ISO 13485:2016 (3rd Ed)MEDICAL DEVICES –QUALITY MANAGEMENT SYSTEMS –REQUIREMENTS FOR REGULATORY PURPOSES
A BRIEF OVERVIEW
Presentation by Abe WongASQ-CQA, LSS-MBB
FDA Clinical InvestigatorISO 13485:2016 Auditor
[email protected] (858) 231-9399 1
Reasons for new editionSome new medical events contributing to changes during the past 13 years since the 2nd Edition was released in 2003:
◦ Cardiovascular Disease Prevention and Cancer Prevention◦ Vaccine-Preventable Diseases◦ Maternal and Infant Health◦ Devices manufactured utilizing non-viable tissue or human cells ◦ Active Implantable and Nanomaterial Devices◦ Motor Vehicle Safety and Occupational Safety◦ Medical Software and Automated Computerized Devices◦ Public Health Preparedness and Response◦ International Council for Harmonisation
◦ Regulatory members: Europe, Japan, USA, Canada, and Switzerland
◦ Observer members: Brazil, India, Mexico, Singapore, South Korea, Russia, Chinese Taipei, and Australia
◦ Recent re-organizational changed on 10/26/2015 from International Council on Harmonisation
◦ A transformation from the previous Global Harmonisation Task Force (GHTF)
[email protected] (858) 231-9399 2
The QMS FrameworkProcess Approach
◦ Stakeholders◦ Internal organization, suppliers, customers, external parties, etc.
◦ Each conversion from input to output is a process by itself◦ Design, development, production, storage, distribution, installation, servicing
◦ Application, identification, and interaction of the processes◦ This 3rd Edition framework provides clarification to previous releases
◦ Allowing the users an easier understanding for meeting requirements
◦ Processes are considered as added value to the organization
◦ The result is determined by the process performance and its effectiveness
◦ Objective measurement is engaged for process improvement
◦ The organization still has the responsibility and accountability
◦ Justification is necessary for any exclusions and alternative approaches from the requirement
[email protected] (858) 231-9399 3
Relationship with ISO 9001:2015Active Implantable Device
Advisory Notice
Customer Complaints
Labeling
Sterilization & Requirements
Production & Service Control
Product Cleanliness & Contamination Control
Identification & Traceability
[email protected] (858) 231-9399 4
Key Elements in ISO 9001Section Number ISO 9001:2008 ISO 9001:2015
1 Scope Scope
2 Normative References Normative References
3 Terms & Definitions Terms & Definitions
4 General Requirements Context of the Organization
5 Management Responsibility Leadership
6 Resource Management Planning
7 Product Realization Support
8 Measurement, Analysis & Improvement Operation
9 Performance Evaluation
10 Improvement
[email protected] (858) 231-9399 5
Comparing the concepts Section Number ISO 9001:2015 ISO 13485:2016
1 Scope Scope
2 Normative References Normative References
3 Terms & Definitions Terms & Definitions
4 Context of the Organization QMSSystematic Requirements, organization, medical devices, processes, outsourcing, conformity, software validation, documents & records
5 Leadership Management ResponsibilitiesQuality Policy, quality planning, management reviews, audits
[email protected] (858) 231-9399 6
Comparing the concepts Section Number ISO 9001:2015 ISO 13485:2016
6 Planning Resources ManagementInfrastructure, human resources, work environment, contamination control
7 Support Product RealizationRisk management, product realization planning, quality objectives, verifications, D&D reviews, validations, complaints, sterile barrier systems, traceability, implantable devices
8 Operation Measurement, Analysis & ImprovementRisk management, feedbacks, complaints, reporting, internal audit, monitoring & measurement of processes & product, nonconforming control, data analysis, improvement, CAPA
[email protected] (858) 231-9399 7
What’s new in the big picture?ISO 13485:2016 vs ISO 13485:20031. Flexibility
◦ Organization can exclude any requirement if they are able to justify the reason for the exclusion or the alternative method taken
2. Regulatory◦ Explicitly expects compliance to any and all other applicable statutory & regulatory requirements at the
same time
3. Risk based approach◦ Apply risk management methods and techniques to all phases of every processes from D&D through
post-market activities and any possibilities in between
4. Design & Development inputs◦ Organization must include risk management in all stages of activities, which clarifies the usability &
safety of the output, and all that can be verified & validated
[email protected] (858) 231-9399 8
What’s new in the big picture?ISO 13485:2016 vs ISO 13485:20035. Medical device file & record keeping
◦ Required documentation including the description of each device or family of devices plus all the associated specifications, procedures, and records with the expectation of protection to patient privacy, and protecting confidential health information
6. Product realization◦ The production process must be able to identify every elements that is compliant to verification, validation,
revalidation, and traceability requirements
7. Training◦ The organization must specify operator training, user training, and any regulatory, usability, and safety
requirements in every process, and these requirements are met before releasing the product to customers
