ISO 9001 and 13485 Integrated Human Resource Management Procedure Template

ISO 13485 was derived from ISO 9001, and the two competence clauses look close enough to merge. Twelve differences matter — and unlike most standard pairings, they run in both directions.

Four requirements exist only in ISO 9001. Six exist only in ISO 13485. Two exist in both and are worded so differently that satisfying one leaves the other open.

ISO 13485 requires four bases of competence where ISO 9001 requires three, requires the competence process itself to be documented, requires action to achieve or maintain competence, requires the evaluation method to be proportionate to risk, and requires anyone working temporarily under special environmental conditions to be competent or supervised.

ISO 9001 pushes the other way. Its awareness clause has four items where ISO 13485 has one composite requirement — the only place in this pairing where the quality standard is the wider. It requires organizational knowledge to be determined and maintained, and it requires actions to be implemented to prevent human error. Neither has any ISO 13485 counterpart at all.

What is included

• One procedure covering both standards — 56 pages, editable Microsoft Word format
• The ISO 9001:2026 edition of this template, free, when we issue it — emailed to the address used at purchase
• Appendix E — the integration decision record, twelve divergences with alternatives and the decisions to confirm before adoption
• Inline marking convention — [Q], [D], [Q+D] and [MSI] — in the body text rather than collected in an appendix, because a marked requirement is only useful where the requirement is read
• Section 2.0 — scope determination first, with the device boundary drawn by process rather than by department
• Both scope tests applied — work affecting QMS effectiveness, and work affecting product quality. Neither test contains the other, and applying one loses a whole population
• Section 8.4 — risk-proportionate evaluation, the ISO 13485 requirement, applied across both scopes
• Section 8.5 — qualification in both senses, kept as two records: the license a person holds, and their qualification against a specific validation
• Sections 8.6 and 8.8 — organizational knowledge and actions to prevent human error, both ISO 9001 requirements, applied to the device scope where neither is required and both matter more
• Section 8.10 — the ISO 9001 four-item awareness set applied to both scopes, plus regulatory awareness under ISO 13485 Clause 5.5.2 c)
• One retention rule, taken from the device side, so a combined system does not apply the shorter one by accident
• Records table with no blanks — fourteen records, each with clause driver, owner, retention and location
• Exception and contingency paths — eleven, several differing deliberately between scopes
• Maturity ladder — four levels across eight elements, including an integration element
• Full clause cross-reference — both standards side by side, twenty-eight requirements, so an auditor or inspector from either scheme follows one table
• Process interaction map — embedded and supplied as an editable SVG, with device-scope interfaces marked
• Appendix A — one register serving both scopes, nine parts
• Appendix B — competence shortfall and action record, asking whether the failure was incompetence or error before the action is chosen
• Appendix C — two desk-level routines and two deliberately mirrored worked examples
• Appendix D — determination worksheet, the nine things to settle before the procedure runs

Two worked examples, deliberately mirrored

The first is a failure ISO 13485 has no clause to catch. An operator with eleven years’ experience fits a component the wrong way round about once a month on a Class II line. Retrained three times. She is demonstrably competent — several hundred correct fits between errors. ISO 13485 has no clause about preventing error by a competent person; ISO 9001 Clause 8.5.1 g) does. A locating pin, under an hour of workshop time, no recurrence in twelve months.

The second is a failure ISO 9001 has no clause to catch. A sterile barrier sealing validation names two operators who left the line eighteen months ago. The third is trained and competent under Clause 7.2, and not qualified under Clause 7.5.6 b) — so product has been made by an arrangement differing from the validated one, and the difference is documented in the validation report itself.

Each organization was fully compliant with the standard it was reading, and had a real problem the other would have caught. Neither example involves anyone doing their job badly.

Written as a working document, not an outline

It arrives as a filled-in worked example, so you can see what each element looks like when it is done properly, with bracketed placeholders wherever a value is genuinely yours to set — thresholds, roles, intervals, retention periods. You are editing a working document rather than filling in a hollow template.

Every MSI procedure carries the same seven structural marks: a real trigger with informal routes included, one accountable owner with named alternates, stated thresholds rather than intentions, the record as the gate rather than a report about the work, a defined exception path, trainable in one sitting, and an event-based review trigger with the calendar as a backstop only.

Who it is for

Quality and regulatory managers and consultants at organizations running both a general quality system and a medical device system. It is most useful at mixed sites where the device boundary has never been drawn by process, and where two competence procedures have quietly diverged.

