 7.3.2: documented procedures and a plan with stages, reviews, checks, responsibilities, traceability and resources, kept current. Covers clauses 7.3.3 and 7.3.4: complete, unambiguous, verifiable inputs, approved, and outputs in a form suitable for verification that meet them, traced line by line, showing how a risk becomes part of a design. Then covers clause 7.3.5: systematic reviews at planned stages, with the functions concerned, and records identifying the design, the people and the date, with a software medical device developer in London releasing updates every few weeks. Ends with a recap.

What you will be able to do

• Audit a design plan for stages, reviews and responsibilities
• Trace design inputs to outputs line by line
• Check that design review records identify the design, people and date

Why it matters

Good designs start with good inputs; incomplete reviews let design problems pass into production unseen.

Practice: Practice: Design and development: planning to review · 3 questions

Opens with the coated urinary catheter's signed validation report, where nurses at two hospitals used thirty catheters that met every criterion, but the catheters were hand-made in the laboratory before the coating line existed. Explains clauses 7.3.6 and 7.3.7: plans with methods, criteria and sample rationale, connected devices, and validation on representative product, with clinical or performance evaluation before release, shown by an orthopaedic implant maker in Chicago. Covers clause 7.3.8: outputs verified as suitable for manufacturing and production capability confirmed before specifications are final. Then covers clauses 7.3.9 and 7.3.10: changes assessed for significance and approved before implementation, reviewing parts, stock in process, units delivered and the risk file, as with a coating supplier's new formulation, and a design file for each type or family. Ends with sampling three changes from the change log, and a recap.

What you will be able to do

• Check that validation used product representative of production
• Audit design transfer for manufacturing suitability
• Sample design changes for significance assessment and approval

Why it matters

Validate what customers will get; hand-made validation samples say nothing about devices from the production line.

Practice: Practice: Verification, validation, transfer and changes · 3 questions

Opens at Harbour's goods-in area, where the pouch material that forms the sterile barrier arrives from a supplier that moved its coating line to a new plant, discovered only from a new address on a delivery note, while goods-in only counts deliveries and checks labels. Explains clause 7.4.1: suppliers selected on ability, performance, effect on the device and risk, then monitored and re-evaluated, with records, shown in Harbour's steps for approving a second hub moulder. Covers clause 7.4.2: purchasing information that is adequate before it is sent, with a written agreement to notify changes where it applies. Then covers clause 7.4.3: verification of purchased product in proportion to supplier evaluation and risk, and every known change assessed for its effect, with a syringe maker in Mumbai buying needles. Ends with a recap.

What you will be able to do

• Audit supplier selection, monitoring and re-evaluation records
• Check purchasing information includes change notification where needed
• Verify incoming checks are in proportion to risk

Why it matters

Know your suppliers' changes before they reach you; a silent change to a sterile barrier material can affect every device.

Practice: Practice: Purchasing and supplier controls · 3 questions

Starts at the release desk in Harbour's quality office, where a batch of venous catheters is traced to its steriliser's cycle record, which lists one load number while Harbour's records show three batches went into that load. Explains clause 7.5.1: production planned and controlled, with six kinds of control and a verified, approved record for each batch showing it was made and released, including label reconciliation in packing and what this means for a new pouch sealer. Covers clauses 7.5.2 to 7.5.4: cleanliness of product where it applies, installation verified, and servicing records analysed for complaints and improvement, with an imaging equipment maker in Tokyo that installs and services scanners. Then covers clause 7.5.5: sterilisation parameters recorded for every load and traceable to each production batch, and how Harbour fixed the gap as a corrective action. Ends with a recap.

What you will be able to do

• Audit a batch record from manufacture to release
• Check servicing records are analysed for complaints and improvement
• Trace sterilisation records from load to batch and back

Why it matters

Trace it both ways, load to batch and batch to load; sterility records that do not link cannot support release.

Practice: Practice: Production, installation, servicing, sterile · 3 questions

Returns to sealer two from Module 6: the pouch sealing validation was done in 2022 at three temperature settings, but revision 4 of the instruction raised the setting above all of them. Explains clause 7.5.6: validating processes whose output cannot be, or is not, verified, including where deficiencies appear only after the product is in use, and how the decision to validate is made. Covers the seven elements, from approval criteria to revalidation and approval of changes, with validated limits carried into production and software validated in proportion to risk, shown in the shape of Harbour's pouch sealing file. Then covers clause 7.5.7: sterilisation and sterile barrier systems validated before use and after changes, even when outsourced, with a contract steriliser in Frankfurt and a day's log of alarms and actions. Ends with checking the change log against validations, and a recap.

What you will be able to do

• Decide when a process must be validated under clause 7.5.6
• Check revalidation triggers against the change log
• Audit sterilisation and sterile barrier validation, including outsourced work

Why it matters

Check the change log against the validations; a setting moved outside its validated range breaks the evidence for every seal.

