MedQraft
← All insights
QMS / ISO 13485

Maintaining a Quality System: Connecting Procedures with Actual Work

What should be checked first when quality system documents exist but do not match actual operations? This article suggests practical methods for verifying the connection between procedures, responsibilities, records, and review results by following a single change task.

Last regulatory review: 2026-09-11 Rev. 1.1 4 min read

Verify the Flow of One Task Rather Than the Number of Documents

While procedures may be organized, the responsible parties might work in different ways.

Conversely, even if work is conducted, there may be no records indicating the criteria used for judgment.

ISO 13485:2016 addresses the requirements of a quality management system that consistently satisfies customer and applicable regulatory requirements related to medical devices and associated services.

This is why it is essential to examine both document retention and actual operations together.

Official Introduction to ISO 13485:2016

Below is MedQraft's practical suggestion for examining operational status, not a complete compliance audit checklist.

Choose One Recent Change Task

For an imaginary case, let’s assume that we changed the supplier for production parts.

Related materials may be scattered among purchase emails, meeting minutes, test results, and revised documents.

Step Verification Questions
Change Request Who wanted to change what for what reason?
Impact Review Did you consider the impact on specifications, risk management, and existing evaluation materials?
Decision Who approved the change within what scope?
Execution From what model and time was the new part used?
Confirmation Are the results of planned verification activities connected with remaining actions?
Document Reflection Do the site standards and training materials match the changes?

The review scope will vary depending on the type of change.

This does not mean that the same depth of review or the same format should be applied to all changes.

Dividing Issues into Three Reveals the Maintenance Scope

Issues with Standards: Procedures do not align with the current organization or approval authority is unclear.

After verifying the responsible parties and judgment points, procedures need to be updated.

Implementation Issues: Standards exist, but they are not followed.

You need to determine if it is due to lack of training, schedules, tools, or authority.

Simply revising documents cannot be considered a resolution.

Issues with Records: Evidence exists, but it is hard to find or the version connection is broken.

You can start by improving how document numbers, change numbers, applicable models, and record locations are connected.

Without this distinction, operational issues can easily be resolved only by adding documents or organizing necessary procedures into file sorting.

Specify Items to Be Maintained First

Rather than fixing all documents simultaneously, it is advisable to prioritize based on factors such as impact on safety and quality, frequency of occurrences, and degree of lack of evidence.

The inspection results should include current status, necessary actions, responsible parties, and completion criteria.

Instead of "improving change management," write actionable steps like "connect the supplier change with the applicable model and evaluation results and complete pending reviews."

Examining Connections with a Single Supplier Change

The following is a hypothetical example of maintenance rather than a real customer case.

Let’s assume that we applied parts from a new supplier, but the purchasing team has approval emails, the quality team has inspection results, and the production team retains work standards from before the revision.

Simply confirming the existence of each file may seem normal, but the application point and criteria are not connected.

Confirmed Status Required Follow-up Review Example Evidence for Completion
No model specified in approval email Confirm the approval scope and target model Records confirming the approval scope
Inspection results reference previous specifications Confirm the criteria used for evaluation and impact of changes Review results and required follow-up evaluations
On-site standards are previous version Confirm the distribution status and impact scope Verification of application of the latest standards and related actions
Hard to find the starting point of use Trace the scope of application through purchase and production records Records linked to application point and target

Avoid retroactively filling in missing past records as if they were created at the time.

Distinguish between currently verifiable facts and parts that cannot be verified, and record discovered issues and follow-up reviews at the actual time of completion.

Transitioning Problems Discovered in Internal Audits to Operational Improvements

If document number errors and repeating approval omissions are treated as issues of the same level, the maintenance prioritization will become unclear.

Review the impact and repetition of discovered issues and handle them according to the applicable procedures.

It is helpful to separate content that needs to be corrected immediately from content that requires further review of causes and prevention of recurrence.

For example, even if the reason for an approval omission is recorded as "carelessness of the responsible party," it could actually be that they lack substitute approval authority or that the approval stage is skipped due to scheduling.

After confirming the actual work of the relevant responsible parties, measures should be determined.

Distinguish between the fact of having conducted training and the judgment that the issue has been resolved.

Five Points to Confirm in a Maintenance Meeting

  • Which tasks are disconnected at which points?
  • What products, records, and ongoing tasks may be affected?
  • What needs immediate attention and what requires further review?
  • Who determines the completion status and based on what evidence?
  • How will the same issues be monitored to ensure they do not recur in follow-up confirmations?

These questions are not aimed at increasing new formats.

If answers can be found in existing records, then begin by organizing those connections.

If issues of repetition or decisions regarding resources/authority are needed, it is best to compile that information to be utilized in management decisions.

Prepare for Audits While Observing Daily Operations

QMS maintenance is about ensuring that audit materials and on-site operations are linked together.

Organizations targeting the U.S. market must also confirm compliance with the QMSR implemented on February 2, 2026.

Holding ISO certification does not allow one to assume meeting regulatory requirements for all markets.

FDA QMSR Guide

MedQraft discusses the necessary range and deliverables for QMS building, operation maintenance, and audit preparation by examining existing procedures and work records together.

This example does not substitute for a complete review of requirements according to the standard text.

Let's talk

Apply what you have read
to your product.

Tell us your product's current stage and the questions you need to review.

Discuss your questions ↗
MedQraft / Let's talk

Project inquiry

Start with your challenge.
We will work through it together.

Tell us your product's current stage and the support you need.
We will review the questions and define a suitable scope of support.

