MSI's ISO 13485 Human Resource Management Procedure template

ISO 13485 Human Resource Management Procedure Template

$149

The documented process ISO 13485 requires for competence, training and awareness — with the evaluation method set by risk, records kept against four bases rather than one, and the personnel qualification that process validation depends on.

ISO 13485 Clause 6.2 is not Clause 7.2 with the words changed. It opens with a sentence ISO 9001 does not have, and three more differences follow it.

Clause 6.2 requires the organization to document the process for establishing competence, providing needed training, and ensuring awareness. That is a documented process requirement in a standard that names only a limited number of them — the first signal that this clause is doing something different.

Competence rests on education, training, skills and experience — four bases, where ISO 9001 has three, and the added one is the hardest to evidence. Clause 6.2 b) requires action to achieve or maintain competence, so decay is in scope. And the NOTE to the clause requires the methodology used to check effectiveness to be proportionate to the risk associated with the work.

Personnel competence also reaches outside Clause 6. Clause 7.5.6 b) makes qualification of personnel an element of every documented process validation procedure, alongside equipment qualification. Clause 6.4.1 b) requires anyone working temporarily under special environmental conditions to be competent or supervised by a competent person. Neither is in a training matrix, and both are inspectable.

Risk-proportionate evaluation — the requirement unique to this standard

The NOTE to Clause 6.2 states that the methodology used to check effectiveness is proportionate to the risk associated with the work for which the training or other action is provided. It is the only competence clause in any of these standards that ties the evaluation method to risk rather than to role, and it changes the design of the whole procedure: the method is chosen from the risk of the task before the action is delivered, not from what was convenient afterwards.

Ask most device manufacturers how they evaluate training effectiveness and the answer is one method applied to everything — usually a test taken minutes after the session, with a pass rate above ninety-five percent. A method that never identifies anyone as not-yet-competent is not evaluating. Section 7.4 supplies a four-level risk-to-method mapping, and the form records the method the mapping required, the method actually used, and the reason for any difference.

What is included

  • Complete Clause 6.2 procedure — 42 pages, editable Microsoft Word format. This document is itself the documented process Clause 6.2 requires
  • Four bases recorded separately — education, training, skills and experience — because Clause 6.2 e) requires records of all four, and the skills column is the one that will be empty in your file today
  • Section 7.4 — risk-proportionate evaluation, a four-level mapping settled in advance, with the risk level recorded on every evaluation
  • Section 7.5 — personnel qualification for validated processes under Clause 7.5.6 b), kept as a separate record from competence, with requalification triggers
  • Section 7.6 — special environmental conditions under Clause 6.4.1, with competent or supervised recorded per entry and the supervisor named
  • Retention set by the device rule rather than the employment rule, with the four-part test stated in full
  • Channel-enumerated trigger — twelve routes in, including personnel change on a validated process
  • Single-owner accountability with named alternates, discharging part of Clause 5.5.1
  • Records table with no blanks — ten records, each with clause driver, owner, retention and location
  • Exception and contingency paths — eight, each with an owner, a limit and an approver
  • Key performance indicators — five, including validated processes with at least two qualified personnel
  • Maturity ladder — four levels across eight elements, scoreable as a self-assessment
  • Full clause cross-reference — eighteen obligations mapped to where each is discharged
  • Process interaction map — embedded and supplied as an editable SVG, with device-scope interfaces marked
  • Appendix A — competence register, seven parts including personnel qualification
  • Appendix B — competence shortfall and action record, built as the release gate
  • Appendix C — desk-level work instruction with per-step timings, and two worked examples deliberately different in shape
  • Appendix D — determination worksheet, the six things to settle before the procedure runs

Qualification is not the same record as competence

A person can be competent to operate a sealing machine and not qualified against the validation for a particular sealing process on a particular device family. The first is Clause 6.2; the second is Clause 7.5.6 b).

Where a process is validated because its output cannot be verified by subsequent monitoring, the personnel who perform it are part of what was validated. Checking each validation report against the current shift roster takes about four minutes, and it is the highest-yield check in this document.

Written as a working document, not an outline

It arrives as a filled-in worked example, so you can see what each element looks like when it is done properly, with bracketed placeholders wherever a value is genuinely yours to set — thresholds, roles, intervals, retention periods. You are editing a working document rather than filling in a hollow template.

Every MSI procedure carries the same seven structural marks: a real trigger with informal routes included, one accountable owner with named alternates, stated thresholds rather than intentions, the record as the gate rather than a report about the work, a defined exception path, trainable in one sitting, and an event-based review trigger with the calendar as a backstop only.

