EU MDR Audit Tool

Area Audited Audit Date

Lead Auditor Location

ISO MDR
Audit Task Notes
Section Requirement
ISO 13485: 2016 Chapter 1-4
1 Article 10, 11, Role of organisation is identified within the life cycle of the medical device: manufacturer, N/A __ Conforms __ Repeat __
13, 14, 16, 31; authorized representative, importer, distributor, supplier, other. Statement is made in a
Annex VI QMS document for the role or function of the organisation in relation to what company
activities are performed.

1 Article 10, 11, Scope of organisation is stated in QMS system as to activities performed by the company N/A __ Conforms __ Repeat __
13, 14; Annex in the life cycle related to MDR requirements, e.g. design, development, manufacturing,
IX servicing, distribution, complaint handling, depending on size of the organisation,
classification of device, and risk of device.
1 Article 5, 10, Outsourced processes are defined, identified, and level of control established concerning N/A __ Conforms __ Repeat __
25; Annex IX those processes applicable to MDR within scope of product families. Clear identification
should be made for what activities are done external to the organisation.
4.1 Article 1, 4, 5, Role of organisation is defined including identification that Medical Device Regulation N/A __ Conforms __ Repeat __
8, 10; Annex 2017/745 EU is regulatory requirement to be met. QMS documentation shall support that
IX, X, XI MDR and applicable Articles or Annexes are within scope of the QMS.
N/A Article 1, 5, 10, Define how the organisation has implemented a regulatory strategy for compliance with N/A __ Conforms __ Repeat __
11, 13, 14, 25, Medical Device Regulation 2017/745 EU. Verify that quality planning is implemented for
52, 61, 83, 98; implementation of regulatory requirements, review of changes, and any modifications
Annex I, II, III, made to the device are updated.
V
4.1.1 Article 1, 4, 5, Define how the QMS is reported against regulatory requirements from MDR to show N/A __ Conforms __ Repeat __
8, 10; Annex system is being maintained and effective. Organisation shall have processes defined for
IX, X, XI how effectiveness of QMS to each regulatory requirement is met.
4.1.1 Article 5, 10; Appropriate regulatory requirements are identified in each process within the QMS as N/A __ Conforms __ Repeat __
Annex IX, X, XI applicable to role and activity of the organisation. Each process shall identify regulatory
requirements, monitoring, measuring, and how these are results are maintained.
N/A Article 1, 5, 10, Manufacturer as the legal entity is registered in the EUDAMED system for the organization N/A __ Conforms __ Repeat __
16, 30, 31, 33 with all pertinent and accurate information. Confirm that the EUDAMED electronic system
contents match the organisation's administrative information.
4.1.3 Article 10; Records are maintained for each of the regulatory requirement demonstrating processes N/A __ Conforms __ Repeat __
Annex II, III are established, implemented, and maintained. Evidence for each of the processes are
defined for how this is supported.
4.1.4 Article 10; Changes to the QMS system are evaluated for impact against requirements of the MDR. N/A __ Conforms __ Repeat __
Annex II, III, Change to processes are documented for how risk-based approach is applied to each of
IX, X, XI the areas.

