# ISO 13485 measurement, analysis and feedback What clause 8 asks of feedback, complaint handling, reports to regulators, internal audit, process and product checks, and the data analysis behind CAPA. Source: https://sted.digital/docs/standards/iso-13485/measurement-and-analysis · Last reviewed 17 October 2026 · Strand Standards and regulations ISO 13485:2016 clause 8 asks you to plan the checks that prove your devices and system conform (8.1), then run feedback (8.2.1), complaint handling (8.2.2), reporting to regulators (8.2.3), internal audit (8.2.4), monitoring of processes (8.2.5) and of product (8.2.6), and analyse the data (8.4) to show where action is needed. ## The requirement in plain English **Planning (ISO 13485:2016 8.1).** You plan how you will monitor, measure, analyse and improve, so that you can show product conforms and the system works. That includes choosing methods and any statistical techniques. **Feedback (ISO 13485:2016 8.2.1).** A documented procedure gathers and monitors information on whether you met customer requirements, from production as well as after the device is in use. Feedback is an input to risk management and to product and process changes. Where a regulation requires you to learn from post-production experience, reviewing it is part of this process. **Complaint handling (ISO 13485:2016 8.2.2).** A complaint is any communication alleging that a released device falls short on identity, quality, durability, reliability, usability, safety or performance (ISO 13485:2016 3.4). A documented procedure covers receiving and recording information, deciding whether it is a complaint, investigating, deciding whether to report it to a regulator, handling the product involved, and deciding on corrections or corrective action. If you do not investigate, you record why. If someone outside contributed, such as a supplier, you share the relevant information with them. **Reporting to regulatory authorities (ISO 13485:2016 8.2.3).** Where a regulation requires you to report complaints that meet its criteria, or to issue advisory notices, a documented procedure says how, and you keep records of each report. The criteria and the deadlines come from the law, not the standard. **Internal audit (ISO 13485:2016 8.2.4).** A documented procedure sets up audits at planned intervals. The programme weighs each process's importance, its status and earlier results. Criteria, scope, frequency and methods are recorded. Auditors do not audit their own work. Managers of the audited area make corrections and take corrective action without undue delay, and follow-up verifies them. **Processes and product (ISO 13485:2016 8.2.5 and 8.2.6).** You monitor quality system processes and act when they miss their planned results. You check product at the planned stages against acceptance criteria, record who authorised release, and do not release until every planned check is done. For implantable devices you also record who performed each inspection or test. **Analysis of data (ISO 13485:2016 8.4).** A documented procedure collects and analyses data on feedback, product conformity, process and product trends, suppliers, audits and service reports, using appropriate statistical techniques. If the analysis shows the system is not working, it feeds improvement (ISO 13485:2016 8.5). This is guidance to help you understand the requirement, not legal advice. ## What good looks like A 40-person company makes a connected blood-pressure monitor and its app. Every support ticket, app review, sales report and distributor email lands in one inbox, and a trained screener decides within one working day whether it is a complaint. Each complaint record carries a reportability decision with its reason, signed by the regulatory lead, even when the answer is not reportable. Possible serious incidents go to the regulatory lead the same day, because the regulation's clock may already be running. Complaint trends are reviewed monthly by failure mode, model and lot. A post-market surveillance plan per device lists the sources and the thresholds that trigger a CAPA. The [internal audit](/docs/glossary/internal-audit) programme covers every process once a year, and design, complaints, CAPA and supplier control twice. Engineers audit quality processes and quality engineers audit engineering, and an external auditor covers the quality lead's own work. Each finding goes to corrective action with a due date, and the next audit checks it held. Product release is signed by a named quality engineer only when the release checklist is complete. Process data, such as first-pass yield and complaint response times, is charted monthly against targets. The quarterly data review ends with decisions: a preventive action, a supplier review, or no action with the reason. All of it reaches the management review, where feedback, complaints, regulatory reports and audits are required inputs (ISO 13485:2016 5.6.2). ## Evidence an auditor expects - **Feedback, complaint, reporting and data analysis procedures** (required, all four documented): the auditor checks they match what people do. - **Complaint records** (required): the complaint decision, investigation or the reason for none, the reportability decision and any corrective action. - **Reports to regulators** (required where made): the report, its date and the complaint it came from. - **Audit programme, plans, reports