MedQraft
← All insights
QMS / ISO 13485

Defining the Scope of QMS Consulting: Preparing for the First Conversation

This article outlines how to translate the request for an overall QMS into a specific scope of work.
It introduces questions and hypothetical consultation notes that clarify current state, priority tasks, necessary deliverables, and internal roles.

Last regulatory review: 2026-09-20 Rev. 1.0 7 min read

Consultations Start by Describing the Current Situation

"I would like you to look at the QMS overall."

This is a natural statement to make when requesting an initial consultation.

However, the support needed may differ for organizations establishing a new system versus those that have an existing system but are encountering hurdles in certain tasks.

There is no need to create a perfect requirements document from the outset.

It is a good starting point to explain what products you are dealing with, which stage you are currently at, and why you are considering a consultation.

If there are aspects that are not clearly understood, they can remain unconfirmed.

By distinguishing verified facts from assumptions, it will be easier to define the scope to be examined later.

This document serves as an internal practical guide for preparing for QMS consulting consultations at MedQraft.

It is not a checklist of mandatory forms or audit checklists required by standards.

The publicly available scope of services is based on the QMS Consulting Guide, while the actual scope of performance and deliverables will be discussed individually.

First Question: What Stage Are You Currently At?

The product area and development/manufacturing stage provide the context for the consultation.

Even within the same organization, the tasks for products under development and those that are already on the market may differ, so it is advisable to first delineate the scope of the products or business sites to be consulted this time.

You can briefly describe your current situation, saying things like "I am still in the process of establishing a system," "We have existing procedures, but the person in charge has changed," or "I want to review the preparation status ahead of the audit."

If there are related schedules, it is important to distinguish between confirmed and desired timelines.

Providing a desired timeline does not equate to guaranteeing completion within that period.

Rather than attaching all company materials upon initial inquiry, it is recommended to first describe the types and statuses of the materials you hold.

For example, you might say, "We have a list of procedures, but the status of recent operational records is under review."

The materials and methods required for the actual review can be negotiated later according to the defined scope.

Second Question: What Tasks Do You Want to Resolve First?

When multiple issues appear simultaneously, it is helpful to distinguish the entire list from the first priority task.

What’s important in a consultation is not to select the most plausible terms, but to explain what tasks are challenging and why.

The table below serves as an internal example for specifying requests.

Each row does not imply fixed products or bundled items.

Starting Point for Consultation Good Information to Explain First Example of Scope to Discuss
System Establishment Product/Organization Stage, Assigned Roles, Existing Documents Necessary Task System and Document Structure
Operational Review Points Where Current Procedures and Actual Work Diverge Priority Processes and Records to Review
Audit Preparation Audit Scope and Schedule, Held Materials, Remaining Tasks Review Preparation Status and Follow-up Tasks
Follow-up Actions for Observations Noted Issues, Actions Taken, Unconfirmed Areas Distinction for Review and Follow-Up Support
Maintenance Recurring Tasks, Assigned Roles, Current Management Methods Scope of Ongoing Support Tasks

Even in a situation where everything seems necessary, you can still define what needs to be addressed first.

Consider points where actual work halts, tasks related to upcoming schedules, and matters that need clarification before starting other work.

The initial scope you had in mind may be adjusted during this process.

Third Question: What Deliverables Are Needed?

The same expression of "document support" may contain different expectations.

It is helpful to distinguish whether you want feedback on existing documents, to collaboratively construct revisions, or to review the actual operational process.

For example, if the goal is to review the preparation status, the scope of review subjects and feedback is crucial.

If the purpose is task organization, you can negotiate what flow and roles need improvement and what materials will be used for operations.

If assistance is required in drafting specific forms, it should also be determined who will provide the factual basis, who will review it, and who will ultimately approve it.

Don’t just name the deliverables; discuss how to confirm their completion as well.

Instead of saying, It’s well organized, try to clarify the confirmation status such as, The review comments and remaining tasks for the discussed subjects are distinguished.

This statement is an example, and actual completion criteria will vary depending on the scope of execution.

Hypothetical Case: An Organization Lacking Operational Records Ahead of an Audit

The following is a hypothetical situation for illustration and not an actual customer case.

A medical device team holds existing procedures but requests consultation for audit preparation while failing to adequately organize some operational records.

At this point, it is essential to distinguish whether the request is to "fill in the records" is in reference to actual work undertaken, work that was performed but whose justification is scattered, or tasks that have not yet been completed.

The three states cannot be handled in the same way.

It is not within the scope of support to record work that has not actually been done as if it had been or to retroactively change dates in documentation.