© Oriel STAT A MATRIX. All rights reserved. Page 1 of 6

LEF-R0
 EU MDR Audit Tool
ISO MDR
Audit Task Notes
Section Requirement
4.1.5 Article 5, 10, Specific MDR requirements for an outsourced process is clearly defined depending on the N/A __ Conforms __ Repeat __
25; Annex IX type of outsource entity and risk to the organisation. Matrix, roles, or definitions of
regulatory requirements against MDR for each outsource process is documented.
4.2 Article 1, 10, Current version of the Medical Device Regulation 2017/745 is maintained by the N/A __ Conforms __ Repeat __
ALL organisation as a document of external origin. All applicable harmonized standards
applicable or stated by organisation are maintined within the documentation of QMS.
4.2 Article 1, 5, 29, Lifetime of medical device or medical device family defined in the QMS or technical N/A __ Conforms __ Repeat __
51, 52, 83 documentation. Lifetime of device is linked to the MDR record retention period with
minimum regulatory requirements based on type of device with minimum of 10 years/15
years implantable.
4.2.1 Article 8, 9 A list of identified MDR harmonised standards and published Common Specifications N/A __ Conforms __ Repeat __
(applicable to company products) are provided or maintained showing which company
complies. These documents of external origin have a methodology defined for how they
are reviewed and updated.
4.2.3 Annex II, III Medical Device File links or references how these documentation are maintained for the N/A __ Conforms __ Repeat __
Technical Documentation requirements. Confirm how the MDF links to MDR specific
Technical Documentation to support these are related, how reviewed, internal of review,
and how updates are made.
4.2.4 Article 8, 9, 10, Verify that any changes to product, processes, or QMS system are evaluated for impact N/A __ Conforms __ Repeat __
15, 16, 19, 20, from harmonised standards, Common Specifications, design changes, and other
25, 52, 56, 83; regulatory requirements. QMS must be maintained and effective for compliance to MDR
Annex I, II, V requirements and any changes or new requirements for the regulation.
N/A Article 5, 51, Technical documentation compliant to MDR requirements must be established for each N/A __ Conforms __ Repeat __
52; Annex I, II, product family including procedure defining how generated, updated, and maintained.
III Technical documentation shall be appropriate for risk classification of device including
preclinical evaluation. Technical documentation can be any structure, but must be easily
retrievable from an index or table of contents for how requirements are met.
N/A Article 19, 20, EC Certificate of Conformity issued by Notified Body, as applicable, is valid according to N/A __ Conforms __ Repeat __
24, 29, 33, 56, the expiration date; expiration date is 5 years.
57; Annex XII
N/A Article 5, 6, 10, Medical devices that are CE Marked, placed on the EU market according to the MDR are N/A __ Conforms __ Repeat __
16, 20, 29, 32, registered in the EUDAMED system. Confirm that all finished devices that are distributed
33; Annex V, in the EU are listed in the EUDAMED electronic system and these match the
VI administrative information for the device and/or device family.
4.2.5 Annex II Product realization, QMS, and technical documentation are maintained for life of device or N/A __ Conforms __ Repeat __
MDR defined minimum of 10 years/15 years for implantables. Definition for record
retention period is defined and made in procedure or record for what records are
maintained and for how long.
ISO 13485:2016 Chapter 5
Regulatory requirements are supported by management commitment shown by roles and N/A __ Conforms __ Repeat __
Article 1, 5, 7, responsibilities of the executive management. This should have documentation by job
5.1 10 description or roles that include MDR within scope of job responsibilities.

