The Thread an Auditor Pulls: Tracing One Finding From Internal Audit to CAPA, Document Change, and Training Under ISO 13485

What You Need to Know

> **Auditors sample, then follow the thread.** A certification body auditor, an MDSAP auditing organization, or a notified body rarely reads your QMS from front to back. They pick one record, often a finding, and follow it through every process it touched. The quality of that thread tells them more about your system than any procedure does.

> **One finding crosses at least five ISO 13485 clauses.** A typical chain runs from internal audit (8.2.4) to nonconformity control (8.3) or directly to corrective action (8.5.2), then to document control (4.2.4) and finally to competence and training (6.2). Each link has its own requirements, and each link is a place where the thread can break.

> **The thread exists to protect patients, not to satisfy auditors.** A finding that is recorded but never corrected, a CAPA that changes a procedure nobody was trained on, or an obsolete revision still in use on the shop floor are not paperwork problems. They are the conditions under which a known problem reaches a device and, eventually, a patient.

> **Missing links look the same as missing work.** In many small companies every record exists, but the connections between them live in someone's memory. If an auditor cannot get from the finding to the training record without a person explaining the gaps, the chain is treated as incomplete, regardless of how much work was actually done.

> **You can test your own chain in thirty minutes.** Pick a recently closed CAPA and try to walk it end to end using records alone. Every place you have to ask a colleague, search a folder, or rely on memory is a link to fix before your next audit.

---

Most quality teams prepare for an audit as if the auditor will read the quality manual from page one. Few auditors work that way. Audit time is limited, so they sample. They choose one record, ask a question about it, and follow the answer wherever it leads. The most common starting point is a finding: your own internal audit finding, a complaint, a failed incoming inspection, or a supplier nonconformance.

This article walks through that chain as an auditor would, link by link. For each link it explains why the requirement exists, what ISO 13485:2016 actually asks for, what auditors look for in the records, and where the chain most often breaks. It ends with a structured self-test you can run this week and a set of practical habits that keep the links intact between audits.

---

Why Auditors Follow a Single Thread

Process-based auditing is the norm for ISO 13485 certification audits, and the MDSAP audit model is explicitly structured around linked processes, including management; measurement, analysis and improvement; design and development; production and service controls; and purchasing. Notified bodies auditing a QMS under EU MDR Annex IX also work from samples of real records.

A single finding, followed through its full lifecycle, tests:

- Whether your internal audit programme produces findings that are specific enough to act on - Whether nonconformities are captured, owned and evaluated rather than left as lines in a report - Whether corrective action addresses causes rather than symptoms - Whether the resulting changes are controlled, approved and made available at the point of use - Whether the people doing the work were trained on the change and are competent to apply it - Whether anyone checked that the problem actually went away

No procedure review can answer all six questions at once. A single well-chosen thread can.

---

Link 1: The Internal Audit Finding (ISO 13485 Clause 8.2.4)

### Why It Matters

Internal audit is the organization's own early-warning system. Its purpose is to find weaknesses in the QMS before they affect product, and before an external auditor or a patient finds them first. A finding that is vague, unsupported, or never followed up means a known weakness stays in the system.

### What the Standard Requires

Clause 8.2.4 requires internal audits at planned intervals to determine whether the QMS conforms to planned arrangements, to the requirements of ISO 13485, to the organization's own QMS requirements and to applicable regulatory requirements, and whether it is effectively implemented and maintained. It requires a documented procedure for planning, conducting, recording and reporting audits; an audit programme that considers the status and importance of the processes and the results of previous audits; and auditors who do not audit their own work. Records must identify the processes and areas audited and the conclusions.

The clause then makes the link that starts the whole chain: the management responsible for the area being audited must ensure that any necessary corrections and corrective actions are taken without undue delay to eliminate detected nonconformities and their causes. Follow-up activities must include verification of the actions taken and reporting of the verification results.

### What Auditors Look For

- **A finding written against a requirement.** "Clause 7.4.1: re-evaluation criteria not defined for supplier X" is a finding. "Supplier files are a bit messy" is an opinion. The requirement reference is what makes the finding actionable and traceable. - **Objective evidence.** A document number, a record ID, a date, a sample size. Without evidence, a finding cannot be verified later, and neither can its closure. - **Programme coverage.** Did the audit programme actually cover the processes it said it would, at the intervals it planned? Gaps in coverage are a finding in their own right. - **Follow-up and verification.** Is there evidence that the area's management responded, and that someone verified the response? A finding with no follow-up record is the first broken link.

