Direct Answer
ISO 13485 top management — the person or group who directs and controls a medical device organization at the highest level — carries duties across all of Clause 5 of ISO 13485:2016: communicating the importance of customer and regulatory requirements, setting the quality policy and measurable objectives, defining responsibility and authority, appointing a management representative, ensuring internal communication, providing resources, and personally conducting management review. Since the FDA’s QMSR took effect on February 2, 2026, the records that show how leadership performs those duties are open to FDA inspection. The seven things experienced leaders most often miss are rarely about missing paperwork; they are about decisions that never get made.
The Blind Spot
The Leadership Team That Passes Every Audit and Still Misses the Point
Certified. Compliant. Quietly drifting.
The certificate is on the lobby wall. The surveillance audit closed with two minor findings. The management review happened on schedule, the minutes are signed, and the slide deck looks exactly like last year’s. And on slide fourteen, the same complaint trend has been climbing for three consecutive quarters while everyone in the room nodded and moved on.
That is the most common condition MSI finds in established medical device quality systems, and it is not a documentation failure. It is a leadership one. After 28 years of ISO consulting and 200+ audits attended, MSI’s experience is that mature systems rarely fail because a procedure is missing. They fail because ISO 13485 top management slowly stops using the system to make decisions and starts using it to produce records. The records keep passing. The business keeps absorbing the cost.
The stakes for that drift changed in 2026. Under the FDA’s Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference, the old exemption that kept management review records out of routine FDA inspection is gone. An investigator can now read how ISO 13485 top management actually behaves — what it was told, what it decided, and what it let slide. This article is not a how-to for running a first management review; MSI’s ISO 13485 management review playbook covers that. It is for leaders whose system is already running, and who want to know what they are not seeing.
Know the Requirement
What ISO 13485 Actually Asks of Top Management
Six sub-clauses. One accountable group.
ISO 13485 predates the harmonized structure used by ISO 9001, ISO 14001, and ISO 45001, so its leadership requirements sit in Clause 5, “Management responsibility,” rather than in a Clause 5 called “Leadership.” The difference matters less than the content. Every sub-clause names ISO 13485 top management directly, and most leaders who have been certified for years can recite the list without recognizing how much of it is a personal obligation rather than a departmental one. MSI’s overview of the ISO 13485 standard covers the wider architecture; the table below maps the leadership clauses against the assumption MSI most often hears in the room.
| Clause | What ISO 13485 requires of top management | What leaders often assume |
|---|---|---|
| 5.1 Management commitment | Provide evidence of commitment: communicate the importance of customer and applicable regulatory requirements, establish policy and objectives, conduct management reviews, ensure resources. | Signing the quality manual is the commitment. |
| 5.2 Customer focus | Ensure customer requirements and applicable regulatory requirements are determined and met. | Sales and regulatory affairs own this. |
| 5.3 Quality policy | Ensure the policy fits the organization’s purpose, includes commitment to requirements and to maintaining QMS effectiveness, and is communicated, understood, and reviewed. | The policy written at certification still works. |
| 5.4 Planning | Ensure measurable quality objectives, including those needed to meet regulatory and product requirements, are set at relevant functions and levels. | Objectives are a quality department report. |
| 5.5 Responsibility, authority, communication | Define and document responsibilities and authorities, appoint a management representative, and ensure internal communication about QMS effectiveness. | The management representative handles the system. |
| 5.6 Management review | Review the QMS at documented planned intervals against defined inputs and record decisions and actions. | The review is an annual meeting to get through. |
Read the right-hand column again. None of those assumptions produces an audit finding on its own, which is exactly why they survive. Each one quietly moves an obligation that belongs to ISO 13485 top management down to a function that has no authority to fulfill it. The seven misses that follow are what those assumptions look like in practice.
Clause 5, Written Down
Give Every Clause 5 Duty an Owner, a Method, and a Record
Leadership commitment is the requirement most quality systems describe in a sentence and prove with nothing. MSI’s ISO Procedure Templates and Guides library includes a Leadership and Commitment procedure written to the clause — editable Word, built on one architecture with the rest of the set, and covering ISO 9001, ISO 13485, ISO 14001:2026, ISO 45001, and ISO 7101. It turns top management’s duties into steps someone can follow and an auditor can trace.
Miss #1
Mistaking a Status Report for a Management Review
Reporting is not reviewing.
