how to implement iso 13485 updates

Greg Howard

June 2016

Implementing ISO 13485:2016

Introduction Overview of changes New QMS requirements Implementing the requirements using PDCA Future changes Questions/Comments

Implementing ISO 13485:2016 Overview of Changes Current State: ISO 13485:2003 addresses general quality system

requirements for medical device manufacturers Regulatory bodies assign criteria for meeting these

quality system requirements Regulatory bodies establish additional requirements

specific to device safety and functionality that are not addressed by ISO 13485:2003

Implementing ISO 13485:2016 Overview of Changes Current State: ISO 13485:2003 contains 20 clauses that require

“documented procedures” to address QMS processes such as document control, design control, or CAPA.

ISO 13485:2003 has 10 additional clauses that require “documented requirements “ for processes such as maintenance or rework. These are usually documented as work instructions.

Implementing ISO 13485:2016 Overview of Changes Current State: FDA 21CFR part 820 requires an additional 12 procedures

addressing QMS processes such as calibration, labeling or statistical techniques.

FDA 21CFR part 820 also contains requirements for maintaining quality records including design history files, master device records, device history records and complaint files.

Implementing ISO 13485:2016 Overview of Changes New State: ISO 13485:2016 now requires 26 procedures including the

original 20 procedures from ISO 13485:2003 and 6 new procedures already required by regulatory agencies.

ISO 13485:2016 now contains requirements for maintaining design history files, medical device records, device history records, and complaint files.

Implementing ISO 13485:2016 Overview of Changes New State: The new procedures address management review,

competency and training, calibration, rework, complaint handling and regulatory reporting.

There are 6 additional procedures still required by the FDA that are not required by ISO 13485:2016: process control, final acceptance, labeling, distribution, statistical techniques.


4.0 Quality System

Implementing ISO 13485:2016 QMS Documentation Requirements 4.2.3 Medical Device File A file is required for each device type or family containing

or referencing all documents required to comply with quality and regulatory requirements.

Typical contents are product specifications, labeling and IFU specifications, packaging specifications, procedures and work instructions required for product realization, forms required as quality records.

Implementing ISO 13485:2016 QMS Documentation Requirements 4.2.5 Control of Records Methods must be defined for protecting confidential

health information contained in records according to applicable regulatory requirements.


5.0 Management Responsibility

Implementing ISO 13485:2016 Management Responsibility 5.4.1 Quality Objectives Quality Objectives must also address

regulatory requirements. Quality Objectives must be measurable – should show

performance over time using methods defined in an Analysis of Data procedure.

Quality Objectives must be consistent with the Quality Policy – should focus on product and regulatory requirements and effectiveness of the quality system.

Implementing ISO 13485:2016 Management Responsibility 5.6 Management Review A Management Review procedure is required

(already an FDA requirement) Management Review inputs now include complaint

handling and regulatory reporting (in addition to feedback)

Be sure to review quality objectives each time; review quality policy at least annually


6.0 Resource Management

Implementing ISO 13485:2016 Resource Management 6.2 Human Resources Organization must now document the process for

establishing competency, providing needed training, and establishing employee awareness. (already an FDA requirement)

Recommend a general procedure supported by individual work instructions addressing competency, training, and awareness.

Implementing ISO 13485:2016 Resource Management 6.2 Human Resources Competency requirements are education, skills, and

experience – usually documented in job descriptions Training needs should address new employee orientation,

safety training, procedural training, job skill training, external certifications

Employee awareness training should help employees understand the impact of their work upon the doctors and patients who use the company’s products

Implementing ISO 13485:2016 Resource Management 6.3 Infrastructure Requirements for facilities, equipment, and support

services must be documented These requirements must include provisions to prevent

mixing of product and assure proper handling PM requirements to be documented for production

equipment, environmental controls, and monitoring or measuring equipment

Implementing ISO 13485:2016 Resource Management 6.4 Work Environment Requirements for the production environment

must be documented For sterile medical devices, the organization shall

document requirements for control of contamination with microorganisms or particulate matter, and maintain the required cleanliness during assembly or packaging processes


7.0 Product Realization

Implementing ISO 13485:2016 Product Realization 7.2 Customer-Related Processes Customer requirements now include applicable

regulatory requirements; organizations must communicate with regulatory authorities in accordance with applicable regulatory requirements

Customer requirements now include user training requirements. The organization shall identify what training is required to assure that physicians and patients can use a device in a safe and effective manner; such training must be made available to the device users

Implementing ISO 13485:2016 Product Realization 7.3 Design and Development V&V Design verification and validation protocols/reports must

state the methods used, acceptance criteria, and statistical rationale for sample sizes

Design validation must be performed using representative product, such as initial production runs

Rationale for the product used must be documented in the validation report

Implementing ISO 13485:2016 Product Realization 7.3 Design and Development V&V If a device must interface or be connected to another

device during use, the device must interface or be connected during design verification and validation activities

In the above instance, the validation criteria must verify the device meets the requirements for its intended use when so connected or interfaced

Implementing ISO 13485:2016 Product Realization 7.3.8 Design and Development Transfer A procedure is required for the transfer of a design

project to production The procedure must require that design V&V activities

have been complete and production processes have been validated prior to production transfer

Implementing ISO 13485:2016 Product Realization 7.3.9 Design and Development Changes A procedure is required for the design change process The procedure must require that design changes identify

the impact of potential changes upon the function, performance, usability, and safety of the device, plus the impact upon applicable regulatory requirements

Implementing ISO 13485:2016 Product Realization 7.3.10 Design and Development Files A file is required for each device or device family The file must include or reference all records that were

used to verify compliance to device requirements and to verify any design changes

