Question 1

Is a three-day internal audit enough for our ISO 13485 scope?

Accepted Answer

Often, yes, for a focused operation such as kitting, distribution or a single production line. Audit length should follow the number of processes and their risk, not headcount alone. We confirm the number of days after reviewing your quality manual, process map and your last certification body report, and we tell you if three days is too few before you commit. For one healthcare logistics client with a focused kitting process, three days covered the full scope because the documents were reviewed remotely first.

Question 2

Can you review our documents before coming on site?

Accepted Answer

Yes, and we recommend it. A remote review of your QMS documents produces a gap summary before the audit starts. On-site days are then spent on evidence and interviews, not reading procedures. Your team spends less time away from the floor, and the audit starts with the highest-risk gaps already identified.

Question 3

Can you be with us during the certification audit?

Accepted Answer

Yes, as an option. Because we have already audited your system, we can support your team during the certification body’s visit. We help locate evidence, clarify the intent of a requirement, and take notes on findings so your responses are accurate. The certification body’s auditor makes the decisions. Our role is preparation and support, not speaking for you.

Question 4

Can we combine ISO 27001 and ISO 13485 audits?

Accepted Answer

Yes. Both standards share a management system structure, so the shared parts can be audited once. Document control, internal audit, management review, corrective action and risk management are audited together, then each standard’s specific requirements are audited on their own. This reduces consulting time and can reduce certification body audit days when your registrar also runs an integrated audit.

Question 5

Why outsource internal audits instead of training our own people?

Accepted Answer

It depends on how often you audit and how independent your auditors can be. Many clients do both: outsource now, train over time. A small team rarely has someone who can audit their own department objectively, and a part-time internal auditor’s findings often stay at the symptom level. Outsourcing gives you senior, independent auditors now. Training builds the skill in house for the long term.

Question 6

Can the auditor also fix what they find?

Accepted Answer

Not on the same process in the same cycle. ISO 19011 expects auditors to be objective and not audit their own work. We report root causes and recommend direction. Your team, or a separate engagement, implements the fix, and we verify it worked in the next audit cycle. That separation is what keeps your audit results credible to your certification body.

Question 7

What happens after the audit report?

Accepted Answer

A report alone changes nothing. Each finding gets a root cause, an owner and a due date, and we verify the fix worked. Leaders see a prioritized list in the closing meeting, so decisions are made that day. Before the next audit or certification visit, we check that each corrective action was implemented and is working.

Question 8

How much does an ISO internal audit cost?

Accepted Answer

It depends on six factors: people in scope, sites, number of standards, process risk, system maturity and how much follow-through you need. We quote a fixed fee for a defined scope after a short scoping call, so you know the total before work starts. The pricing page explains each factor and how to lower it.

Your ISO audit questions, answered