Complete Guide - ISO 13485 - 2016 QMS For Medical Device-1

Your Complete Guide to ISO 13485:2016 Quality
Management System for Medical Devices
Written by: Brian Newbery
Founder of Fast-Track QMS Consultants
A long time ago working for a company where I was about to transition from leading R&D
projects to moving into head of Quality, I was told by a wise colleague to be just aware that
a lot of companies consider having a Quality department and a quality management system
as a necessary evil, and a must have just to meet regulations.
Over time I have seen many companies to different degrees, believe and act as if this were
indeed a fact and not the misconception that it really is. Fortunately there are ways to
change this thinking of management, and I can share some best practices on how this can
be achieved in other articles that I have available.
The point of me bringing this up at the beginning of this article is to encourage you, as you
read through each section covering all elements of the ISO 13485:2016 Standard, is not to
just to think of the items as regulatory requirements, but how they can be beneficial to
achieving high quality of your medical device and provide the user and patient with a safe
product that meets their needs and intended use.
My recommendation is for you to think about how each element of ISO 13485:2016 and your
quality management system can help guide you on not only meeting the regulatory
requirements, but also the safety, product quality, and business needs, including cost and
time savings, customer and employee satisfaction and competitiveness.
Ok, so now let’s get into each of the 5 elements of ISO 13485:2016, with the goal to help you
understand and comply with the requirements, and so you can focus on true quality.
4 5 6 7 8
Quality Management Resource Product Measurement
management responsibility management realization analysis &
system improvement
https://fasttrackiso13485.com 1 of 37 P020.1
Your Complete Guide to ISO 13485:2016 Quality
Management System for Medical Devices
CONTENTS
3. Introduction Design & Development Transfer

Design & Development Changes
5. General Requirements and
Design & Development Files
Documentation Requirements
Quality Manual 24. Purchasing
Medical Device File
Control of Documents 26. Production & Service Provision
Control of Records Control of Production
Cleanliness of Product
9. Management Responsibility Installation & Servicing Activities
Management Commitment
Sterilization
Quality Policy
Validation of Processes for Production
Responsibility
Identification
Management Review
Traceability
14. Resource Management Customer Property

Preservation of Product
16. Product Realization – Planning
31. Monitoring & Measuring Equipment
16. Customer-Related Processes
32. Measurement, Analysis/Improvement
17. Design & Development Customer Feedback & Complaints
Design & Development Planning Internal Audit
Design & Development Inputs Control of Nonconforming Product
Design & Development Outputs Analysis of Data
Design & Development Review Corrective and Preventive Action
Design & Development Verification
Design & Development Validation 37. Final Thoughts
Introduction
One frequently asked question from start-up medical device companies, and even
some established business, is what countries require the ISO 13485:2016
No simple answer to that question, but generally. compliance with ISO 13485:2016
is required by countries in Europe and Asia, UK, Canada, Australia, and many
other countries. ISO 13485 is accepted as the basis for CE marking in the EU.
Medical devices marketed in the United States, however, must meet the
requirements of the FDA’s Quality System Regulation (QSR). This also will be
changing in the not too distant future as the FDA is working towards harmonizing
its medical device quality system regulation, 21 CFR Part 820, to ISO 13485:2016
ISO 13485:2016 is a globally reconized regulatory and quality standard for medical
device companies, and is based on ISO 9001 with additions for companies
involved in any part of the life cycle of medical devices. It adopts the process
model concepts of Plan, Do, Check, Act, and is designed for medical device
companies of all sizes and all product classifications.
It was issued to support medical device companies in designing a QMS that

establishes and maintains the effectiveness of their processes. It ensures the
consistent design, development, production, installation and servicing of medical
devices that are safe for patients and meet their intended purpose.
So in addition to meeting the requirements of ISO 13485:2016

here are some of the main benefits of implementing this QMS.
Global recognition of your medical device company
ISO 13485:2016 is recognized by the Global Harmonization Task Force (GHTF)

and has become the most recognized QMS Standard globally for the medical
device industry. Achieving Certification by one of the world’s leading Certification
Bodies will help you promote your company, and which is essential for a start-up
medical device company.
The ISO Certificate helps to assure customers that the company has a good robust
quality management system and helps to provide them with the confidence in your
medical device quality.
Effective Quality Management System
For a quality management system to be effective it needs management and

employee involvement.
Key processes in your quality management system need to include; quality goals
and regular monitoring of those goals, a feedback process, document controls,
design and development process, internal audits and a corrective action process,
along with many other elements.
ISO 13485:2016 has all of this covered within the 5 elements, and with total
involvement from senior management on down, it can be very effective in helping
to provide quality products and producing a continues improvement culture.
Process and Quality Improvements
Continuous monitoring, measuring and analysis within the QMS, in order to drive
improvements in product and processes, and to ensure conformity and
effectiveness of the quality management system is a key element of the ISO
13485:2016 Standard.
This can drive process improvements as well as improvements through listening

and reacting to the voice of the customer through feedback and complaint
handling.
Improved Involvement of Employees and Top Management