The single most expensive habit MSI sees in mature systems is the management review that has become a briefing. Every one of the twelve Clause 5.6.2 inputs is on a slide in front of ISO 13485 top management, the presenters are well prepared, and the meeting ends on time. What it does not produce is a decision. Clause 5.6.3 requires the output of the review to include decisions and actions on improvement of the QMS, improvement of product related to customer requirements, changes needed to respond to new or revised regulatory requirements, and resource needs. A record that lists data but no decisions does not meet that requirement, however polished it looks.
The tell is the action log. If the actions from the last three reviews are mostly “continue to monitor,” ISO 13485 top management is reviewing as an audience rather than as the owner. A useful test: for every input on the agenda, ask what the leadership team would have to see to change something. If no one can answer, the input is being reported, not reviewed. MSI’s article on management review benefits shows what changes when the meeting starts making decisions, and the management review procedure guide covers how to write the procedure so decisions are built into the format.
A management review counts only if ISO 13485 top management leaves the room with recorded decisions — owners, dates, and resources — on the four output areas Clause 5.6.3 names. Data without decisions is a status report, and under the QMSR an investigator can read the difference in the minutes.
Miss #2
Treating Regulatory Requirements as the Quality Department’s Job
Clause 5.1 names leadership first.
The very first duty Clause 5.1 assigns to ISO 13485 top management is communicating the importance of meeting customer requirements and applicable regulatory requirements. Not delegating it. Communicating it. Yet in many device organizations, regulatory change is something leadership hears about only when regulatory affairs flags a deadline, and the question in the room is “are we covered?” rather than “what does this change about how we operate?”
The QMSR is the clearest example. MSI’s coverage of the FDA QMSR rule and its alignment with ISO 13485 explains the mechanics: the final rule published in the Federal Register replaced the old Quality System Regulation, and 21 CFR Part 820 now incorporates ISO 13485:2016 by reference. For leadership, the practical consequence is that Clause 5 is no longer only a certification requirement. It is part of a federal regulation, and the FDA’s Compliance Program 7382.850 directs how investigators inspect it. The agency’s own QMSR FAQ confirms that management review, internal audit, and supplier audit records are no longer shielded from inspection.
Leaders who have absorbed this change — the ISO 13485 top management teams MSI sees adapting fastest — ask a different question. Instead of “did regulatory confirm we are compliant,” they ask “which of our regulatory obligations would we be unable to explain to an investigator ourselves?” When ISO 13485 top management can answer that, the Clause 5.1 commitment is real. MSI’s look at regulatory change management explains why registers maintained by one function tend to lag behind the business, and MSI’s article on QMS compliance versus certification explains why holding a certificate and meeting the requirements are not the same thing.
Miss #3
Hiding Behind the Management Representative
Appointed by leadership. Not a replacement for it.
Clause 5.5.2 requires ISO 13485 top management to appoint a member of management who, irrespective of other responsibilities, ensures QMS processes are documented, reports to leadership on effectiveness and improvement needs, and promotes awareness of regulatory and QMS requirements. It is a valuable role. It is also the most common way leadership accountability leaks out of the system.
The pattern looks like this: the management representative prepares the review, presents the review, writes the minutes, and owns most of the actions. Top management attends, asks a few questions, and signs. On paper, the review happened. In substance, the management representative reviewed the system and briefed the executives. The standard does not allow that substitution, and the QMSR makes the substitution visible to anyone reading the record. MSI’s article on the ISO management representative covers the role in depth; for leaders, the point is simpler. The representative reports to ISO 13485 top management. The decisions belong to the people being reported to.
Clause 5.5.1 reinforces this. It requires leadership to define, document, and communicate responsibilities and authorities, and to document the interrelation of everyone who manages, performs, and verifies work affecting quality, with the independence and authority needed to do it. An organization chart is not that document. A management representative who has the responsibility but not the authority to move resources is the clearest sign that ISO 13485 top management has delegated the obligation without delegating the power to fulfill it.
Free Guide · Rev Oct 2026
Five Moves That Put Leadership Back in the Chair
MSI’s free 5 Steps to a Decision-Ready ISO Management Review was written for exactly this problem. Step two is literally “put leadership in the chair,” and the other four — run it like a board meeting, bring the expertise, cover every required input, and communicate the results — are what keep it there. Share it with your management representative and your CEO before the next review; it reads in minutes and reframes who owns the meeting.
Miss #4
Setting Quality Objectives That Never Move a Resource
Measurable is not the same as meaningful.
Clause 5.4.1 requires ISO 13485 top management to ensure that quality objectives — including those needed to meet applicable regulatory requirements and product requirements — are established at relevant functions and levels, are measurable, and are consistent with the quality policy. Most established systems meet the letter of that requirement. The objectives exist, they have targets, and someone tracks them.
