ISO 13485: Leadership Engagement That Stands Up to Audit

A leadership team can endorse quality without resolving the problems that threaten it. For ISO 13485 practitioners, the practical question is whether management turns quality information into decisions, resources and follow-through. This is more than a certification concern: FDA’s Quality Management System Regulation incorporates ISO 13485 into US device quality regulation, while retaining FDA-specific requirements and the precedence of US law and regulations where conflicts arise. (

Look beyond objectives to the resources behind them

The MDSAP Audit Approach directs auditors to examine measurable quality objectives and whether management provides necessary resources, including recent resource requests and their outcomes. MDSAP is a multinational audit framework, not FDA’s own inspection procedure. ( A useful leadership test is therefore to select a quality objective and examine what management made possible. Was staffing approved, equipment provided or a competing priority reconsidered? Where a request was declined, ask how the underlying quality concern was addressed. These questions are practical audit prompts, not additional requirements: they help distinguish a stated ambition from an adequately supported plan.

Trace emerging risk through management’s response

MDSAP guidance asks auditors to evaluate management’s responsiveness to new product risks, including resource decisions, qualified personnel and arrangements for updating risk-management files. It also connects post-market feedback with formal reviews and revisions. ( In practice, select a complaint or safety signal and follow its path through the organisation. Examine what reached management, what decision followed, who received responsibility and how the risk assessment or controls were reconsidered. Acknowledgement alone is a weak endpoint. The more useful leadership discussion is whether the response matched the emerging concern and whether unresolved matters received further attention.

Make management review a decision process

MDSAP calls for documented management reviews at planned, sufficiently frequent intervals, using inputs such as audit findings, customer feedback, process performance, corrective and preventive action status, and previous review actions. ( A practical approach is to organise follow-up around the issue, decision, accountable owner and evidence that the action addressed the concern. Revisit unfinished actions rather than repeatedly recording them without resolution. For US-regulated manufacturers, FDA confirms that management-review, quality-audit and supplier-audit reports are now subject to inspection; ISO 13485 certification does not exempt a manufacturer from inspection. Keep oversight records candid and retrievable, rather than treating the certificate as the evidence of effective leadership. (

What to do next

Before the next management review, trace a live quality concern from evidence to leadership decision, resource allocation and follow-up. Use any gaps to focus the discussion. The Cognicert ISO 13485 Medical Devices Quality Management Lead Auditor course trains participants to audit ISO 13485 effectively—a relevant next step for professionals developing their audit capability.

Scope and sources

• Quality Management System Regulation (QMSR) | FDA
• MDSAP Audit Model
• Quality Management System Regulation – Frequently Asked Questions | FDA

This is practical commentary informed by the public sources above and the Cognicert ISO 13485 Medical Devices Quality Management Lead Auditor course description. It is not a certification decision or legal interpretation. Drafted with AI assistance and published after automated checks; it has not been individually reviewed before publication. For corrections, contact Cognicert.