4 Quality management system (QMS) T 22                    pdca p

 

4.1 General requirements

Purpose of the QMS, requirements of ISO 13485, control of outsourced processes, software validation

Requirements 1 to 26 (see also the quiz)

md requirements 

 In the simplified diagram of figure 4-1 we can see the purpose of an ISO 13485 quality management systemset of processes allowing the achievement of the quality objectives (see also ISO 9000, 3.5.4):

purpose

Figure 4-1. Purpose of an ISO 13485 QMS

The requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4) of the ISO 13485 standard in clauses 4 to 8 are shown in figures 4-2:

iso 13485 requirements
Figure 4-2. The requirements of the ISO 13485: 2016 standard

Requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4) related to productsany outcome of a process or activity (see also ISO 9000, 3.7.6) are specified by the customeranyone who receives a product (see also ISO 9000, 3.2.4)  , by the company or a regulation.

The requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4) of ISO 13485 apply exclusively to the quality management systemset of processes allowing the achievement of the quality objectives (see also ISO 9000, 3.5.4) and its processesactivities that transform inputs into outputs (see also ISO 9000, 3.4.1):

  • customer requirements and applicable regulatory requirements are identified and taken into account
  • the quality management system (QMS) is established, documented, implemented and maintained
  • the quality policy, objectives, resources and work environment are determined
  • the roles of the manufacturer, importer, distributor and authorized representative are documented 
  • processes required by the QMS:
    • are identified, measured, monitored
    • records are retained for compliance with requirements:
      • of the ISO 13485 standard
      • applicable regulatory requirements
    • their objectives are established and analyzed
    • their necessary resources are provided
    • their sequence and the interactions are determined
    • their operational criteria are established
    • their information essential for monitoring is ensured
    • their owners are named
  • the level of risk of the processes is identified in relation to:
    • impact on safety and performance of medical devices
    • regulatory compliance
  • actions to achieve planned results and maintain process efficiency are established and implemented
  • staff are involved

In annex 05 are shown the new requirements of the 2016 version of the standard with examples of actions to be undertaken. record

Processactivities that transform inputs into outputs (see also ISO 9000, 3.4.1) changes (cf. sub-clause 7.3.9) are:

  • evaluated against their impact on:
    • the QMS
    • medical devices
  • controlled in accordance with the requirements:
    • of the ISO 13485 standard
    • applicable regulatory requirements

An outsourced processactivities that transform inputs into outputs (see also ISO 9000, 3.4.1) is always controlled and does not relieve the organizationa structure that satisfies a need (see also ISO 9000, 3.2.1)   of its responsibilitiescapacity to make a decision alone towards customersanyone who receives a product (see also ISO 9000, 3.2.4)   (cf. sub-clause 7.4). Outsourced processesactivities that transform inputs into outputs (see also ISO 9000, 3.4.1) are identified and their level of risklikelihood of occurrence of a threat or an opportunity (see also ISO Guide 73, 1.1) is proportionate to the ability of the external party to meet the requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4) (see annex 07). An element of outsourced processactivities that transform inputs into outputs (see also ISO 9000, 3.4.1) control is the signed supplierentity that provides a product (see also ISO 9000, 3.2.5) qualityaptitude to fulfill requirements (see also ISO 9000, 3.6.2) agreement. record

The proceduredocument describing the to carry out a process (see also ISO 9000, 3.4.5 and documented information)  software validationconfirmation that the application of a process, product, service or material allows expected results to be achieved (see also ISO 9000, 3.8.13)   includes:

  • validation of software applications prior to initial use
  • revalidation after software or application change
  • a proportionate approach of risk associated with its use
  • retaining records

Used software is validated and a list is retained. 

