ISO 13485 Awareness

ISO 13485:2016
Medical devices — Quality management

systems
Requirements for regulatory purposes
Mohamed Ibrahim Tabl
Master in Quality Management

ISO 9001-2015 lead auditor
ISO 45001-2018 lead auditor
PDF created with pdfFactory Pro trial version www.pdffactory.com

Management
is a set of activities including planning, organizing, steering, and controlling an
organization’s resources with the aim of achieving organizational goals in an efficient
and effective manner.

System
• System :
• a set of principles or procedures according to which something is done; an organized
scheme or method.
• Is a set of rules, an arrangement of things, or a group of related things that work toward
a common goal. An example of a system are the laws and procedures of a democratic
government. ... An example of a system is all the organs that work together for digestion.
• A management system is a set of policies, processes and procedures used by an

organization to ensure that it can fulfill the tasks required to achieve its objectives
• An effective business management system is a deliberately integrated set
of management processes and tools that help align the company strategy and annual
objectives with daily actions, monitor progress and prompt corrective actions. It guides
and empowers managers and employees to drive process improvements every day

General structure of management system
1) Structure “ org chart + job description”
2) Procedures/ Processes:
Procedure : Set of activities connected together to
describe the interaction between a set of processes
Process : Detailed steps that describe the method
of doing a certain task to convert a certain input to
a certain Output
3) Resources
Total Quality Management Mohamed Ibrahim 4

Quality management system QMS

‫?‪WHAT ARE STANDARDS‬‬
‫• ﻣواﺻﻔﺎت ﻋﺎﻟﻣﯾﺔ ﻟﻠﻣﻧﺗﺟﺎت واﻟﺧدﻣﺎت واﻷﻧظﻣﺔ ‪ ،‬ﻟﺿﻣﺎن اﻟﺟودة واﻟﺳﻼﻣﺔ واﻟﻛﻔﺎءة‪ .‬ﻓﮭﻲ ﻣﻔﯾدة ﻓﻲ ﺗﺳﮭﯾل اﻟﺗﺟﺎرة اﻟدوﻟﯾﺔ‪.‬‬
‫• ﻧﺷرت اﻟﻣﻧظﻣﺔ اﻟدوﻟﯾﺔ ﻟﻠﺗوﺣﯾد اﻟﻘﯾﺎﺳﻲ ﺣواﻟﻲ‪ 23091‬ﻣﻌﯾﺎر دوﻟﻲ ‪ ،‬واﻟﺗﻲ ﺗﻐطﻲ ﻛل ﺻﻧﺎﻋﺔ ﺗﻘرﯾﺑًﺎ ‪ ،‬ﺑد ًءا ﻣن اﻟﺗﻛﻧوﻟوﺟﯾﺎ ‪،‬‬
‫وﺳﻼﻣﺔ اﻷﻏذﯾﺔ ‪ ،‬واﻟزراﻋﺔ واﻟرﻋﺎﯾﺔ اﻟﺻﺣﯾﺔ‪ .‬ﺗؤﺛر ﻣﻌﺎﯾﯾر اﻻﯾزو اﻟدوﻟﯾﺔ ﻋﻠﻰ اﻟﺟﻣﯾﻊ ﻓﻲ ﻛل ﻣﻛﺎن‪.‬‬
‫‪PDF created with pdfFactory Pro trial version www.pdffactory.com‬‬

‫ دوﻟﺔ ﻓﻲ ﻣﻌﮭد اﻟﻣﮭﻧدﺳﯾن اﻟﻣدﻧﯾﯾن ﻓﻲ ﻟﻧدن وﻗرروا إﻧﺷﺎء‬25 ‫ ﻋﻧدﻣﺎ اﻟﺗﻘﻰ ﻣﻧدوﺑون ﻣن‬1946 ‫ﺑدأ اﻟﻘﺻﺔ ﻓﻲ ﻋﺎم‬
‫ ﺑدأت اﻟﻣﻧظﻣﺔ اﻟﺟدﯾدة‬، 1947 ‫ ﻓﺑراﯾر‬23 ‫ ﻓﻲ‬."‫ﻣﻧظﻣﺔ دوﻟﯾﺔ ﺟدﯾدة "ﻟﺗﺳﮭﯾل اﻟﺗﻧﺳﯾﻖ اﻟدوﻟﻲ وﺗوﺣﯾد اﻟﻣﻌﺎﯾﯾر اﻟﺻﻧﺎﻋﯾﺔ‬
.‫ ﻋﻣﻠﯾﺎﺗﮭﺎ رﺳﻣﯾًﺎ‬،ISO ،
Because 'International Organization for Standardization' would have different acronyms in different
languages (IOS in English, OIN in French for Organization international de normalization), our founders
decided to give it the short form ISO.
Total Quality Management Mohamed Ibrahim

International Organization for Standardization
(ISO)
•"ISO", derived from the Greek ISOS, meaning "EQUAL".
• Is the world's largest developer and publisher of International Standards.
•It is a non-governmental organization, based in Geneva , Switzerland
•Officially began operations on 23 February 1947 by 25 countries.
•It is a network of the national standards institutes of 167 countries, one member per country.
•Developed more than 18000 standards for all dimensions of sustainable development :
economic , environmental and societal
•ANSI American national standard institutes is the US representative to ISO

8
Total Quality Management Mohamed Ibrahim

Compliance vs certification
• Compliance
• Any organization can choose to implement a
management system standard and use the standard to
drive improvement and manage risk.
• Certification
• Certification to ISO standards for an organization is simply a
way of proving that an organization does indeed comply with
the relevant standard(s). It does not involve implementing
extra requirements or controls, and if an organization has
already become truly compliant, certification should be a
simple next step.
• Certification involves an audit being performed by an
independent organization known as a certification body. A
certification body will usually perform an audit over two stages.
9