For a quality management system to be truly effective it’s a lot more than just
following the ISO 13485:2016 Standard requirements. It’s also fully understanding
the intent of each element, and this should then, if carried out with passion and
commitment, greatly improve the involvement of management and all employees.
Now let’s look at the ISO 13485:2016 requirements in more detail:
General Requirements
Element 4.1 General requirements, sets the tone and intent, for the
ISO 13485:2016 medical devices quality management system standard, and
states that the company shall document a quality management system, and
maintain its effectiveness in accordance with the requirements of the Standard and
applicable regulatory requirements.
Key requirements I would like to emphasize here is; document a quality

management system and maintain its effectiveness. Also applicable
regulatory requirements.
These are all part of the 5 elements of the standard. Another requirement is for the
organization to document the role(s) undertaken by the organization.
Documentation Requirements
Documentation of the quality management system process along with records as

required by the procedures is extremely important, and if you have worked in
quality for more than a day, you must have heard someone say, “ if it isn’t
documented, then it didn’t happen.”
Most people are not big fans of documentation, and it’s critical that all involved in
following the processes covered in the QMS procedures, and ISO 13485:2016
Standard, and those responsible for completing the records, understand fully the
importance and value of these requirements.
Documentation is required to define the processes, produce and maintain records

to demonstrate the processes are being followed, and provide as evidence during
audits or investigations for CAPA’s, customer complaint investigations, etc.
A key to success and consistency with documentation is to establish a functional

document management system that is not too burdensome, is well managed and
controlled, and follows all the ISO 13485:2016 requirements’ as well as
appropriate regulatory requirements.
In today’s high tech world it may well be worth considering using one of the many
eQMS systems that are available. This is becoming a very popular option even for
start-up medical device companies.
Just need to keep in mind that any software eQMS applications need to be
validated prior to use.
Fast-Track QMS Consultants can provide guidance on which eQMS to consider

and see our Services and Partner page for details.
Quality management system documents can be shown in a pyramid

structure as shown below.
Quality Manual
The Quality Manual is a key foundational document in your quality management

system and serves as a guide to your QMS. It needs to be well written and easy to
read. Don’t make the mistake of many companies and make it too lengthy and
difficult to navigate.
Reading the Quality Manual is a good way to start off the training for new
employees that will be involved in the quality management system. Also for any
external audit, the auditor will be asking right up front for a copy of the manual.
The Quality Manual should cover a summary of each section of ISO 13485:2016
and how the company meets that requirement, and be written in a general policy
format.
The ISO 13485:2016 Standard includes the following requirements for the
Quality Manual
• Description of the scope of your QMS, including details of and justification for
any exclusion or non-application.
• List of documented procedures or reference to them, which is how I

recommend you meet this requirement.
• Description of the interaction between the processes of the QMS.
• Outline of the structure of the quality management documentation. (Fig. 1)
For more on a Quality Manual for ISO 13485, download our eBook by
clicking on the link below:
Writing a Quality Manual that meets ISO 13485:2016
Medical Device File
For every medical device type or device family there needs to be Medical Device
File established, and maintained that includes, or referencing documents, that
contain the following:
• Description of the product, its use, purpose, labeling and instructions for use.
• Specifications of the product.
• Specs and procedures for manufacturing, storage, handling and distribution.
• Procedures for measuring and monitoring
• As appropriate procedures for installation and servicing
Control of Documents
Having a good documentation procedure which defines your controls for all quality
management system documents and records is essential and needs to define the
following:
• Review and approval prior to use and after any revisions

• Identification of current revision level and history of changes, and applicable
documents are available at point of use.
• Ensure documents remain legible, identifiable and do not deteriorate over time
• Control of all required external documents that support your QMS
• Control of obsolete documents to prevent unintended use and retention

periods for at least one copy of obsolete documents.
Best practice for QMS documentation is to establish and follow a thorough and
functional document management system for your company, that meets your
requirements and the ISO 13485:2016 Standard, as well as applicable regulatory
requirements, but without being burdensome.
For a start-up medical device company this can be a challenge if they don’t have
the resources and/or experience to develop such a quality management system.
This is where an experienced consultant like Fast-Track QMS Consultants can be
a major benefit.
Also worth considering for both a start-up and established medical device
company, is using an eQMS which can manage your documentation and allow you
to better focus on developing and manufacturing high quality products.
Fast-Track QMS Consultants can work with you on this and help in the selection
and implementation of your eQMS. See our Partner page on our website.
Control of Records
Records require very similar controls, as those for documents, and provide the
evidence that specific procedures were followed and in some cases the results of
carrying out the procedure, i.e., inspection and testing procedures and records.
One additional requirement for QMS records is defining the required record
retention period. This needs to be document and controlled and using an eQMS
system can be a very efficient way of controlling your QMS records.
Management Responsibility
A good and effective quality culture has to be supported and promoted from the
top down, and needs to have clear, communicated and ongoing commitment from
executive management.
In my experience, I have seen a company where the employees were dedicated

skilled workers with a quality mindset, but unfortunately the quality system was not
supported by the executive management, and they were at risk for potential major
issues with regulatory bodies as well as customers and patients.
Fortunately I have experienced more companies where the full support and
commitment for the quality management system and product quality was present
and visible to all employees. This was a significant enabler, in making these
companies successful, and resulting in a reputation for high quality products.
Management Commitment
Two very important parts to management commitment, and I would suggest the
first, and critical component is the true vision and understanding of just how
important the top-down commitment of quality is to a medical device company, and
second, is being able to show evidence of this commitment as required by the ISO
Standard.
Evidence of this commitment can be shown by:
• Communicating to the organization just how important quality is to the