8. Design & Development verification & validation◦ Including associated and ancillary medical device component, connections and interfaces, requirement to
verify and validate that the process output meets the design input
[email protected] (858) 231-9399 9
What’s new in the big picture?ISO 13485:2016 vs ISO 13485:20039. Design & Development changes
◦ Establish change control processes, evaluate any impact and the significant, including associated device or family of devices before executing the change or the transfer
10. Design & Development transfer◦ Specifically requirement to focus on the necessity of processes to ensure that the outputs are suitable
for manufacturing before becoming production specifications
11. Procurement control◦ The organization must engage with risk base approach on making sure that the safety and performance
of the device with the supplied component are achievable, and that the suppliers are actually meeting all product, customer, and relevant statutory requirements
12. Supplier management◦ Provide proof for monitoring record of supplier performance and any changes made with the
considerations for risk impact, in case of the supplier’s underperformance or failure to perform
[email protected] (858) 231-9399 10
What’s new in the big picture?ISO 13485:2016 vs ISO 13485:200313. Purchased risks
◦ Consider the risks from purchased parts when and if any unanticipated changes at the supplier side were made and whether or not it impacts the device in a long term or affecting the normal process
14. Process validation◦ Establish validation plans and procedures that including revalidation of the device whenever and
wherever is necessary in every stage
15. Servicing◦ Analyze the service records to identify whether the service request also consists of a complaint nature
in addition to only routine servicing and that any improvement opportunities are captured on the record
16. Complaints◦ Including all types of potential complaints under the established Complaint Handling Procedure that
complies with applicable regulatory requirements
[email protected] (858) 231-9399 11
What’s new in the big picture?ISO 13485:2016 vs ISO 13485:200317. Nonconforming product delivery
◦ Investigate nonconforming products after delivery to determine the extend of corrective action and reporting to external parties or to the authority if necessary
18. Process improvement◦ Including maintenance of the safety and performance of the device whenever any improvements are
being considered, and to verify compliance with all applicable regulatory requirements before the implementation of corrective and preventive actions, and that the actions do not compromise the safety and performance of the device
[email protected] (858) 231-9399 12
ISO 13485:2016 (3rd Ed) Summary of Additional Requirements since the 2nd Ed
Section Descriptions
Introduction –General
Added these two new influences:(1) Organizational Environment(2) Regulatory Requirements
Introduction –Clarification of Concepts
Added these two new criteria: (1) Compliance with regulatory requirements(2) The requirement of necessary for the organization to manage risks
[email protected] (858) 231-9399 13
ISO 13485:2016 (3rd Ed) Summary of Additional Requirements since the 2nd Ed
Section Descriptions
4 – QMS4.1 General Requirements
• Added requirement to document the roles of the organization• Added requirements related to changes to processes• Added requirements related to validation of the application of computer
software used in the quality management system
6 – Resource Management6.3 Infrastructure
• Added requirement that infrastructure prevents product mix-up and ensure orderly handling of product
• Added information system to the listing of supporting services
6 – Resource Management6.4 Work Environment and
Contamination Control
• Added documentation requirement for work environment• Added requirement related to control of contamination with
microorganism or particulate matter for the sterile medical devices
[email protected] (858) 231-9399 14
ISO 13485:2016 (3rd Ed) Summary of Additional Requirements since the 2nd Ed
[email protected] (858) 231-9399 15
Section Descriptions
7 – Product Realization7.1 Planning of Product
Realization
• Added requirement to list the planning details
7 – Product Realization7.2 Customer-Related
Processes
• Added requirement to list the customer-related processes• Added requirement to communicate with regulatory authority
7 – Product Realization7.3.2 Design and
Development Planning
• Added requirement to list the D&D planning details
7 – Product Realization7.3.3 Design and
Development Inputs
• Added requirement to list the D&D input details• Added requirement that the requirement to list the D&D input details be
able to verified or validated
ISO 13485:2016 (3rd Ed) Summary of Additional Requirements since the 2nd Ed
[email protected] (858) 231-9399 16
Section Descriptions
7 – Product Realization7.3.5 Design and
Development Review
• Added requirement to list details of the contend of records
7 – Product Realization7.3.6 Design and
Development Verification
• Added requirement for documentation of verification plans and interface considerations
• Added requirement for records of verification
7 – Product Realization7.3.7 Design and
Development Validation