What are the benefits of being certified?
• If an organization has taken the time to become compliant then getting
certified can have the following benefits:
‫ ﻓﯾﻣﻛن أن ﯾﻛون ﻟﻠﺣﺻول ﻋﻠﻰ اﻟﺷﮭﺎدة اﻟﻔواﺋد‬، ‫إذا ﻛﺎﻧت اﻟﻣؤﺳﺳﺔ ﻗد اﺳﺗﻐرﻗت وﻗﺗًﺎ ﻟﺗﺻﺑﺢ ﻣﺗواﻓﻘﺔ‬
:‫اﻟﺗﺎﻟﯾﺔ‬
• The organization can easily prove compliance to customers and interested parties
‫ﯾﻣﻛن ﻟﻠﻣﻧظﻣﺔ أن ﺗﺛﺑت ﺑﺳﮭوﻟﺔ اﻻﻣﺗﺛﺎل ﻟﻠﻌﻣﻼء واﻷطراف اﻟﻣﻌﻧﯾﺔ‬
• The organization is independently recognized for its efforts
‫اﻟﻣﻧظﻣﺔ ﻣﻌﺗرف ﺑﮭﺎ ﺑﺷﻛل ﻣﺳﺗﻘل ﻟﺟﮭودھﺎ‬
• The level of auditing from customers can often be significantly reduced as independent
certification can increase assurance
‫ﻏﺎﻟﺑًﺎ ﻣﺎ ﯾﻣﻛن ﺗﻘﻠﯾل ﻣﺳﺗوى اﻟﺗدﻗﯾﻖ ﻣن اﻟﻌﻣﻼء ﺑﺷﻛل ﻛﺑﯾر ﺣﯾث ﯾﻣﻛن أن ﺗؤدي اﻟﺷﮭﺎدة اﻟﻣﺳﺗﻘﻠﺔ إﻟﻰ زﯾﺎدة اﻟﺿﻣﺎن‬
• Many organizations are now demanding that their suppliers are certified to ISO
standards
‫ﺗطﺎﻟب اﻟﻌدﯾد ﻣن اﻟﻣﻧظﻣﺎت اﻵن ﺑﺄن ﻣوردﯾﮭﺎ ﻣﻌﺗﻣدون وﻓﻘًﺎ ﻟﻠﻣﻌﺎﯾﯾر‬
10

‫ﻣﺰاﯾﺎ اﻟﺤﺼﻮل ﻋﻠﻰ ﻧﻈﺎم ﻓﻌﺎل‬
‫• ﻗد ﯾدﻓﻊ اﻟﻌﻣﻼء زﯾﺎدة ﺗﺻل اﻟﻰ ‪ %10‬ﻣن ﻗﯾﻣﺔ اﻟﺧدﻣﺔ ﻣﻘﺎﺑل ﺧدﻣﺔ أﻓﺿل‬
‫• ﻓﻰ ﺣﺎﻟﺔ ﺣﺻول اﻟﻌﻣﯾل ﻋﻠﻰ ﺧدﻣﺔ ﺟﯾدة ﺳﯾﻧﻘل اﻧطﺑﺎﻋﮫ اﻟﻰ ﻋدد ﻣن اﻻﺷﺧﺎص ﻣن ﺣوﻟﮫ‬
‫ﻣﺎ ﺑﯾن ‪ 12-9‬ﺷﺧص‬
‫• ﻓﻰ ﺣﺎﻟﺔ ﺣﺻول اﻟﻌﻣﯾل ﻋﻠﻰ ﺧدﻣﺔ ﺳﯾﺋﺔ ﺳﯾﻧﻘل ﺧﺑرﺗﮫ وﺗﺟرﺑﺗﮫ اﻟﻰ ‪ 20‬ﺷﺧص‬
‫• ﻧﺳﺑﺔ ﺗﺻل اﻟﻰ ‪ %90‬ﻟن ﯾﻌودو ﻟﻠﺗﻌﺎﻣل ﻣﻊ اﻟﻣؤﺳﺳﺔ ﻓﻰ ﺣﺎﻟﺔ ﺗﻘدﯾم ﺧدﻣﺔ ﺳﯾﺋﺔ‬
‫• ﻧﺳﺑﺔ ‪ 82-80‬ﻣن اﻟﻌﻣﻼء ﯾﻌﺎودون اﻟﺗﻌﺎﻣل ﻣﻊ اﻟﻣؤﺳﺳﺔ اذا ﺗﻌﺎﻣﻠت ﺑﺳرﻋﮫ واھﺗﻣﺎم ﻣﻊ‬
‫اﻟﺷﻛﺎوى‬
‫‪11‬‬
‫‪PDF created with pdfFactory Pro trial version www.pdffactory.com‬‬

