When Should a Medical Device Company Bring in an ISO 13485 Consultant?

Many medical device companies bring in an ISO 13485 consultant when an audit is approaching, a notified body has raised findings or a commercial opportunity depends on demonstrating quality management readiness. By that point, the internal team may already be stretched, procedures may no longer reflect how the company operates and important records may be missing. What initially appears to be a documentation task can become a wider issue affecting certification, commercialisation or market access. The right time to seek support is usually earlier, when the business, product or regulatory strategy is changing faster than the quality management system (QMS) can keep up.

This does not mean every company needs extensive consultancy support from the outset. It means recognising when additional expertise, capacity or independent review would help the organisation move forward. A good consultant should work with the processes and knowledge already available, identify what genuinely needs attention and help establish a system that people can use. The objective is not to create more procedures. It is to make sure the right controls are operating, responsibilities are understood and the company can demonstrate that its quality system works in practice.

1. You Are Moving from Development Towards Commercialisation

During early development, work often depends on a small team, shared folders and knowledge held by individual people. As the device becomes more established and the company prepares for manufacture, regulatory submission and commercial supply, those arrangements can become harder to manage. More suppliers may become involved, outsourced activities may increase and manufacturing or software release processes may need clearer controls. Decisions that were previously discussed informally now need an agreed approach to review, approval and record-keeping. Questions from investors, customers or commercial partners about certification can also reveal that the organisation needs a clearer quality management plan.

This is a useful point to involve an ISO 13485 consultant because the system can be developed around the activities the company is actually undertaking. The consultant should help identify where approvals are needed, how changes will be controlled, which records must be retained and who is responsible for each process. For example, the transition from development to commercial supply should not leave uncertainty about which specifications have been approved or how supplier-related decisions are documented. The aim is a proportionate QMS that supports the next stage of the business without introducing unnecessary administration. Building these arrangements while activities are becoming formalised gives the team an opportunity to use and refine them, rather than attempting to impose a complete system immediately before an external assessment.

2. Your Internal Resources Are Stretched

The need for an ISO 13485 consultant does not necessarily indicate a lack of internal expertise. Many organisations have capable quality and regulatory professionals who are balancing submissions, technical documentation, supplier issues, product development and day-to-day quality responsibilities. The difficulty is capacity. QMS implementation actions may be repeatedly postponed, training records may fall behind and internal audits or management reviews may be delayed because urgent operational matters take priority. Procedures may have been written but not fully introduced, leaving a gap between what the system describes and what staff are doing.

A useful warning sign is that quality activities receive concentrated attention only when an audit approaches. Another is that the same small group is expected to complete the work and provide its independent review, without sufficient time or separation of responsibilities. External support can help by providing temporary capacity, reviewing a defined area or taking responsibility for a specific workstream. It may also be appropriate where the internal team needs specialist input on a particular process or finding. The scope should be clear, with agreed responsibilities and deliverables, so that consultancy support reduces pressure rather than creating another project for the team to manage. This can be particularly valuable while the company recruits, restructures or develops its own quality expertise.

3. You Are Entering a New Market or Facing New Requirements

A QMS should be considered alongside the company’s wider regulatory strategy. A system that suited an earlier development stage or market may need to change as the organisation expands. Preparing to enter the EU, UK, US, Canada or another international market is therefore a sensible point to review whether the existing arrangements remain appropriate. The same applies when the company moves towards a pathway involving third-party QMS assessment, adds a new device type or classification, or introduces a manufacturing activity that the current system does not adequately cover. The question is not simply whether the company already has procedures, but whether those procedures address its changing activities and responsibilities.

Changes to the legal manufacturer, critical suppliers or outsourced processes can also require a closer review. Existing documentation may describe responsibilities that no longer reflect the arrangements in place. Similarly, integrating software lifecycle, information security or post-market surveillance activities into the QMS requires more than adding a separate procedure for each topic. The processes need to connect, with clear ownership, appropriate records and an understood route for reviewing issues or changes. An ISO 13485 consultant should help identify which parts of the system need to change and how they relate to the wider regulatory requirements. This keeps the work focused on genuine gaps rather than expanding the documentation without improving operational control.