What leaders miss is the connection to Clause 5.1(e) and Clause 6.1, which require ISO 13485 top management to ensure the availability of resources needed to implement and maintain the system. An objective that has been red for four quarters without a single resource decision attached to it is not an objective. It is a decoration. The question MSI asks in a leadership session is blunt: name the last time a missed quality objective changed a budget, a headcount, a schedule, or a priority. If no one can name one, the objectives are not connected to how the business is actually run.
The fix is not more objectives; it is fewer, sharper ones with a pre-agreed trigger. When an objective misses for two consecutive periods, it comes to the management review with a resource option attached, and leadership decides — fund it, change it, or retire it with a documented reason. That one rule converts a reporting metric into an instrument ISO 13485 top management actually uses. MSI’s piece on management system oversight shows what happens when governance bodies stop asking what their metrics are for.
Miss #5
Hearing About Complaint Trends After They Become Reports
The earliest signal arrives the slowest.
ISO 13485 builds an early-warning system into its measurement clauses, and most leadership teams never see it working. Clause 8.2.1 requires the organization to gather and monitor feedback on whether customer requirements have been met, and states that this information serves as a potential input into risk management for maintaining product requirements and improving product realization. Clause 8.2.2 requires documented complaint handling, including evaluation of whether a complaint must be reported to regulatory authorities under Clause 8.2.3.
By the time a complaint trend reaches the management review deck, it has usually been aggregated, normalized, and smoothed into a quarterly number. The signal that a single field engineer noticed in week two arrives at ISO 13485 top management in week twelve, often after the decision window has closed. The leaders who catch these trends early are not reading more data. They have set a threshold that pulls specific signals to their attention between reviews — a complaint category crossing a rate, a feedback theme appearing at more than one customer, a reportability decision that took longer than it should have.
Because ISO 13485 has no general risks-and-opportunities clause, product risk management is where these signals are meant to land. MSI’s article on ISO 13485 risk management explains why the FDA now inspects that connection, and its guide to how CAPA works under ISO 13485 shows how a signal should travel from complaint to corrective or preventive action. When ISO 13485 top management asks to see one complaint traced from intake through risk file to CAPA closure, it learns more about the system than any summary slide can show. The same logic applies to supplier signals; MSI’s look at why a supplier management program fails in year two traces the pattern upstream.
Miss #6
Trusting Records Nobody Has Audited
A clean record is not a verified one.
Every management review input depends on records, and every record depends on someone having checked that the process behind it works. Clause 8.2.4 requires internal audits at planned intervals to determine whether the QMS conforms to planned arrangements, ISO 13485, and applicable regulatory requirements, and is effectively implemented and maintained. In practice, the audit program in many established systems has narrowed: the same processes get audited every year, others have not been touched since certification, and leadership assumes the coverage is complete because the audit schedule exists.
“If you are not doing internal audits on an annual basis, you are not compliant.”
— Diana Lynn, Founder and President, MSI
That is the expectation registrars bring across the industry: every requirement of the standard internally audited on an annual cycle. Organizations that follow their procedures faithfully often believe they are compliant, and they are not, because no one has independently verified that the procedures still match the work. For ISO 13485 top management, the question is not whether internal audits happen. It is whether the audit program covered every requirement this year, and whether the findings actually reached the review. MSI’s internal audit services and its guide to the ISO 19011:2026 internal audit procedure cover how to build that coverage, and the ISO 13485 2-Day Internal Auditing course builds the in-house auditors who sustain it.
Device-Only or Combined Scope
Walk Into the Review With Every Input Already in Its Place
A leadership team cannot decide on what it cannot see. MSI’s Management Review Tool Kits give you a presentation deck and a matching Word minutes form built from the clause, with the clause reference printed under every section — so no input goes missing and every decision has a place to be recorded. Choose the ISO 13485 edition for device-only scope, or the combined ISO 9001 and ISO 13485 edition, now updated to ISO 9001:2026, if you hold both certificates.
Miss #7
Letting the Facts Get Argued Away
Systems deteriorate one explanation at a time.
The last miss is the hardest to see from the inside. A record shows a problem. Someone in the room has a reasonable explanation — the data period was unusual, the customer is difficult, the supplier just changed — and the item moves to “monitor.” No one lied. No procedure was broken. But the fact on the page did not change anything, and the next time the same signal appears, there is a precedent for explaining it away.
“Having systems, acting on what the records are reporting, and never letting anyone deny the facts is what prevents good systems from deteriorating.”