customer.
Many ways this can be done, and one of the best examples I have seen, is a
company that would on occasion, invite surgeons from local hospitals to give a
talk on the importance of quality to all employees. Part of that presentation was
the doctor asking employees to just imagine it was members of their families,
or themselves, being treated with the use of the medical device they had
designed and built. As you might imagine that was very effective!
• Establishing and communicating the Quality Policy
• Quality Objectives that are monitored and communicated to all employees
• Active participation in Management Reviews
• Ensuring the availability of qualified personnel
Customer focus
Top management, often referred to as executive management, needs to set the
example for all employees on just how important it is for the company and for
customers to have an effective quality management system. A big part of this is for
management to ensure that customer requirements and applicable regulatory
requirements are determined and met.
The final customer for a medical device is the patient, and this needs to be the
focus all through the QMS from design and development of the medical device,
through manufacturing, distribution, feedback on the device, post market
surveillance, and all aspects of the quality management system.
Quality Policy
Having a Quality Policy is both a requirement of ISO 13485:2016 and a good way
to communicate management’s commitment to quality, and to maintain the
effectiveness of the quality management system. It needs to be applicable to the
purpose of the organization. The policy should be designed not just by the quality
leader but include in its drafting the members of the senior management team.
It may not be practical for all employees to be able to recite the policy word for
word, but it needs to be communicated throughout the organization and everyone
should know where its posted in their area and be able to point to it if asked.
I have found one best practice is to include the Quality Policy in the Quality Manual
and to include as one of the inputs for your Management Review meeting, at least
once a year to review the Quality Policy for continued suitability.
Below is a sample quality policy just to provide an idea on potential content:
QUALITY POLICY
Company xyzzy will consistently provide products that meet or exceed the
requirements and expectations of our customers. We will meet all
appropriate international quality standards, and regulatory requirements.
We will actively pursue continuous quality improvement and programs,
that enable each employee to perform their job right the first time, every
time.
Responsibility, Authority and Communication
Top management has the responsibility at the highest level, to ensure the quality
management system is fully implemented and is effective. This includes appointing
a member of management to be the Management Representative, and who has
the responsibility and authority to ensure the QMS is fully documented, and for
reporting to top management on the effectiveness of the QMS, and areas that
need improvement.
Another important responsibility for top management, and the Management
Representative, is communication throughout the organization of the required
regulatory requirements and the effectiveness of the QMS.
Here are some of the most effective ways and best practices I have seen for
communicating the above, just to provide you with some ideas:
• including quality performance updates at regular daily production meetings on

the manufacturing floor, as well as staff meetings
• quality performance indicator updates posted on a regular basis, often
monthly, throughout the facility
• an annual all employee communication week that includes quality, safety and
other business updates
• employee recognition by top management for their contributions to quality
improvements
• at monthly employee communication meetings executive management, hand
out awards to recognize manufacturing areas for best improvement against
quality objectives. Would also include presentations by management on quality
performance and any updates on regulatory or quality system requirements
Management Review
Every medical device company needs to conduct planned management reviews,

and they are a requirement of ISO 13485:2016 and FDA.
All too often, and perhaps more than just about any other quality system
requirement, these meetings are considered by management as a must do, check
the box activity.
I would encourage any organization that fits that description, to find ways of
making these management reviews constructive, informative, and where required,
action oriented.
My experience has been that there should not be any big surprises from
management reviews, if, the company is doing a good job of communicating and
discussing ongoing quality updates on a regular basis.
However conducting an overall review of all of the required inputs can still be
beneficial at least annually.
Some would suggest it should be every quarter, and for myself having experience
with companies that conducted reviews quarterly, twice a year and annually, I
would recommend, that for an established mature quality management system,
that once or twice a year is likely ok. and for start-up medical device companies
once a quarter might be fine.
Executive management who are on board with the companies quality culture will
embrace reviews of the overall quality management system, including review of
the quality policy, quality objectives and results and overall status and
effectiveness of the QMS.
Management Review Inputs should include
• Status of action items identified at previous Management Reviews.

• Review of Quality Policy
• Quality Objectives and Scorecard.
• Customer feedback and customer complaints.
• Audit results, Internal and External.
• Manufacturing process performance.
• Product monitoring and measurement.
• Corrective and Preventive Action status.
• New or revised Regulatory requirements.
• Reporting to Regulatory authorities.
• Changes that might impact the Quality System.
• Recommendations for improvement.
• Supplier performance.
• Training and resource requirements.
Management Review Outputs should include
• Improvements required to maintain the suitability, adequacy, and effectiveness

of the Quality Management System and its processes.
• Product or process modification plans to address customer requirements.
• Resource requirements.
• Changes to respond to applicable new or revised Regulatory requirements.
• Conclusion as to continued suitability and effectiveness of the QMS.
If you would like to purchase our Management Review procedure or any

other of our available SOP templates, click below link to our website:
SOP Templates available for Purchase including Management Review
Resource Management
Resource management under element 6 of the Standard covers the following:

