ISO & GRC Training for medical device manufacturers.

Why device makers train with Sterling Academy

A medical device manufacturer works under some of the closest regulatory scrutiny of any industry. Before a device reaches patients, a regulator or a notified body has to be satisfied that it was designed under control, that its risks were analysed and reduced, that it is made the same way every time, and that problems in the field are found and corrected. Every one of those conditions depends on people who know what they are doing, and every audit checks it.

The rules have also changed. In the United States, the FDA's Quality Management System Regulation (QMSR), which replaced the old Quality System Regulation in February 2026, incorporates ISO 13485:2016 by reference, so US and international quality system requirements now share one foundation. In the European Union, the Medical Device Regulation (EU MDR) sets demanding rules for clinical evidence, post-market surveillance and technical documentation, and notified bodies audit against them. The Medical Device Single Audit Program (MDSAP) lets one audit satisfy the regulators of Australia, Brazil, Canada, Japan and the United States. ISO 14971 sets the method for risk management across the life of a device, and IEC 62304 sets the life cycle for medical device software.

All of these require competent people and evidence of their competence. ISO 13485 asks you to determine the competence needed for each role, provide training, check that the training was effective and keep records. Auditors and investigators sample those records, and when a nonconformity or a field problem is traced back, the question of training comes up quickly.

Device companies range from start-ups with a single product to large manufacturers with many sites. In both, engineers, quality staff and production teams are busy, and long classroom days are hard to schedule. Online training, taken on any device in short sessions, fits the work.

Sterling Academy brings Sterling's classroom training online, with the same content, available 24/7. Each course ends with a final exam, and each person who completes it receives a verifiable certificate with a QR code that an auditor, an investigator or a notified body can check. Sterling's classroom training certificates have been accepted by certification bodies at client audits, and the Academy carries the same content.

What each role in a device company needs to know

Every employee. Production, warehouse and office staff need the foundation: what the quality management system is and why it matters to patients, how their work affects device safety, the basics of the EU MDR if you sell in Europe, and how to complete records correctly the first time. The pack gives them ISO 13485 Awareness, EU MDR Awareness (Regulation (EU) 2017/745) and Good Documentation Practice (GDocP) Training.

Quality and regulatory. QA, RA and quality system owners build and run the system and face the auditors. They need ISO 13485 in depth, the QMSR, the MDSAP audit model, design controls and risk management. The pack gives them ISO 13485:2016 Implementation Training, US FDA QMSR (21 CFR Part 820) Training, MDSAP: Medical Device Single Audit Program Training, Design Controls for Medical Devices and ISO 14971 Medical Device Risk Management.

Engineering and R&D. Design, software and risk engineers decide most of a device's safety before it is ever made. They need design controls, software life cycle, risk management and failure analysis. The pack gives them Design Controls for Medical Devices, Software as a Medical Device and IEC 62304 Training, ISO 14971 Medical Device Risk Management and FMEA: Failure Mode and Effects Analysis.

Internal auditors. ISO 13485 and the QMSR require internal audits, and suppliers of critical components must be controlled and often audited. The pack gives your auditors ISO 13485:2016 Internal Auditor Training, Supplier Evaluation & Second-Party Audits and ISO 19011, the international guidance on auditing management systems.

How the courses work

• Online and on demand. Learners study on a computer, tablet or phone, 24/7, at their own pace. Each course page shows the total learning time, including module quizzes, exercises and the final exam.
• Built from real classroom training. The content is the same as Sterling's classroom training, built by industry experts, domain specialist trainers and globally renowned auditors with 30+ years in ISO and GRC. Each course page has a sample video.
• Practical examples. The examples come from working organisations, including device manufacturers, so engineers and quality staff recognise the situations they meet.
• A real final exam. Each course ends with an assessed final exam. Awareness courses need 70% for the certificate; practitioner courses, which lead to a Certificate of Competence, need 60%. The retake rule is explained on each course page.
• A certificate anyone can verify. Each person who completes a course receives a certificate with a QR code. Learners can share a badge on LinkedIn.
• 12 months' access. Each course, and each pass, gives 12 months' access.

Courses or a pass: the cheapest way to buy

Each role card shows the courses that role needs, the price one by one, and a pass when it is close to or cheaper than the courses. We mark the cheaper option as best value and never show a saving that is not real.

For quality and regulatory staff, who need several practitioner courses, the All-Access Pass opens every course in the catalogue, including the GMP, validation and data integrity courses many device makers also need. For the other roles, the card shows at today's prices whether the listed courses or a pass is cheaper, and marks that option as best value.

If one person needs most of the pack, for example a head of quality and regulatory affairs, the All-Access Pass opens all 12 courses on this page, and every other course, for US$499 per person for 12 months.