The consultation notes can be organized as follows:

The example does not define specific product requirements or performance periods.

Classification Hypothetical Consultation Notes Prepared Independently
Current Status Holds existing procedures.
The level of organization of recent operational records varies by task.
Priority Task Would like to differentiate between checking preparation status and remaining tasks.
Held Materials List of procedures, some operational records, and a current task list.
Desired Support Review of agreed subjects and organization of follow-up tasks.
Internal Roles Actual execution of work, factual confirmation, designating internal reviewers and approvers.
Additional Negotiation Review subjects, scope of material provision, deliverables, schedules, and costs.

The aim of these notes is not to conceal shortcomings.

It is to reveal what needs review and confirm how the actual execution and support are interconnected.

The support for audit preparation does not guarantee passing the audit or obtaining certification.

Define Internal Roles as Well

Even when utilizing external support, internal team members can most closely verify the organization's actual operational information.

It is advisable to clarify the parts to be managed internally, such as the explanation of current processes or product status, factual confirmation of performed tasks, and internal approvals within the organization.

If multiple departments are involved, consider setting a point of contact for consolidating opinions.

Having multiple people assigned as responsible does not inherently cause problems, but if differing explanations or revision requests are conveyed, it can become unclear which content to review as a basis.

Distinguishing items needing departmental confirmation from final approvals can be helpful.

The decision of whether to adopt software can also be discussed separately from the consulting request.

This approach prioritizes deciding which issues to resolve before changing the tools, rather than changing tools before understanding current work.

If product functionality or automation is needed, it is essential to verify the actual scope of provision and compatibility separately.

Please Provide Three Points in Your Initial Inquiry

There is no need to finalize all details in your initial inquiry.

Briefly stating the following three points will help in understanding the situation:

  1. Product and Current Stage: What product are you dealing with, and at what stage of development, manufacturing, or operation are you?
  2. First Task to Resolve: What is the reason for this consultation and what actual tasks are blocked?
  3. Held Materials and Required Support: To what extent do you have documents/records, and what support do you expect?

For example, you might write, "We are a medical device manufacturer and currently operating existing quality procedures.
There are mismatches between assigned roles and actual tasks, so I would like to consult the scope of the review first.
We hold a list of procedures and some recent operational records."

This is also a hypothetical phrase and can be adjusted to fit your actual situation.

The schedule, costs, material-sharing methods, and deliverables for individual support will be discussed later.

This article does not promise free provision, fixed lead times, or specific results.

Confirm the Agreed Scope After Consultation

As negotiations progress, distinguish between tasks to be included this time and those to be reviewed separately later, and confirm roles regarding deliverables and materials to be provided.

Discussing how the scope will be adjusted when new tasks are discovered will also help to reduce differing expectations.

MedQraft collaborates with organizations to define the necessary QMS support range based on current documents and actual operations.

Let us know about your products and current tasks at Consultation Request.

If you want to further examine your current operational status before consultation, you can also refer to Article on Checking Connection Between Procedures and Actual Operations.

This article addresses checking operations, while this one discusses the scope for requesting external support.

Basis for writing: MedQraft's publicly available QMS consulting guide and operational standards for company content.

Public guide and local site materials review date: September 20, 2026.

The tables, questions, and hypothetical consultation notes in this text are independently drafted suggestions and are not mandatory forms required by standards.

Let's talk

Apply what you have read
to your product.

Tell us your product's current stage and the questions you need to review.

Discuss your questions ↗
MedQraft / Let's talk

Project inquiry

Start with your challenge.
We will work through it together.

Tell us your product's current stage and the support you need.
We will review the questions and define a suitable scope of support.

Contact@medqraft.co.kr ↗
Information: name, company, email, inquiry and service of interest · Purpose: responding to your inquiry · Retention: until the inquiry is resolved Read the privacy policy
Privacy policy

MedQraft / Privacy

Privacy policy

MedQraft processes only the information needed for website inquiries.
We delete the collected inquiry information when the inquiry is resolved.

Effective date: September 18, 2026

1. Scope and purposes of processing

This policy applies to visits and business inquiries at www.medqraft.co.kr.
We process personal information to review and respond to inquiries, discuss the scope of support, and operate the website reliably.
Customer business data stored in Q-Atelier is governed by the relevant service agreement and separate notices.