• Provision of resources
• Human resources
• Infrastructure
• Work environment and contamination control
All of the above resources are very important and play a major part in effectively
managing your medical device business, and producing a high quality, conforming
product that you and your customers expect and need.
This includes the need for the company to determine and provide the resources
required to implement and maintain the effectiveness of the quality management
system, including meeting applicable regulatory and customer requirements.
For human resources that will be performing work that can affect product quality,
the focus rightly so, is on hiring competent personnel based on appropriate
education, training, skills and experience.
Procedures need to be in place for training and establishing the competence of

personnel. Also needs to include the requirement for communicating awareness of
the negative effect that their work can have on the quality of the product, if not
performed properly.
Training records and other appropriate records of personnel need to be maintained

and are frequently subject to any external audits.
Another key point is the need for methods to check the effectiveness of training
based on the level of risk associated with the work being performed.
Best practice I can recommend, is to start with a baseline on training needs and
document in a training matrix, covering all employee job functions, including
management positions, and listing the specific training required for those positions.
Details on education, experience etc. can be part of the Job Description for each
position, and training plans for key positions should also be documented, as well
as having an annual training plan for the company.
Infrastructure: suitable to support the quality and conformity of the medical

device, also needs to be determined and documented. This includes buildings,
utilities, process equipment including software, and supporting services. The work
environment if it can affect product quality needs to be controlled, and this includes
any specific clothing and health requirements for personnel.
Where appropriate there needs to be documented procedures for the handling of

contaminated product, including any suspected or potentially contaminated
product.
I know of a medical device manufacturing plant that was closed down for weeks
due to contamination. Fungi was detected on wooden pallets on a raw material
incoming shipment, not immediately being removed from the facility, which then
led to potential contamination of the whole facility.
Product Realization- Planning
This is a major element of ISO 13485:2016 and describes how your company
designs and develops, manufactures and delivers the product.
Planning involves the documentation, including records, of one or more processes

for risk management throughout the product realization process. Also the following
areas are part of this planning process:
• The quality objectives, specifications, and product acceptance criteria;

• Processes and resources required for product realization;
• Infrastructure and work environment requirements;
• Verification, validation, monitoring, measurement, inspection and testing,
storage, distribution, and traceability for the product;
Customer-Related Processes
So I think everyone would agree, that understanding what the customer needs
from your product is one key to success. Defining and documenting these
requirements is fundamental to your quality management system. Failing to do this
well increases the risks to your business and to the quality of the product.
You could have a great medical device design but if does not meet the customers
needs then you’re not going to be successful. Let’s look at the customer related
processes as defined in element 7.2
Quality Management System processes directly related to the customer and

required under ISO 13485:2016 include the following:
• Determination of requirements for your product

• Review of requirements related to the product
• Communication with customers
Design and Development
It is a requirement that you have documented procedures for design and

development. The diagram below shows the different stages.
Risk management and design reviews are also key parts of the design and
development methodologies and I cover those in more detail below.
Also worth noting is that the design and development process as defined in the
ISO 13485:2016 Standard is very similar to that with the FDA 21 CFR Part 820.30
requirements for design controls
Design and Development Planning
So your medical device design and development project proposal has executive
management approval and now it’s time to start the formal design project, and one
following each of the ISO 13485:2016 7.3 requirements.
A well-managed design and development project should have a formal

documented plan outlining the scope of the design efforts and which includes the
following:
Selection of a Project Leader and team members
The best practice that I have seen frequently, and have been part of, is the use of
a cross functional team for Design and Development projects. It should not be a
solo effort on the part of R&D.
The full-time team members will most often be only from R&D with other
department representatives getting involved as required. The size of the team and
represented areas will depend on the complexity of the device design and may
also require that outside suppliers be involved.
All team members need to be trained in the procedures and requirements for
Design and Development.
Design and Development Inputs
Design Inputs come from the User Requirements, and define performance criteria,
functional requirements, safety and usability, as well as features of device design.
Design Inputs also need to include the following:

• regulatory requirements and standards depending on your intended markets
• any applicable outputs from risk management
• information and lessons learned from previous similar designs, as appropriate
• comparable competitive products as appropriate
Design Inputs must be clear and capable of verification and validation.
It is best practice to consider how you will verify or validated each of these design
inputs at the time you are establishing those inputs. Its referred to sometimes as
“simultaneous engineering” with can provide benefits including multidisciplinary
collaboration and a fast-track design process.
Design and Development Outputs
As your Design and Development project progresses you will start to develop your
Design Outputs. These are the specifications for the device and provide the
information for purchasing, manufacturing and any installation and service
provision. It can be in the form of engineering drawings, specification sheets etc.
Each of the design Outputs need to correspond and meet the documented and
approved Design Inputs. Design Outputs should also include:
• Contain or reference to acceptance criteria