How do we choose a good certification body?
• There are many factors to take into consideration but first we should describe an important matter. There are
no rules or laws preventing anyone from setting up a company and calling it a “certification body” and
awarding certificates. So how can we be sure that a certification that has been awarded by a “certification
body” is credible and reliable?
‫ ﻻ ﺗوﺟد ﻗواﻋد أو ﻗواﻧﯾن ﺗﻣﻧﻊ أي ﺷﺧص ﻣن‬.‫ھﻧﺎك اﻟﻌدﯾد ﻣن اﻟﻌواﻣل اﻟﺗﻲ ﯾﺟب أﺧذھﺎ ﺑﻌﯾن اﻻﻋﺗﺑﺎر وﻟﻛن ﯾﺟب ﻋﻠﯾﻧﺎ أوﻻً وﺻف ﻣﺳﺄﻟﺔ ﻣﮭﻣﺔ‬
‫ إذن ﻛﯾف ﯾﻣﻛﻧﻧﺎ اﻟﺗﺄﻛد ﻣن أن اﻟﺷﮭﺎدة اﻟﺗﻲ ﺗم ﻣﻧﺣﮭﺎ ﻣن ﻗﺑل "ھﯾﺋﺔ اﻟﺗﺻدﯾﻖ" ﻣوﺛوﻗﺔ‬.‫إﻧﺷﺎء ﺷرﻛﺔ وﺗﺳﻣﯾﮭﺎ "ھﯾﺋﺔ اﻟﺗﺻدﯾﻖ" وﻣﻧﺢ اﻟﺷﮭﺎدات‬
‫وﻣوﺛوﻗﺔ؟‬
• One response is accreditation. In order to demonstrate that their certification processes are fair, credible, and
trustworthy certification bodies should follow a standard known as ISO 17021.
‫ ﯾﺟب أن ﺗﺗﺑﻊ ھﯾﺋﺎت اﻟﺗﺻدﯾﻖ‬، ‫ ﻣن أﺟل إﺛﺑﺎت أن ﻋﻣﻠﯾﺎت ﻣﻧﺢ اﻟﺷﮭﺎدات اﻟﺧﺎﺻﺔ ﺑﮭم ﻋﺎدﻟﺔ وذات ﻣﺻداﻗﯾﺔ وﺟدﯾرة ﺑﺎﻟﺛﻘﺔ‬.‫رد واﺣد ھو اﻻﻋﺗﻣﺎد‬
17021 ‫ﻣﻌﯾﺎرا ﯾﻌرف ﺑﺎﺳم اﯾزو‬
ً
• ISO 17021 lays out how a certification body should operate in order to provide confidence in the
certifications they award.
.‫ﯾﺣدد ﻛﯾﻔﯾﺔ ﻋﻣل ھﯾﺋﺔ إﺻدار اﻟﺷﮭﺎدات ﻣن أﺟل ﺗوﻓﯾر اﻟﺛﻘﺔ ﻓﻲ اﻟﺷﮭﺎدات اﻟﺗﻲ ﺗﻣﻧﺣﮭﺎ‬
• When a certification body is compliant to ISO 17021 they can be audited and accredited by an accreditation
authority. Most countries around the globe have a national accreditation authority (sometimes more than
one) which accredits certification bodies. These bodies are all members of the International Accreditation
Forum
‫ ﺗﻣﺗﻠك ﻣﻌظم اﻟﺑﻠدان ﻓﻲ ﺟﻣﯾﻊ أﻧﺣﺎء اﻟﻌﺎﻟم‬.‫ ﯾﻣﻛن ﻣراﺟﻌﺔ ﺣﺳﺎﺑﺎﺗﮭﺎ واﻋﺗﻣﺎدھﺎ ﻣن ﻗِﺑل ھﯾﺋﺔ اﻋﺗﻣﺎد‬، ‫ﻋﻧدﻣﺎ ﺗﻛون ھﯾﺋﺔ إﺻدار اﻟﺷﮭﺎدات ﻣﻠﺗزﻣﺔ ﺑﮭﺎ‬
‫ ھذه اﻟﮭﯾﺋﺎت ﻛﻠﮭﺎ أﻋﺿﺎء ﻓﻲ ﻣﻧﺗدى اﻻﻋﺗﻣﺎد اﻟدوﻟﻲ‬.‫ﺳﻠطﺔ اﻋﺗﻣﺎد وطﻧﯾﺔ )أﺣﯾﺎﻧًﺎ أﻛﺛر ﻣن ﺳﻠطﺔ واﺣدة( ﺗﻌﺗﻣد ھﯾﺋﺎت اﻟﺗﺻدﯾﻖ‬ 12

International Accreditation Forum (IAF) .
• So when selecting a certification body always check whether they are

accredited by a member of the IAF. There are some “certification
bodies” which are not accredited or are accredited by organisations
which are not members of the IAF. This does not by default mean
that their service is poor, however it is much harder to prove
creditability without such recognition.
‫ ﺗﺣﻘﻖ داﺋ ًﻣﺎ ﻣﻣﺎ إذا ﻛﺎﻧت ﻣﻌﺗﻣدة ﻣن ﻗﺑل ﻋﺿو ﻓﻲ ﻣﻧﺗدى‬، ‫ﻟذﻟك ﻋﻧد اﺧﺗﯾﺎر ھﯾﺋﺔ ﺗﺻدﯾﻖ‬
‫ ھﻧﺎك ﺑﻌض "ھﯾﺋﺎت اﻟﺗﺻدﯾﻖ" ﻏﯾر اﻟﻣﻌﺗﻣدة أو اﻟﻣﻌﺗﻣدة ﻣن ﻗﺑل‬.‫اﻷﻛﺎدﯾﻣﯾﯾن اﻟدوﻟﻲ‬
‫ ھذا ﻻ ﯾﻌﻧﻲ اﻓﺗراﺿﯾًﺎ أن ﺧدﻣﺗﮭم‬.‫اﻟﻣﻧظﻣﺎت اﻟﺗﻲ ﻟﯾﺳت أﻋﺿﺎء ﻓﻲ ﻣﻧﺗدى اﻷﻛﺎدﯾﻣﯾﺎت اﻟدوﻟﻲ‬
.‫ وﻟﻛن ﻣن اﻟﺻﻌب ﺟدًا إﺛﺑﺎت اﻟﻣﺻداﻗﯾﺔ دون ھذا اﻻﻋﺗراف‬، ‫ﺿﻌﯾﻔﺔ‬
13

Types of Quality Audit
First party audit Second party audit Third party audit
• Internal audit • External audit • External audit

• Ex: QA audit • Ex: supplier audit • Ex: Certification
supply chain • Party have body,
• Verification of interest in governmental
implementation organization agencies
of system • Give certification,
registration
14

Types of Audit
Combined Audit
• When two or more management systems of different disciplines (e.g. quality,

environmental, occupational health and safety) are audited together
• 1st , 2nd & 3rd party audit can apply
Joint audit
• When two or more auditing organizations cooperate to audit a single auditee

• 2nd‫ و‬3rd party audit can apply
Special audit
• Extension “ application > response> Audit activity

• Short notice audit “ follow up suspension , invest complaint , response to change
15

National Accreditation authority ex: EGAC “Egypt” –UKAS “U’K”-
IAS “USA” - COFRAC “ France ”- DAKKS “Germany”
ISO17021:2015
Accredit
certification bodies ”SGS, URS ,…. Personal certification bodies
Certify Certify training

organization providers and trainers
Audit Train
Auditee Auditors Training
“ Registered organization” Independent auditors organizations
16