and follow-up** (required): risk weighting, auditor independence, findings closed and verified. - **Product release records** (required): acceptance evidence and the name of the person who released each lot or version. - **Data analysis outputs** (required): trends, the statistical method and the conclusion; charts without decisions draw a finding. - **Post-market surveillance plan and reports** (required by device regulations rather than the standard): sources, thresholds and actions taken. ## Common mistakes ### Complaints hiding in the support queue A software company treats bug reports as tickets, not complaints. An auditor samples the helpdesk and finds reports of wrong readings never assessed. Screen every channel against the complaint definition and record the decision. ### No reportability decision on non-reported complaints The file shows complaints that were not reported, but not why. Under audit or inspection, an unrecorded decision looks like no decision. Record the criteria you applied and who decided. ### The quality lead audits the quality system In a small company the quality lead audits everything, including CAPA and document control, which they run. Clause 8.2.4 forbids auditing your own work. Swap auditors between teams or bring in an external auditor for those processes. ### An audit calendar that ignores results The programme repeats the same schedule each year whatever the last audits found. The standard asks you to weigh status and earlier results. Audit more where findings, complaints or changes cluster. ### Analysis without conclusions Monthly charts are produced and filed. Nobody writes what they mean or what to do. Close each review with a decision, even if it is no action, and its reason. ## How Sted helps For ISO 13485 clauses 8.2 and 8.4 Sted's knowledge base carries the Customer Feedback and Complaints Procedure (PRC-CFC) with its Customer Complaint Record (REC-CCR), Customer Feedback Record (REC-CFR) and Complaint and Feedback Trend Review Record (REC-CFTR, suggested monthly), the Internal Auditing Procedure (PRC-IAP) with its Internal Audit Schedule (REC-IAS, suggested annually), Internal Audit Plan (REC-IAP) and Internal Audit Report (REC-IAR), the Post-Market Surveillance and Vigilance Procedure (PRC-PMSV) with its Post-Market Surveillance (PMS) Plan (REC-PMS), Post-Market Surveillance (PMS) Review Record (REC-PMSR) and Periodic Safety Update Report (REC-PSUR), and the Monitoring and Measurement Procedure (PRC-MMP) with its Monitoring and Measurement Framework Record (REC-MMFR) and Monitoring and Measurement Record (REC-MMR). Records are part of the Full Management System plan, and nothing is scheduled until an owner picks a first due date. Sted's knowledge base holds seven record templates under the Incident Management Procedure (PRC-IMP), among them the Information Security Incident Record (REC-ISI), the Data Protection Incident Record (REC-DPI), the Cardholder Data Incident Record (REC-CDI), the Medical Device Incident Record (REC-MDI), the AI / Algorithmic Incident Record (REC-AII) and the Incident Response Plan Test Record (REC-IRPT), which comes with a suggested annual frequency. Records are part of the Full Management System plan. 33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date. Only evidence from the last 12 months counts towards readiness. Sted holds complaint, audit and incident records. It does not decide whether a complaint is reportable or send a report to a regulator; your regulatory lead does. ## Related guides and terms - [Internal audit guide](/docs/guides/internal-audit): building a risk-based programme, with an ISO 13485 supplier-control audit example. - [Post-market surveillance and vigilance under EU MDR](/docs/standards/eu-mdr/post-market-surveillance-and-vigilance): the reporting criteria and deadlines that clause 8.2.3 points to. - [Improvement](/docs/standards/iso-13485/improvement): where complaints, audit findings and trends turn into corrective and preventive action. - [Internal audit](/docs/glossary/internal-audit): the term, and how ISO 13485's independence rule differs. - [Repeating records](/docs/product/repeating-records): how Sted raises trend reviews and audit schedules when they fall due. - [ISO 13485 hub](/docs/standards/iso-13485): how clause 8 fits the rest of the standard. ## Frequently asked questions Q: Is every customer support ticket a complaint under ISO 13485? A: No, but more of them are than most teams expect. A ticket is a complaint when it alleges a problem with a released device's identity, quality, durability, reliability, usability, safety or performance. A password reset is not; a reading that looked wrong is. Screen every ticket and record the decision. Q: How often must ISO 13485 internal audits happen? A: At planned intervals you set, with no number in the standard. The programme must weigh how important and how healthy each process is and what earlier audits found. Many small manufacturers cover every process once a year and audit design, complaints and CAPA more often. Q: Do we have to report every complaint to the regulator? A: No. ISO 13485:2016 8.2.3 asks for a documented procedure to report the complaints that meet a regulation's reporting criteria, such as serious incidents under EU MDR. You assess every complaint for reportability and record the decision and its reason, including when the answer is no.