Audit management software for ISO 13485 and MDSAP

HAVGATE audit management turns notes into an inspection-ready report: clause or MDSAP task, evidence, finding, and a path into nonconformance and CAPA. It is built for internal audits, supplier audits and the MDSAP audit approach, not for a generic checklist app.

The problem with audit reports in Word

An ISO 13485 internal audit is not hard because the standard is secret. It is hard because the report is assembled by hand. The auditor walks the process, writes notes, then spends the next day formatting an executive summary, a clause table, a finding list and a signature page. Version 4 of the file is the one that went to the auditee. Version 7 is the one that includes the missing objective evidence. Nothing in the file points at the CAPA that was opened three weeks later, so the management review input is a fresh copy-paste.

HAVGATE keeps the audit as a record from the plan onward. You schedule the audit, assign the criteria (ISO 13485, ISO 9001, MDSAP, EU MDR, or a combination on Pro and above), capture compliance status and comments against the clause or task, classify nonconformities, and generate the report from those entries. The lead auditor reviews the draft. Wording assistance, where it is used, stays a draft until a person approves it. The report can then be sent for electronic approval. The same finding can open a nonconformance so the closure is not a sentence in an appendix.

What the audit module does

• Audit plans and a program schedule, so clause 8.2.4 coverage is visible across the year.
• Clause-based auditing for ISO 13485:2016 and ISO 9001:2015.
• MDSAP AU P0002.010 tasks across all seven chapters, with linked regulatory references.
• Multi-standard sessions on Pro, Business and Enterprise, so one walk-through can record 13485, MDSAP and EU MDR together.
• Smart report generation that structures findings and leaves the lead auditor in control of the final text.
• PDF export, digital approval requests, and a history of the record.
• Basic nonconformance logging on Starter, and CAPA workflow from Pro upward.

Starter is for a solo auditor or consultant: one standard per audit, up to 10 audits a month, PDF export and a single user, at 19 a month. Pro at 39 a month adds every published standard, multi-standard sessions, unlimited audits, plans, scheduling, CAPA and the dashboard. Business at 89 a month adds up to 10 people, multi-site programs and custom branding on reports. Enterprise is custom and adds the wider eQMS modules. A 14-day trial of the audit platform does not need a card. The published trial allows up to 3 audit reports. Those figures are the ones already printed on the audit plans.

Regulation clause mapping for audits

ISO 13485:2016 clause 8.2.4 requires the organization to conduct internal audits at planned intervals to determine whether the QMS conforms to planned arrangements, to the standard and to the organization's own requirements, and whether it is effectively implemented. Auditors must be independent of the work they audit. Records of the audits and of the results must be maintained. Clause 8.2.2 and 8.2.3 cover feedback and complaint-related monitoring that an internal audit often samples. Clause 5.6 requires management review to consider audit results. If the audit program cannot show the schedule, the criteria, the auditor's independence and the finding's closure, the clause is not demonstrated, even if a report file exists somewhere.

MDSAP does not audit ISO 13485 as a naked clause list. The audit approach in AU P0002.010 follows processes: management; device marketing authorization and facility registration; measurement, analysis and improvement; adverse events and advisory notices; design and development; production and service controls; and purchasing. Internal audit evidence is sampled inside that approach, especially in Chapter 3. A tool that only stores a 13485 checklist will force the MDSAP auditor to rebuild the sequence. HAVGATE pre-loads the MDSAP tasks so the plan matches the sequence an auditing organization uses. See the MDSAP checklist page for the seven chapters.

EU MDR Article 10 requires manufacturers to establish, document, implement and maintain a QMS, and Article 10(9) points at the quality system that supports technical documentation, risk, clinical evaluation and post-market duties. An internal audit of those processes is how you know the QMS is operating before a notified body samples it. FDA's Quality Management System Regulation aligns the US quality-system rule with ISO 13485. Teams that previously kept a separate Part 820 checklist can audit the 13485 clauses and keep the QMSR reference on the same record, instead of maintaining two reports that drift apart.

How a report is produced

During the audit you record status, comments and nonconformities against the criteria. The report step organizes that material into a professional report: summary, findings by severity, and the clause or task reference. You edit before anyone is asked to sign. Approvers receive a link, review the report and sign. The point of the flow is time and traceability together. A fast report that cannot show who changed a finding is not an improvement. A perfect audit trail that still takes two days to format is what teams are trying to leave.

Supplier audits use the same engine. Purchasing controls under ISO 13485 7.4 and MDSAP purchasing tasks need evidence that you evaluated the supplier and that you acted on what you found. An audit of a contract manufacturer or a critical component supplier should end in the supplier record, not in a PDF that nobody attaches. Open the supplier module from the finding when the action belongs there, and open CAPA when the cause sits in your own QMS.

Who the audit module is for

The published positioning is MedTech startups, small manufacturers and growing teams, plus the consultants who audit them. Starter is labeled for solo auditors and consultants. Business is labeled for mid-size and growing organizations. Enterprise is the full eQMS when documents, training and suppliers need to live with the audit, not beside it. HAVGATE does not publish a design-control authoring module or a clinical EDC product. If your main gap is design history or a clinical study database, say so in the evaluation and compare that requirement with vendors who publish those modules. If your main gap is the audit report, the MDSAP checklist and the link from finding to CAPA, this is the module to trial.

Screenshots of the program dashboard and audit records are on this page so you can see the layout before you create an account. The sample report is a fictional AR-000101 written to show structure, not a customer deliverable. There is no logo bar and no quote, because there are no customers to cite.