A pass also removes a decision people tend to put off. Once a learner holds a pass, adding a course for a new customer, a new regulation or a new job costs nothing more for the rest of the 12 months, and that is often when the second and third courses get taken.

When you train 11 people or more, every price drops by 20% per person, and by 30% from 51. You can mix plans in one order.

Evidence for auditors, investigators and notified bodies

The first kind of evidence is the certificate for each person: named, dated, tied to a specific course and final exam, and verifiable by QR code.

The second is the company console. Your administrator invites people, assigns each person only the courses their role needs, and sees who has started, who is in progress, who has stalled and who has finished, by course and by person.

The third is the report. You can download training records and file them with your training procedure, or show them during an audit or inspection.

A final exam also helps with a requirement many companies struggle with: showing that training was effective. A result for each person, against a defined pass mark, is objective evidence that the learner understood the course, which you can combine with on-the-job checks.

A training plan for a device manufacturer

Map roles to competence. Your training procedure should say what each role needs. The four role cards on this page are a starting point; adjust them to your products and processes.

Train everyone on the basics. Assign the every-employee courses to all staff, so the quality system and good documentation are understood across the company.

Train quality and regulatory before the transition work. If you are still aligning your quality system to the QMSR, or preparing for MDSAP or EU MDR audits, the quality and regulatory team takes its courses first.

Train engineers before the next design project. Design controls, risk management and software life cycle training pays off most at the start of a project, when decisions are still cheap to change.

Prepare internal auditors. Auditors complete their courses before the next audit cycle, and supplier auditors before the next supplier audit.

Renew every year. Use the console to see whose training is due.

Training gaps auditors often find in device companies

No evidence of effectiveness. Records show that people attended, but not that they understood. A final exam result, with on-the-job checks, closes the gap.

Design teams untrained on design controls. Engineers who joined from other industries may never have worked under design controls. The design history file shows it.

Risk management done once and forgotten. ISO 14971 expects risk management through the whole life of the device, including production and post-market information. Teams trained on the standard keep the risk file alive.

Software outside the system. Software teams sometimes work outside the quality system. IEC 62304 training brings them inside it.

Weak supplier control. Critical suppliers are a frequent source of findings. Trained supplier auditors evaluate and audit them properly.

Documentation errors. Late entries, missing signatures and unexplained corrections are among the most common observations. Good documentation practice training for everyone prevents them.

After launch: complaints, CAPA and the feedback loop

A device's quality system does not stop at release. Complaints, service reports, returned products and post-market data all feed back into risk management, corrective action and sometimes design change. Auditors and investigators spend much of their time here, because this is where a weak system lets a problem reach patients more than once.

Three skills decide how well this loop works. The first is root cause analysis: complaint and CAPA records that end with "operator error, retrained" rarely satisfy an auditor, because they seldom find the real cause. The catalogue's Root Cause Analysis & CAPA course teaches structured methods that hold up. The second is risk management: each complaint and trend should be checked against the risk file, so new hazards or higher frequencies are caught. The ISO 14971 course covers how post-production information updates the risk file. The third is documentation: complaint files, investigations and CAPA records must be complete, contemporaneous and clear. The good documentation practice course gives everyone the same discipline.

For EU MDR, the loop is formalised as post-market surveillance, with plans and reports in the technical documentation and vigilance reporting for serious incidents. The EU MDR awareness course explains these duties so the people who handle complaints know when a report may be needed and who to tell.

Many companies add Root Cause Analysis & CAPA to the quality and regulatory card for the people who own complaints and CAPA. With six practitioner courses on the card, the card will show the All-Access Pass as the better buy.

ISO 13485, QMSR, MDSAP and EU MDR: how they fit together

ISO 13485 is the international quality management system standard for medical devices, and the basis for certification by a certification body.

The QMSR is the FDA's quality system rule for devices sold in the United States. Because it incorporates ISO 13485 by reference, with some FDA-specific additions, a company that works to ISO 13485 is close to the QMSR, but must still meet the FDA's added requirements and expect FDA inspection.

MDSAP is an audit programme: one audit, by a recognised auditing organisation, that covers the requirements of five regulators. It is built on ISO 13485 with each country's added requirements.

EU MDR is the law for devices placed on the EU market. Its quality system requirements fit with ISO 13485, but it adds detailed rules for clinical evaluation, technical documentation, post-market surveillance and vigilance, audited by notified bodies.

The common core is ISO 13485, which is why the quality and regulatory card starts with it. Design controls and ISO 14971 risk management run through all four.

Services beyond training

Sterling's expert and experienced consultants help medical device manufacturers achieve ISO 13485 certification and meet the US FDA QMSR and EU MDR, simply and faster: gap assessments, documentation, internal audits and support through the audit. Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.

Ask for a team proposal below. A Sterling consultant replies within one working day.

Talk to a Sterling consultant