### Where the Link Breaks

The most common weakness is a finding closed in the audit report itself, with a note such as "discussed with process owner", that never enters the nonconformance or CAPA process.

---

Link 2: The Nonconformity Record (ISO 13485 Clause 8.3)

### Why It Matters

A finding becomes real work only when it has an owner, a record and a decision. The nonconformity record is where the organization formally acknowledges the problem, evaluates its impact on product and decides what to do next. If product is involved, this is also the point where nonconforming product is prevented from reaching a patient.

### What the Standard Requires

Clause 8.3 applies to nonconforming product. Clause 8.3.1 requires the organization to ensure that product which does not conform to product requirements is identified and controlled to prevent its unintended use or delivery, under a documented procedure. The evaluation of nonconformity must include a determination of the need for an investigation and notification of any external party responsible for the nonconformity. Records of the nature of the nonconformities and any subsequent actions taken, including evaluation, investigation and the rationale for decisions, must be maintained.

Clauses 8.3.2 to 8.3.4 then address actions for nonconforming product detected before delivery, after delivery (including the issue of advisory notices where applicable), and rework.

An important nuance: many internal audit findings concern a process or a system, not a product. Strictly speaking, these are not nonconforming product under 8.3. Most QMS procedures still route them into a common nonconformance or quality issue record, which then feeds corrective action under 8.5.2. That is a perfectly sound design, as long as your procedure says so and the records follow it.

### What Auditors Look For

- **A record with an owner.** The finding has become a numbered record with a responsible person and a due date, rather than remaining a line in a Word report. - **Impact evaluation.** If the finding could affect product already made or shipped, is there a documented assessment? For a supplier finding, for example, were lots received from that supplier evaluated? - **A documented decision.** Was an investigation needed? Was a correction enough, or does the issue go to CAPA? The rationale should be written down, especially when the answer is "no further action". - **Traceability back to the source.** Searching for the audit finding ID should land you on the nonconformance record, not on a spreadsheet tab that only one person knows about.

### Where the Link Breaks

The typical failure is parallel tracking: audit findings in one spreadsheet, nonconformances in another, and no cross-reference between them.

---

Link 3: The Corrective Action (ISO 13485 Clause 8.5.2)

### Why It Matters

Correction fixes the instance. Corrective action fixes the cause. Without it, the same problem returns, sometimes in a form that does reach product. This is why CAPA is consistently one of the most scrutinized areas in ISO 13485, MDSAP and EU MDR audits, and why the corrective action record is usually where the audit conversation spends the most time.

### What the Standard Requires

Clause 8.5.2 requires the organization to take action to eliminate the cause of nonconformities in order to prevent recurrence, without undue delay, with actions proportionate to the effects of the nonconformities encountered. The documented procedure must define requirements for:

1. Reviewing nonconformities, including complaints 2. Determining the causes of nonconformities 3. Evaluating the need for action to ensure that nonconformities do not recur 4. Planning and documenting the action needed and implementing it, including, as appropriate, updating documentation 5. Verifying that the corrective action does not adversely affect the ability to meet applicable regulatory requirements or the safety and performance of the medical device 6. Reviewing the effectiveness of the corrective action taken

Records of the results of any investigation and of the action taken must be maintained.

Under the EU MDR, Article 10(9) lists the management of corrective and preventive actions and verification of their effectiveness among the aspects the manufacturer's QMS must address, so the same expectations apply when a notified body samples your CAPA records.

### What Auditors Look For

- **A root cause that goes far enough.** "Human error" or "procedure not followed" usually means the investigation stopped one question too early. Auditors ask what in the system allowed the error, and whether it could happen elsewhere. - **A proportionate, documented decision.** Not every nonconformity needs a full CAPA, but a decision not to act must be documented with its reasoning. - **Action that matches the cause.** The planned action should clearly address the stated root cause, not a neighbouring symptom. - **The 8.5.2(e) check.** Evidence that someone assessed whether the action could adversely affect regulatory compliance or device safety and performance. This step is specific to ISO 13485 and is frequently missing. - **An effectiveness check defined in advance.** "Training completed" describes an activity, not a result. A credible check defines what will be measured, over what period or sample, and what result counts as success. - **Timeliness.** Long gaps between opening, implementation and effectiveness review, without a documented reason, conflict with "without undue delay".