Certification
road map
Project Gap
Determine Estimate Management
Select Internal Certification
owner Define Learn analysis
the required Cost and decision certificatio Training audit audit
and scope standard
standard Task list ROI n body &Correction
teams

Auditee
“ Registered organization”
Enquiry
certification bodies ”SGS, URS ,….
formal- assessment
Certification First stage audit
road map Second stage audit
Certification approval Surveillance one
Recertification Surveillance two

Suspension / withdrawal of certification
• Certification
• Certification to ISO standards for an organization is simply a way of proving
that an organization does indeed comply with the relevant standard(s).
• Suspension
• Hold the certification
• Presence of NCRs , and you have time to fix those points
• “ 3 month, 1 year
• If you did not solve so withdrawal of certification
• If withdrawal “ stage 1 and stage 2 audit from start “.
19

Audit Stages
• Stage one is a high level review of the management system
• Objective of stage one audit
• Conduct Document review of system to determine if system cover all requirments
• Evaluate readiness of organization to undergo stage 2 audit
• Area of concern to be fixed
• Potential NCRs
• Obtaining evidence that internal audit , management review are being planned
performed and will be completed prior to stage 2
• Providing focus for the planning of stage 2 audit “Scope, infrastructure ,
determine how many working days it will take in stage 2 audit”
20

Audit Stages
• stage two
• Take place at the site of auditee
• is used to look at the management system in much closer details to provide
evidence of compliance in various areas.
• Check the implementation of system
• Effectiveness of system.
• Conformity to all requirements of the applicable MS standard
21

High Level Structure / Annex SL
• The High-Level Structure (HLS)
• Annex SL is a new management system format that helps streamline
creation of new standards, and makes implementing multiple
standards within one organization easier. It replaces ISO's Guide 83,
which provided a base structure and standardized text for
management system standards (MSS).
‫ھو ﺗﻧﺳﯾﻖ ﺟدﯾد ﻟﻧظﺎم إدارة ﯾﺳﺎﻋد ﻋﻠﻰ ﺗﺑﺳﯾط إﻧﺷﺎء ﻣﻌﺎﯾﯾر ﺟدﯾدة وﯾﺟﻌل ﺗﻧﻔﯾذ ﻣﻌﺎﯾﯾر ﻣﺗﻌددة‬
‫ﺻﺎ ﻗﯾﺎﺳﯾًﺎ‬ ً
ً ‫ھﯾﻛﻼ أﺳﺎﺳﯾًﺎ وﻧ‬ ‫ اﻟذي وﻓر‬، 83 ‫ ﯾﺣل ﻣﺣل دﻟﯾل اﯾزو‬.‫داﺧل ﻣؤﺳﺳﺔ واﺣدة أﺳﮭل‬
‫ﻟﻣﻌﺎﯾﯾر ﻧظﺎم اﻹدارة‬
• Standardized core definitions
• is a set of 10 clauses that all ISO management system standards are
required to use in the future. ... The High Level Structure is not
intended for organizations to use to order and structure their own
discipline-specific management system.
... .‫ ﻓﻘرات ﺗﺗطﻠب ﺟﻣﯾﻊ ﻣﻌﺎﯾﯾر ﻧظﺎم إدارةﻻﺳﺗﺧداﻣﮭﺎ ﻓﻲ اﻟﻣﺳﺗﻘﺑل‬10 ‫ﻋﺑﺎرة ﻋن ﻣﺟﻣوﻋﺔ ﻣن‬
‫اﻟﮭﯾﻛل اﻟرﻓﯾﻊ اﻟﻣﺳﺗوى ﻏﯾر ﻣﺧﺻص ﻟﻠﻣﻧظﻣﺎت ﻻﺳﺗﺧداﻣﮫ ﻓﻲ ﺗرﺗﯾب وﺗﻧظﯾم ﻧظﺎم إدارة‬
‫ﺧﺎص ﺑﮭﺎ‬
22

23

• The Benefits of High Level Structure
• The High Level Structure will ensure that future management
system standards support each other. They will be easier to read and understand,
and it will aid greatly in the integration of multiple standards within the one
organization
‫ ﺳﯾﻛون ﻣن اﻟﺳﮭل ﻗراءﺗﮭﺎ‬.‫ﺳﯾﺿﻣن اﻟﮭﯾﻛل رﻓﯾﻊ اﻟﻣﺳﺗوى أن ﻣﻌﺎﯾﯾر ﻧظﺎم اﻹدارة اﻟﻣﺳﺗﻘﺑﻠﯾﺔ ﺗدﻋم ﺑﻌﺿﮭﺎ اﻟﺑﻌض‬
‫ وﺳﺗﺳﺎﻋد ﺑﺷﻛل ﻛﺑﯾر ﻓﻲ دﻣﺞ ﻣﻌﺎﯾﯾر ﻣﺗﻌددة داﺧل ﻣﻧظﻣﺔ واﺣدة‬، ‫وﻓﮭﻣﮭﺎ‬
• An integrated management system (IMS) combines all related components
of a business into one system for easier management and operations.
Quality, Environmental, and Safety management systems are often
combined and managed as an IMS. ... However all auditors will be able to
work across the whole system.
‫ﯾﺟﻣﻊ ﻧظﺎم اﻹدارة اﻟﻣﺗﻛﺎﻣل ﺑﯾن ﺟﻣﯾﻊ ﻣﻛوﻧﺎت اﻷﻋﻣﺎل ذات اﻟﺻﻠﺔ ﻓﻲ ﻧظﺎم واﺣد ﻟﺗﺳﮭﯾل اﻹدارة‬
‫ ﻏﺎﻟﺑًﺎ ﻣﺎ ﯾﺗم اﻟﺟﻣﻊ ﺑﯾن أﻧظﻣﺔ إدارة اﻟﺟودة واﻟﺑﯾﺋﺔ واﻟﺳﻼﻣﺔ وإدارﺗﮭﺎ ﺑﺎﻋﺗﺑﺎرھﺎ وﻟﻛن‬.‫واﻟﻌﻣﻠﯾﺎت‬
.‫ﺳﯾﺗﻣﻛن ﺟﻣﯾﻊ اﻟﻣراﺟﻌﯾن ﻣن اﻟﻌﻣل ﻋﺑر اﻟﻧظﺎم ﺑﺄﻛﻣﻠﮫ‬
24

