ISO 13485 Nonconformity, Corrective Action, and Continual Improvement Procedure Template & Guide

ISO 13485:2016 · $149 · Editable Word format

Since February 2, 2026, the FDA Quality Management System Regulation has incorporated ISO 13485:2016 by reference into 21 CFR Part 820. Your corrective action procedure is no longer only a quality document. For US-marketed devices it is the operative form of a federal regulatory requirement, and the records it generates are inspectable.

This is a complete procedure covering Clause 8.3 in full — general controls, product detected before delivery, product detected after delivery, and rework — together with Clause 8.5 improvement, corrective action, and preventive action. Editable Word format, filled-in worked example, bracketed placeholders where values are yours to set.

Four things device procedures routinely omit, all of them here.

The regulatory-impact verification. Clause 8.5.2(e) requires verifying that the corrective action does not adversely affect the ability to meet applicable regulatory requirements or the safety and performance of the medical device. This was added in the 2016 revision. It has no ISO 9001 equivalent, so it is absent from most procedures adapted from a 9001 base — and it is a verification step, meaning it needs a method, an owner, and a record, not a checkbox.

Preventive action as a live clause. ISO 9001 removed preventive action in 2015 and replaced it with risk-based thinking. ISO 13485 did not. Clause 8.5.3 still requires a documented procedure with its own five requirements and its own records. Device systems built from a 9001 template lose it entirely, and an auditor sampling for it finds nothing.

Rework. Clause 8.3.4 requires documented procedures that take account of the potential adverse effect of the rework, undergoing the same review and approval as the original procedure, with verification against acceptance criteria and applicable regulatory requirements afterward. Rework happens constantly. It is proceduralized far less often than it happens.

Without undue delay. Clause 8.5.2 states that necessary corrective actions shall be taken without undue delay. That is a timing obligation with no number attached, which means the organization has to supply the number. A procedure that does not state one has not implemented the requirement — it has restated it.

What’s included

• Complete Clause 8.3 and Clause 8.5 procedure — 42 pages, editable Word format
• Nonconforming product controls built to 8.3.1 — identification, documentation, segregation, evaluation, and disposition, with responsibilities and authorities named
• Investigation determination step, including notification of any external party responsible for the nonconformity
• Before-delivery disposition routes per 8.3.2, with the concession record carrying justification, approval, regulatory confirmation, and the identity of the authorizing person
• After-delivery section per 8.3.3, with the advisory notice arrangement capable of being put into effect at any time
• Rework section per 8.3.4 — adverse-effect assessment, same review and approval as the original, post-rework verification, records
• Stated corrective action clock giving "without undue delay" a number you set
• Regulatory-impact and device safety verification per 8.5.2(e), with method, owner, and record
• Preventive action section per 8.5.3, complete with its own five documented requirements
• Effectiveness review with a defined interval and a stated route when the check fails
• Exception and contingency paths — cause undetermined, action refused, owner departed, finding open at surveillance
• Records table with no blanks — 22 records, controlled per Clause 4.2.5
• Interfaces to ISO 14971 risk management, complaint handling, and regulatory reporting, with what flows where
• Maturity ladder across eight device-specific elements
• Process interaction map — editable SVG plus embedded image
• Cross-reference to ISO 13485 and 21 CFR Part 820, and where each requirement is addressed
• Appendices A, B, and C — nonconformity and corrective action record with device sections, corrective and preventive action log, and a desk-level work instruction with a device worked example

Who it’s for

Quality and regulatory professionals at medical device manufacturers, contract manufacturers supplying under device quality agreements, and consultants supporting device clients. Relevant whether you are ISO 13485 certified, preparing for certification, or adjusting to QMSR.