© Oriel STAT A MATRIX. All rights reserved. Page 2 of 6

LEF-R0
 EU MDR Audit Tool
ISO MDR
Audit Task Notes
Section Requirement
Quality objectives have relation or links to MDR requirements how these are shown N/A __ Conforms __ Repeat __
Article 10, 52, throughout the company. Objectives linked to MDR requirements are measurable and
5.4.1 56 consistent with quality planning for the company; appropriate to risk class for device.
Organization has defined a Person Responsible for Regulatory Compliance with roles and N/A __ Conforms __ Repeat __
responsibilities documented in the QMS. This individual is responsible for showing
5.5.1 Article 10, 15 effectiveness and maintaining QMS according to the MDR.
Role of the Management Representative is linked to the MDR Person Responsible for N/A __ Conforms __ Repeat __
Regulatory Compliance to show how regulatory requirements are shown to the
5.5.2 Article 10, 15 organisation.
Changes to MDR requirements, new/updated harmonized standards, new/updated N/A __ Conforms __ Repeat __
Article 1, 4, 5, Common Specifications are summarized for changes and impacts to the QMS. New
8, 9, 10, 33, regulatory requirements evaluated for impact to QMS based on changes to MDR and risk
5.6.3 123 class of device.
ISO 13485:2016 Chapter 6
Sufficient resources are defined for how MDR requirements are maintained including N/A __ Conforms __ Repeat __
Article 10, 15, Person Responsible for Regulatory Compliance. Resources defined for how requirements
6.1 25; Annex I are met including infrastructure, distribution, and life cycle of device.
Personnel are trained and competent on MDR regulation overall concepts and N/A __ Conforms __ Repeat __
Article 1, 10, requirements. Specific aspects of MDR regulation are applied as appropriate to each job
6.2 ALL function and/or defined in a job description.
ISO 13485:2016 Chapter 7
Risk management implemented against EN ISO 14971 standard including requirements of N/A __ Conforms __ Repeat __
Article 5, 10; MDR for appropriate class of device. Confirm both process and product risk management
7.1 Annex I, II, III implemented for company across activities.
Confirm product realization activities appropriate for class of device as defined by MDR N/A __ Conforms __ Repeat __
Article 1, 5, 10, and conformity assessment route. Conformity assessment route selected is applicable for
7.1 51, 52; Annex I class of device including risk management activities.
Article 1, 4, 5, Classification of device is documented including the Rule determination. Rule N/A __ Conforms __ Repeat __
10, 51, 52; determination shall document rationale or justification for selection of Rule based on
7.1 Annex I, II intended use, duration of use, and contact with end user.
If organisation is located outside of the EU, then an Authorized Representative must be N/A __ Conforms __ Repeat __
Article 5, 10, used that is located physically in the EU. Confirm that an Agreement exists, current, and
11, 12, 15, 30, valid between the legal manufacturer and the Authorized Representative. Agreement is
N/A 31, signed between responsible person at the manufacturer and responsible person at AR.
Article 10, 13, General Safety and Performance Requirements have been established for each device or N/A __ Conforms __ Repeat __
14, 16, 19, 52, device family. Verify how the GSPR has been met through compliance with harmonised
53; Annex I, II, standards, Common Specifications, risk management, clinical benefit, and preclinical
N/A III testing performed by the company.
Declaration of Conformity has been established for each device or each family of devices N/A __ Conforms __ Repeat __
Article 5, 19, according to MDR classification. Declaration of Conformity has minimum requirements
24, 29; Annex from Annex along with UDI number, devices, and contact information; DofC should be
7.2 IV revision controlled.