Plan-Do-Check-Act Cycle
The PDCA cycle can be applied to all processes and to the management system as a whole.
25

Suitable for both small and large organizations
Better internal management
Benefits of Less wastage
ISO Increase in efficiency, productivity and profit
13485:2016
to your
Improved customer retention and acquisition
business Consistent outcomes, measured and monitored
Globally recognised standard
Compatible with other ISO standards
26

ISO 13485:2016
Medical devices — Quality management systems —
Requirements for regulatory purposes

Introduction
ISO 13485 specifies requirements for a Quality Management System (QMS) to

be applied by organizations involved in the medical device industry. The
standard can be applied by organizations performing design and development,
production, storage and distribution, installation, servicing, and disposal of
the medical device, and by suppliers or other external parties providing
products to such organizations.
The medical device industry is highly regulated. As such, the standard sets
requirements for an organization to identify all regulatory requirements that
are applicable to its business activities, determine its role in these activities
according to the regulatory requirements, and ensure that its QMS conforms to
these regulatory requirements.
Implementation of the QMS is a strategic decision of the organization, which

can be influenced by various factors such as organizational environment,
varying needs, particular objectives, the products the organization provides,
etc.

Clarification of concepts
The standard uses particular phrases to formulate the
requirements, and this clause explains these phrases and
concepts. The terms and phrases used are the following:
Ø “ As appropriate” – The requirement doesn’t have to be applied by the organization if the organization
can justify the exclusion. The requirement will be appropriate if it is necessary to meet the
requirements of the product and any legal requirements, to conduct corrective actions, and/or to
manage risks.

Clarification of concepts
The standard uses particular phrases to formulate the
requirements, and this clause explains these phrases and
concepts. The terms and phrases used are the following:
Ø “Risk” = pertains to safety and performance requirements, or meeting

regulatory requirements
Ø “Documented”= required to be established, implemented, and maintained
Ø “Product” = now means product or service…
output that is intended for a customer, or an intended output of
Product Realization
Ø “Regulatory requirements” = is limited to the legal requirements for the
quality management system and legal requirements for safety or
performance of the device

Clarification of concepts (continue)
In addition, the standard uses the following words to indicate what is a requirement, versus a
recommendation or an allowance:
Ø “ Shall ” refers to a requirement
Ø “ Should ” refers to a recommendation
Ø “ May ” refers to an activity that is permitted
Ø “ Can ” refers to an activity that is possible or that the organization is capable of conducting.
Information marked as “Note” does not include any additional requirements to the clause to which it belongs;
rather, it provides guidance in understanding or clarifying the requirement.

Process approach
The process approach is key for an effective Quality Management System
This basically means that every operation of the company must be observed AS
A PROCESS, by breaking down the company into its processes and determining
their sequence, interaction, inputs and outputs; identifying the processes in the
company and which processes starts before other processes are finished; and
determining what resources and information are needed to start the process and
what results are expected from the process)
Once a system has been set up accordingly ( based on the processes) , the organization
will be able to monitor and measure its processes, their effectiveness, and their efficiency,
and then improve them,
In simple terms, the process approach represents the concept of observing all
operations in the company as processes.
The best way to start implementing the process approach is to create a process map,
which should include all processes and their interconnections

33

34

Scope ‫اﻟﻣﺟﺎل‬
This standard specifies the requirements for a QMS for organizations that
need to demonstrate their ability to provide medical devices and related services
in compliance with customer and regulatory requirements.
These organizations could be involved in one or more lifecycle stages of the

medical device industry,
OR
could be a supplier or external party that provides products or services to
organizations manufacturing medical devices.
Some requirements of the standard could be inapplicable to an organization and

can be excluded from the scope of the QMS. Such requirements belong to clauses
6, 7,and 8and for each exclusion, the organization needs to provide documented
justification.

Compatibility with other
management systems
ISO 13485 does not include any

requirements specific to other
management systems, such as
environmental, occupational health
and safety, information
security, etc.
However, it enables an organization to
align or integrate its Quality
Management System with the
requirements of other management
systems.

Section 4: Quality Management System
Main Requirements _Ref. issue 2003
GENERAL REQUIREMENTS
§ Quality Management System (QMS) meeting the requirements of
the ISO 13485 International Standard
§ QMS determine the processes, process sequence, and process
resources including monitoring and improvement
§ Organization has the ability to properly manage the processes
which have been decided to be outsourced

Main Requirements _Ref. issue 2003
GENERAL REQUIREMENTS
§ QMS documentation include the quality policy,
quality objectives, quality manual, documented
records, and procedures (required by ISO 13485 and
necessary for the processes)
§ Quality manual includes QMS scope, any exclusions,
the documented procedures (or references), and
interactions between processes
§ A procedure to define the controls needed for
effective document control
§ Documented procedure established to define the
controls needed for the identification, storage,
protection, retrieval, retention, and disposal of
records

Clauses & Sub clauses to underline_ Ref. issue 2016
Ø 4.1 General
Ø 4.1.1 document the role(s) of the organization.
Ø Roles undertaken by the organization can include manufacturer, authorized representative, importer or distributor
Ø 4.1.2 determine and apply the processes needed and apply a risk based approach to the
control of those processes
Ø determine the sequence and interaction of these processes.

Ø 4.1.3
Ø a ) determine criteria and methods needed to ensure
that both the operation and control of these processes
are effective
Ø b ) ensure the availability of resources and information
necessary to support the operation and monitoring of
these processes;
Ø C ) implement actions necessary to achieve planned
results and maintain the effectiveness of these
processes;
Ø D ) monitor, measure as appropriate, and analyze these
processes;
Ø E ) establish and maintain records needed to
demonstrate conformance to this International
Standard and compliance with applicable regulatory
requirements (see 4.2.5).

