Angie Coombs Presentation May 10, 2016 · ISO 13485:2003 •The ISO 13485:2003 standard continues...

Copyright © 2012 BSI. All rights reserved.

2016 MEDEC Regulatory Conference

May 10, 2016

Angie Combs

Copyright © 2012 BSI. All rights reserved. 2

Information to be Presented

• Process for Registration to ISO13485:2003/CMDCAS

• Process for changes to scope, name and/or address changes, product changes

• Guidance Document information

• MDSAP Program and BSI’s participation

05/05/2016


ISO 13485:2003

•The ISO 13485:2003 standard continues to be the world wide recognized standard for auditing a medical device quality management system. The standard has changed, earlier this year and there will be a 3 year transition. ISO 9001:2008 has also changed in 2015 with high level requirements. Many medical device companies continue to maintain both certificates and the requirements in their QMS for registration to both certificates

05/05/2016


CMDCAS Registration

•CMDCAS stands for Canadian Medical Devices Conformity Assessment System. This approval is given to Registrars so they can apply the logo on their ISO 13485:2003 certificates once a manufacturer demonstrates compliance with the Canadian Medical Device Regulations.

05/05/2016


CMDCAS Registration

•In the US, BSI has ISO 13485:2003 only certificates with the SCC logo which stands for Standards Council of Canada, our accreditation body.

•A CMDCAS certificate will have both the SCC logo and the CMDCAS logo. These logos cannot be used on product or literature. They are for Registrar use only.

05/05/2016


Foundation of the Medical Devices Regulation

•Degree of pre-market scrutiny based on the risk of a device:•Medical Devices and IVDDs are given progressive risk based classes: Class I, II, III, and IV

•Includes devices of human origin•Safety, effectiveness and labeling requirements

05/05/2016


What Does the Manufacturer Need to Know?

• Is it a Medical Device?•Who is the “Manufacturer?”•Classification of Medical Devices•Medical Device License Categories •Medical Device License Requirements•Applicability of QS Requirements•Pre-market Activities •Post-market Activities•Other MDR Requirements

05/05/2016


Is It a Medical Device?

•Medical Device (F&D Act) Definition:• “Medical device” is a device within the meaning of the Act, but does not include any device that is intended for use in relation to animals

• It is an instrument, apparatus appliance for:•Diagnosis, treatment, prevention or mitigation of a disease or abnormal physical state

•Restoring or modifying body functions/structure•Diagnosis of a care during or after pregnancy

• Includes non-active and in vitro diagnostic devices•See Section 1 of the CMDR under interpretations

05/05/2016


Who Is the “Manufacturer?”

Legal manufacturer = name on the label:

• Manufacturer is whomever sells a medical device under their own name, trade-mark, trade name or other name or mark owned or controlled by the person, and who is responsible for designing, manufacturing, assembling, processing, labeling, packaging, refurbishing, modifying, or assigning a purpose to the device

• The manufacturer either performs the above or has someone performing this on their behalf

05/05/2016


Who is the “Manufacturer?”

•Foreign manufacturers meeting the definition of a Canadian manufacturer and importing to or distributing in Canada themselves or via another entity are manufacturers not importers or distributors.

05/05/2016


Classification of Medical Devices

•Health Canada reviews the manufacturer’s classification

•CMDR Schedule 1 – Classification Rules for Medical Devices• Includes 16 Rules for invasive, non-invasive, active and special rules plus

•9 Rules for IVDD• In addition, there is a Schedule 2, which is for Implants

05/05/2016



• Classes (Schedule 1 and 2 of the CMDR):

05/05/2016

Heart valve, AIMDD systems, Devices of human origin

Implants

highest risk (animal tissue devices, HIV test kit)

Class IV

medium risk (hip implant, glucose monitor)

Class III

low risk (contact lenses, pregnancy test kit)

Class II

lowest risk (surgical instruments, culture media)

Class I



•Note: The CMDR differentiates between Implants as in Schedule 2, and implantable devices in schedule 1 [example orthopedic devices]

• Implants require patient registration cards and distribution records in accordance with sections 54, and 66-68

• Implantable devices under schedule 1 does not require fulfillment of sections 54 or 66-68

05/05/2016


Medical Device License Categories

• Device License (Sec. 26 –43):