### Where the Link Breaks

Two weak points dominate: the root cause and the effectiveness check. A quieter third is the missing forward reference: the CAPA says "SOP updated" but not which SOP or revision. Root cause and effectiveness methods are covered in depth in the CAPA guide linked below.

---

Link 4: The Changed Document (ISO 13485 Clause 4.2.4)

### Why It Matters

Most real corrective actions change a document: an SOP, a work instruction, a form, an inspection plan or a specification. The document is how the fix reaches the people doing the work. If the new revision is not approved, not available at the point of use, or competing with an obsolete copy, the corrective action exists on paper only.

### What the Standard Requires

Clause 4.2.4 requires a documented procedure for document control. The controls most relevant to a CAPA-driven change are:

1. Review and approve documents for adequacy prior to issue 2. Identify the current revision status of, and changes to, documents 3. Ensure relevant versions are available at points of use 4. Prevent the unintended use of obsolete documents and identify them suitably

Changes must be reviewed and approved by the original approving function or another designated function with access to pertinent background information. Obsolete controlled documents must be retained for at least the lifetime of the device as defined by the organization, and not less than the retention period of any resulting record or as specified by regulatory requirements.

### What Auditors Look For

- **The revision the CAPA produced.** The first question is usually simple: "Show me the document this CAPA changed." The second is: "Which revision was in force before, and when did the new one become effective?" - **Approval before issue.** Approval dates that come after the effective date, or approvals by someone without the appropriate authority, are common findings. - **Identified changes.** A revision history that explains what changed, ideally citing the CAPA number. - **Availability and obsolete control.** Auditors may walk to the workstation to check which version people actually see. A printed old revision in a drawer undermines the corrective action.

### Where the Link Breaks

The CAPA record and the document history often do not point at each other. The auditor then waits while someone searches folders, and a well-executed fix starts to look uncontrolled.

---

Link 5: The Training Record (ISO 13485 Clause 6.2)

### Why It Matters

A new revision means people must work differently. If the people in the affected roles were not trained on the change, or their competence was never confirmed, the root cause is still in place. For changes that affect product quality or safety, this is the link that determines whether the fix actually reaches the device.

### What the Standard Requires

Clause 6.2 requires that personnel performing work affecting product quality are competent on the basis of appropriate education, training, skills and experience. The organization must document its process for establishing competence, determine the competence needed, provide training or other actions, evaluate the effectiveness of those actions, ensure personnel are aware of the relevance of their activities, and maintain records of education, training, skills and experience. Clause 6.2 also states that the methodology used to check effectiveness must be proportionate to the risk associated with the work for which the training or other action is being provided.

### What Auditors Look For

- **Training on the specific revision.** Records showing that people in the affected roles were trained on the new revision, not just on the procedure in general at some earlier date. - **Complete and timely coverage.** Everyone in the affected role, including shift and temporary staff, trained before performing the work under the new revision. - **Proportionate effectiveness evaluation.** For low-risk administrative changes, a read-and-understand acknowledgement may be adequate. For changes to inspection criteria or a special process, auditors expect stronger evidence, such as observation or a practical assessment. - **Connection to the CAPA.** If the CAPA's effectiveness depends on people following the new SOP, the training record is part of the CAPA evidence and should be referenced from it.

### Where the Link Breaks

A signed sheet in a binder, with no revision number and no reference to the change, proves attendance, not training on the fix.

---

Closing the Loop

Auditors then check that the loop was closed. The effectiveness check defined in the CAPA (8.5.2(f)) should have been executed against its acceptance criterion and concluded; if it failed, a new or extended investigation is a sign of a healthy system. The internal audit procedure (8.2.4) requires verification of the actions taken and reporting of the results, so the original finding should close only after that verification. Finally, audits and corrective action are required inputs to management review (5.6.2), and the minutes should show that leadership sees the same thread.

---

Why the Chain Breaks in Small Companies

In a 15-person device company, every one of these records usually exists. The problem is where they live. The audit report is a Word file. The nonconformance is a spreadsheet row. The CAPA is an email thread. The SOP is on a shared drive. The training proof is a signed sheet in a binder. Each record on its own may be fine. The links between them are where the time goes. Nobody wrote "see NC-0142" in the SOP change request, so the connection exists only in one person's memory. When that person is on holiday during the audit, the chain looks broken even though the work was done.