Ø 4.1.4 Changes made to these

processes must be:
ØEvaluated for impact on the
QMS
ØEvaluated for impact on the
medical device produced
ØControlled
Ø 4.1.5 When the organization
chooses to outsource any process
that affects product conformity
to requirements, it shall monitor
and ensure control over such
processes.

Ø 4.1.6 – Requires documented procedures for the validation of
software used in the Quality Management System.
Ø 4.1.6 – Such software shall be validated prior to initial use, and as

appropriate, after changes.

Ø 4.2 Documentation
requirements
• other documentation
specified by applicable
regulatory requirements.

Ø 4.2.3 - Medical Device File:
For each medical device type or medical device family,
the organization shall establish and maintain a file(s)
either containing or referencing documents generated
to demonstrate conformity with the requirement of
this International Standard and compliance with
applicable regulatory requirements.

Ø 4.2.3 Medical Device File Content:
ü General description of the medical device, intended use/purpose, and

labelling, including any instructions for use;
ü Specifications for product,
ü Specifications or procedures for manufacturing, packaging, storage,
handling and distribution;
ü Procedures for measuring and monitoring;
ü As appropriate, requirements for installation; and
ü As appropriate, procedures for servicing.

Section 5: Management Responsibilities
5.1 MANAGEMENT COMMITMENT

Top management show commitment to the QMS, communicating requirements,
quality policy, and quality objectives, and conducting management reviews and
ensuring resources
5.2 CUSTOMER FOCUS

Top management ensure that customer requirements are determined and are met
with the aim of enhancing customer satisfaction
5.3 QUALITY POLICY & 5.4 QUALITY OBJECTIVES

An appropriate quality policy, including commitment to meet requirements &
improvement
Quality objectives shall be measurable and consistent with the quality policy

Section 5: Mangement Responsibilities
Ø 5.6 – Management Reviews

Ø The organization shall document
procedures for management review
Ø The organization shall carry out
management review at documented
planned intervals
Ø New management review inputs
ü Complaint handling
ü Reporting to regulatory authorities

Section 5: Mangement Responsibilities
Ø New management review inputs

Ø Complaint handling
Ø Reporting to regulatory authorities
Ø New Management review outputs

Ø All outputs shall be recorded and include
the inputs reviewed and decisions in relation to
Ø Suitability, adequacy and effectiveness of the system
Ø Changes needed to respond to new and or revised regulatory requirements

Section 6: Resource Management
6.0 RESOURCE MANAGEMENT

6.1 PROVISION OF RESOURCES
There are assigned resources to implement and maintain the QMS &
improve QMS effectiveness, and enhance customer satisfaction through
customer requirements
6.2 HUMAN RESOURCES / 6.2.1 GENERAL
The employees who are responsible for accomplishing the working procedures
related with product conformity competent in the meaning of appropriate
education, training, skills, and experience
6.2.2 COMPETENCE, TRAINING AND AWARENESS
The needed competence shall be determined, the necessary training shall be
provided, & training effectiveness shall be evaluated_ Appropriate records

• 6.3 INFRASTRUCTURE
The infrastructure needed shall be defined, provided and
maintained to achieve product requirements; incl.
buildings, associated utilities, process equipment (hardware
and software), and supporting services (e.g., transport,
communication, or IT services)

Main Requirements _
6.4 WORK ENVIRONMENT AND CONTAMINATION CONTROL

The work environment needed to meet product requirements
according to ISO 13845 shall be established, documented,
monitored, and controlled
• document requirements for health, cleanliness and
clothing of personnel if contact between such personnel
and the product or work environment could affect
medical device safety or performance
• ensure that all personnel who are required to work
temporarily under special environmental conditions
within the work environment are competent or
supervised by a competent person.
NOTE Further information can be found in ISO 14644 and ISO 14698.

Ø Documented processes to demonstrate

and maintain competence
Ø Infrastructure prevent product mix-up
and ensure orderly handling of product.

Ø 6.4.2 – Contamination Control

ü Control of contaminated or potentially contaminated product in
order to prevent contamination of the work environment,
personnel, or product.
ü For sterile medical devices, the organization shall

document requirements for control of contamination with micro-
organisms or particulate matter and maintain the required
cleanliness during assembly or packaging processes.

Section 7: Product Realization
7.0 PRODUCT REALIZATION

7.1 PLANNING OF PRODUCT REALIZATION
- Organization shall plan and develop the processes needed for product
realization consistent with the requirements of the other processes
- Production planning shall include product quality objectives, processes and

documents, resources, product measurement activities, and necessary records
7.2 CUSTOMER-RELATED PROCESSES

7.2.1 DETERMINATION OF REQUIREMENTS RELATED TO THE PRODUCT
All product requirements shall be determined (customer, unstated but necessary
requirements, statutory and regulatory, and additional requirements considered
necessary)

7.1 Planning of
product
realization
7.6 Control of
7.2 Customer-
monitoring and
related
measuring
processes
equipment
Product
realization
7.5 Production
7.3 Design and
and service
development
provision
7.4 Purchasing

7.1 Planning of product realization

a) quality objectives and requirements for the product;
b) the need to establish processes and documents (see
4.2.4) and to provide resources specific to the product,
including infrastructure and work environment;
c) required verification, validation, monitoring,
measurement, inspection and test, handling, storage,
distribution and traceability activities specific to the
product together with the criteria for product
acceptance;
d) records needed to provide evidence that the
realization processes and resulting product meet
requirements (see 4.2.5).