05/05/2016

Need ISO 13485 certificate that has been issued by a CMDCAS recognized registrar

QS Requirement

Renewed annually on Nov 1WhenManufacturers of Class II, III, IVWho

Note: Scope of certificate must describe devices in unambiguous terms


Medical Device License Categories

• II. Establishment License (MDEL) (Sec. 44 – 51):

05/05/2016

Do not need ISO 13485 certificate that has been issued by a CMDCAS recognized registrar

QS Require-ment

Renewed annually on December 1When

Importers and Distributors of Class I, II, III, IV and Manufacturers of Class I with no Distributor

Who


CMDR Medical Device License Requirements

Device license requirement class I devices:

• No device license required

05/05/2016


CMDR Applicability of QS Requirements

•Class I Medical Devices (Sec. 25):•No quality system (QS) requirement

•Class II Medical Devices (Sec. 26 - 32):•The QS under which the device is manufactured must satisfy ISO 13485:2003 with possible exclusion of Clause 7.3. Manufacturers are encouraged to include design control if they are design responsible

05/05/2016



Class III and IV (Sec. 26 - 32):

• The QS under which the device is manufactured must satisfy ISO 13485:2003 with no exclusion of Clause 7.3; design control must be included and assessed

05/05/2016



Custom-made and devices sold for special access (sec. 69 -78):

• No QS requirement

05/05/2016



What is not accepted by Health Canada?

• ISO 9001:2008 QS certificates• QS certificate issued to other countries’ national or

regional standards, EN ISO 13485:2012• Any other QS certificate issued to a standard other than

ISO 13485:2003 • FDA inspections• Manufacturer’s self declaration of conformity

05/05/2016


Outsourced Processes

Must be considered under Guidance Documents 210 point 2.3.2:

• Would not have to visit a sub-contractor that does not have substantial involvement with the manufacture or design and manufacture of the medical device

• Would not have to visit if supplier is not supplying a part, material or service that is affecting the conformity of the medical device with the Safety and Effectiveness Requirements of the CMDR

05/05/2016


Outsourced Processes

• If the sub-contractor does have substantial involvement in the QMS or supplies a part that is critical to the medical device, the Registrar must evaluate whether there is sufficient objective evidence at the legal manufacturer’s location that shows the competence of the supplier (subcontractor) to undertake the supply of the part, material or service in relation to the medical devices that are manufactured, or designed and manufactured, under the registered QMS

•Risk must always be considered as part of this evaluation

05/05/2016


Applicability of QS Requirements – Outsourcing

Subcontract manufacturer’s QS?

• Important consideration:• Control exercised by the manufacturer over

the subcontractor• Quality System registration held by the

subcontractor (ISO 13485)

05/05/2016


Applicability of QS Requirements – Outsourcing

Control of the subcontractors through contracts, purchasing agreements, specification verification or second party audits could include:• Specifying design and product requirements • Specifying personnel qualifications • Verifying that subcontracted products meet

specified requirements • Specifying a quality system under which the

subcontracted products are designed and manufactured

• Performing on-site inspections • Validating processes

05/05/2016


Applicability of QS Requirements – Multi-site

Large companies with multiple facilities:

• More than one site or geographic location under scope of QS is used in the design and manufacturing process, these sites or locations may be audited by the registrar

• Central office or location with a network of local offices or branches under one QS.

• Audit days are based on MD9 from the ISO17021:2011 requirements, sampling is not allowed for locations with design and manufacturing capabilities.

05/05/2016


Applicability of QS Requirements – Multi-site

Large companies with multiple facilities:

• Multi-site organizations under one QS plus some processes (e.g., device license application, device license amendment, regulatory correspondence, packaging, warehousing, and distribution) delegated to sites or subcontractors outside QS All sites under QS audited plus Activities outside QS audited for objective evidence

that the applicable sections of the CMDRs have been addressed

05/05/2016


Virtual Manufacturers

•Organizations that act as a “virtual manufacturer” such as own brand labelers, distributors or retailers acting as manufacturers present a challenge to the auditor in terms of audit planning and execution

•Virtuals have the same legal responsibility for meeting the safety, effectiveness and QMS requirements as a real manufacturer

•Organizations that act as a regulatory correspondent and have assigned regulatory activities by the manufacturer, must be audited by the registrar

•Any decision and justification for not visiting a supplier, an OEM, or a regulatory correspondent shall be documented and made available for review

05/05/2016


Registrar Requirements When Certificates Change

•BSI and all approved CMDCAS registrars are required to notify Health Canada within 15 days of any scope reduction, cancelled certificate, expired certificate not renewed, or suspended certificate.