4. An Audit, Gap Assessment or Certification Deadline Is Approaching

An upcoming certification audit, surveillance audit, customer audit or due diligence review is a common reason to seek ISO 13485 support. The value of that support depends on how clearly the company understands its current position and how much time remains to address any gaps. A focused review can be useful where the QMS has not been independently assessed, internal audits have not covered the full system or management review inputs and outputs are incomplete. Previous findings that remain open, weak corrective actions and uncertainty among staff about their responsibilities are also important reasons to seek help before the external review begins.

A consultant can assess whether the available records demonstrate implementation, identify the highest-risk issues and help the company prioritise realistic actions. However, preparing for an audit should not become an exercise in making the documentation appear complete. A procedure needs to be used, and the organisation needs records showing how the process operates. Missing evidence cannot always be resolved by revising the procedure or creating another form. The underlying activity may need to be completed, reviewed and followed up before the company can demonstrate that the issue has been addressed.

This is why bringing in support early matters. A consultant cannot create genuine implementation immediately before an audit. Early engagement gives the team time to correct the system, clarify responsibilities, use the revised processes and generate evidence that they are working. Where a deadline is already close, the support should still be practical and transparent about what can be achieved. Prioritising the most significant gaps is more useful than attempting to rewrite every procedure without allowing time for the changes to take effect.

5. The QMS Exists on Paper but Is Not Working in Practice

Some medical device companies already have an ISO 13485 QMS, but staff do not use it consistently because it has become complicated, difficult to navigate or disconnected from daily work. People may follow informal processes instead of approved procedures, while forms are duplicated, incomplete or difficult to find. Responsibilities may be unclear, and changes may be made without documented review or approval. The system can look extensive while failing to provide reliable control over the activities it is intended to manage.

Other warning signs include corrective and preventive actions, commonly referred to as CAPAs, remaining open without addressing the root cause, missing supplier or training records and incomplete post-market information. Repeated findings across more than one audit are particularly important because they suggest that previous actions have not resolved the underlying problem. In these situations, the answer may not be additional documentation. The company needs to understand why the existing process is not being followed, whether it is workable and whether the people responsible have the clarity and support needed to implement it.

A good ISO 13485 consultant should help simplify the system, clarify ownership and strengthen implementation. This may involve removing unnecessary duplication, making records easier to locate or bringing procedures back into line with the way the business needs to operate. The work should connect the documented process with the people, decisions and evidence involved. The goal is a QMS that supports development and commercial activities every day, not one that is opened shortly before an audit and set aside afterwards.

Choosing the Right Scope of ISO 13485 Support

The most useful consultancy engagement starts with a clear explanation of the problem. A company approaching commercialisation may need help establishing its QMS, while an organisation with an experienced internal team may only require temporary capacity or an independent review. A business entering a new market may need a focused assessment of changing requirements, while a company facing recurring findings may need help improving implementation. These are different situations and should not automatically lead to the same proposal or volume of work.

An ISO 13485 consultant should help the company distinguish between missing procedures, missing records, unclear responsibilities and processes that are not operating effectively. That distinction determines what needs to happen next. Bringing in support before the pressure becomes urgent gives the organisation more opportunity to address the cause of the problem rather than repeatedly managing its consequences. The measure of success is not the size of the quality manual, but whether the QMS reflects the business, supports its activities and produces reliable evidence of compliance.

LFH supports medical device companies in developing, reviewing and improving quality management systems that reflect their products, regulatory pathways and operational needs. Whether you are preparing for commercialisation, expanding into a new market, supporting a stretched internal team or addressing audit findings, our specialists can help identify the gaps and establish practical priorities. Speak to LFH about medical device compliance support that strengthens your existing processes and helps your organisation move forward.

FAQs – ISO 13485 Consultants