The ISO guide “The integrated use of management system standards” of 2018, contains relevant recommendations on the integration of management systems.

pointPitfalls to avoid:

  • going overboard on quality: explications
    • a useless operation is performed without adding value and without the customer asking for it - it is a waste, cf. quality tools D 12
  • having all procedures written by the quality manager: explications
    • quality is everybody's business, cf. paragraph 6.2 - "the staff is conscious of the relevance and importance of each to the contribution to quality objectives", which is even more true for department heads and process pilots
  • forgetting to take into account the specificities related to the corporate culture: explications
    • innovation, luxury, secrecy, authoritarian management (Apple)
    •  strong culture related to ecology, action and struggle, while cultivating secrecy (Greenpeace)
    • fun and quirky corporate culture (Michel & Augustin)
    • liberated company, the man is good, love your customer, shared dream (Favi)
Good practices
Bad practices

Top of the page

 

4.2 Documentation

Documentation pyramid, procedures and records of a medical device QMS

Requirements 27 to 62

documents

The right document, at the right place, at the right moment

The documentation of the QMSQuality Management System (cf. figure 4-3) includes:

pyramid

Figure 4-3. Documentation pyramid

The quality manualdocument specifying the general measures taken by an organization to obtain conforming products or services (see also ISO 9000, 3.8.8) (cf. annex 08) describes the: record

The quality manualdocument specifying the general measures taken by an organization to obtain conforming products or services (see also ISO 9000, 3.8.8) is like traffic laws: it is mainly a guide, a tool, but it does not teach you to drive.

The medical deviceproduct or service to be used for purposes of diagnosis, prevention, monitoring, treatment, alleviation of disease or injury file includes the technical documentation developed and maintained for each model or type of MD and each servicing activity. This documentation includes: 

Documentsany support allowing the treatment of information (see also ISO 9000, 3.8.5) requiring approval of changes by customersanyone who receives a product (see also ISO 9000, 3.2.4)   or authorities are identified.

A chart summarizing customeranyone who receives a product (see also ISO 9000, 3.2.4)   requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4), applicable regulatory requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4) and processesactivities that transform inputs into outputs (see also ISO 9000, 3.4.1) is a great help in verifying QMSQuality Management System conformityfulfillment of a specified requirement (see also ISO 9000, 3.6.11).

Each internal documentany support allowing the treatment of information (see also ISO 9000, 3.8.5) is verified and approved. Any documented proceduredocument describing the to carry out a process (see also ISO 9000, 3.4.5 and documented information), requirementexplicit or implicit need or expectation (see also ISO 9000, 3.6.4) or activity is implemented and maintained. Outdated (obsolete) documentsany support allowing the treatment of information (see also ISO 9000, 3.8.5) are identified, retained and their use prohibited in the workshop.

The next-to-last version of a documentany support allowing the treatment of information (see also ISO 9000, 3.8.5) may become a recorddocument providing objective evidence of achieved results (see also ISO 9000, 3.8.10 and documented information).

The technical report ISO/TR 10013 (2006): "Guidelines for quality management system documentation" provides recommendations relative to the documentation of a QMSQuality Management System.

Answers to all 416 requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4) (in the text « shall ») of clauses 4 to 8 of the ISO 13485 standard are included in the documentation. ISO 9001 “only” requires 305.

Document: any support allowing the treatment of information
Record: document providing objective evidence of achieved results
Quality manual: document specifying the general measures taken by an organization to obtain conforming products or services
Procedure: document describing the actions to carry out a process

The proceduresdocument describing the to carry out a process (see also ISO 9000, 3.4.5 and documented information)   of ISO 13485 (cf. annex 09) are: record

You can group several proceduresdocument describing the to carry out a process (see also ISO 9000, 3.4.5 and documented information) into one. The documentation can be in any form and any type of medium. It contributes, among other things, to providing objective evidencedemonstrably true factual data (see also ISO 9000, 3.8.3) and evaluating the effectivenesscapacity to perform planned activities with minimum effort (see also ISO 9000, 3.7.11)   and performancemeasurable and expected results of the management system (see also ISO 9000, 3.7.8) of the QMSQuality Management System.

Objective evidence: demonstrably true factual data

Rework: action on a product to make it conform

A proceduredocument describing the to carry out a process (see also ISO 9000, 3.4.5 and documented information) may or may not be documented (see ISO 9000: 2015, sub-clause 3.4.5 – Note 1: “Procedures can be documented or not”). Our preference is for the documented (written) solution, short, simple and relevant. Especially in cases where the absence of a proceduredocument describing the to carry out a process (see also ISO 9000, 3.4.5 and documented information) can lead to deviations from the policy, the quality objectivesquality-related, measurable goal that must be achieved (see also ISO 9000, 3.7.2), the safety or the performancemeasurable and expected results of the management system (see also ISO 9000, 3.7.8) of the medical deviceproduct or service to be used for purposes of diagnosis, prevention, monitoring, treatment, alleviation of disease or injury.

