ISO 13485 certification in Bangladesh helps medical device businesses demonstrate how they control quality across the activities included in their audit scope. A factory may need to show how it approves components, monitors production and releases finished lots. A distributor may need to show how it selects suppliers, manages stock and traces a complaint back to the right shipment. This guide takes both teams through the decisions they need to make before requesting a certification audit.
Start with your products, locations and responsibilities. Then use a recent transaction to see whether your existing records support the scope you want on the certificate. The sections below show which evidence to gather, what to ask when comparing audit quotations, and how to keep the system working after certification. For a broader comparison of management system standards, see Technotex’s guide to ISO certification in Bangladesh.
Define the device families, activities and sites
ISO 13485 certification in Bangladesh starts with a precise description of what your organization does in the medical device supply chain. A manufacturer that designs and assembles a device has a different scope from an importer that stores and distributes finished goods. A contract manufacturer may perform a particular process to a customer’s specification, while a service company may install or maintain equipment. Write down your actual responsibilities before selecting procedures or requesting an audit quotation.
List the device families and the activities performed for each. For one family, the organization might control purchasing, assembly, final inspection and release. For another, it might receive the finished device, check documents, store it and ship it to customers. If the same warehouse handles both families, specify which incoming checks, storage conditions and release rules apply to each. A simple activity map can make those differences easier to see than a single broad scope sentence.
Next, identify the facilities that perform or control those activities. A head office may approve suppliers, a separate production site may perform assembly, and a third party may provide a specialized process. Record who decides whether each output can be accepted. In particular, distinguish the team that performs a task from the organization that is responsible for defining and checking its requirements.
Review your proposed scope with the people who handle orders, production and customer communications. Ask them to identify exceptions, such as products stored temporarily off-site, repair work performed away from the facility, or packaging controlled by an external provider. These details may affect how the scope is written and where evidence needs to be sampled. Update your map when activities or responsibilities change.
Use the same description when requesting quotes so providers can respond on the same basis. Ask them to confirm the standard, sites, activities and any scope assumptions in writing. For broader context, see Technotex’s guide to ISO certification scope.
| Operating model | Evidence to gather | Question to resolve before the audit |
|---|---|---|
| Manufacturer | Process records, acceptance criteria and release approvals | Which manufacturing steps are performed at each site? |
| Importer or distributor | Supplier approval, receipt checks and lot or serial records | Who owns complaint escalation and stock isolation? |
| Service provider | Competency records, service reports and equipment checks | What criteria determine whether a serviced device can return to use? |
Separate certification, device authorization and buyer requirements
The ISO 13485 standard overview describes a quality management system for organizations that need to demonstrate their ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. The quality system can help an organization control its responsibilities, but the specific obligations depend on the device, role and market. Identify those obligations with the responsible team and confirm them through authoritative sources before making a compliance decision.
Set up a requirements register. For each device family, record the markets served, your organization’s role, the authority or customer that specifies the requirement, and the owner responsible for checking it. Link to the source of the requirement and record when it was reviewed. If a customer has its own packaging or traceability rules, identify them separately and explain how changes to those rules are communicated to the people doing the work.
A common mistake is to accept an order before deciding who owns a regulatory responsibility. For example, a customer and supplier may agree on a production specification but leave unclear who approves a labeling change. Document who evaluates the change, who communicates it to relevant parties and which version is approved for release. If the responsibilities depend on a written agreement, retain the agreement and check that the operating procedure follows it.
Where a device will be sold in multiple markets, avoid assuming the same evidence can be reused in every submission. Confirm the scope and status of the certificate, and ask the buyer or responsible regulatory professional what additional evidence applies to the transaction. Keep marketing claims consistent with the certificate and the applicable requirements.
A short review checklist can help purchasing and sales teams route questions. Ask which device family is involved, which market it is for, who controls the specification, what approval or evidence is requested, and who will resolve open points. The answer may involve a quality-system certificate, a product document or another obligation. Keep the final decision and its source with the relevant order or project.
Run a gap review using completed work
A gap review works best when the team looks at a recent order or batch and follows the decisions it made. Pick a product family in the proposed scope. Trace the order from the approved specification through purchasing, receiving, production or handling, inspection and release. Identify where employees relied on instructions, who could approve exceptions and whether the completed records support the decisions they describe.
For each activity, classify the finding in plain language. A control may already work and have accessible evidence. A control may work but be difficult to demonstrate because the records are incomplete or scattered. Or the organization may need to design a new control. Avoid recording a general gap such as “documentation needs improvement” when the actual issue is that a receiving record does not identify the specification revision. Naming the problem makes it easier to assign an owner and verify the fix.
