QMS software for medical devices: spreadsheets, consultants or a system that stays
Most quality systems are not lost in an audit. They decay quietly in the months after one: a shared drive nobody owns, a consultant who has moved on, a register last updated before the audit. The question is not which tool looks best. It is which one is still working a year from now.
Last checked against its sources on 23 October 2026.
Three ways companies run an ISO 13485 system
| Approach | What it does well, and what it leaves behind |
|---|---|
| Word, Excel and a shared drive | Cheap to start and familiar. It leaves you to enforce version control, approvals, training records and due dates by hand, and the system lives in whoever built it. |
| A consultant | Expert knowledge, fast documents, a guide through the first audit. When the engagement ends, the knowledge and the habit of running the system often leave with them. |
| QMS software | Approvals, versions, training, CAPA and due dates enforced by the system itself, with the evidence recorded as the work happens. It still needs people who own it, and it must be validated for its intended use. |
These are not exclusive. Plenty of companies use a consultant to set the system up and software to keep it running.
What to judge any approach on
- Does it keep the evidence, not just the procedures? Training records, supplier evaluations, complaint files and CAPA closures are what show the system is followed.
- Does it enforce document control: one current version, approved before release, with the history kept?
- Does it put the regulated calendar in front of you: internal audits, management reviews, calibration, supplier re-evaluation, licence and retention fee dates?
- Does it separate duties, so the person who wrote a document or a fix is not the one who signs it off?
- Will it still work when the person who set it up has left?
- Can you show an auditor what changed, when and by whom?
Software in your QMS has to be validated
ISO 13485:2016 clause 4.1.6 requires documented procedures for validating the computer software used in the quality management system, before first use and after changes, in proportion to the risk of using it. That applies to a spreadsheet that calculates due dates as much as to a dedicated system. Ask any supplier what validation evidence they provide, and plan your own validation for how you use it.
Choosing in the right order
The tool matters less than knowing what it has to fix. A company whose gaps are in supplier control and CAPA needs something different from one whose gaps are in document control. Find your weakest areas first; then judge each approach on whether it closes those gaps and keeps them closed.
Common questions
- Can I run an ISO 13485 quality system on spreadsheets?
- Yes, ISO 13485 does not require dedicated software. The spreadsheets are then QMS software for clause 4.1.6 purposes and need validating, and you carry the work of enforcing versions, approvals and due dates by hand.
- Does QMS software make my company compliant?
- No. Software can enforce the process and keep the evidence, but compliance depends on people following the system. Only a recognised certification body can certify you, and only SAHPRA can license you.
Find your three highest-impact gaps before your next inspection.
The free Gap Heatmap: 27 questions across nine ISO 13485 areas, about 4 minutes. You get a readiness score, the gap between what you say you have and what you could show an inspector, and your biggest gaps ranked, each mapped to its clause. Free, no card.
Start my free Gap Heatmap →Sources
- ISO 13485:2016, Medical devices: quality management systems (clause 4.1.6)
- SAHPRA, ISO 13485 certificate as a prerequisite for the approval of a medical device establishment licence (MD01-2025/2026_v2, 18 September 2025)
This guide summarises published documents; it is not legal or regulatory advice. Check the source before you rely on a date or requirement.
ISO-13485 Compliance OS is software, not a regulator, notified body or certification body, and is not affiliated with or endorsed by SAHPRA. Nothing here is legal advice; no regulatory outcome is promised or guaranteed.