• Identify key characteristics to ensure product safety
• Packaging and labeling and if required instructions for use
Design Outputs also need to be in a form suitable for verification against the
Design Inputs and need to be documented and approved before release.
Design and Development Review
Medical Device companies need to consider design reviews, not as checking a

box, but adding real value to help design a medical device that meets user needs
and provide a successful design.
Design Reviews are also a regulatory requirement to meet ISO 13485:2016 as

well as FDA.
They are also a way to ensure and document the design and development process
is on track and meeting planned expectations.
Design Reviews are conducted throughout the project as shown in the diagram
below.
Design
User
Needs Review
Design
Input
Design
Process
Design
Verification Output
Medical
Device
Validation
FDA Design Controls Waterfall Diagram
Design and Development Verification
First let’s clarify any potential confusion between the meaning of verification versus
validation. According to the FDA, they define them as follows:
Verification: Means confirmation by examination and provision of objective

evidence that specified requirements have been fulfilled.
Validation: Means confirmation by examination and provision of objective

evidence that the particular requirements for specific intended use can be
consistently fulfilled.
So as mentioned earlier, when you’re developing the Design Inputs you should
have a good idea and plan how to conduct Design Verification. The basic goal is to
prove by inspection and testing that the Design Outputs meet the Design Inputs.
Plan your Design Verification and document that plan before you begin the
inspection and testing process.
Document the results and indicate pass or failure of requirements along with any
required follow up actions.
Design and Development Validation
Design Validation is to confirm that the medical device you have designed,
consistently meets the design specifications, user needs and intended uses. This
means you should be involving the potential customers and end users to provide
you documented feedback on the design, and if it meets their needs.
Validation testing can be performed under actual or simulated conditions and must
be performed using product that was manufactured using final production
equivalent documentation, materials and processes. This also means that the
manufacturing, testing and inspection process need to have been completed, and
as appropriate, all of the required Process Validations.
It’s always best practice to have established early on in the project, a Master
Validation Plan, that would include all the required Process Validations and Design
Validations. This MVP needs to include for the Design Validation activities, how
many end users are required for the validation, what type of testing is to be
performed, acceptance criteria, etc.
Design validation must be completed before commercial distribution of the device.
Design and Development Transfer
Design and development transfer is not a single event that occurs once a design is
complete and validated, but should start early in the design and development
process.
As shown in the diagram below it is more of a simultaneous activity and can start
as soon as parts of the design and manufacturing process become finalized.
For any company this approach makes sense, and for a start-up medical device
company this is critical for the fast-track approach. Any time a partial design
transfer takes place, a design review should be held first, and the final transfer also
preceded by a design review and all documented.
Design and Development Changes
As a normal part of your design and development process there will be changes
you make to your medical device design during development. It is necessary to
control these changes during the design and development pre-market phase.
These changes need to be controlled, validated, reviewed, and documented in
your DHF.
Once the design is finalized and released through the Design Transfer process,
any new changes being made will need to follow a documented procedure
for control of design changes.
That means you need to have processes and procedures in place to ensure:
• There is a formal controlled process for requesting and managing a change

• Reviews and approvals of requested changes
• Verification and Validation of the change as required
• Documenting the change
A risk assessment should be carried out for all but the simplest of changes and
completed before the design change process begins. The formal risk assessment
can help guide the design as well as its verification and validation plans.
A review of design changes along with the risk assessment should include
evaluation of the effect of the change on the product, including product in process,
and product already distributed.
A regulatory assessment may also be required, depending on the nature of the

change requested. If it’s a new market for your medical device, the regulatory
requirements may be different and would need to be considered.
For more on Design and Development, you can download our eBook by
going to our website: Click here
Design and Development Files
It is a requirement that a design and development file be maintained for your

medical device. These are often referred to as Device Master Records (DMR’s),
following the FDA terminology.
All activities related to the design and development project are to be maintained in
these files and kept current with any design changes.
The Design and Development File, or Design History File (DHF), which it is
commonly referred to, will have been updated continually as the team works its
way through the product design and development.
It contains or references records generated that demonstrate the products

conformity to design and development requirements, and any changes that were
made. The file(s) will include documents and records for the following:
• User needs and Design Inputs

• Design Outputs
• Design Reviews
• Design Verification and Validation
• Design Transfer
• Design Changes
Purchasing
Supplier approval and ongoing management of suppliers for medical device

companies is another one of those critical processes, which if done right can help
you manufacture your medical device to the high quality you and your customers
are expecting.
Unfortunately there are some medical device companies, including start-ups as
well as mature companies, that don’t give supplier approval and management the
priority it needs.
This can cause lengthy delays in product production and distribution, as the
supplier works on corrections to rejected material, and even more serious, product
recalls due to failure of supplier material on distributed product.
Your company needs to have as a requirement of ISO 13485:2016 7.4

documented procedures covering the purchasing process. These procedures need
to include the entire purchasing process from the selection and approval of
suppliers, all the way through to the confirmation that purchased product received
conforms to specifications.
This is another area of the quality management system where risk needs to be
considered, and the selection of suppliers and criteria used should be based on
the risks associated with the medical device and the material being purchased.
The diagram below outlines the basic steps that should be followed for supplier
selection and management.
Need for Supplier Supplier Supplier Monitoring

new Risk Approval Approval of
supplier Assess Process Performance
Learn more on Supplier Approval and Management by downloading our

eBook. Click on the link below:
Supplier Approval and Management
Production and Service Provision
Control of Production and Service Provision
This element, for control of production, and as appropriate for service provision, is
to ensure that the manufacturing of your medical device is planned, carried out,
monitored, and controlled, all to ensure that the product conforms to the required
specifications.
The level of production controls should be based on risk and communicated and
controlled through various documentation including, procedures, work instructions,
process monitoring, including SPC, specifications and inspection and test
procedures.
Each product and production process should be well defined and documented,
including acceptance criteria. Not until the release criteria has been met should the
work in-process be released to the next process, or for final product, released for
distribution.
Cleanliness of Product
For any type of product you would expect it to be clean, but of course for a medical
device this can be especially critical and depending on the type of medical device
will require certain levels of cleanliness. This needs to be well defined in
specifications and the manufacturing cleaning processes defined and documented.
Procedures are required for cleanliness of product if the medical device:
• Requires cleaning before sterilization or its use;

