ISO 14155 Clinical Investigation Audit Checklist

An ISO 14155 clinical investigation audit checklist should help an auditor examine whether a medical device investigation is controlled, appropriately documented and supported by credible evidence. It should connect the investigation plan, participant protections, device use, data handling and sponsor oversight. A checklist is a navigation tool; it does not replace independent judgment, a defined audit scope or the applicable requirements.

Start with the investigation's purpose, device characteristics, sites and regulatory context. A premarket investigation of a new device and a post-market investigation may present different questions. Software-based devices and complex interfaces can introduce additional evidence pathways. Build the audit around what the device and study actually do, rather than copying a generic pharmaceutical checklist.

Confirm the applicable edition and framework

ISO's published ISO 14155:2026 information identifies a fourth edition replacing ISO 14155:2020. Publication of a new edition should not be treated as proof of an identical immediate legal transition in every jurisdiction. Confirm the edition, regional requirements, approvals and contractual expectations relevant to the investigation being audited.

The standard addresses clinical investigations of medical devices and does not generally apply to in vitro diagnostic devices. Avoid extending the checklist to a different product category without a justified framework. Record the criteria in the audit plan so that the auditee and auditor understand the basis for evaluating the sampled evidence.

Understand the investigation before selecting samples

Review the clinical investigation plan, device description, key assessments, important safety information and organizational responsibilities. Identify which activities involve the greatest potential consequence for participants or the credibility of results. Consider how the device is supplied, used, maintained, updated, returned or otherwise accounted for during the investigation.

Select samples that help test those relationships. A convenience sample of easy-to-retrieve records may miss the most informative cases. Include relevant changes, exceptions and handoffs where the scope permits. The related article on GCP auditing for medical device studies provides context for connecting independent examination with the investigation's actual operating model.

Review participant-facing processes

Examine the relevant consent, eligibility, communication and follow-up processes against the approved arrangements and applicable criteria. Follow how site staff identify the correct information and document that the required activities occurred. Assess whether changes to the investigation were communicated and implemented through the expected routes.

Look beyond the presence of a signed form. The audit question concerns whether the process can be reconstructed and whether relevant protections were maintained. Treat potential concerns according to their consequence and the evidence. The general principles in protocol deviation management help organize factual assessment and escalation without assuming a single reporting rule fits every investigation.

Trace the investigational device through use

Follow a sampled device or device-related record from receipt through relevant use and disposition. Check how the site identifies the intended device version, manages access and recognizes relevant changes or problems. Include software or configuration information where it affects how the investigational device functions or how results are generated.

Reconcile device information with investigation records, training and relevant accountability evidence. An auditor should be able to explain which device configuration was involved in a sampled activity. Where information is distributed between sponsor, site and technical systems, clarify how those sources are connected and which record is authoritative.

Distinguish device risks from investigation procedures

Ask how the team identifies and manages risks associated with device use and with study-specific procedures. Those categories can overlap but are not identical. A procedure performed only for the investigation can introduce considerations that are not captured by a narrow focus on the device's intended routine use.

Examine the relationship between the risk assessment, investigation plan, site instructions and actual conduct. A risk document is more useful when its controls are visible in operations. Critical-to-quality planning offers a related way to connect important study conditions with controls, owners and review evidence.

Test data and record traceability

Select important assessments and follow them through source information, device outputs, transfers, review and reporting. Understand transformations and corrections. Determine whether context needed to interpret an output remains available, particularly where data move between a device, software platform, vendor and study database.

For electronic processes, consider relevant computerized-system validation and audit-trail review evidence. The appropriate depth depends on the device and data flow. Do not assume that a successful technical test or a system's commercial availability alone demonstrates suitability for every investigational use.

Examine sponsor and vendor oversight

Review how the sponsor receives information, evaluates emerging issues and follows up decisions. Where vendors perform important activities, test whether responsibilities and handoffs operate as documented. Compare agreements, oversight records and practical examples rather than relying solely on a statement that a provider maintains an appropriate quality system.

Ask how recurring issues, relevant device changes and unresolved findings reach the people who can act. Vendor qualification and quality agreement resources provide related operational questions. Oversight should produce a clear understanding of material issues, not just a record that scheduled meetings took place.

Use change scenarios to test the checklist

Consider a hypothetical investigation in which a device configuration changes during conduct. Ask the auditor to follow the decision, applicable approvals, technical information, site communication and records of subsequent use. The exact evidence depends on the investigation and framework, but the exercise tests whether the checklist connects technical and clinical responsibilities. It also reveals whether the audit scope excludes an important interface. Record that limitation clearly if access or time prevents examination, rather than implying that an unreviewed area has been found satisfactory.

Report findings with evidence and useful follow-up

For each finding, describe the applicable criterion, observed condition, evidence and potential consequence. Make the scope of the conclusion clear. Distinguish a sampled exception from evidence suggesting a wider weakness, and explain any limits on what the audit could establish. Avoid implying certification or a guaranteed regulatory outcome from a single audit.

Agree proportionate follow-up and verify important actions through CAPA effectiveness checks. QA Insight's clinical audit services can support related planning and examination. A strong ISO 14155 audit checklist helps an independent reviewer test connected evidence while keeping the investigation's participants, device and scientific purpose in view.