You audit everything once a year. That might be the problem.

Clause 8.2.4 asks you to audit your own system at set intervals. Each audit answers two questions.

First, does your QMS conform? That means conforming to your own arrangements, to the requirements of ISO 13485, to your own QMS requirements and to applicable regulatory requirements.

Second, is it effectively implemented and maintained? A procedure that exists on paper but not on the warehouse floor fails this test.

The clause then asks for:

• a documented procedure that sets out who is responsible, and how audits are arranged, carried out, recorded and reported;
• an audit programme that takes into account the status and importance of the processes and areas being audited, and the results of previous audits;
• defined and recorded audit criteria, scope, interval and methods;
• auditors chosen so the audit is objective and impartial, and who do not audit their own work;
• records of audits and their results, including the processes and areas audited and the conclusions.

When an audit finds something, the management responsible for that area makes sure corrections and corrective actions happen without undue delay. Follow-up includes verifying the action taken and reporting the result of that verification.

The words "risk-based" do not appear in 8.2.4 itself. The idea comes from two places. The clause asks you to weigh the status and importance of each process. And clause 4.1.2 asks you to apply a risk-based approach to the control of the processes in your QMS. Put those together and a flat, identical schedule for every process is hard to defend.

Internal audit is your QMS checking itself. If it works, you find your own problems before anyone else does.

That makes the audit file a useful view of everything else. It shows which processes you looked at, what you found, and whether you fixed it. A thin audit file suggests problems that have not been found yet. A full one with no follow-up suggests problems found and left alone.

The live Heatmap finding for this area is: "Audit programme not risk-based." It is a common shape. Every process gets audited once a year, in the same order, with the same checklist. It looks thorough. But your cold chain, your complaints handling and your stockroom document control receive the same attention as the process that has never once caused trouble.

1. Do you run internal audits against a planned programme covering all QMS processes?

What "we do this" sounds like: "We do an internal audit every year before the external audit."

What you could put on the table: a written audit programme for the year. It lists every QMS process, the date each will be audited, the scope, the criteria and the named auditor. Completed audit reports that match the programme. And a record of any audit that moved, with the reason.

One audit squeezed into the month before the certification body arrives is a rehearsal. A programme is spread across the year, with each process audited on purpose.

2. Is the audit programme risk-based — more frequent or deeper on higher-risk processes?

What "we do this" sounds like: "We cover everything, so it's all covered."

What you could put on the table: a short written rationale for how often each process is audited. Higher-risk processes, or ones with recent problems, are audited more often or in more depth. The inputs that drove those choices are visible: complaint trends, CAPA history, past audit findings, changes to processes or regulations.

Coverage tells you every process was seen. Risk-based tells you the dangerous ones were seen more closely.

3. Are audit findings recorded with corrective action and verified close-out?

What "we do this" sounds like: "We raise the findings and the team sorts them out."

What you could put on the table: each finding written against a specific requirement, with evidence. A correction and, where needed, a CAPA linked to it. A named owner and a due date. And a dated follow-up record, by someone other than the owner, showing the action was verified.

"Sorted out" is a claim. Verified close-out is a record of someone checking.

• An Internal Audit SOP that sets out responsibilities and how audits are run, recorded and reported
• A written audit programme covering every QMS process, with dates and auditors
• A rationale for audit frequency, based on process importance, status and previous results
• Defined criteria, scope and method for each audit
• Evidence that no auditor audited their own work
• Auditor training or competence records
• Completed audit reports with processes covered, findings and conclusions
• Findings linked to corrections and CAPAs, with owners and due dates
• Follow-up records verifying actions taken, and the result reported
• Audit results reported into management review

These are patterns I see, not statistics.

The one-week audit. Every process audited in a single week, just before the external audit. It is better than nothing. It is not a programme.

Auditing your own work. In a small company, the Quality Manager is often the only trained auditor. They end up auditing document control, which they also run. The standard does not allow that. A cross-audit with a peer company or an outside auditor solves it.

Checklists that never change. The same checklist every year finds the same nothing. The checklist should follow the risk, including last year's findings and this year's complaints.

Findings with no close-out. The finding is raised, a CAPA is opened, and the next audit finds the same thing. Nobody verified the first fix.

Programme on paper only. The programme says quarterly. The reports show two audits in 18 months. The gap between the two is the finding.

SAHPRA is phasing in mandatory ISO 13485:2016 certification, per its MD01 notice dated 18 September 2025. Phase 2 covered renewals from 1 June 2025, for manufacturers and for distributors and importers. Phase 3, from 1 April 2026, applies to companies already holding a certificate: holders "will be requested to submit". SAHPRA describes the requirement as mandatory. Amendments follow on 1 June 2027, and all new applications on 1 April 2028.

Your establishment licence is what lets you trade. An inspection tests whether your system supports it. Your internal audit file is your own record of testing that system before anyone else does. The inspector's job is to see evidence, not intentions.

Set aside 60 minutes with your last audit programme and your CAPA log.

1. 10 minutes. List every process in your QMS. Use your quality manual or SOP index.
2. 15 minutes. For each process, note the date of its last internal audit and whether it found anything.
3. 15 minutes. Score each process high, medium or low risk. Ask two questions: how much can it affect the device or the patient, and has it caused trouble in the last year? Complaints, CAPAs and past findings are your evidence.
4. 10 minutes. Set an audit frequency to match. High risk more than once a year. Low risk at your standard interval.
5. 10 minutes. Book the next audit for your highest-risk process, with a named auditor who does not run that process.

You now have the start of a risk-based programme, and a written reason for each choice.