2. Information collected and retention

Required information
Name, email address and inquiry
Optional information
Company, selected service of interest, and contact or business details you provide in your inquiry
Collection methods
Website inquiry forms and email inquiries
Basis for processing
Consent to collection and use provided through the inquiry form.
Where necessary to fulfill a request relating to the formation or performance of a contract, we process information on the applicable legal basis.
Retention period
We retain inquiry information until the inquiry is resolved, then delete it without delay.
If information becomes part of a separate contract, we separately explain the required information and retention period.
Where retention is legally required, only the relevant information is stored separately.

You may decline to provide required information, but this will prevent submission of the website inquiry form.
You can make an inquiry without providing optional information.
Do not submit sensitive information unnecessary for the inquiry, such as national identification numbers or patient information.

3. Service providers and external services

Inquiries are forwarded from the website server through an email delivery service to our company mailbox.
We do not maintain a separate inquiry database in this processing workflow.

Vercel Inc.
Website hosting, server-side inquiry processing, operations and security.
Technical information such as IP address, request time, browser and request details may be processed.
Plus Five Five, Inc. (Resend)
Delivery of inquiry notification emails containing name, email, company, service of interest and inquiry details, and management of delivery logs
Gabia Hiworks
Receipt, storage and replies to inquiries in our company mailbox

We do not sell inquiry information or provide it for advertising purposes.
We do not disclose it for an independent third party's purposes unless there is a lawful basis, such as a legal requirement or separate consent.

4. Overseas processing and storage

Overseas cloud services are used to process website requests and deliver emails.
Information entered in an inquiry is transmitted over an encrypted connection upon submission.

Vercel Inc. / United States
Information is transmitted for inquiry request processing and hosting.
Privacy contact: privacy@vercel.com.
Operational records are subject to the retention periods of the services and settings used and Vercel's processing policies.
Vercel data processing information
Plus Five Five, Inc. (Resend) / United States
Information is transmitted upon submission to deliver the inquiry email and manage delivery records.
Privacy contact: privacy@resend.com.
Resend's published default retention period for emails and logs on its standard plans is 30 days.
Earlier deletion may be requested from the provider.
Resend retention and deletion information

Deleting inquiry emails from our mailbox and deleting technical records held by external providers involve different processes.
You may contact the person listed below about deletion, restriction of processing or overseas processing.
If you do not wish to use overseas processing through the website form, you may email us directly.
The processing policies of the email services used will still apply.

5. Deletion and safeguards

After confirming that an inquiry has been resolved, we delete the email and separately saved copies.
Printed materials, if any, are destroyed by shredding or another method that prevents reuse.
Where deletion of information held by an external processor is necessary, we submit a request through that provider's deletion procedure.

Access to personal information is restricted to staff who need it for their work.
We protect information through HTTPS transmission and account access controls.
We do not publish materials containing personal information in public repositories or on public pages.

6. Your rights

You may request access, correction, deletion, restriction of processing or withdrawal of consent by contacting the designated email address.
We will verify your identity to the extent necessary, process the request under applicable law, and notify you of the result.
If we cannot fulfill a request, for example because of a legal retention obligation, we will explain the reason.
For requests made through a representative, we may verify their authority.

7. Access information and external content

We use Naver conversion tracking to measure visits and completed inquiries attributable to Naver search advertising.
Technical information such as the visited URL, referring page, browser and cookies, and whether an inquiry was completed, may be processed.
The name, email, company and inquiry text entered in the form are not included in conversion events.
You can block or delete cookies in your browser.

Server access information may be processed for website delivery and security.
Vercel Web Analytics is used for anonymous visitor statistics on the introduction page and Insights.
Insights statistics aggregate article views, referral sources, countries and device types.
Visitor analytics do not use analytics cookies.
Names, emails, companies and inquiry text from the consultation form are not included in analytics events.
Instagram-specific links use UTM parameters to identify referral sources.
Loading external video or fonts on the website may transmit technical information, including IP address and browser details, to the relevant provider.

You can block or delete cookies and site data in your browser settings.
Some features or external content may be restricted depending on your settings.

8. Privacy officer and contact

Business
MedQraft / Representative: Byeonghwi Kim
Privacy officer and inquiry contact
Byeonghwi Kim
Email
Contact@medqraft.co.kr
Postal inquiries
Suite 222, 56 Geumto-ro 80beon-gil, Sujeong-gu, Seongnam-si, Gyeonggi-do, Republic of Korea (Geumto-dong, Widen Tower)

For privacy-related complaints, you may contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee for assistance.

9. Changes to this policy

Changes to processing purposes, information collected, retention periods or service providers will be published on this page with their effective date.

September 18, 2026: Website inquiry privacy policy first published

October 14, 2026: Added information on Insights visitor analytics and Instagram referral measurement