Implementing ISO 13485:2016 Product Realization 7.4. Purchasing – Change Notification Purchasing information must include a written agreement

that the supplier will notify the customer prior to implementing any changes that could impact the ability of the product to meet requirements

When the customer becomes aware of any changes to purchased product, the impact of the changes upon the production process or product must be evaluated

Implementing ISO 13485:2016 Product Realization 7.4 Purchasing - Supplier Evaluation Criteria must be established for supplier evaluation and

selection that is based upon supplier performance and is proportionate to the associated risk

Supplier performance must be monitored; the results used during supplier re-evaluation; and records must be maintained of evaluation, selection, monitoring and re-evaluation (supplier scorecards)

Implementing ISO 13485:2016 Product Realization 7.4 Purchasing The extent of verification activities shall be based upon

supplier evaluation results and be proportionate to the associated risk

Implementing ISO 13485:2016 Product Realization 7.5.4 Servicing Servicing has been added to 8.4 Analysis of Data Service records must be analyzed to determine if the

underlying service issue constitutes a complaint Service records must be analyzed to determine if the

underlying service issue requires a formal corrective action

Implementing ISO 13485:2016 Product Realization 7.5.6 Process Validation Production controls must include qualification of

infrastructure (Equipment Qualification) Processes must be validated if the resulting output

cannot OR IS NOT verified The FDA requires validation unless the output

is 100% verified

Implementing ISO 13485:2016 Product Realization 7.5.6 Process Validation Validation procedures must utilize statistical methods and

provide rationale for sample sizes Validation of production software shall be proportionate

to the risk posed by the software Software must be revalidated following any changes Requirements to validate sterilization processes has been

expanded to include sterile barrier systems

Implementing ISO 13485:2016 Product Realization 7.5.11 Preservation of Product Packaging and shipping containers must be designed and

constructed in a manner that will protect the product from alteration, contamination or damage when exposed to expected conditions or hazards

Requirements for special conditions must be documented if packaging alone cannot preserve the product

Special conditions must be controlled and records maintained

Implementing ISO 13485:2016 Product Realization 7.6 Monitoring and Measuring Equipment Calibration activities are to be performed using

documented procedures or work instructions Any adjustments to equipment must be documented Software used during inspection or testing must be

validated in proportion to the risk presented Validation requirements must be documented in a

procedure; Validation records must be maintained


8.0 Measurement, Analysis, Improvement

Implementing ISO 13485:2016 Measurement, Analysis and Improvement 8.2.1 Feedback The methods used to gather and use feedback must be

documented in a procedure or work instruction. Feedback must be obtained from both production and

post-production activities. Information gained from feedback should be used as an

input to the risk management process.

Implementing ISO 13485:2016 Measurement, Analysis and Improvement 8.2.2 Complaint Handling A procedure is required to define requirements for the

documentation, investigation, and reporting of complaints and handling the related product

If a complaint is not investigated, justification must be documented

Resulting CAPA activities must be documented

Implementing ISO 13485:2016 Measurement, Analysis and Improvement 8.2.4 Internal Audit Internal audit criteria must include compliance to

applicable regulatory requirements Internal audit reports must identify the areas and

processes being audited, and conclusions reached by the auditors

Implementing ISO 13485:2016 Measurement, Analysis and Improvement 8.2.6 Monitoring and Measurement of Product Inspection records must identify the inspection

equipment used to perform measurement activities

Implementing ISO 13485:2016 Measurement, Analysis and Improvement 8.4 Analysis of Data The procedure for analysis of data must define

appropriate methods for analysis, including statistical techniques and the extent of their use.

Analysis must be performed on data from feedback, product conformity, process trends, supplier performance, audit results and service reports.

Implementing ISO 13485:2016 Measurement, Analysis and Improvement 8.5 Improvement The organization shall identify and implement any

changes necessary to maintain effectiveness of the quality system as well as medical device safety and performance through the use of the quality policy, quality objectives, audit results, post-market surveillance, analysis of data, corrective actions, preventive actions, and management review.

Implementing ISO 13485:2016 Plan, Do, Check, Act PLAN the quality system upgrade Perform a gap analysis to identify what new requirements

are satisfied by the current quality system. Assign resources and timelines for creating new

procedures, work instructions, or forms. Identify subject matter experts who can advise on the

correct interpretation of the new requirements.

Implementing ISO 13485:2016 Plan, Do, Check, Act DO - Implement the new QMS requirements Train personnel to understand the new requirements and

utilize the new documentation Implement methods and tools for monitoring

performance of the new processes Establish quality objectives for the new processes Incorporate the new requirements into the

internal audit process

Implementing ISO 13485:2016 Plan, Do, Check, Act CHECK – verify implementation and compliance Utilize techniques such as line-side-review or layered

audits to assure effectiveness of the implementation process

Verify compliance via the internal audit process Monitor process performance using appropriate

statistical methods

Implementing ISO 13485:2016 Plan, Do, Check, Act ACT – Continuous Improvement Management monitors compliance to new requirements

during management review and takes action when milestones or quality objectives are not being met

Corrective actions are taken when audit findings identify the new requirements are not being met

Implementing ISO 13485:2016 Future Changes

MDSAP

Implementing ISO 13485:2016 Future State MDSAP Medical Device Single Audit Program addresses

requirements of 21CFR part 820, Canadian MDR, ANVISA(Brazil), Australia, and Japan MHLW

ISO 13485:2016 audits for MDSAP participants will include applicable QMS regulatory requirements from participating countries


Any questions?

http://www.bonezonepub.com/subscribe

how to implement iso 13485 updates

Presentations & Public Speaking