• Process agents need to be removed during the manufacturing processes;
• Device is supplied non-sterile and will be cleaned prior to sterilization or use;
• Product application is for use non-sterile, but cleanliness is significant for use.
Installation and Service Provision
If your medical device is of the type that requires installation and/or servicing, you
need to have documented procedures covering these activities. These procedures
will be part of your medical device file.
This includes establishing installation acceptance criteria and provisions to verify

correct installation. These should be part of defining design and development
inputs and developed during the design and development project. Records of
installation shall be maintained.
If your medical device requires servicing, then you need to define servicing
requirements, specifications, and procedures for doing so; these items are part of
the medical device file.
Servicing also requires review of records for activities carried out by the company
or by an approved service supplier to see if any of the information should be
considered as a complaint and/or to be used as an input to the improvement
process.
Sterilization:
For medical devices that are sterilized and/or use sterile barrier packaging, the
sterilization process must be validated prior to implementation in production.
Refer to ISO 11607-1 and 11607-2 for specific sterilization requirements.
Sterilization requirements need to be part of the design and development project

starting with inclusion in the design inputs. Verification and validation of the
sterilization process also to be included in the design project, and be successfully
completed prior to design transfer to production. Any changes to the sterilization
process after this will need to be revalidated prior to implementing the change.
Records of each production lot or batch after sterilization and including sterilization
process parameters shall be documented and traceable to each production lot or
batch and be part of the products manufacturing records.
Validation of Processes for Production and Service Provision
ISO 13485:2016 7.5.6 states the following requirement for process validation:
The organization shall validate any processes for production and service provision
where the resulting output cannot be or is not verified by subsequent monitoring or
measurement and as a consequence, deficiencies become apparent only after the
product is in use or the service has been delivered.
The US FDA Quality System Regulation defines process validation as:
Process validation means establishing by objective evidence that a process

consistently produces a result or product meeting its predetermined specifications”
Very often it can be beneficial due to risk, overall efficiency and costs to carry out
process validation even though process verification is carried out. The decision
tree below is a guide to the decision process.
In most cases, other than the simplest validations, a cross-functional team should
be formed to plan and oversee the validation activities. Just a very general
guideline, in my experience the magic number for team efficiency is trying to not
go over 5 to 7 team members. Its ok to bring in other area experts occasionally as
required, e.g. regulatory, microbiologist, marketing, etc.
Members of the validation team will depend on the process being validated but can
include personnel with expertise in, and representing:
• Quality Assurance
• Engineering
• Manufacturing
• Research & Development
Team members need to be qualified in the areas they represent, and who know
the product and process very well. They also need to be aware of defects and
errors that may be encountered as part of their area of responsibility and specific
to the product being validated.
The team leader needs to be trained in the process validation procedure, and other
team members be familiar with the overall validation process. Each of the
validation team members will be listed in the protocols with the areas represented.
Process validation depending on the process being validated will follow the steps
shown in the below diagram, and are Installation Qualification (IQ), Operational
Qualification (OQ) and Performance Qualification (PQ)
Learn more on Process Validation by downloading our eBook available

from our website Store Click here
Identification
Documented procedures are required to identify raw materials, material in process,

components and finished product throughout all stages of the product realization
process. This includes inventory, distribution, installation and servicing where
applicable.
The reason for clear identification is to help avoid mix-ups and to provide indication
of the product status and its inspection and/or testing status.
Depending on the medical device classification and applicable regulatory

requirements it may be a requirement that the product is identified with a unique
identification number, lot or batch number. This can also be a benefit and
requirement in the case of a complaint investigation, adverse event, recalls and
other quality related issues.
Today many global markets require a unique device identification (UDI) and is
required to be part of the device labeling. For more on this click on the link below
for guidance on requirements for UDI.
IMDRF Guidance on UDI
Traceability
Traceability requirements depend on the type of medical device and not all require
it. Implantable medical devices is one example where procedures are required to
meet regulatory requirements for traceability.
Records need to be maintained for product after distribution and include details of
the name and address of when and where the product was shipped. If there is a
need to act due to some adverse event this traceability information is critical.
Customer Property
If you have any customer property in your manufacturing site you need to have
established processes in place to control, identify, verify, protect, and safeguard
this property. Records need to be maintained for these activities if applicable.
This could be as an example measuring or test equipment the customer has

provided for measuring their product, or labeling materials to add to their final
product prior to release and shipment.
Preservation of Product
This requirement is for documented procedures for preserving and protecting the
conformity of the product during processing, storage, handling and distribution.
You may not have a separate procedure for this, but rather include these
requirements in your other documented procedures specific to your manufacturing
process procedures, environmental control procedures, packaging design, etc.
Control of Monitoring and Measuring Equipment
All of the measuring equipment you use, throughout your manufacturing processes
to determine acceptance of work in process and final product release, must be
controlled, calibrated, or verified to standards.
This equipment also needs to be clearly labeled with equipment identification,