Who it is for

Quality and regulatory managers, and consultants, at medical device manufacturers certified or certifying to ISO 13485. It is most useful where the skills column is empty, where one evaluation method is applied to every task regardless of risk, or where validated processes name personnel who have since moved on.

What it changes

  • You fill the basis nobody records. A person can hold the degree, attend the course, have five years in post, and still be unable to perform the task. Appendix C gives a four-step observation routine: watch them on production work, write what you saw in a sentence, note what they did not do, sign and date.
  • You evaluate in proportion to risk, and can show it. The form records the method the mapping required and the method actually used, which turns the NOTE to Clause 6.2 into something demonstrable rather than something asserted.
  • You close the qualification gap before an inspector finds it. A trained but unqualified operator running a validated process means product made by an arrangement that differs from the validated one — and the difference is documented in the validation report itself, which names the personnel.
  • You keep the records long enough. Human resources retention is set by employment law and is commonly shorter than the device rule. Where a training record is also a Clause 6.2 e) record for work affecting product quality, the device rule governs.
  • You stop single-covering validated processes. Counting validated processes with only one qualified operator converts a compliance measure into a production measure, which is the surest way of getting it fixed.

Format and license

Editable Microsoft Word (.docx), 42 pages. An editable SVG of the process interaction map is supplied alongside it, so you can retitle the boxes with your own process names. Adapt it, rebrand it, and adopt it into your document control system. Purchase grants your organization a perpetual, non-exclusive license to edit, rebrand and use the template, including at multiple sites under common ownership. It may not be resold, sublicensed, distributed outside the buying organization, or published in whole or in substantial part.

MSI Template v1.0 · July 2026 · Built to ISO 13485:2016.

Regulatory status, and where to start

On February 2, 2026 the United States Food and Drug Administration’s Quality Management System Regulation took effect, amending 21 CFR Part 820 to incorporate ISO 13485:2016 by reference. If you distribute in the United States, the records this procedure creates are inspectable under Part 820. Confirm the current position against fda.gov before adopting.

Not sure this is the one you need? Take the free Competence and Awareness Maturity Check — seventeen questions, about six minutes.

Clause 6.2 d) awareness is tested by interview. The QMS Interviews course prepares your people for the questions an auditor or inspector will ask them directly. If you also run ISO 9001, the combined Device variant covers both standards with twelve divergences identified.

Questions

Is this a template or a finished procedure?

Both, deliberately. It is written as a filled-in worked example so you can see what each element looks like when done properly, with bracketed placeholders wherever a value is genuinely yours to set — thresholds, roles, intervals, retention periods. You are editing a working document rather than filling in a hollow outline.

Will this pass an audit?

A procedure does not pass an audit; an organization does. What this gives you is a procedure that addresses every requirement of the clause with a named owner and a named record, and that describes a process people can actually follow. Conformity is demonstrated by implementation and evidence — a perfect document over an operation that ignores it is still a finding. Unfilled placeholders are unmet requirements, so fill them.

What changed with the Quality Management System Regulation?

It took effect on February 2, 2026 and amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, with the subparts FDA determined to be substantively similar reserved. Inspections now reference ISO 13485 clause numbers. One consequence worth reading: the former regulation required personnel to be made aware of device defects that may result from improper performance of their jobs, and Clause 6.2 d) frames awareness differently. Section 7.7 keeps defect awareness as a row you retain or delete deliberately, rather than losing it by omission during a documentation retitle.

What counts as evidence of a skill?

A dated, signed observation of the person performing the task on production work, naming the standard they met and anything they did not do. Not a certificate, and not a training log — those are two of the other three bases.

We use different clause numbering and our own document numbers.

Every cross-reference sits in a table at the back rather than baked into the body text, precisely so you can renumber without unpicking the procedure. Document numbers appear as bracketed placeholders throughout.

Can you help us implement it?

Yes. Call Management Systems International at 760-434-9141 to schedule a planning session.


Management Systems International, LLC is a veteran-owned and female-owned ISO consulting firm founded in 1998. Over twenty-eight years we have supported more than eighty certifications, attended more than two hundred audits, and trained more than six hundred professionals.

ISO 13485 is a trademark of the International Organization for Standardization. This template is an independent work by Management Systems International, LLC and is not endorsed by or affiliated with ISO, any certification body, or any regulatory authority. Clause references are provided so you can locate each requirement in your own licensed copy of the standard; the standard itself is not reproduced.

This template is guidance, not legal or regulatory advice. Medical device regulatory requirements vary by jurisdiction, by device classification, and over time, and they change. You are responsible for identifying which apply to you, confirming their current text against the primary source, and taking advice from your regulatory affairs function.

© 2026 Management Systems International, LLC · All rights reserved.