— Diana Lynn, Founder and President, MSI
Clause 5.5.3 requires ISO 13485 top management to ensure that appropriate communication processes exist and that communication takes place regarding the effectiveness of the QMS. Most organizations, and much of ISO 13485 top management, read that as a newsletter or a dashboard. Its real test is whether bad news travels upward intact. When the people closest to the work learn that problems raised at the bottom are softened by the time they reach the top, they stop raising them, and the records start to describe the system leadership wants rather than the one it has.
ISO 13485 top management can check this directly. Pick one recurring issue from the last year and ask who first knew about it, when, and how long it took to reach the review. When that interval is long, the failure is not in the meeting; it is in a handoff nobody logged. MSI’s The Portrait is an independent operational assessment built for exactly this condition — commissioned by the executive who owns the outcome, it follows real work through every handoff to locate where a visible problem stopped moving. MSI’s article on leadership tenacity explores why resilient systems depend on leaders who keep asking.
Measure It
A 10-Minute Self-Check for ISO 13485 Top Management
Seven questions. Honest answers. One score.
Use this before your next management review. Score each question 0 if the answer is no, 1 if it is partly true or inconsistent, and 2 if you could show an auditor the evidence today. The score is not a certification predictor; it is a quick read on how much of the system ISO 13485 top management is actually steering.
| # | Question for top management | Evidence that earns a 2 |
|---|---|---|
| 1 | Did our last three management reviews each record decisions — not just “monitor” — on all four Clause 5.6.3 output areas? | Action log with owners, dates, and resources |
| 2 | Could our CEO explain, without notes, which regulatory requirements changed this year and what we did about each? | Regulatory change items in review minutes with decisions |
| 3 | Does the management representative have the authority to move resources, documented in Clause 5.5.1 records? | Documented authority, not only responsibility |
| 4 | Has a missed quality objective changed a budget, headcount, or priority in the last twelve months? | A recorded resource decision tied to an objective |
| 5 | Do defined complaint or feedback thresholds reach leadership between reviews? | Escalation criteria and at least one escalation record |
| 6 | Did internal audits cover every requirement of ISO 13485 in the last twelve months? | Audit program coverage matrix with no blank rows |
| 7 | Can we name one recurring issue, who first knew, and how long it took to reach the review? | A traced example with dates |
12–14: leadership is steering the system; protect the habits that got you here. 7–11: the system is sound but drifting toward reporting; pick the two lowest-scoring questions and make them agenda items. 0–6: the system is producing records more than decisions, and the next audit or inspection is likely to read it that way. In MSI’s experience across 80+ certifications supported, the organizations that improve fastest are not the ones with the highest first score — they are the ones whose ISO 13485 top management scores the check honestly and assigns owners to the lowest items the same week.
Dual-Certified? Read This
ISO 9001:2026 Adds to the Leadership Load
Same leaders. A wider brief.
For device organizations that also hold ISO 9001, the brief for ISO 13485 top management widened on September 16, 2026, when ISO 9001:2026 was published. ISO 13485 is unchanged, but Clause 5.1.1 of the new ISO 9001 edition adds an explicit leadership duty: promoting quality culture and ethical behaviour. That is not a boardroom-only topic. MSI’s position is that quality culture and ethical behavior are every department’s issue, and the new edition’s awareness requirements reach everyone doing work under the organization’s control. MSI’s article on ISO 9001 ethics requirements for 2026 covers what that means in practice, and its list of unethical business practices gives teams concrete examples to discuss.
For an integrated system, the practical step is to start the transition at the next management review rather than in a separate project. Put the data you already have against the ISO 9001:2026 requirements on the review slides, mark what you cannot yet show as TBD with an owner and a date, and let ISO 13485 top management make those items decisions. The free ISO Transition Risk Scorecard rates transition readiness before that meeting, and MSI’s ISO 9001 and ISO 13485 integrated system article shows how to keep one system serving both certificates.
The MSI Difference
How ISO Consulting Helps ISO 13485 Top Management See What It Is Missing
An outside view of an inside problem.
The seven misses in this article are hard to see from inside the leadership team because each one feels reasonable in the moment. Experienced ISO consulting gives ISO 13485 top management an outside reader who has seen the same patterns across many organizations and knows what a registrar or investigator will notice first.
Management Systems International (MSI) has supported organizations for 28 years, with a track record of 80+ certifications supported, 200+ audits attended, and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare, and other regulated industries. That record matters here for one reason: MSI has watched how registrars read leadership evidence, and increasingly how the QMSR changes what investigators expect to find. MSI’s ISO 13485 consulting for medical devices works with leadership teams at every stage, and its industries served page shows where that experience was earned.