calibration status, and due date for next calibration. All the monitoring and
measuring equipment should be documented, and records kept for status of
calibration. Any equipment found to be out of calibration needs to be investigated,
and recommend issuing a CAPA, to see if any product may be affected.
For some applications, i.e. use of software, may need to be validated before use.
Any external calibration service needs to go through a service supplier approval
process.
Measurement, Analysis and Improvement
Customer Feedback and Complaint Handling
Feedback from customers on meeting their requirements is another way of

measuring the effectiveness of your quality management system. Methods for
obtaining and using this information need to be documented in a procedure.
Feedback also can be gathered from production and post-production activities and
all sources of feedback can be potential input into risk management for elements
of the quality management system.
Handling of Customer Complaints is a vital requirement for a medical device

company both for reasons of quality and safety of the device, and to meet the
requirements of ISO 13485:2016, and FDA.
Complaint handling should be performed as a priority, and its good practice to

have a timing target for closure of complaints. The FDA requires handling of
complaints to be done by a formally designated unit, and this is also good practice.
It can be a continuous improvement process, resolving customer complaints,

reducing internal nonconformance’s which lead to significant cost savings, and
also of course improving customer satisfaction and safety of the medical device.
Where applicable for customer complaints received, it is a requirement to report

adverse events, or issuance of advisory notices to the appropriate regulatory
authorities. This needs to be documented in a procedure and records kept.
The diagram below shows the basic required steps in the complaint handling
process.
Receive & Investigate Report to Handling of Determine

Evaluate Complaint Regulatory Product as need for
Information Authorities? required CAPA
Internal Audit
I have always regarded internal audits as a good opportunity to not only monitor
the compliance to your procedures, as well as to regulatory requirements, but also
to check the effectiveness of the quality management system, and to find
opportunities for making corrections and improvements.
The diagram below outlines the basic steps in planning, conducting the audit and
follow up actions:
Audit Form Audit Conduct Audit CAPA’s &

Plan Team Audit Report Reaudit
The benefits of conducting internal audits include the following:
• Provides a mechanism for checking and addressing product quality issues

• Checking and monitoring QMS procedures at planned intervals and fixing any
gaps found
• Ensures compliance with procedures and appropriate regulatory requirements
• Discover and implement opportunities for improvement
Internal audits should also be planned based on risk. If parts of your quality system
are lower risk, and past audits and ongoing performance has met requirements,
then these areas may need auditing less frequently. On the other hand, for higher
risk areas, or areas where there have been procedure changes or issues, these
should be audited more often.
Control of Nonconforming Product
A documented procedure is required to control any nonconforming product that is

found during the manufacturing process, all the way from receiving raw materials,
to release, and shipment of the final product.
The procedure needs to clearly define the responsibilities, authorities and controls,
for the identification, documentation, segregation, evaluation and disposition of
nonconforming product.
It needs to be determined if an investigation of the cause of the nonconformity is

required and if it should be escalated into the CAPA process.
Although accepting nonconforming product is permitted with appropriate

documentation and authorization under the ISO 13485:2016 Standard, my advice
based on experience, is to either not have this option as part of your quality
management system, or use it under very limited occurrence’s, and for only minor
nonconformities.
A good question to always ask is, if the nonconformity has occurred with the
product being only slightly outside of the specification and is still acceptable under
deviation, then is the spec tighter than it needs to be?
If a product nonconformity is discovered after delivery the action to be taken needs

to be based on risk proportionate to and/or the potential effects of the
nonconformity. There also needs to be a documented procedure for issuing
advisory notices according to applicable regulatory requirements.
Rework procedures are also a requirement, and depending on the type of product,
could also justify having a separate procedure for sorting the conforming from the
nonconforming, in a batch or production lot of product.
If rework is carried out, it needs to be well documented with appropriate

documented instructions, which should also require validation before approval for
the rework is given.
Analysis of Data
Procedures are required for the analysis of appropriate data to demonstrate the
suitability, adequacy and effectiveness of the quality management system. I have
always believed this should be a routine process for a start-up medical device
company as well as a mature business.
The use of data analysis and statistical tools and trend analysis were appropriate,
can be very beneficial not only for meeting the requirements of the ISO 13485 and
regulatory requirements but also for improving the product quality, by generating
corrective and preventive actions, improving customer satisfaction and reducing
costs.
Data that needs be monitored, analyzed and recorded, at a minimum:
• Feedback and customer complaints

• Product and process characteristics and performance
• Supplier performance
• Audits
• Service reports as appropriate
Others I would recommend:
• Training activities, i.e. completed on time

