ISO 13485 Documentation: Why a Complete QMS Can Still Fail an Audit

ISO 13485 Documentation: Why a Complete QMS Can Still Fail an Audit

A full set of ISO 13485 documents does not guarantee a successful audit. According to Govindasamy Jaganathan, founder of MedQMS Nexus, the most common failure is treating the standard as a paperwork exercise rather than a functioning quality management system.

In this interview, Jaganathan shares what he has seen go wrong, the challenges startups face that online guidance does not address, and how companies should weigh templates against consultant-led implementation.

When Documentation Does Not Match Reality

Asked about a client whose ISO 13485 documentation set turned out to be unusable for their actual audit, Jaganathan described a familiar pattern: documents that existed on paper but did not reflect how the company operated.

He said "I have seen cases where a company had a complete set of ISO 13485 documents, but the documents did not reflect how the company actually operated. Procedures were generic, responsibilities were unclear, and there was insufficient evidence that the processes were implemented. The main issue was treating ISO 13485 as a documentation exercise rather than as a functioning QMS."

The takeaway is direct: auditors look for evidence that processes are implemented, not just described. Generic procedures and unclear responsibilities create gaps that a complete document set cannot hide.

The Startup Gap: From Requirements to Application

Startups often understand the requirements of ISO 13485 but struggle to apply them to their specific business. Jaganathan said "Startups usually understand the standard requirements but struggle with how to apply them to their specific business. Common challenges include QMS scope, risk management, outsourced processes, design controls, supplier controls, CAPA, complaints, PMS, and maintaining practical records. The biggest gap is translating regulatory requirements into a QMS that actually works for the company."

That list covers the areas where generic guidance tends to fall short. Scope decisions, risk management, outsourced processes, design controls, supplier controls, CAPA, complaints, and post-market surveillance all depend on the company's products and processes. Practical records are part of the same problem: without them, implementation cannot be demonstrated.

Templates or Consultants? The Wrong Question

On the choice between ready-made QMS templates and building documentation with a consultant, Jaganathan said companies often decide too quickly by focusing on initial cost.

He said "Companies often focus too much on the initial cost. A template can provide a good starting point, but it still needs to be customized to the company's products, processes, risks, and regulatory requirements. A consultant can provide that customization and implementation support. The better question is not 'template or consultant?' but 'Will this QMS actually work in our organization and stand up to an audit?'"

That reframing matters. A template is a starting point, not a finished system. Customization to products, processes, risks, and regulatory requirements is where the real work happens, and that is also where implementation support becomes valuable.

Practical Takeaways

• Treat ISO 13485 as a functioning QMS, not a documentation exercise. Procedures should reflect how the company actually operates.
• Make responsibilities clear. Unclear ownership is a common weakness in documentation sets that fail audits.
• Keep evidence of implementation. Records are how processes are demonstrated to an auditor.
• Translate requirements to your business. Scope, risk management, outsourced processes, design controls, supplier controls, CAPA, complaints, and PMS all need to fit the company's specific context.
• Evaluate cost beyond the initial price. The better question is whether the QMS will work in the organization and stand up to an audit.

For companies preparing for certification, the interview points to a consistent theme: the value of documentation depends on whether it describes and supports the way the company actually works. More about the approach is available at MedQMS Nexus.