• Added requirement for documentation of validation plans, including product to be used for validation and interface considerations
• Added requirement for records of validation
7 – Product Realization7.3.9 Control of Design
and Development Changes
• Added requirement that the evaluation of the change effect should be made on products in process and on the outputs of risk management and product realization processes
• Added requirement to consider the detail in the determination of the significance of a design and development changes
ISO 13485:2016 (3rd Ed) Summary of Additional Requirements since the 2nd Ed
[email protected] (858) 231-9399 17
Section Descriptions
7 – Product Realization7.4.1 Purchasing Process
• Added requirements related to monitoring and re-evaluation of suppliers, and action to be taken when purchasing requirements are not met
7 – Product Realization7.4.2 Purchasing
Information
• Added requirement to include notification of changes in purchased products
7 – Product Realization7.4.3 Verification of Purchased Product
• Added requirements on the context of verification activities and action to be taken when the organization becomes aware of any changes to the purchased product
7 – Product Realization7.5.1 Control of
Production and Service Provision
• Added requirement for details related to the controls for carrying out production and service provision
ISO 13485:2016 (3rd Ed) Summary of Additional Requirements since the 2nd Ed
[email protected] (858) 231-9399 18
Section Descriptions
7 – Product Realization7.5.4 Servicing Activities
• Added requirement for analysis of records for service activities
7 – Product Realization7.5.6 Validation of
Processes for Production and Service Provision
• Added requirement to list the validation processes• Added requirement for details related to situations requiring procedures• Added requirements related to the validation records
7 – Product Realization7.5.7 Particular
Requirements for Validation of Processes for
Sterilization and Sterile Barrier System
• Added requirements for sterile barrier systems
ISO 13485:2016 (3rd Ed) Summary of Additional Requirements since the 2nd Ed
[email protected] (858) 231-9399 19
Section Descriptions
7 – Product Realization7.5.8 Identification
• Added requirement for Unique Device Identification (UDI)• Added requirement for a documented procedure for product
identification • Added requirement for documentation regarding identification and
product status during production
7 – Product Realization7.5.11 Preservation of
Product
• Added requirement to list details for how preservation can be accomplished
ISO 13485:2016 (3rd Ed) Summary of Additional Requirements since the 2nd Ed
[email protected] (858) 231-9399 20
Section Descriptions
8 – Measurement, Analysis and
Improvement8.2.1 Feedback
• Added requirement to utilize feedback in risk management processes in order to monitor and maintain product consistency
8 – Measurement, Analysis and
Improvement8.2.6 Monitoring and
Measurement of Product
• Added requirement to identify the test equipment used to perform measurement activities
8 – Measurement, Analysis and
Improvement8.3 Control of
Nonconforming Product
• Added requirement for documentation details related to kinds of controls• Added requirements related to concessions• Added requirements for records related to the issuance of advisory
notices
ISO 13485:2016 (3rd Ed) Summary of Additional Requirements since the 2nd Ed
[email protected] (858) 231-9399 21
Section Descriptions
8 – Measurement, Analysis and
Improvement8.4 Analysis of Data
• Added requirement to include determination of appropriate methods, including statistical techniques and the extent of their use
• Added requirement to list all input details
8 – Measurement, Analysis and
Improvement8.5.2 Corrective Action
• Added requirement to verify that the corrective action does not have an adverse effect
• Added requirement for corrective action to be taken without undue delay
8 – Measurement, Analysis and
Improvement8.5.3 Preventive Action
• Added requirement to verify that the preventive action does not have an adverse effect
An Example of Relevant StandardsISO 14971:2007 Medical Device Risk Management
ISO 14001:2015 Environmental Management
ISO 19011:2011 Auditing
ISO 27001:2013 Information Security
ISO 28000:2007 Supply Chain Security
ISO 11135:2014 Sterilization of Health Care Products - Ethylene Oxide
ISO 11137-1:2006 Sterilization of Health Care Products - Radiation
OHSAS 18001:2007 Occupational Health & Safety Assessment Series
IEC 60601-1:2012 (3rd Ed) Medical Electrical Equipment
[email protected] (858) 231-9399 22
Thank You --Questions, Answers, and DiscussionsContact information
◦ Email: [email protected]
◦ Phone: (858) 231-9399
◦ Subject Matter Expert on FDA 21CFR cGMP regulations
◦ Specialized in providing QMS training and CAPA coaching
◦ Expertise on risk management, 510(k) submission, international regulatory compliance, CE Marking
◦ Offering on-site training classes for D&D compliance, internal auditors, ISO auditors, six-sigma green & black belts
◦ Providing remedial consultation services for organizations that has been cited on Form 483 observations from a FDA audit
◦ Also providing advisory services for organizations that has received a Warning Letter from the FDA or during a Consent Decree period
[email protected] (858) 231-9399 23