Ask people to demonstrate how they find the current instruction at the place of work. A supervisor may know where to find an approved drawing, while a temporary worker may rely on a printed copy on the bench. If you replace a document, check that both routes lead to the current version. The ISO document control guide explains how to organize approvals and identify obsolete copies.
Use a simple action log with the finding, affected product or process, owner, due date, and proposed evidence of closure. Prioritize work that can affect device conformity, traceability or release decisions. A low-impact formatting problem can be handled separately from an issue that leaves the organization unable to determine which lots were shipped. Set an interim control when appropriate and have a qualified owner confirm what can proceed while an issue is resolved.
Review progress against completed records. A revised form is an output of the action. Evidence that employees used the revised form, and that a reviewer could reconstruct the decision, shows whether the change addressed the gap. Sample a second order after the change and compare it with the original example. See the gap analysis guide for a method of turning review findings into a practical plan.
| Check | Example evidence | Typical owner |
|---|---|---|
| Define the scope | Approved site and activity list | Management |
| Test traceability | Completed forward and backward trace exercise | Warehouse and quality |
| Review outsourced activities | Signed specifications and supplier monitoring record | Purchasing |
| Close priority gaps | Action log with verified evidence | Process owners |
Control purchased materials and outsourced processes
Start supplier control by identifying which purchased items or services can affect device conformity. Record the item, supplier and any outsourced activity involved. A packaging supplier, a calibration provider and a contractor performing a specialized operation may require different kinds of approval and monitoring. Define the evidence that fits the item or service instead of relying on a single questionnaire for every vendor.
Purchasing documents should communicate the requirements that the supplier needs to fulfil. Identify the item, the approved specification or revision, acceptance criteria and any documentation expected with the delivery. If the supplier must notify you before changing a material, facility or method, make the notification arrangement clear. Ensure that people receiving the goods can find the applicable purchase and acceptance information without relying on informal messages.
Decide what to check at receipt and what to verify through another method. A receiving check may confirm identity, quantity, lot information and required documents. A more detailed verification may need sample inspection, review of supplier records or an evaluation of the provider’s process. Choose the method according to the applicable requirements and risk. If an item arrives without a required record, define who can place it on hold and who decides the next step.
Where a process is outsourced, name the organization that approves the output and the people who review the provider’s evidence. Keep the agreed requirements and review process accessible. A supplier certificate may help answer a specific question about the provider, while the purchase controls still need to explain how your organization verifies the product or service it receives.
Track information about repeat defects, incomplete records and late notifications. Review whether issues occur with a particular supplier, item or order pattern. When the same problem recurs, ask whether the specification is clear, whether receiving uses the correct revision, and whether the supplier is receiving timely feedback. Record the decision to continue, restrict or reconsider the approval and the evidence supporting it.
As a practical test, choose a recent purchase order and ask a colleague to identify the approved supplier, applicable specification, receiving check and any action taken. If those records use different identifiers, add a cross-reference that allows the transaction to be followed reliably.
Make traceability and release decisions easy to reconstruct
Identify what needs to be traceable for each device family and activity in scope. The required level can vary with the device, the applicable requirements and the organization’s responsibilities. Define the identifiers used in purchasing, production, storage and distribution, and show how they connect. A consistent lot or serial reference can help a team locate relevant records without relying on the memory of the person who handled the order.
For a manufacturer, start with an incoming lot and follow it into production records and the finished output. Check whether the record identifies which specification applied, the acceptance checks performed and who approved release. For a distributor, start with the delivery received and follow it into stock records and a customer dispatch. Confirm that any hold, return or correction is recorded in a way that prevents unintended shipment.
Explain what happens when a record cannot be matched. For example, an inspection result may use a work order number while a dispatch record uses a different identifier. Create a reliable mapping and designate an owner who can correct errors. Keep the original evidence and record the reason for a correction. A record that was edited without explanation may be difficult to interpret months later.
Release controls should specify who can approve the decision and what evidence must be available first. Test how the process handles a missing result, a failed check or a request to ship before review is complete. An employee should be able to determine whether the item is accepted, on hold or awaiting a decision. Define how that status is represented in the system and at the physical location if both are used.
Try a trace exercise in both directions. From a finished item or dispatch, locate the applicable incoming and process records. Then start with a selected incoming lot or service event and identify affected output or orders. Record how long the exercise took, where information was unclear and who will improve the process. A successful exercise should demonstrate that another trained employee can repeat the trace.
Review the records with the people who use them, especially when a shift changes or a new system is introduced. If an identifier is difficult to read or enter consistently, address that issue before it appears repeatedly in the evidence. Small improvements in how records are captured can make the audit trail easier to follow.