© Oriel STAT A MATRIX. All rights reserved. Page 3 of 6

LEF-R0
 EU MDR Audit Tool
ISO MDR
Audit Task Notes
Section Requirement
Article 5, 19, N/A __ Conforms __ Repeat __
20, 51, 52; Device placed on the market in the EU has been declared for conformity against the MDR
Annex I, II, III, regulation. Information supports that the device can be sold in the EU throughout the
7.2.1 IV entire QMS, scope of QMS, and risk classification of device.
Article 4, 5, 8, N/A __ Conforms __ Repeat __
9, 19, 20, 29, Products meet MDR requirements based on risk classification of device, intended use, and
51, 52; Annex declaration of conformity. Specific MDR requirements are defined in the MDF and
7.2.2 IV, V, VI Technical Documentation supporting how these confirm CE Marking of device.
Article 5, 6, 7, N/A __ Conforms __ Repeat __
11, 13, 14, 16, Procedures exist for how complaint handling for MDR, vigilanc reporting for MDR, and field
83, 87, 89, 92; safety actions for MDR are identified and documented. Processes shall be implemented
7.2.3 Annex III for post-market activities with MDR specified for how actions are taken and reported.
Clinical evaluation for finished CE Marked device shall be documented for supported N/A __ Conforms __ Repeat __
safety and performance of device. A procedure shall be documented and implemented for
how clinical evaluation is generated, reviewed, updated, and maintained through life cycle
Article 5, 10, of device. MDR requirements for clinical evaluation, clinical investigation, and clinical
19, 61; Annex evidence must be established based on risk classification of device; CER should be
N/A XIV revision controlled.
If clinical evaluation and clinical investigation require continued post market activities, then N/A __ Conforms __ Repeat __
Article 5, 10, a Post Market Clinical Follow-up shall be documented according to MDR requirements. If
19, 61, 83, 93; no PMCF is performed, document must be made for rationale and justification for not
N/A Annex XIV performing a PMCF.
Article 4, 5, 8, N/A __ Conforms __ Repeat __
9, 19, 20, 29, Design and development of finished medical devices includes Medical Device Regulatory
51, 52; Annex 2017/745 EU as part of regulatory requirements. The design planning, inputs, review, and
7.3 IV, V, VI release of products for CE Marking must include applicable MDR requirements.
Article 4, 8, 9, Verify that design inputs include reference and information related to how MDR N/A __ Conforms __ Repeat __
27, 51, 91; requirements are met for device. Regulatory requirements includes section in design
7.3.3 Annex I, II inputs for how MDR CE Marking is met.
Verify that design ouputs include reference and information related to how MDR N/A __ Conforms __ Repeat __
Article 4, 8, 9, requirements have been met for device. Output of design activities support through
27, 51, 91; documentation, design reviews, verification, and validation that requirements are met and
7.3.4 Annex I, II, III updated.
Design changes are established, monitoried, and documented to show how MDR N/A __ Conforms __ Repeat __
Article 4, 8, 9, requirements are met and maintained. These include when new/updated harmonized
10, 29, 53, 56, standards or new/updated Common Specifications are published; including an impact
7.3.9 83, 93 assessment on current device design.
Article 19, 20, Design and development files are linked or referenced to MDR requirements of declaration N/A __ Conforms __ Repeat __
29, 51, 52; to the regulation. Technical documentation shall be referenced or identified for how these
Annex I, II, III, are related to design and development files. Two distinct files or indexes may exist that
7.3.10 IV, V need to be referenced to each other.

© Oriel STAT A MATRIX. All rights reserved. Page 4 of 6

LEF-R0
 EU MDR Audit Tool
ISO MDR
Audit Task Notes
Section Requirement
Article 5, 10, Outsourced processes where purchases are made have been defined, identified, and risk- N/A __ Conforms __ Repeat __
25; Annex IX, based approach established concerning those processes applicable to MDR within scope
7.4.1 X, XI of product families.
Article 5, 8, 9, N/A __ Conforms __ Repeat __
10, 15, 19, 20, Manufacturing of CE Marked products for placement on the EU market need to have
29, 52; Annex applicable items included in manufacturing processes. Traceability, identification, status,
7.5 I, IX, X, XI packaging, labeling, etc. must include specific requirements for CE Marking.
Article 5, 21, Procedure and method established for custom made devices that are distributed in the EU N/A __ Conforms __ Repeat __
29, 31, 83; and how these meet MDR requirements. Organisation should establish process for how
N/A Annex XIII custom made devices are identified, controlled, labeled, and distributed in the EU.
Unique device indentification has been implemented specific for MDR CE Marking for N/A __ Conforms __ Repeat __
Article 10, 13, products in the EU. UDI has been placed on the product packaging, labeling, and direct
7.5.8 14, 26, 27, 28 on product based on classification of device and re-use status of device.
Article 10, 13, Confirm for implantable devices that there is an implant card described by the MDR N/A __ Conforms __ Repeat __
14, 18, 25, 26, requirements that is provided to the end user that is managed, recorded, and updated as
7.5.9 27 applicable. Implant card shall include name, address, and contact info of consignee.
Article 7, 8, 9, Information supplied to the user must be in each Member State language where the N/A __ Conforms __ Repeat __
10, 18, 19, 26, product is distributed. Confirm that labeling is provided with the device that has been
27, 41; Annex translated as applicable. Organisation should have a listing of where products are
N/A I, II, IV distributed to verify which languages are required.
Finished devices through life cycle must clearly identify storage and handling conditions. N/A __ Conforms __ Repeat __
Article 10, 13, Regulatory requirements for the MDR shall meet that handling through life cycle for special
7.5.11 14; Annex I conditions, handling, and validation of packaging.
ISO 13485:2016 Chapter 8
Article 5, 10, N/A __ Conforms __ Repeat __
13, 14, 56, 83, Methods for obtaining post market information shall be documented according to MDR
84, 86, 93; requirements for gaining PMS and market surveillance. A PMS plan shall be documented
8.2.1 Annex III for how feedback is gathered, analyzed, and maintained.
Article 5, 10, Complaint handling system established, implemented, and maintained specific to MDR for N/A __ Conforms __ Repeat __
13, 14, 56, 83, how complaints are recorded for CE Marked products. Complaint procedure shall include
86, 93; Annex method for when reporting is made to Competent Authorities and Notified Body, as
8.2.2 III applicable.
Article 5, 10, N/A __ Conforms __ Repeat __
13, 14, 56, 83, Procedure documented and implemented for reporting vigilance activities. MDR reporting
86, 87; Annex requirements, timelines, and who is reported to shall be defined in a procedure with
8.2.3 III records maintained.
Article 5, 10, N/A __ Conforms __ Repeat __
13, 14, 56, 83, Procedure documented and implemented for conducting Field Safety Corrective Actions.
86, 87; Annex MDR reporting requirements, timelines, and who is reported to shall be defined in a
8.2.3 III procedure with records maintained.

