ISO-13485 Compliance OS · Free guide · iso13485-compliance.co.za/guides/iso-13485-nine-areas
The nine ISO 13485 areas on one page
The free Gap Heatmap scores nine areas of ISO 13485:2016. Here is each one in a few lines: the clause behind it, the problem it catches, and one test you can run this week with records you already have.
Last checked against its sources on 24 October 2026.
Which area is your biggest gap? The free Gap Heatmap: 27 questions, about 4 minutes, nine ISO 13485 areas.
Take the free Heatmap →How to use this page
Pick one area a week. Each test takes under an hour. You do not fix anything during the test. You find out where you stand, and you leave with evidence instead of a claim.
1. Document control (§4.2.4)
The problem: Uncontrolled documents in circulation. The SOPs usually exist; nobody can prove which copy is live.
Test it this week: Walk to one point of use, such as the receiving desk. Compare the printed copies with your master document list and mark every mismatch.
2. Management review (§5.6.2)
The problem: Review inputs with no trend data. A list of what happened is not a trend.
Test it this week: Count complaints by month for the last 12 months. Put the last 6 months next to the 6 before. That is your first trend.
3. Risk management (§7.1)
The problem: A risk file not updated post-market. It was finished the day it was written, and complaints never fed back into it.
Test it this week: Take your highest-volume product family. Match each complaint and return from the last 12 months to a hazard in its risk file, and mark any with no hazard as new.
4. Supplier control (§7.4.1)
The problem: Supplier re-evaluation records incomplete. You checked your suppliers once, and cannot show they still pass.
Test it this week: List every supplier you paid in the last 90 days, couriers and calibration included. Mark anyone who is not on your approved-supplier list.
5. CAPA (§8.5.2)
The problem: No documented CAPA effectiveness checks. The CAPA is closed, but nothing shows the problem went away.
Test it this week: List every CAPA closed in the last 12 months. Mark which records hold a written effectiveness check, with a date and a name.
6. Internal audit (§8.2.4)
The problem: An audit programme that is not risk-based. Every process is audited once a year, whatever its risk.
Test it this week: Score each process high, medium or low risk, using last year's complaints, CAPAs and findings. Book the next audit for the highest-risk one, with an auditor who does not run it.
7. Design and development (§7.3)
The problem: Nobody has written down how clause 7.3 applies to what you actually do, so the design question has no answer on paper.
Test it this week: List anything you change yourself, such as labels, kits, packaging, instructions or software settings. Mark each one "no design impact" or "needs a closer look".
8. Product realisation (§7.5)
The problem: You cannot say quickly which customers received a given lot.
Test it this week: Pick one lot you received in the last 6 months. Using only your records, list every customer who got it, with quantities and dates. Time yourself.
9. Records and evidence (§4.2.5)
The problem: The work was done, but the record cannot be found.
Test it this week: Find 5 records: a supplier evaluation from 2 years ago, a training record for your newest staff member, last year's management review minutes, a closed CAPA and a delivery note for one lot. Time each search.
Find your three highest-impact gaps before your next inspection.
The free Gap Heatmap: 27 questions across nine ISO 13485 areas, about 4 minutes. You get a readiness score, the gap between what you say you have and what you could show an inspector, and your biggest gaps ranked, each mapped to its clause. Free, no card.
Start my free Gap Heatmap →Sources
- ISO 13485:2016, Medical devices: quality management systems
- SAHPRA, ISO 13485 certificate as a prerequisite for the approval of a medical device establishment licence (MD01-2025/2026_v2, 18 September 2025)
This guide summarises published documents; it is not legal or regulatory advice. Check the source before you rely on a date or requirement.
ISO-13485 Compliance OS is a software product. It does not warrant SAHPRA outcomes.
ISO-13485 Compliance OS is software, not a regulator, notified body or certification body, and is not affiliated with or endorsed by SAHPRA. Nothing here is legal advice; no regulatory outcome is promised or guaranteed.