05/05/2016


GD 207

•2.3.2 Two or more manufacturer’s names on a certificate

•Prescribes a format for when manufacturers have more than one name associated with their QMS.

•Manufacturers should demonstrate intent to sell with other names in Canada.

•Nevertheless, multiple names on a single certificate is undesirable and should be avoided where possible.

05/05/2016


GD 207

•Guidance document available to anyone on the Health Canada website for the content of ISO13485:2003 certificates issued by Registrars. Free

•Manufacturer’s Name:•Name shall be the same for the cert, licence, and device label.

•Simplistic rule reinforces the link between the responsible entity and the device.

05/05/2016


GD 207

•2.4 Manufacturer’s address•Treated separately from manufacturer’s name, but similar rationale

•Address on the certificate = Address on the licence = Address on the device label

•PO Box can be added to a physical address

05/05/2016


GD 207

•2.6.2 Device listing•Mostly addressed with templates in Appendix 1.• “Accessories” allowed but manufacturers should not point to this term for licensing a device which is absent in the scope statement.

•The addition of a device should prompt a consideration for another audit and/or certification decision.

05/05/2016


GD 210

•Guidance document used by Auditors for ISO 13485:2003 Quality Management System Audits Performed by Health Canada Recognized Registrars

•You may see BSI auditors using this document or referring to it, but it is available to anyone on the Health Canada website and could be useful in your own internal audit system.

05/05/2016


Internal Auditing to the CMDR requirements

•Are the requirements for the CMDR written into my company’s QMS?

•What types of license(s) does my company have?•Medical, Establishment, both?•Who is responsible for reporting incidents and recalls to Health Canada?

•What training has this person had related to CMDR requirements?

•Do they know the reporting requirements? For problem reporting or recalls? 10/30 days

•Do they know reporting requirements for an updated certificate to HC? Within 30 days

05/05/2016


Internal Auditing to the CMDR

•What Technical files does my company have for the products sold into Canada?

•Are they complete related to the CMDR requirements in Sec. 10-20?

•What are the classification(s) of my company’s devices?• Is there adequate detail in the technical file to support design requirements.

•Does labeling meet the Canadian Requirements? Is English and French necessary?

05/05/2016


Internal Auditing to the CMDR

•How are my company’s products distributed in Canada? Is there an authorized agent that does this? What records does this person have to maintain?

•Does my company have any outsourced processes? If critical, does this company maintain their own ISO13485 certificate or CMDCAS certificate?

•Does my company’s scope of registration cover all products that will be sold or are being sold into Canada?

05/05/2016

Copyright © 2012 BSI. All rights reserved.

MDSAP and BSI’s Participation in the Program

Angie Combs

05/05/2016


International Medical Device Regulatory Forum (IMDRF)

• IMDRF Management Committee (MC) regulators:•Australia, Brazil, Canada, China, the European Union, Japan and the United States of America

•Representatives of the World Health Organization (WHO) •Regulators from the Russian Federation, Mexico, Asian Harmonization Working Party (AHWP) participate as affiliate organization

•Japan joined MDSAP in 2015

05/05/2016


International Medical Device Regulatory Forum (IMDRF)

• IMDRF was conceived in February 2011 as a forum to discuss future directions in medical device regulatory harmonization.

•Voluntary group of medical device regulators from around the world who have come together to build on the strong foundational work of the Global Harmonization Task Force on Medical Devices (GHTF)

•Accelerate international medical device regulatory harmonization and convergence.