7.2 Customer-related processes

• 7.2.1 Determination of requirements related to product
qrequirements specified by the customer, including the

requirements for delivery and post-delivery activities;
qrequirements not stated by the customer but necessary for
specified or intended use, as known;
qapplicable regulatory requirements related to the product;
qany user training needed to ensure specified performance
and safe use of the medical device; e)
qany additional requirements determined by the organization

Ø 7.2.2 Review of requirements related to product
Ø This review shall be conducted prior to the
organization’s commitment to supply product to
the customer (e.g. submission of tenders, acceptance of
contracts or orders, acceptance of
Ø changes to contracts or orders) and shall ensure that:
Ø a) product requirements are defined and documented;
Ø b) contract or order requirements differing from those previously
expressed are resolved;
Ø c) applicable regulatory requirements are met;
Ø d) any user training identified in accordance with 7.2.1 is available or
planned to be available;
Ø e) the organization has the ability to meet the defined requirements.
Ø When the customer provides no documented statement of
requirement, the customer requirements shall be confirmed by
the organization before acceptance.

Ø 7.2.3 – Communication:
The organization shall plan and document arrangements for
communicating with customers in relation to:
a) product information;
b) enquiries, contracts or order handling, including amendments;
c) customer feedback, including complaints;
d) advisory notices.
Issue of advisory notices: The recall committee makes the final

determination as to whether advisory notices must be issued. The
advisory notices are sent through a traceable method, such as certified
mail. The records of advisory notices are maintained and the effectiveness
of advisory notices is monitored.

Section 7: Product Realization 7.3 Design and development
Design
planning
Design
Design
change
input
control
Design Design
Transfer output
Design Design
validation review
Design
verification
61

design and functional, meet the input
7.3.4 Design and development outputs

7.3.3 Design and development inputs
performance, requirements for
development design and
usability and
stages safety
development
7.3.2 Design and development planning
provide
responsibiliti requirements,
appropriate
es and according to
information for
the intended
authorities purchasing,
use production and
for design service provision
and applicable
regulatory contain or
development requirements reference product
and standards; acceptance
the resources criteria
needed, applicable specify the
including output(s) of characteristics of
necessary risk the product that
management are essential for
competence its safe and
of personnel proper use. 62

63

7.3.4 Design and development outputs
Outputs shall:
- meet the input requirements for design and development
- provide appropriate information for purchasing, production and service provision
- contain or reference product acceptance criteria
- specify the characteristics of the product that are essential for its safe and proper use.
- be in a form suitable for verification against the inputs
- shall be approved prior to release.
Ø 7.3.5 – Design and Development Review

Ø Shall include the identification of the design under review, the
participants involved and the date of the review

Ø 7.3.6 – Design and Development Verification
Ø The organisation shall
ü Document verification plans, including acceptance criteria, statistical
techniques and rational for sample size
ü Where a device is connected to another device, verification shall
include confirmation that the design output meets the design input
when connected
Ø 7.3.7 – Design and Development Validation

Ø The organisation shall
ü Document validation plans, including acceptance criteria, statistical
techniques and rational for sample size
ü Validation shall be conducted on representative samples. The rational
for product choice shall be recorded

ü Where a device is connected to another device, validation shall include
confirmation that the requirements for the specified application or
intended use have been met
ü a medical device used for clinical evaluation or performance evaluation
is not considered to be released for use to the customer
ü Validation shall be completed prior to release for use of the product to
the customer.
Ø *7.3.8 – Design and Development Transfer

ü The organization shall document procedures for transfer of design and
development outputs to manufacturing.
ü Results and conclusions of the transfer shall be recorded (see 4.2.5).

Ø 7.3.9 – Control of Design and Development Changes
ü The organization shall determine the significance of the changes to
function, performance, usability, safety and applicable regulatory
requirements for the medical device and its intended use
The changes shall be:
* Reviewed;
* Verified;
* Validated, as appropriate; and
* Approved.
ü The review of design and development changes shall include

* Evaluation of the effect of the changes on constituent parts and
product in process or already delivered,
* Inputs or outputs of risk management and product realization
processes.

Ø * 7.3.10 – Design and Development Files
ü The organization shall maintain a design and development file for each
medical device type or medical device family.
ü This file shall include or reference records generated to demonstrate
conformity to the requirements for design and development and
records for design and development changes.
(*New sub-clause)

Ø 7.4 – Purchasing
Ø 7.4.1 – Purchasing Process
The organization shall establish criteria for the evaluation and selection of suppliers. The criteria shall be:
ü based on the supplier’s ability to provide product that meets the organizations’ requirements,
ü based on the performance of the supplier,
ü based on the effect of the purchased product on the quality of the medical device, and
ü proportionate to the risk associated with the medical
device.
Critical supplier
Crucial supplier
General supplier

Ø 7.4.1 – Purchasing Process (continue )
The organization shall plan the monitoring and re-evaluation of suppliers
Non fulfillment of purchasing requirements shall be addressed with the

supplier proportionate to the risk associated with the purchased product and
compliance with applicable regulatory requirements.

Ø 7.4.3 – Verification of Purchased Product
The extent of verification activities shall be based on the supplier evaluation
results and proportionate to the risks associated with the purchased product.
ü When the organization becomes aware of any changes to the
purchased product, the organization shall determine whether these
changes affect the product realization process or the medical device.

Ø 7.5: Production & Service Provision
Ø 7.5.1 – Control of Production and Service Provision

As appropriate, production controls shall include but are not limited to:
b) qualification of infrastructure,
c) implementation of monitoring and measurement of process parameters and
product characteristics
Ø 7.5.2 – Cleanliness of Product

The organization shall document requirements for cleanliness of product or
contamination control of product if:
c) product cannot be cleaned prior to sterilization or its use, and its cleanliness is
of significance in use;

Ø 7.5.4 – Servicing Activities
The organization shall analyze records of servicing activities carried out by the
organization or its supplier:
ü to determine if the information is to be handled as a complaint and
ü as appropriate, for input to the improvement process
Ø 7.5.6 – Validation of Processes for production and service provision

ü As appropriate, statistical techniques with rationale for sample sizes
ü Requirements for records (see 4.2.5);
ü Revalidation, including criteria for revalidation; and
ü Approval of changes to the processes

Ø 7.5.6 – Validation of Processes for production and service provision
(continue)
ü The specific approach and activities associated with software validation and revalidation shall
be proportionate to the risk associated with the use of the software including the effect on the
ability of the product to conform to specifications.
ü Records of the results and conclusion of validation and necessary actions from the validation shall be
maintained (see 4.2.4 and 4.2.5).