The most efficient first step is a planning session. MSI reviews your management review procedure and recent records, scores the seven areas in this article, and gives ISO 13485 top management a prioritized list of decisions to make — whether or not MSI does the follow-on work. Organizations that want MSI to carry the system can explore SurePath for implementation and certification or SureResults for ongoing internal audits and maintenance. Executives who prefer to start with concepts can watch MSI’s free ISO Executive Decision Briefs. To talk it through, call MSI at 760-434-9141.
Talk to Someone Who Has Sat Through 200+ Audits
Find Out Which of the Seven Your Leadership Team Is Missing
In one planning session, MSI’s ISO consulting team reads your last management review record the way an auditor or FDA investigator would, scores your leadership evidence against the seven areas above, and — if you also hold ISO 9001 — maps what the 2026 edition adds. You leave with a short, prioritized list of decisions for top management.
Prefer to start in-house? Use the ISO procedure template library for the Leadership and Commitment procedure and the management review tool kit that matches your certification scope for the review itself, or call 760-434-9141.
Quick Answers
ISO 13485 Top Management: Frequently Asked Questions
Who is top management under ISO 13485?
Top management is the person or group of people who directs and controls the organization at the highest level, the definition ISO 13485 takes from ISO 9000. In most device companies that is the CEO or general manager and the executive team. ISO 13485 top management cannot hand its Clause 5 duties to the management representative or the quality department; it can delegate tasks but keeps the accountability.
What are top management’s responsibilities under ISO 13485 Clause 5?
ISO 13485 top management must communicate the importance of customer and regulatory requirements, establish the quality policy and measurable quality objectives, ensure customer and regulatory requirements are determined and met, define and document responsibilities and authorities, appoint a management representative, ensure internal communication about QMS effectiveness, ensure resources are available, and conduct management reviews at documented planned intervals.
Can the management representative run the management review instead of top management?
The management representative can prepare and organize the review and report on system performance, but cannot replace ISO 13485 top management in it. Clause 5.6 requires top management to review the QMS and record decisions. A review presented, decided, and minuted by the representative alone does not meet the requirement, and under the QMSR that record is open to FDA inspection.
Does the FDA QMSR change what ISO 13485 top management must do?
The QMSR, effective February 2, 2026, incorporates ISO 13485:2016 by reference into 21 CFR Part 820, so the Clause 5 duties are now part of a federal regulation for device manufacturers selling in the US. It also removed the exemption that kept management review, internal audit, and supplier audit records out of routine inspection, so the evidence of how top management performs those duties can now be reviewed by FDA investigators.
How often should ISO 13485 top management review the quality management system?
ISO 13485 requires management review at documented planned intervals and does not set a frequency. Annual reviews are common, while many mature systems hold semi-annual or quarterly reviews. Whatever interval is chosen must be documented in the procedure, and ISO 13485 top management should also set thresholds that bring significant complaint, feedback, or regulatory signals to its attention between reviews.
Does ISO 9001:2026 affect ISO 13485 top management?
ISO 13485 itself is unchanged. Organizations that also hold ISO 9001 face new leadership expectations in ISO 9001:2026, published September 16, 2026, including an explicit duty for top management to promote quality culture and ethical behaviour. MSI recommends starting the transition at the next integrated management review, putting available data against the new requirements and marking missing items TBD with owners and dates.
Sources
References
- ISO 13485 Medical Devices — International Organization for Standardization
- ISO 9001:2026 Quality management systems — Requirements
- Quality Management System Regulation (QMSR) — U.S. Food and Drug Administration
- QMSR Frequently Asked Questions — U.S. Food and Drug Administration
- Medical Devices; Quality System Regulation Amendments, Final Rule — Federal Register
- 21 CFR Part 820 — Electronic Code of Federal Regulations
- Compliance Program 7382.850, Inspection of Medical Device Manufacturers — FDA
- International Medical Device Regulators Forum (IMDRF)
- ISO 13485 quality resources — ASQ
- Global Accreditation Cooperation (Global ACI)
- Baldrige Performance Excellence Program — NIST
About Management Systems International (MSI)
Management Systems International (MSI) is a veteran-owned, female-owned ISO consulting and training firm based in Carlsbad, California, with a Southeast branch in Atlanta, serving clients nationally and internationally. For 28 years, MSI has helped organizations implement and maintain ISO 9001, ISO 13485, ISO 14001, ISO 45001, and ISO 7101 management systems, with 80+ certifications supported, 200+ audits attended, and 600+ professionals trained. Call 760-434-9141.
