What is quality management system certification?
Quality Management System (QMS) certification is an independent assessment conducted by a certification body to confirm that the implemented quality system meets the requirements of an international standard. This process includes documentation review, organizational audit, and ongoing conformity monitoring in subsequent years.
A QMS certificate not only confirms compliance with the ISO standard but also serves as crucial regulatory evidence in MDR and IVDR certification processes.
Legal requirements for QMS certification
In the medical device and IVD sector, QMS certification is closely tied to regulatory requirements. MDR (EU) 2017/745 and IVDR (EU) 2017/746 require manufacturers to implement and maintain a quality system proportionate to the risk class of the device.
Although ISO 13485 certification is not legally mandatory, in practice, its absence makes it nearly impossible to meet MDR/IVDR requirements related to technical documentation, risk management, post-market surveillance, and corrective and preventive actions.
The QMS certification process
QMS certification consists of several key stages that should be systematically planned. The process involves not only documentation preparation but also evaluating the system’s practical implementation across the organization.
- Gap analysis of the current system against the standard (e.g., ISO 13485).
- Preparation or update of QMS documentation.
- Implementation of processes aligned with the standard and legal requirements.
- Conducting an internal audit and management review.
- Submitting the application to a certification body.
- Certification audit – Stage 1 (documentation review) and Stage 2 (on-site audit).
- Issuance of the certificate or request for corrective actions.
- Ongoing compliance monitoring and annual surveillance audits.
A gap audit is also recommended to identify weaknesses before the official certification begins.
Documentation in ISO certification
The certification process requires evaluation of complete QMS documentation, which must comply with the ISO standard and reflect actual organizational practices. Documentation must demonstrate consistency between records and real-world operations.
- Quality policy and objectives,
- Operational procedures and work instructions,
- Monitoring records, analysis, and corrective actions,
- Internal audit and management review records,
- Personnel qualification evidence.
The required documentation must comply with ISO 13485 as well as internal operational procedures, which are subject to audit in the quality system documentation.
Duration and validity of the QMS certificate
The full certification process—from gap analysis to receiving the certificate—can take between 3 to 12 months depending on the device’s risk class, organizational readiness, and process complexity.
A QMS certificate is valid for 3 years and requires annual surveillance audits. Upon expiration, a recertification audit is necessary.
The role of the quality management representative
One of the key ISO 13485 requirements is the appointment of a person responsible for overseeing the quality management system. This function, known as the management representative, ensures QMS compliance, reports outcomes to top management, and initiates improvements. This person also plays a vital role in communication with notified bodies and regulatory authorities.
Monitoring QMS effectiveness
An effective QMS requires not just implementing procedures but also continuous monitoring and evaluation. This includes analyzing audit data, management reviews, CAPA (Corrective and Preventive Actions), and assessing the effectiveness of implemented measures. These mechanisms follow the PDCA (Plan–Do–Check–Act) cycle and are required by both ISO 13485 and MDR/IVDR.
Integrating post-market activities with the QMS
The quality system should also cover post-market surveillance (PMS), PMCF studies, and handling incidents and complaints. By implementing an effective PMS integrated with QMS, the manufacturer ensures compliance with MDR and enhances product safety in the market.
Preparing for a notified body audit
A notified body audit differs from a certification audit — it focuses on compliance with MDR/IVDR, technical documentation, and PMS effectiveness. Preparation involves both procedural and team readiness: audit participants must understand their roles, responsibilities, and applicable requirements. A mock audit and documentation review are recommended before the notified body visit.
Common issues in QMS certification
During certification preparation, medical device manufacturers often encounter organizational and documentation challenges that affect the timeline and success of certification.
- Documentation gaps or inconsistencies between records and practice,
- Insufficient implementation of operational procedures,
- Missing internal audits or management reviews,
- Misinterpretation of ISO 13485 requirements in the MDR/IVDR context.
Solutions may include appropriate training, team competence development, and independent consulting support.
How does Pure Clinical support QMS certification?
Our support covers every stage of quality management system certification. By partnering with Pure Clinical, you gain access to:
- Gap analysis and action plan tailored to device class and type,
- Preparation or update of QMS documentation aligned with ISO 13485,
- Staff training on QMS, MDR, and certification body expectations,
- Conducting internal audits and preparing for external audits,
- Consulting during certification and surveillance phases,
- Support in implementing changes after audit findings.
As part of preparation, it’s also important to secure processes such as supplier evaluation and post-market surveillance.
What happens after certification?
Maintaining the certificate is an ongoing process. It requires regular internal audits, management reviews, and document updates. These activities can be streamlined using a modern eQMS system that supports document control, nonconformity tracking, and preparation for external audits.
FAQ
Can a QMS certificate be revoked before the 3-year expiry period?
Does QMS certification apply to both medical devices and IVD products?
Who can act as the Quality Management Representative in a certified QMS?
What criteria are used by certification bodies to assess QMS readiness?
Certification bodies assess documentation completeness, effectiveness of processes like PMS, CAPA, internal audits, and supplier controls. Readiness audits (gap assessments) are often used to identify weak points before formal certification begins.