• CAPA objectives, i.e. closed on time, and any repeat CAPA’s
• Nonconformances and rework
• Process validations
Corrective and Preventive Action
In my 25+ years of experience leading quality management systems, I have

become convinced that the Corrective and Preventive Action (CAPA) procedure
and following it with passion, can be one of the most important and value-added
processes in your quality management system.
However corrective and preventive action procedure requirements, continues to be

one of the most frequent QMS nonconformances reported by external quality and
regulatory auditing bodies. FDA findings include, not having a CAPA procedure, to
not following all of the requirements, i.e. no verifying the effectiveness of the
implemented corrective action.
I encourage any medical device company, to give the CAPA process the attention
and priority it deserves, to resolve customer complaints and feedback, internal
audits, nonconforming product ,and any other significant issues with your QMS.
The diagram below outlines the CAPA process that should be used as far as the
inputs, procedure steps and resulting outputs:
Corrective action and preventive action are two very distinctive steps with
corrective action being reactive and preventive action being proactive. The ISO
13485 Standard does differentiate between the two as follows:
Corrective action: take action to eliminate the cause of nonconformities in order

to prevent recurrence. Preventive action: determine action to eliminate the
causes of potential nonconformities in order to prevent their occurrence.
Final Thoughts
So hopefully reading this article has answered some of your questions on the
requirements of the ISO 13485:2016 Standard, plus some best practices that will
help provide a quality management system that delivers more than just the
minimum of meeting the regulatory requirements.
A robust well managed QMS supported by top management can provide a real
business advantage, by resulting in high quality medical devices that are safe and
meet the requirements of the customer.
A QMS is not just to get certification and check the box, but is also to facilitate a
more efficient medical device company, and one that can include a focus on the
quality of your product, and to understand your customers, and what they need for
the patients.
If you’re a start-up medical device company, I know from experience there are
many pressing issues that take up your time and resources, and implementing a
quality management system is just one of those. If that is the case, then you might
want to consider using outside experienced consulting help.
That’s where we can work with you and assist with your ISO 13485:2016 gap
analysis and implementation planning. We can also provide you with the
documentation templates we have available, along with the consulting services we
offer, we can save you considerable time and overall cost by getting your quality
system implementation fast-tracked and certified, so you can get your products to
market faster, and start earning a return on your investment.
How can Fast-Track QMS Consultants help:

Want to learn more about Fast-Track QMS Consulting and the document
bundles and consulting services we can provide,
then just click here
Our complete Turnkey Document Bundle includes 41 procedures and 36

supporting form templates that cover all elements of ISO 13485:2016 and include
FDA 21 CFR 820 requirements.

Complete Guide - ISO 13485 - 2016 QMS For Medical Device-1

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Complete Guide - ISO 13485 - 2016 QMS For Medical Device-1

Uploaded by

Copyright:

Available Formats

Your Complete Guide to ISO 13485:2016 Quality

Management System for Medical Devices

Written by: Brian Newbery

Founder of Fast-Track QMS Consultants

3. Introduction Design & Development Transfer

14. Resource Management Customer Property

It was issued to support medical device companies in designing a QMS that

So in addition to meeting the requirements of ISO 13485:2016

Global recognition of your medical device company

ISO 13485:2016 is recognized by the Global Harmonization Task Force (GHTF)

For a quality management system to be effective it needs management and

Process and Quality Improvements

This can drive process improvements as well as improvements through listening

Improved Involvement of Employees and Top Management

Now let’s look at the ISO 13485:2016 requirements in more detail:

Key requirements I would like to emphasize here is; document a quality

Documentation of the quality management system process along with records as

Documentation is required to define the processes, produce and maintain records

A key to success and consistency with documentation is to establish a functional

Fast-Track QMS Consultants can provide guidance on which eQMS to consider

Quality management system documents can be shown in a pyramid

The Quality Manual is a key foundational document in your quality management

• List of documented procedures or reference to them, which is how I

• Description of the interaction between the processes of the QMS.

• Outline of the structure of the quality management documentation. (Fig. 1)

• Review and approval prior to use and after any revisions

• Control of obsolete documents to prevent unintended use and retention

In my experience, I have seen a company where the employees were dedicated

Evidence of this commitment can be shown by:

• Communicating to the organization just how important quality is to the

• Establishing and communicating the Quality Policy

• Quality Objectives that are monitored and communicated to all employees

• Active participation in Management Reviews

• Ensuring the availability of qualified personnel

Below is a sample quality policy just to provide an idea on potential content:

Responsibility, Authority and Communication

• including quality performance updates at regular daily production meetings on

Every medical device company needs to conduct planned management reviews,

Management Review Inputs should include

• Status of action items identified at previous Management Reviews.

• Improvements required to maintain the suitability, adequacy, and effectiveness

If you would like to purchase our Management Review procedure or any

SOP Templates available for Purchase including Management Review

Resource management under element 6 of the Standard covers the following:

Procedures need to be in place for training and establishing the competence of

Training records and other appropriate records of personnel need to be maintained

Infrastructure: suitable to support the quality and conformity of the medical

Where appropriate there needs to be documented procedures for the handling of

Planning involves the documentation, including records, of one or more processes

• The quality objectives, specifications, and product acceptance criteria;

Quality Management System processes directly related to the customer and

• Determination of requirements for your product

It is a requirement that you have documented procedures for design and

Design and Development Planning

A well-managed design and development project should have a formal

Selection of a Project Leader and team members

Design Inputs also need to include the following:

Design Inputs must be clear and capable of verification and validation.

Design and Development Outputs

• Contain or reference to acceptance criteria

Medical Device companies need to consider design reviews, not as checking a

Design Reviews are also a regulatory requirement to meet ISO 13485:2016 as