Connect complaints, nonconformities and corrective action
Define how a complaint is received, recorded and routed. The receiving team should capture enough detail to identify the device or transaction, the nature of the issue and when it occurred. Assign a qualified owner to review the information, determine the next step and assess applicable reporting responsibilities where relevant. Keep the procedure aligned with the organization’s role and the obligations it has identified for the device and market.
Separate an immediate response from a corrective action. An immediate response could involve identifying affected stock and preventing unintended distribution while the issue is evaluated. A corrective action addresses the cause of a problem where action is appropriate. Record what was done, who authorized it and how the result will be checked. If an item is returned or replaced, keep the transaction linked to the complaint record so the customer response and internal review can be followed together.
Use examples from real work to test your process. Suppose two customers report similar packaging damage. The organization may need to compare the affected product lots, approved packaging details, handling records and delivery conditions. A review should consider whether both reports point to the same issue or only appear similar. Record the evidence for the decision and identify what is still uncertain.
When action is needed, select a practical way to verify effectiveness. If the change is to a packaging check, examine later orders processed under the revised instruction. Compare the results against the problem originally reported. If the evidence is incomplete, keep the action open or schedule another review. A closure date should reflect the point at which the responsible team has a reasonable basis for its decision.
Protect personal information and confidential customer material when assembling evidence for an audit. A central action register can refer to restricted supporting records by ID. Give access to the people who need it for the review and use the appropriate method when sharing records externally. Ask the audit contact what evidence is needed, and prepare a sample that demonstrates the process without exposing unrelated information.
Technotex’s guide to audit nonconformities gives additional examples of writing a finding, assigning an owner and checking whether the response works.
Prepare for internal review and the certification audit
An audit programme should reflect the activities and sites in scope. List the areas to be audited, relevant criteria and the people responsible for carrying out the review. Consider past findings, changes and the significance of the work when planning coverage. A team should be able to explain what was checked, why it was selected and which evidence supports the result.
Ask an internal auditor to follow a sample across departments. For example, trace an approved product specification through purchasing and inspection, then verify whether the release decision refers to the correct evidence. Interview the people who perform the checks. A procedure may describe the intended workflow, while interviews and records help establish whether employees can follow it under normal conditions.
Discuss the results at management review. Include relevant information about performance, customer feedback, supplier issues and the status of corrective actions, based on the requirements applicable to the system. Present enough context for management to make decisions. If complaints rose after a new product was introduced, show the period and device family involved rather than using a single count for the entire operation. Record decisions, responsible owners and follow-up dates.
For the external assessment, ask the certification body to confirm the proposed scope, evidence requests, site schedule and contacts. Provide accurate information about the roles performed, the products or device families involved, applicable outsourced processes and the size and organization of the operation. Discuss where documents will be available and who can explain them. Keep arrangements in writing so you can compare them with the quotation and your internal preparation plan.
The Technotex guide to Stage 1 and Stage 2 audits explains the broader assessment process. Follow the arrangements confirmed for your organization and address findings using traceable evidence. Ask how the certification decision is communicated and how ongoing audits are planned. When a certificate is issued, verify the organization name, scope and site information before giving a copy to a buyer.
An audit evidence index can identify the location of each record, the person responsible for it and the version in use. Keep it small enough to maintain when documents change. Use it to make evidence easier to find, then check that the underlying records show the real work employees performed.
Worked example for a Bangladesh medical device supplier
Consider a hypothetical supplier that imports finished devices, stores them at one facility and distributes them to institutional customers. It does not perform assembly or design for the device family in this example. Its quality manager starts by describing the work the organization controls, including purchase requirements, receiving, storage, dispatch, complaints and returns. The organization confirms its responsibilities with the relevant parties for the products and markets involved.
The team chooses one incoming shipment to map. The purchase record shows the approved supplier and product reference. The receiving record confirms the identity and lot information, the condition of the delivery and the documentation the organization expects. If a check is incomplete, the item is kept out of available stock while the responsible person reviews the evidence. The warehouse team records the hold in the stock system and communicates the status during the shift handover.
Next, the team follows a delivery to a customer. The dispatch record shows the product and lot, quantity and destination. When a customer reports a problem, the complaint reviewer uses those details to link the issue back to the shipment. The reviewer can identify what documentation was checked at receipt and whether any similar issue was reported. The team records the immediate response, the decision about any further review and the owner for follow-up.
During internal audit, a reviewer asks a second employee to trace the same transaction. The employee can find the dispatch record but cannot link it to the receiving record because the warehouse report uses a shortened supplier reference. The team adds a documented cross-reference and updates the receiving instruction. A later trace of another delivery verifies whether the change works.
At management review, the team considers how much time trace exercises take, how often stock is placed on hold and where records are hard to retrieve. It decides to train staff on the updated process and to sample records after the next intake. The decision is recorded with an owner and a review date. The example shows how a quality management system can be built around the activities a supplier actually performs. A manufacturer or service provider would develop different controls and evidence for its own responsibilities.