05/05/2016


MDSAP Goals

•Recognize Auditing Organizations (AO)

•Single Audit by AO would: •benefit patient health and patient access • leverage regulatory resources •minimize medical device manufacturing disruptions due to multiple regulatory audits

•provide global benefit both on short term goals and longer term goals by IMDRF regulators

05/05/2016


MDSAP Pilot

•Pilot started in January 2014 (for three years)•CB’s from participating member states can apply to AO’s

•CMDCAS recognized registrars•Office audit and witnessed audits required•Conducted by regulator (Health Canada, US FDA, ANVISA, TGA, or Japan)

05/05/2016


MDSAP Manufacturer Audit Cycle

•ISO 13485:2003 +•GMP requirements of the regulatory authorities, TGA + ANVISA + Health Canada + FDA + Japan

•One audit to address all•Certification will be required

05/05/2016


MDSAP Manufacturer Audit Cycle

•The Medical Device Single Audit Program is based on a three year audit cycle.

•The Initial Audit, also referred to as the “Initial Certification Audit” is a complete audit of a medical device manufacturer’s quality management system (QMS) consisting of a Stage 1 Audit and a Stage 2 Audit

• (Duration of audits is based specifically on tasks that are applied to each organization, around 15 minutes per task)

05/05/2016


Differences in Report Writing from CMDCAS or CE to MDSAP

•Non-conformities will be graded. Grading of 1-3 are considered Minor. Three NCs with a grade of 4 will require an Unannounced audit as well as any NC with a score of 5. We are required to do follow-up visits with an unannounced visit 6-9 months later to verify the actions are completely implemented and remain closed.

05/05/2016


Differences in CMDCAS to MDSAP

•The MDSAP audit sequence was designed and developed to allow for the audit to be conducted in a logical, focused and efficient manner.

•The audit will begin with Management requirements, Measurement/Analysis and Improvement, Design and Development and Production and Service Controls and supporting processes in Purchasing. Additional support processes of Device Marketing Authorization and Facility Registration and Medical Device Adverse Events and Advisory Notice Reporting will also be reviewed as part of the audit.

05/05/2016


BSI is now a Recognized AO

•This means BSI has met the requirements to be an Auditing Organization and we can now conduct MDSAP Audits.

•We have had audits at both our Herndon office and UK office.

•We have had 3 witness audits by the FDA and Health Canada for large multi-sites and approximately 12 others in the last few months.

05/05/2016


Submitting Reports to the Regulators

•All MDSAP Audit reports MUST be submitted to ALL Regulators. As part of this program, regardless of the outcome, ALL Regulators will be reviewing the reports.

•There will be a database set-up for these reports so that the Regulators can review the reports, the NCs, the grading and look for trending in the non-conformities.

05/05/2016


Opting out of Regulations

•Manufacturers CANNOT opt out of any regulation if they are currently selling in that market. Meaning, you can’t have an MDSAP audit and have us only audit the requirements for Brazil and Australia, if you currently also sell into Canada, Japan and the US.

•We would not audit you to any regulation that is not applicable, but if it is, we must include the regulatory requirements for any of these jurisdictions.

05/05/2016


Potential Witness Audits by the Regulators

•BSI has had numerous Witness Audits by all our accreditations bodies, including Health Canada and MHRA annually.

•We have always done well in these audits and it has been our experience that the Regulators are only interested in BSI and what we are doing during these witness audits.

•Our clients have always commented after the fact that the experience was not disruptive and not as bad as they thought it would be.

05/05/2016


Lessons Learned

•BSI originally thought we could take on-line training and send our auditors out for these audits and they would be ready, but this was not the case. We have found they need more mentoring.

•This is a very different audit and program and takes some getting used to. We have found the scoring of the NCs to be questioned by clients. They think it’s a judgement of their QMS rather than what it actually is, a score of lack of implementation or information.

05/05/2016


Lessons Learned

•Most of the clients have done very well, but typically the Brazilian and Australian requirements are not evident in the procedures.

•Review of US MDR requirements are usually within the 30 day requirements, but evidence of review of other jurisdictions is sometimes lacking.

•Training of auditors is usually needed to bring competence level up for internal as well as supplier auditing.

05/05/2016


MDSAP Audit Application Status

• In Closing….

•BSI has completed around 40 audits and we have issued 8 certificates.

•We cannot issue a certificate until a client has completed a full assessment under either an initial or recertification.

05/05/2016


Questions

05/05/2016

Date post:	17-Jul-2020
Category:	Documents
Upload:	others
View:	0 times
Download:	0 times