Quality Management Systems for Drugs and Devices
9
Clause 4. Those controls should be proportionate to the
risk related to the process and should include written
quality agreements.
A significant addition is a requirement to validate
QMS computer software (in addition to software used
in the product) prior to initial use and following any
changes this includes software used in production,
design and development, testing, inventory control, label-
ing, distribution, calibration, maintenance, Corrective
and Preventive Action (CAPA), data management and
complaints handling. Clause 4 includes the requirement
to develop a device file that demonstrates conformity
with ISO 13485 and regulatory requirements.
Clause 4 now includes a detailed list of the
technical documentation that could be used to meet
regulatory requirements, including product description,
classification, preclinical testing, clinical evaluation, user
information (e.g., labels and IFU), standards applied
and risk management documentation.
Management Responsibility
Clause 5 requires top management to communicate
the importance of meeting customer and regulatory
requirements within the organization (previously, this
was explicitly the management representative’s remit).
There also is a new requirement to document authori-
ties and responsibilities. Action item identification and
implementation to meet quality objectives are required,
along with documentation of progress and any revisions.
The management representative’s responsibility to liaise
with external parties now includes regulatory authorities.
Management review frequency and rationale also should
be documented, including a documented procedure for
management review. The list of inputs for management
review includes complaint handling, reporting to reg-
ulators, process monitoring and product monitoring.
An additional management review output is needed to
respond to new or revised regulatory requirements.
Resource Management
Clause 6 now specifies organization personnel work-
ing at all levels in product quality, process fulfilment,
regulatory requirements and QMS compliance shall be
competent on the basis of education, training, skills and
experience. Staff competence should be maintained, and
training effectiveness verification must be commensu-
rate with the risk of the work for which the training is
provided, requiring a documented process.
If maintenance activities can affect product safety
or performance, documented procedures must exist for
that equipment. Additionally, if the work environment
can affect product safety or performance, the orga-
nization must document the requirements and have
procedures in place for monitoring and measuring the
work environment, e.g., an organization must document
the requirements for contamination and cleanliness for
sterile medical devices.
Product Realization
Clause 7.1 requires a risk management process to
be established, with specific criteria for product and
product acceptance: verification, validation, revalidation,
monitoring, measurement, inspection, test activities,
handling storage and traceability. Clause 7.2 requires
the organization to determine user training needs and
to develop provisions for protecting confidential health
information. A new clause contains requirements on
communicating with regulatory authorities.
In addition, the updated standard contains more
details on design planning, with an emphasis on
decision points and provides further details on transfer
activities (to ensure design outputs have been verified
before transfer to production occurs). Further details
are provided on verification and validation (V&V)
requirements. V&V activities require a specific plan,
with details on methodology, sample sizes and accep-
tance criteria. The standard also contains a new clause
on design transfer, specifying planning activities for
suppliers, personnel, materials and equipment.
Clause 7.3 requires organizations to maintain a file
that shows the design and development process has been
properly followed, including documenting the following:
• the methods used to ensure traceability of design
outputs to design inputs
9
Clause 4. Those controls should be proportionate to the
risk related to the process and should include written
quality agreements.
A significant addition is a requirement to validate
QMS computer software (in addition to software used
in the product) prior to initial use and following any
changes this includes software used in production,
design and development, testing, inventory control, label-
ing, distribution, calibration, maintenance, Corrective
and Preventive Action (CAPA), data management and
complaints handling. Clause 4 includes the requirement
to develop a device file that demonstrates conformity
with ISO 13485 and regulatory requirements.
Clause 4 now includes a detailed list of the
technical documentation that could be used to meet
regulatory requirements, including product description,
classification, preclinical testing, clinical evaluation, user
information (e.g., labels and IFU), standards applied
and risk management documentation.
Management Responsibility
Clause 5 requires top management to communicate
the importance of meeting customer and regulatory
requirements within the organization (previously, this
was explicitly the management representative’s remit).
There also is a new requirement to document authori-
ties and responsibilities. Action item identification and
implementation to meet quality objectives are required,
along with documentation of progress and any revisions.
The management representative’s responsibility to liaise
with external parties now includes regulatory authorities.
Management review frequency and rationale also should
be documented, including a documented procedure for
management review. The list of inputs for management
review includes complaint handling, reporting to reg-
ulators, process monitoring and product monitoring.
An additional management review output is needed to
respond to new or revised regulatory requirements.
Resource Management
Clause 6 now specifies organization personnel work-
ing at all levels in product quality, process fulfilment,
regulatory requirements and QMS compliance shall be
competent on the basis of education, training, skills and
experience. Staff competence should be maintained, and
training effectiveness verification must be commensu-
rate with the risk of the work for which the training is
provided, requiring a documented process.
If maintenance activities can affect product safety
or performance, documented procedures must exist for
that equipment. Additionally, if the work environment
can affect product safety or performance, the orga-
nization must document the requirements and have
procedures in place for monitoring and measuring the
work environment, e.g., an organization must document
the requirements for contamination and cleanliness for
sterile medical devices.
Product Realization
Clause 7.1 requires a risk management process to
be established, with specific criteria for product and
product acceptance: verification, validation, revalidation,
monitoring, measurement, inspection, test activities,
handling storage and traceability. Clause 7.2 requires
the organization to determine user training needs and
to develop provisions for protecting confidential health
information. A new clause contains requirements on
communicating with regulatory authorities.
In addition, the updated standard contains more
details on design planning, with an emphasis on
decision points and provides further details on transfer
activities (to ensure design outputs have been verified
before transfer to production occurs). Further details
are provided on verification and validation (V&V)
requirements. V&V activities require a specific plan,
with details on methodology, sample sizes and accep-
tance criteria. The standard also contains a new clause
on design transfer, specifying planning activities for
suppliers, personnel, materials and equipment.
Clause 7.3 requires organizations to maintain a file
that shows the design and development process has been
properly followed, including documenting the following:
• the methods used to ensure traceability of design
outputs to design inputs