Regulatory, Quality and Information Security Audits

Internal audits help organisations assess whether their quality, regulatory, information security, and operational processes remain compliant with applicable requirements. They also help identify gaps, verify implementation of procedures, and prepare for external audits and regulatory inspections.

Internal audits are required or expected under various frameworks, including ISO 13485, ISO 9001, ISO/IEC 42001, ISO/IEC 27001, NEN 7510-1, MDSAP, FDA QMSR, and other management system standards. Audit activities help demonstrate ongoing compliance and system effectiveness.

Audit frequency depends on the applicable standard, organisational risks, previous findings, regulatory obligations, and business activities. Most organisations establish a risk-based audit programme that covers all relevant processes within a defined audit cycle. At the minimum the expectation is to execute audits on a yearly basis.

Yes. MedQAIR supports internal audits and audit preparation activities for quality management systems aligned with ISO 13485, MDSAP, FDA QMSR, and related regulatory frameworks.

Internal audits are conducted on behalf of the organisation to assess compliance and identify improvement opportunities. External audits are performed by certification bodies, notified bodies, regulators, customers, or other independent parties to evaluate compliance against specific requirements.

Yes. Depending on the audit scope, available documentation, and applicable requirements, audits may be performed on-site, remotely, or through a hybrid approach that combines both methods.

Supplier audits assess whether suppliers and subcontractors maintain appropriate controls, quality processes, and compliance activities. They are often used for critical suppliers whose products or services may impact product quality, safety, cybersecurity, or regulatory compliance.

Regulatory due diligence involves reviewing compliance status, quality systems, technical documentation, regulatory approvals, and operational risks before acquisitions, investments, licensing activities, or strategic partnerships.

Yes. Audit activities may include reviewing technical files, quality system documentation, software lifecycle records, cybersecurity documentation, clinical evidence, and other regulatory documentation relevant to the audit scope.

Audits help organisations assess whether processes, documentation, supplier controls, post-market activities, and management system requirements remain aligned with MDR and IVDR expectations throughout the product lifecycle.

Yes. Information security audits may assess compliance with ISO/IEC 27001, NEN 7510-1, cybersecurity controls, supplier security management, vulnerability management processes, and related governance activities.

Common findings include incomplete procedures, insufficient records, gaps in supplier oversight, inadequate training evidence, weak change management controls, inconsistencies in technical documentation, and deficiencies in cybersecurity or risk management processes.

Preparation typically includes reviewing procedures, ensuring documentation is current, closing known gaps, verifying training records, assessing supplier controls, and conducting internal audits or mock audits to identify potential findings before the external assessment.

Yes. MedQAIR provides qualified auditors and specialists to support internal audits, supplier audits, information security audits, due diligence assessments, audit readiness activities, and remediation programmes across medical device, software, and AI-enabled healthcare technologies.