When preparing for certification, the supplier uses its activity map, scope proposal and evidence index to discuss the assessment. It links the findings from internal review to completed actions and uses the agreed scope when it communicates with customers.
Compare quotations and plan after certification
Request a written quotation using the same scope information for each provider. Include the legal name, sites, activities, device families, employee information and outsourced processes as relevant. Mention any existing certification or customer deadlines. Ask the provider to identify what it has assumed and which factors might change its assessment plan or price.
Compare the scope, audit arrangements, reporting and follow-up included in the offer. Check whether travel, additional sites or changes to the proposed scope are handled separately. Ask about expected preparation and the process for addressing findings. A quotation can be easier to compare when it separates initial assessment, later surveillance and any additional charges. Technotex’s ISO certification cost guide provides more questions to use during a review.
Before making a decision, confirm the certification body’s applicable accreditation scope and any acceptance conditions set by the buyer. A buyer may have requirements about the issuing body, standard, scope or sites. Retain the buyer’s written requirements and check them against the proposed arrangement. Review the Technotex accreditation and recognition page for the applicable scope, and raise questions with the certification body directly.
Plan how responsibilities will continue after initial assessment. Keep the scope, device and supplier records current as work changes. Schedule reviews of complaints, traceability and corrective actions. Make sure the people who own these processes understand what information they need to collect and when to bring an issue to management. Where a change may affect the scope or assessment arrangements, discuss it with the certification body according to the applicable process.
Set up a simple handover for the next cycle. The handover can identify the main changes since the last review, open actions, evidence available and upcoming dates. Ask each owner to check the accuracy of the information. A calendar reminder alone cannot confirm that controls are still working. Sample completed work and record where the system needs adjustment.
For service details, visit the Technotex ISO 13485 certification page. When you contact Technotex, include your organization’s role, device families, proposed activities and sites so the discussion can start with a clear scope.
Frequently asked questions
What is ISO 13485 certification in Bangladesh?
It is third-party certification of a quality management system against ISO 13485 for the medical device activities and sites listed on the certificate. The audit tests how the organization implements and maintains its system. A manufacturer, distributor or service provider should confirm that its intended activities fit the certificate scope before agreeing to an audit programme.
Can an importer or distributor apply for ISO 13485 certification?
An organization can discuss certification for the quality management activities it actually performs, such as supplier approval, receiving, storage, distribution and complaint handling. The audit scope should reflect the products, sites and activities the organization controls. Give the certification body a clear account of outsourced operations and any activities handled by the legal manufacturer.
How much does ISO 13485 certification cost in Bangladesh?
Request an itemized quotation. Audit fees depend on the scope, number of sites, personnel, complexity and audit time. Compare the initial audit, travel, surveillance and recertification separately. Budget for your own implementation work, such as training, documentation, process changes and supplier assessments, as well as the certification body’s audit fees.
How long does it take to get ISO 13485 certified?
Timing depends on how much of the system is already in use, how quickly evidence can be collected, the audit schedule and the time needed to close findings. Ask for a schedule covering readiness work, internal audit and management review, both initial audit stages and any follow-up after findings. Assign an owner and due date to each activity.
What documents are reviewed during an ISO 13485 audit?
Expect the auditor to sample documents and records relevant to the scope. Typical examples include the quality manual, procedures, training records, supplier evaluations, product acceptance records, traceability evidence, complaints and corrective actions. Keep completed examples available so the auditor can follow a process from the initial request through the final decision.
Can ISO 9001 and ISO 13485 share the same quality processes?
Organizations can share processes such as document control, training, supplier evaluation and internal audits when the shared process covers each applicable requirement. Map the requirements separately, identify where medical device controls need additional detail, and agree the certification scopes with the certification body. A shared record system can make evidence easier to retrieve during each audit.
Does ISO 13485 certification cover medical device registration?
Certification covers a quality management system within the scope on the certificate. Device registration or authorization is a separate decision made under the applicable rules for the device and market. Before preparing a tender or export submission, confirm the requirements with the relevant authority and request the buyer’s exact wording for the certificate and scope.
How can a buyer verify an ISO 13485 certificate?
Check the certificate number, issuing body, legal entity, covered locations, scope, standard and current status. Use the issuing body’s verification channel and, where accredited certification is required, verify the body’s accreditation scope. If your supplier’s listed activities or sites differ from those on your purchase order, ask the supplier and issuer for clarification before approving the certificate.
Discuss your certification scope with Technotex
Have your device families, site addresses, activities and buyer requirements ready when you contact the certification team. See the Technotex ISO 13485 certification service page to discuss your proposed audit scope and request an itemized quotation.
