Robert House Medtech Quality

Medical device and SaMD startups

Walk into your first audit with a design history file you can defend.

I help early-stage device teams build ISO 13485 design controls, ISO 14971 risk files and IEC 62304 software records alongside development. When the auditor samples a requirement, the trace is complete.

Book a readiness call Get the free checklist
Design history file / Traceability matrixSample
NeedDescriptionInputOutputVerificationStatus
UN-01Clinician reads the result in under 10 secondsDI-04DO-11VER-08Traced
UN-02Device alerts the user when a sensor failsDI-06DO-14VER-12Traced
UN-03Patient data is encrypted in transitDI-09DO-17missingGap
Finding: UN-03 has a design output but no verification record. An auditor sampling this requirement would raise a nonconformity under clause 7.3.6.

Where startups get stuck

Does any of this sound familiar?

01

The audit is booked and the file is still drafts.

Design work happened, but the records that prove it are scattered across drives, tickets and inboxes.

02

Requirements do not trace to tests.

User needs live in slides, specifications live in Jira, and nobody can show which test verifies which requirement.

03

The risk file stopped at version one.

The hazard analysis was written early and has fallen behind every design change since.

04

Software ships faster than the paperwork.

Your team releases every sprint and is unsure what IEC 62304 expects from an agile process.

Services

A clear path from first call to certification audit.

Most clients follow the first three steps in order. Internal audits are available on their own at any time.

Step 1 ยท Start here

Readiness Assessment

An independent review of your quality system and design records against ISO 13485 and the MDSAP audit model.

  • Document review and team interviews
  • Gap scoring for every applicable clause
  • Prioritised remediation plan with effort estimates
  • Read-out session with your leadership
Step 2

Design Controls Build Sprint

I close the gaps from the assessment by building the records with your engineers, using your real product.

  • Design and development plan
  • Inputs, outputs and review records
  • Verification and validation plans
  • Traceability matrix and risk file update
Step 3

Audit Readiness Retainer

Ongoing support that keeps your records current as the design changes, right up to the certification audit.

  • A set number of hours each month
  • Design change and CAPA support
  • Mock audit and interview coaching
  • Support during the audit week
Standalone

Internal Audit

A planned internal audit under clause 8.2.4, performed by an auditor independent of the work being audited.

  • Audit plan and checklist
  • On-site or remote audit
  • Graded findings with objective evidence
  • Report accepted as audit evidence

What you receive

Findings you can act on the same week.

The assessment report scores each area of your design controls and risk management, explains what an auditor would raise, and ranks the fixes by impact. Your team knows exactly where to start.

  • Every gap tied to a clauseEach finding cites the requirement and the evidence that is missing.
  • Effort estimatedEach fix carries an estimate, so you can plan around your audit date.
  • Plain languageWritten so founders, engineers and investors can all follow it.
Readiness Assessment / Summary of findingsSample

Share of applicable requirements fully met, by area

Planning7.3.2
80%
Design inputs7.3.3
55%
Design outputs7.3.4
60%
Design review7.3.5
40%
Verification7.3.6
35%
Validation7.3.7
20%
Design changes7.3.9
30%
Risk managementISO 14971
45%
0%50%100%
Areas below 40% are flagged and scheduled first in the remediation plan.

Built for software teams

Design controls that fit how your team already ships.

I led software at a medical device company through ISO 13485 and MDSAP audits, and I know how to fit design controls into sprints, pull requests and release pipelines, so compliance records come out of the work your engineers already do.

  • IEC 62304 lifecycleSoftware development plan, safety classification, SOUP management and release records.
  • Agile with traceabilityRequirements, tests and approvals linked in the tools your team uses today.
  • Cybersecurity and dataThreat modelling and privacy controls aligned with Health Canada and FDA expectations.

Common questions

Before you book.

When should we start preparing for our first audit?

Six to twelve months before the audit date gives enough time to build records alongside development. Teams with less time can still prepare, and the assessment will show what to prioritise.

We already bought a template pack. Do we still need help?

Templates give you the structure. Auditors look for evidence that the documents describe what your team actually did, and building that evidence is where I help.

Does this cover the FDA QMSR?

Yes. The FDA Quality Management System Regulation took effect on February 2, 2026 and incorporates ISO 13485 by reference. I flag the places where US requirements add to the standard.

Can you act as our quality lead?

Yes, through the retainer. It is set up to transfer the system to a named owner on your team before or soon after certification.

Do you work with teams outside Ontario?

Yes. Most work is remote, and I work with device companies across Canada and with Canadian teams selling into the US.

Find out where your file stands.

Book a 30 minute call. Tell me your device, your class and your target audit date, and you will leave with a clear view of what to fix first.

Book a callFree design controls checklist