Ø 7.5.7 Particular Requirements for the Validation of Process of Sterilization and
Sterile Barrier Systems
ü The organization shall document procedures (see 4.2.4) for the validation of processes for
sterilization and sterile barrier systems.
ü Processes for sterilization and sterile barrier systems shall be validated prior to
implementation and following product or process changes, as appropriate.
ü Records of the results and, conclusion of validation and necessary actions
from the validation shall be maintained

Ø 7.5.8 – Identification
ü The organization shall identify product status with respect to monitoring

and measurement requirements throughout product realization.
Identification of product status shall be maintained throughout
production, storage, installation and servicing of product to ensure that
only product that has passed the required inspections and tests or released
under an authorized concession is dispatched, used or installed. (*was
previously sub-clause 7.5.3.3)
ü If required by applicable regulatory requirements, the organization shall

document a system to assign unique device identification to the medical
device.

Ø 7.5.11 – Preservation of Product
Ø The organization shall protect product from alteration, contamination or

damage when exposed to expected conditions and hazards during
processing, storage, handling, and distribution by:
Ø designing and constructing suitable packaging and shipping containers, or
Ø documenting requirements for special conditions needed if packaging

alone cannot provide preservation

Section 8: Measuring, Analysis & Improvement
Ø 8.2.1 – Feedback
This feedback process shall include provisions to gather data from production
as well as post-production activities

Ø *8.2.2 – Complaint Handling
The organization shall document procedures for timely complaint handling in
accordance with applicable regulatory requirements.
These procedures shall include at a minimum requirements and responsibilities

for:
a) receiving and recording information,
b) evaluating information to determine if the feedback constitutes a
complaint,
c) investigating complaints,
d) determining the need to report the information to the
appropriate regulatory authorities,
e) handling of complaint-related product, and
f) determining the need to initiate corrections or corrective actions.

Ø *8.2.2 – Complaint Handling (continue)
ü If any complaint is not investigated, justification shall be

documented. Any correction or corrective action resulting
from the complaint handling process shall be documented.
ü If an investigation determines activities outside the

organization contributed to the complaint, relevant
information shall be exchanged between the organization and
the external party involved.
ü Complaint handling records shall be maintained (see 4.2.5).

Ø *8.2.3 – Reporting to Regulatory Authorities
ü If applicable regulatory requirements require notification of complaints that meet
specified reporting criteria of adverse events or issuance of advisory notices, the
organization shall document procedures for providing notification to the
appropriate regulatory authorities.
ü Records of reporting to regulatory authorities shall be maintained (see 4.2.5).

Ø 8.2.6 – Monitoring and Measuring of Product
Records shall identify the test equipment used to
perform measurement activities.
Ø 8.3.1 – General
The evaluation of nonconformity shall include a determination of the need
for an investigation and notification of any external party responsible for
the nonconformity.
Ø 8.3.2 – Actions in response to nonconforming product detected

before delivery
Actions in response to nonconforming product detected before delivery
Records of actions relating to the issuance of advisory notices shall be
maintained

Ø 8.4: Analysis of Data
If the analysis of data shows that the quality management system is not
suitable, adequate or effective, the organization shall use this analysis as input
for improvement as required in 8.5

Ø 8.5.2 – Corrective Action
Verifying that the corrective action does not adversely affect the
ability to meet applicable regulatory requirements or the safety
and performance of the medical device;
Ø 8.5.3 – Preventive Action

Verifying that the action does not adversely affect the ability to meet applicable
regulatory requirements or the safety and performance of the medical device;

Thank You

ISO 13485 Awareness

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ISO 13485 Awareness

Uploaded by

Copyright:

Available Formats

ISO 13485:2016

Medical devices — Quality management

Mohamed Ibrahim Tabl

Master in Quality Management

PDF created with pdfFactory Pro trial version www.pdffactory.com

organization’s resources with the aim of achieving organizational goals in an efficient

and effective manner.

PDF created with pdfFactory Pro trial version www.pdffactory.com

• A management system is a set of policies, processes and procedures used by an

PDF created with pdfFactory Pro trial version www.pdffactory.com

Procedure : Set of activities connected together to

describe the interaction between a set of processes

Process : Detailed steps that describe the method

of doing a certain task to convert a certain input to

Total Quality Management Mohamed Ibrahim 4

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

‫‪PDF created with pdfFactory Pro trial version www.pdffactory.com‬‬

Total Quality Management Mohamed Ibrahim

PDF created with pdfFactory Pro trial version www.pdffactory.com

• Is the world's largest developer and publisher of International Standards.

•It is a non-governmental organization, based in Geneva , Switzerland

•Officially began operations on 23 February 1947 by 25 countries.

economic , environmental and societal

•ANSI American national standard institutes is the US representative to ISO

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

‫‪PDF created with pdfFactory Pro trial version www.pdffactory.com‬‬

PDF created with pdfFactory Pro trial version www.pdffactory.com

• So when selecting a certification body always check whether they are

PDF created with pdfFactory Pro trial version www.pdffactory.com

First party audit Second party audit Third party audit

• Internal audit • External audit • External audit

PDF created with pdfFactory Pro trial version www.pdffactory.com

• When two or more management systems of different disciplines (e.g. quality,

• When two or more auditing organizations cooperate to audit a single auditee

• Extension “ application > response> Audit activity

PDF created with pdfFactory Pro trial version www.pdffactory.com

certification bodies ”SGS, URS ,…. Personal certification bodies

Certify Certify training

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

certification bodies ”SGS, URS ,….

Certification First stage audit

road map Second stage audit

Certification approval Surveillance one

Recertification Surveillance two

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

PDF created with pdfFactory Pro trial version www.pdffactory.com

Better internal management

Benefits of Less wastage

ISO Increase in efficiency, productivity and profit

business Consistent outcomes, measured and monitored

Globally recognised standard

Compatible with other ISO standards