Changes made are carried out by the author of the documentany support allowing the treatment of information (see also ISO 9000, 3.8.5) and reviewed and approved by a person with relevant information to make decisions.

Methods of protecting recordsdocument providing objective evidence of achieved results (see also ISO 9000, 3.8.10 and documented information) containing confidential health information are implemented in accordance with applicable regulatory requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4).

A review of the documentation is carried out periodically by the quality managerleader of the journey towards excellence.

The retention period of at least one copy of the documentsany support allowing the treatment of information (see also ISO 9000, 3.8.5) is determined (proceduresdocument describing the to carry out a process (see also ISO 9000, 3.4.5 and documented information) and recordsdocument providing objective evidence of achieved results (see also ISO 9000, 3.8.10 and documented information)). This period complies with applicable regulatory requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4) and shall not be less than the lifetime of the medical deviceproduct or service to be used for purposes of diagnosis, prevention, monitoring, treatment, alleviation of disease or injury and no less than two years from the release of the MD. 

True story 

At a third party audit, the auditor asked to see the version history of three procedures and some instructions.

The procedures all had more than three versions and the instructions (in our case, audit reports) had on average two or three versions (actions and one or two follow-ups).

The auditor was comforted because he was afraid he would come across “inactive” documents. 

The QMSQuality Management System documentation is related to the size and type of the organizationa structure that satisfies a need (see also ISO 9000, 3.2.1)  , the complexity of processesactivities that transform inputs into outputs (see also ISO 9000, 3.4.1) and the competence of staff. This documentation is accessible to the personnel concerned and they are informed during evolutions of the documentation. Only the documentsany support allowing the treatment of information (see also ISO 9000, 3.8.5) that are strictly necessary are required to obtain simplified documentation. Example of documentsany support allowing the treatment of information (see also ISO 9000, 3.8.5) commonly used include:

Specification: final description of system or product requirements in order to develop or validate it

Theprocessactivities that transform inputs into outputs (see also ISO 9000, 3.4.1) "manage documentation" ensures the review, release, changes and implementation of the customeranyone who receives a product (see also ISO 9000, 3.2.4)  's technical specifications. processus

Spoken words fly away, written ones stay. Latin proverb

Retained recordsdocument providing objective evidence of achieved results (see also ISO 9000, 3.8.10 and documented information) required by ISO 13485 and regulation 2017/745 to prove conformityfulfillment of a specified requirement (see also ISO 9000, 3.6.11) and effectivenesscapacity to perform planned activities with minimum effort (see also ISO 9000, 3.7.11)   of the QMSQuality Management System (sub-clauses): 

Each recorddocument providing objective evidence of achieved results (see also ISO 9000, 3.8.10 and documented information) is unique and usually cannot be changed, except for error correction. Any recorddocument providing objective evidence of achieved results (see also ISO 9000, 3.8.10 and documented information) provides evidence of a task, operation, activity, processactivities that transform inputs into outputs (see also ISO 9000, 3.4.1) or requirementexplicit or implicit need or expectation (see also ISO 9000, 3.6.4). Recordsdocument providing objective evidence of achieved results (see also ISO 9000, 3.8.10 and documented information) are the essential database for analyzing processactivities that transform inputs into outputs (see also ISO 9000, 3.4.1) efficiencyfinancial relationship between achieved results and resources used (see also ISO 9000, 3.7.10) and contributing to the maintenance of the QMSQuality Management System. Examples of other recordsdocument providing objective evidence of achieved results (see also ISO 9000, 3.8.10 and documented information) often used:

The recorddocument providing objective evidence of achieved results (see also ISO 9000, 3.8.10 and documented information) retention period is determined and is usually included in the master documentany support allowing the treatment of information (see also ISO 9000, 3.8.5) list. This period is at least two years, complies with applicable regulatory requirementsexplicit or implicit need or expectation (see also ISO 9000, 3.6.4) and cannot be less than the life of the medical deviceproduct or service to be used for purposes of diagnosis, prevention, monitoring, treatment, alleviation of disease or injury. 

Good practices
Bad practices

smileyMinute of relaxation. Game: Documentation

The rest of the T 22v16 ISO 13485 readiness version 2016 training is accessible on this page.

See also the training T 42v16 Internal audit ISO 13485 and the training package ISO 13485.

Top of the page