Practice: Practice: Process validation and sterilisation · 3 questions

Opens with a traceability drill at Harbour, starting from one lot of resin used in long-term venous catheters: in two hours Harbour finds the four batches and the distributors, but one distributor cannot say which hospitals it supplied. Explains clause 7.5.8: product and its status identified throughout, unique device identification where regulations require it, and returns kept apart. Covers clause 7.5.9: traceability to a defined extent, backwards to materials and forwards to customers, shown in what one batch record links to, and for implantable devices, components, materials and environment, distributor records and consignee addresses. Then covers clauses 7.5.10 and 7.5.11: customer property protected and losses reported, and product preserved with special conditions controlled and recorded, such as summer heat in an unconditioned warehouse. Shows how to run the drill. Ends with a recap.

What you will be able to do

• Run a traceability drill backwards and forwards against the clock
• Check traceability records for implantable devices and distributors
• Audit preservation and storage conditions for product

Why it matters

Run the drill both ways against the clock; a distributor without records can stop a recall from reaching patients.

Practice: Practice: Identification and traceability · 3 questions

Starts at Harbour's complaint database, where fourteen venous catheter complaints this year are closed as no fault found, with no device examined, no batch record reviewed and no reason given, including one where the patient needed a second procedure. Explains clauses 8.1 and 8.2.1: measurement planned for a purpose, and feedback from production and after production feeding risk management, shown with four pieces of feedback at Harbour. Covers clause 8.2.2: six steps for every complaint, investigation or a documented justification for not investigating, and information shared with external parties, plus where electronic feedback arrives, from apps to social media. Then covers clause 8.2.3: documented reporting procedures where regulations require them, a recorded decision every time and records of reports. Shows how to sample a complaint log well. Ends with a recap: no silent closures.

What you will be able to do

• Sample a complaint log and test each closure for investigation or justification
• Check that feedback feeds risk management
• Verify a recorded reporting decision for each complaint

Why it matters

No silent closures; a complaint closed as no fault found without investigation can hide a reportable event.

Practice: Practice: Feedback, complaints and reporting · 3 questions

Opens in Harbour's quality control laboratory, where the tensile tester for hub-to-tube bond strength was found reading six percent high in June and adjusted, but nothing was done about results since the previous calibration. Explains clause 7.6: equipment calibrated against traceable standards, identified and protected, previous results assessed and recorded when equipment is found out of tolerance, and measuring software validated in proportion to risk, showing the record it should leave. Covers clause 8.2.5: suitable methods for every process, with four Harbour processes each given a planned result and a method, and action when planned results are missed. Then covers clause 8.2.6: evidence against acceptance criteria, the releaser and test equipment recorded, no release before arrangements are complete, and named testers for implants. Ends with picking five instruments to find in the calibration register, and a recap.

What you will be able to do

• Check that out-of-tolerance results trigger an assessment of past results
• Audit process monitoring methods and planned results
• Verify product release records against acceptance criteria

Why it matters

Adjusting is half the answer; a tester found reading high may have accepted weak bonds that already reached patients.

Practice: Practice: Measuring equipment, processes, product · 3 questions

Starts at the quarantine cage beside Harbour's warehouse, where the nonconformity log shows two thousand four hundred urinary catheters with off-shape tips released as use as is, signed only by the production manager who needed them for a delivery. Explains clause 8.3.1: a documented procedure with authorities, and records of the evaluation and rationale, and why that decision is a concession whatever the form calls it. Covers clauses 8.3.2 to 8.3.4: concessions only with justification, approval and regulations met; action after delivery in proportion to effects, with advisory notice procedures ready at any time; and rework under approved procedures that consider its effect on the product, shown in four elements at Harbour. Then covers clause 8.4: at least six inputs, appropriate methods and results that feed improvement, with a contact lens maker in Hong Kong. Ends with a recap.

What you will be able to do

• Audit nonconforming product decisions for authority and rationale
• Recognise a concession and check its justification and approval
• Check that data analysis covers the required inputs

Why it matters

A deadline is not a justification; an unjustified use as is decision puts nonconforming devices into hospitals.

Practice: Practice: Nonconforming product and analysis of data · 3 questions

Opens with Harbour's corrective action for the tip defects from Module 20: root cause operator error, operators retrained and closed a week later, while reject data show tip defects rising every month since. Explains clause 8.5.1: changes to keep the system and the device effective, through eight named tools. Covers clause 8.5.2: removing the cause without undue delay, in proportion, verifying the action does no harm and reviewing its effectiveness, and why a missing signature on one form does not need a three-month investigation. Shows how to investigate the tip defects properly, checking each answer against evidence such as the mould log, the settings record and the change form. Then covers clause 8.5.3: finding potential problems and their causes and acting in proportion, with one cause on two lines. Ends with writing the finding from the corrective action log, and a recap.

What you will be able to do

• Challenge a root cause such as operator error with evidence
• Check that corrective action effectiveness is reviewed on data
• Audit preventive action for potential problems on other lines

Why it matters

Close on the data, not the date; a CAPA closed while defects keep rising tells management the problem is solved when it is not.