Contact@medqraft.co.kr ↗
Information: name, company, email, inquiry and service of interest · Purpose: responding to your inquiry · Retention: until the inquiry is resolved Read the privacy policy
Privacy policy

MedQraft / Privacy

Privacy policy

MedQraft processes only the information needed for website inquiries.
We delete the collected inquiry information when the inquiry is resolved.

Effective date: September 18, 2026

1. Scope and purposes of processing

This policy applies to visits and business inquiries at www.medqraft.co.kr.
We process personal information to review and respond to inquiries, discuss the scope of support, and operate the website reliably.
Customer business data stored in Q-Atelier is governed by the relevant service agreement and separate notices.

2. Information collected and retention

Required information
Name, email address and inquiry
Optional information
Company, selected service of interest, and contact or business details you provide in your inquiry
Collection methods
Website inquiry forms and email inquiries
Basis for processing
Consent to collection and use provided through the inquiry form.
Where necessary to fulfill a request relating to the formation or performance of a contract, we process information on the applicable legal basis.
Retention period
We retain inquiry information until the inquiry is resolved, then delete it without delay.
If information becomes part of a separate contract, we separately explain the required information and retention period.
Where retention is legally required, only the relevant information is stored separately.

You may decline to provide required information, but this will prevent submission of the website inquiry form.
You can make an inquiry without providing optional information.
Do not submit sensitive information unnecessary for the inquiry, such as national identification numbers or patient information.

3. Service providers and external services

Inquiries are forwarded from the website server through an email delivery service to our company mailbox.
We do not maintain a separate inquiry database in this processing workflow.

Vercel Inc.
Website hosting, server-side inquiry processing, operations and security.
Technical information such as IP address, request time, browser and request details may be processed.
Plus Five Five, Inc. (Resend)
Delivery of inquiry notification emails containing name, email, company, service of interest and inquiry details, and management of delivery logs
Gabia Hiworks
Receipt, storage and replies to inquiries in our company mailbox

We do not sell inquiry information or provide it for advertising purposes.
We do not disclose it for an independent third party's purposes unless there is a lawful basis, such as a legal requirement or separate consent.

4. Overseas processing and storage

Overseas cloud services are used to process website requests and deliver emails.
Information entered in an inquiry is transmitted over an encrypted connection upon submission.

Vercel Inc. / United States
Information is transmitted for inquiry request processing and hosting.
Privacy contact: privacy@vercel.com.
Operational records are subject to the retention periods of the services and settings used and Vercel's processing policies.
Vercel data processing information
Plus Five Five, Inc. (Resend) / United States
Information is transmitted upon submission to deliver the inquiry email and manage delivery records.
Privacy contact: privacy@resend.com.
Resend's published default retention period for emails and logs on its standard plans is 30 days.
Earlier deletion may be requested from the provider.
Resend retention and deletion information

Deleting inquiry emails from our mailbox and deleting technical records held by external providers involve different processes.
You may contact the person listed below about deletion, restriction of processing or overseas processing.
If you do not wish to use overseas processing through the website form, you may email us directly.
The processing policies of the email services used will still apply.

5. Deletion and safeguards

After confirming that an inquiry has been resolved, we delete the email and separately saved copies.
Printed materials, if any, are destroyed by shredding or another method that prevents reuse.
Where deletion of information held by an external processor is necessary, we submit a request through that provider's deletion procedure.

Access to personal information is restricted to staff who need it for their work.
We protect information through HTTPS transmission and account access controls.
We do not publish materials containing personal information in public repositories or on public pages.

6. Your rights

You may request access, correction, deletion, restriction of processing or withdrawal of consent by contacting the designated email address.
We will verify your identity to the extent necessary, process the request under applicable law, and notify you of the result.
If we cannot fulfill a request, for example because of a legal retention obligation, we will explain the reason.
For requests made through a representative, we may verify their authority.

7. Access information and external content

We use Naver conversion tracking to measure visits and completed inquiries attributable to Naver search advertising.
Technical information such as the visited URL, referring page, browser and cookies, and whether an inquiry was completed, may be processed.
The name, email, company and inquiry text entered in the form are not included in conversion events.
You can block or delete cookies in your browser.

Server access information may be processed for website delivery and security.
Vercel Web Analytics is used for anonymous visitor statistics on the introduction page and Insights.
Insights statistics aggregate article views, referral sources, countries and device types.
Visitor analytics do not use analytics cookies.
Names, emails, companies and inquiry text from the consultation form are not included in analytics events.
Instagram-specific links use UTM parameters to identify referral sources.
Loading external video or fonts on the website may transmit technical information, including IP address and browser details, to the relevant provider.

You can block or delete cookies and site data in your browser settings.
Some features or external content may be restricted depending on your settings.

8. Privacy officer and contact

Business
MedQraft / Representative: Byeonghwi Kim
Privacy officer and inquiry contact
Byeonghwi Kim
Email
Contact@medqraft.co.kr
Postal inquiries
Suite 222, 56 Geumto-ro 80beon-gil, Sujeong-gu, Seongnam-si, Gyeonggi-do, Republic of Korea (Geumto-dong, Widen Tower)

For privacy-related complaints, you may contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee for assistance.

9. Changes to this policy

Changes to processing purposes, information collected, retention periods or service providers will be published on this page with their effective date.

September 18, 2026: Website inquiry privacy policy first published

October 14, 2026: Added information on Insights visitor analytics and Instagram referral measurement