Auditors also notice the pattern. When the same kind of link is missing across several sampled threads, a single observation can become a systemic finding against the corrective action, document control or training process as a whole. Under MDSAP, nonconformities are graded using a scoring approach in which repeat nonconformities are escalated, so a recurring broken link costs more each time it appears.

---

The 30-Minute Thread Test: A Self-Audit Exercise

You can test your own chain before an auditor does. The exercise takes about thirty minutes per thread and requires no preparation beyond picking a record.

### Step 1: Pick the Thread

Choose one CAPA that was closed in the last six months and originated from an internal audit finding. If possible, pick one that changed a controlled document. Do not choose your best example; choose a typical one.

### Step 2: Walk It Using Records Only

Set a timer. Then find, in order:

1. The original audit finding, with its clause reference and objective evidence 2. The nonconformance record it opened, with the impact evaluation and the decision to raise a CAPA 3. The root cause analysis, the method used and the decision on action 4. The 8.5.2(e) assessment of regulatory and safety impact 5. The document revision the CAPA produced, with approval date and effective date 6. Evidence that the obsolete revision was withdrawn from points of use 7. The training records for that revision, for every person in the affected role, dated before they performed the work 8. The effectiveness check, its acceptance criterion, the data collected and the conclusion 9. The verification and closure of the original audit finding

### Step 3: Record the Friction

For each step, note how long it took, whether the previous record pointed to it directly, and whether you had to ask someone or search a folder. Anything that took more than a few minutes, or anything that needed a person instead of a record, is a link to fix.

### Step 4: Repeat and Look for Patterns

Run the same test on two more threads, ideally from different process areas or different auditors. A gap that appears once is a one-off. A gap that appears in two or three threads is a process weakness, and it should be treated the way an auditor would treat it: as an input to your own corrective action process.

### What Good Looks Like

A strong thread can be walked by someone outside the quality team, in minutes, using only the records. Each record names the one before and after it, dates run in a logical order, and nobody needs to explain anything verbally.

---

Making the Links Part of the Record

You do not need new software to fix most broken threads. The cheapest fix is a habit: every record carries the ID of the record before and after it.

- **Finding → NC.** The audit report lists the nonconformance number raised for each finding. - **NC → CAPA.** The nonconformance record states whether a CAPA was raised, with its number, or documents why not. - **CAPA → document.** The CAPA names the document number and new revision, and the change request references the CAPA. - **Document → training.** The revision release triggers a training assignment for the affected roles, referencing the revision. - **Training → CAPA effectiveness.** The effectiveness check cites the training completion and any competence evaluation it depends on. - **CAPA → finding closure.** The audit follow-up record references the closed CAPA and its effectiveness conclusion.

Build these references into your forms so they are filled in by default, and consider adding a thread test to your internal audit programme.

If you would rather have the system keep those links for you, that is what quality software is for. In HAVGATE, an audit finding can open the nonconformance and CAPA directly, so the clause reference stays attached as the record moves forward. But the habit matters more than the tool. An auditor follows the links you left behind, whatever system they are in.

---

Final Thoughts

An auditor following one finding through your QMS is asking a simple question: when this organization discovers a problem, does it reliably fix the cause, change the way work is done, and confirm that the fix reached the people and the product? Every clause in the chain, from 8.2.4 to 6.2, exists to make the answer yes.

Teams that pass this test are the ones whose records point at each other. Run the thread test on a few of your own records before your next audit, and fix the links while it is still your own finding.

---

The Thread an Auditor Pulls: Tracing One Finding From Internal Audit to CAPA, Document Change, and Training Under ISO 13485

What You Need to Know

Why Auditors Follow a Single Thread

Link 1: The Internal Audit Finding (ISO 13485 Clause 8.2.4)

Link 2: The Nonconformity Record (ISO 13485 Clause 8.3)

Link 3: The Corrective Action (ISO 13485 Clause 8.5.2)

Link 4: The Changed Document (ISO 13485 Clause 4.2.4)

Link 5: The Training Record (ISO 13485 Clause 6.2)

Closing the Loop

Why the Chain Breaks in Small Companies

The 30-Minute Thread Test: A Self-Audit Exercise

Making the Links Part of the Record

Final Thoughts

Related reading