What it does for you

• Stop adapting a 9001 procedure that was never built for this. ISO 13485 predates the harmonized ten-clause structure. Nonconforming product sits at 8.3, corrective action at 8.5.2, and preventive action still exists.
• Put a number on "without undue delay." The standard sets the obligation; you set the clock. The template makes you set it once instead of defending it after the fact.
• Verify what the corrective action broke. Clause 8.5.2(e) exists because a fix can move a device outside its cleared configuration. The verification has a method here, not a checkbox.
• Recover preventive action. It is a documented-procedure requirement with its own records, and it is the most commonly missing clause in device systems built from a quality template.
• Bring an inspectable record set. Every record has a named location, a named owner, and a retention period set against the requirement rather than convenience.

Clauses addressed

8.3.1, 8.3.2, 8.3.3, 8.3.4, 8.5.1, 8.5.2, 8.5.3

Buy — $149

Need this procedure for more than one standard?

The five single-standard variants are also sold as a package at 20 percent below individual price. Choose the standards you support.

The combined variants below are a different product: one integrated procedure rather than several separate documents, with an integration decision record recording every divergence between the standards.

Other variants of this procedure

Questions

Is this a template or a finished procedure?

Both, and that is deliberate. It is written as a filled-in worked example so you can see what each element looks like when done properly, with bracketed placeholders wherever a value is genuinely yours to set — severity thresholds, roles, systems, intervals, retention periods. You are editing a working document rather than filling in a hollow outline.

What format?

Editable Microsoft Word (.docx), with a PDF copy. Where a process interaction map is included, it ships as an editable SVG alongside the embedded image. Adapt it, rebrand it, adopt it into your document control system. Yours to use.

Will this pass an audit?

A procedure does not pass an audit; an organization does. What this gives you is a procedure that addresses every requirement of the clause with a named owner and a named record, and that describes a process people can actually follow. Conformity is demonstrated by implementation and evidence — a perfect document over an operation that ignores it is still a finding. Unfilled placeholders are unmet requirements, so fill them.

Does it cover the whole standard?

No. Each covers the improvement clause of its standard in full, plus control of nonconforming output where the standard has such a clause. They are one procedure in a management system, and they reference the neighboring processes — document control, internal audit, complaint handling, risk management, management review — rather than replacing them.

What is the difference between correction and corrective action, and why does it matter here?

Correction addresses the thing in front of you: scrap it, rework it, contain it, tell the customer. Corrective action removes the cause so it does not happen again. Every standard in this family requires both, and treats them as separate obligations. The common failure is one form doing both jobs, which lets a disposition record close a finding without any cause ever being examined. These templates keep them as two records with a stated trigger between them, which is usually the single biggest change an organization makes when adopting one.

We already have a corrective action form. Is that not enough?

A form captures what happened. A procedure decides what happens next — which findings get a cause analysis and which do not, who is allowed to decide, how long the organization has, what evidence closes it, and what happens when the check fails. Most systems have a good form sitting on top of an unstated process, which is why closure rates look healthy while the same findings keep coming back.

We use different clause numbering and a different document system.

Every cross-reference is in a table at the back rather than baked into the body text, precisely so you can renumber without unpicking the procedure.

Which one do I need?

Take the template for the standard you are certified to. If you run more than one management system through one improvement process, take the matching combined variant — Device for ISO 9001 with ISO 13485, HSE for ISO 14001 with ISO 45001, Integrated for all three of quality, environment, and safety. If you are unsure, the free Nonconformity and Corrective Action Maturity Check will show you where your current process actually sits before you spend anything.

Can you help us implement it?

Yes. Call Management Systems International at 760-434-9141 to schedule a planning session.

About Management Systems International

MSI is a veteran-owned, woman-owned ISO consulting firm founded in 1998. Diana Lynn has 28 years of experience, has supported more than 80 organizations through successful ISO certification, has attended more than 200 certification and surveillance audits, and has trained more than 600 professionals across manufacturing, technology, medical device, government, healthcare and other regulated industries.

Questions before you buy? Call 760-434-9141.

© 2026 Management Systems International, LLC · All rights reserved