© Oriel STAT A MATRIX. All rights reserved. Page 5 of 6

LEF-R0
 EU MDR Audit Tool
ISO MDR
Audit Task Notes
Section Requirement
Article 10, 15, Internal audits include Medical Device Regulation 2017/745 EU in the audit programme. N/A __ Conforms __ Repeat __
25, 52, 123; Audit plans are published that include specific requirements for including MDR in scope of
8.2.4 Annex I, II, III processes audited.
Internal auditors are trained and qualified to perform audits with scope of MDR N/A __ Conforms __ Repeat __
requirements. Documented training records show qualification and competency for having
8.2.4 Article 10, 15 MDR as part of auditor knowledge.
Article 10, 15, Approval or disposition of nonconforming material prior to delivery must be accepted by N/A __ Conforms __ Repeat __
19, 52; Annex concession or rationale. MDR requirements must be met or accepted by end user prior to
8.3.2 IX, X, IX shipment; method must exist for this disposition.
Article 5, 10, Procedure established for recalling, withdrawing, or removing product from the EU market N/A __ Conforms __ Repeat __
13, 14, 15, 16, has been documented and implemented. FSCA records must be maintained showing the
19, 20, 25, 87; distribution of products, recalled product, and disposition of returned product that are CE
8.3.3 Annex III, IV Marked.
Approval or disposition of nonconforming material prior to delivery that has been reworked N/A __ Conforms __ Repeat __
Article 10, 15, must showing conformance to specification. MDR requirements must be met or accepted
19, 52; Annex by end user prior to shipment or that the product has been reworked to original
8.3.4 IX, X, IX specification.
Article 10, 11, N/A __ Conforms __ Repeat __
13, 14, 15, 19, Corrective action implemented taking into consideration impact of MDR requirements.
20, 83, 87; Corrective action assessment includes how regulatory requirements of CE Marked
8.5.2 Annex I, II, III products may be affected in the field.
Article 10, 11, N/A __ Conforms __ Repeat __
13, 14, 15, 19, Preventive action implemented taking into consideration impact of MDR requirements.
20, 83, 87; Preventive action assessment includes how regulatory requirements of CE Marked
8.5.3 Annex I, II, III products may be affected in the field.

© Oriel STAT A MATRIX. All rights reserved. Page 6 of 6

LEF-R0