What it changes

• You see what each standard is blind to. The two worked examples are chosen for exactly this. One failure is invisible to the device standard, the other to the quality standard, and both are ordinary.
• You stop retraining people who already know how. Asking whether the failure was incompetence or error, before selecting the action, is the highest-value line on the form in either scope.
• You keep qualification straight. A person can hold every license required and still be unqualified against a specific validation. Merging the two records hides it, and the validation report is where it surfaces.
• You apply one retention rule. A combined system with two rules will apply the shorter one by accident, because the human resources system holds one schedule.
• You can defend the integration to both a certification auditor and a regulatory inspector. Appendix E shows the requirement was identified, the divergence recognized, and the stricter position taken deliberately rather than by accident.

Format and license

Editable Microsoft Word (.docx), 56 pages. An editable SVG of the process interaction map is supplied alongside it, so you can retitle the boxes with your own process names. Adapt it, rebrand it, and adopt it into your document control system. Purchase grants your organization a perpetual, non-exclusive license to edit, rebrand and use the template, including at multiple sites under common ownership. It may not be resold, sublicensed, distributed outside the buying organization, or published in whole or in substantial part.

MSI Template v1.0 · July 2026 · Built to ISO 9001:2015 and ISO 13485:2016.

Questions

Is this a template or a finished procedure?

Both, deliberately. It is written as a filled-in worked example so you can see what each element looks like when done properly, with bracketed placeholders wherever a value is genuinely yours to set — thresholds, roles, intervals, retention periods. You are editing a working document rather than filling in a hollow outline.

Should we wait for ISO 9001:2026?

No. ISO 9001:2015 is the only version you can be certified to until the 2026 edition is published, and ISO 13485 is unaffected by that revision. This is the template you need today, and the updated ISO 9001 half is included in this purchase at no additional cost when we issue it.

Will this pass an audit?

A procedure does not pass an audit; an organization does. What this gives you is a procedure that addresses every requirement of the clause with a named owner and a named record, and that describes a process people can actually follow. Conformity is demonstrated by implementation and evidence — a perfect document over an operation that ignores it is still a finding. Unfilled placeholders are unmet requirements, so fill them.

What exactly is an integration decision record?

Appendix E. For each of the twelve places where ISO 9001 and ISO 13485 genuinely differ, it sets out what each standard says, what this procedure does, what the alternative was and why it was rejected, and what you must confirm before adopting. It is what lets you explain a position to an auditor from either scheme rather than working the answer out in the room.

Is ISO 9001 really wider than ISO 13485 anywhere?

On awareness, yes. ISO 9001 Clause 7.3 lists four items including relevant quality objectives and the implications of not conforming. ISO 13485 Clause 6.2 d) asks one composite question. A device manufacturer that built its awareness content from ISO 13485 alone has a narrower set than a general manufacturer, which is the opposite of what most people assume about the two standards.

We only run ISO 13485 today.

Then take the single-standard variant, unless you expect to add ISO 9001. That said, three of the four ISO 9001-only requirements — organizational knowledge, actions to prevent human error, and the wider awareness set — are worth having in a device system whether or not a clause demands them, and Appendix E explains why for each.

We use different clause numbering and our own document numbers.

Every cross-reference sits in a table at the back rather than baked into the body text, precisely so you can renumber without unpicking the procedure. Document numbers appear as bracketed placeholders throughout.

Can you help us implement it?

Yes. Call Management Systems International at 760-434-9141 to schedule a planning session.

---

Management Systems International, LLC is a veteran-owned and female-owned ISO consulting firm founded in 1998. Over twenty-eight years we have supported more than eighty certifications, attended more than two hundred audits, and trained more than six hundred professionals.

ISO 9001 and ISO 13485 are trademarks of the International Organization for Standardization. This template is an independent work by Management Systems International, LLC and is not endorsed by or affiliated with ISO, any certification body, or any regulatory authority. Clause references are provided so you can locate each requirement in your own licensed copies of the standards; neither standard is reproduced.

This template is guidance, not legal or regulatory advice. Medical device regulatory requirements vary by jurisdiction, by device classification, and over time, and they change. You are responsible for identifying which apply to you, confirming their current text against the primary source, and taking advice from your regulatory affairs function.

© 2026 Management Systems International, LLC · All rights reserved.