Practice: Practice: Corrective and preventive action · 3 questions

Starts with last year's one-line internal audit plan at Harbour, worked through the procedures in clause order, so by four o'clock nobody had reached complaints, sterilisation records or the sealing process. Explains building a programme that considers the status and importance of processes and previous results, with the most effort where patients could be harmed, shown as a grid of processes and months. Covers how events change the programme, such as Harbour starting a new coating line in April, complaints rising in May, and a short coating line audit added in July, and pairing an auditor in training with an experienced one. Then covers defining objectives, scope and criteria for each audit, including regulatory requirements, writing a plan that puts the riskiest part first and sharing it in advance, reviewing documented information, and building process-based checklists that ask for evidence, with a sample. Ends with a recap.

What you will be able to do

• Build a risk-based audit programme across processes and months
• Define audit objectives, scope and criteria, including regulations
• Write process-based checklists that ask for evidence

Why it matters

Plan from risk, then audit to the plan; a clause-order plan runs out of time before the processes that harm patients.

Practice: Practice: Planning and preparing the audit · 3 questions

Opens at the door of Harbour's cleanroom, where an internal auditor skips the opening meeting, enters without a hair cover and pulls a sealed pouch open by hand, so by lunchtime nobody wants to talk to him. Explains the opening meeting: agreeing the plan, introducing the team and confirming the audit can run, where short is fine but skipped is not. Covers behaviour on site: safety and hygiene first and hands off, since the cleanroom's rules apply to the auditor, and asking permission in advance for photos and copies with confidentiality and security in mind. Then covers on-site methods with people, such as interviews, observing work and sampling, and remote methods for records while auditing the floor in person, plus spotting the odd, such as a week of identical seal test results. Ends with the human side of auditing and a recap.

What you will be able to do

• Run a short, complete opening meeting
• Follow cleanroom and safety rules while auditing on site
• Choose between on-site and remote audit methods

Why it matters

Open well, follow the rules and people talk; an auditor who breaks hygiene rules loses the trust that brings out the facts.

Practice: Practice: Conducting the audit: opening and on site · 3 questions

Begins with one line from the training, investigate to the depth necessary: follow the trail from answer to record to next question, and stop when the sample is sufficient. Explains how information becomes evidence only when verified as complete, correct, consistent and current, shown by checking whether the label printer template is the approved revision and whether a month's seal test log shows every shift start. Covers sampling by judgement or by statistics, sized to the risk, asking the right type of question, and hearing the people who do the work. Then follows two audit trails, from complaint to corrective action and from design to production, showing how a failure in the complaint log but missing from the risk file is found only by following it. Ends with writing a good note naming the sealer, log, revision, period and three of sixty-two shift starts with no test, and a recap.

What you will be able to do

• Verify information as complete, correct, consistent and current
• Size an audit sample to the risk
• Follow audit trails from complaint to CAPA and from design to production

Why it matters

Only verified information is evidence; following trails finds the failures that sit between departments.

Practice: Practice: Sampling, evidence and audit trails · 3 questions

Begins at the moment you finish auditing an area: share findings with the auditee there and then, review each nonconformity before the closing meeting under the guidance in clause 6.4.8, and let the auditee show further evidence, so nothing comes as a surprise. Explains grading as optional, with criteria you define and communicate, shown at Harbour, and opportunities for improvement where a requirement is met but could be done better. Covers writing every statement in four parts: criteria, evidence, the statement, and related findings with the grade, such as a label printer holding template revision 6 while revision 7 is approved, and four nonconformities that will not stand. Then covers handling an auditee who disagrees, using a process validation finding against clause 7.5.6, and closing the audit with a report that keeps the records clause 8.2.4 requires. Ends with a recap.

What you will be able to do

• Write a nonconformity in four parts: criteria, evidence, statement and grade
• Tell a nonconformity apart from an opportunity for improvement
• Run a closing meeting and issue a report with no surprises

Why it matters

Findings that can be checked and fixed get action; vague findings get argued about and ignored.

Practice: Practice: Findings, the closing meeting and the report · 3 questions

Begins with what happens after the report under clause 8.2.4: the management responsible for the area takes corrections and corrective actions without undue delay, and follow-up verifies the actions and reports the results, as the follow-up guidance in ISO 19011 also describes. Shows one form in four parts, from finding to effectiveness, and asks when a nonconformity is closed: when the form is filled in, or when the action works. Reviews a response to the sealing finding from Module 25, where the change form now asks about validation and validation must sign before release. Then walks through an effective audit step by step and a practice audit at Harbour, with four ways a good finding dies, including auditing only the procedure, taking answers on trust and writing opinions with no criteria. Ends with a three-line recap of the course and the final exam.

What you will be able to do

• Verify that corrective actions work before closing a finding
• Review an auditee's response to a nonconformity
• Plan, conduct and report a practice internal audit

Why it matters

Audit so devices stay safe and findings get action; follow-up is where an internal audit actually changes anything.

Practice: Practice: Follow-up, a practice audit, the exam · 3 questions