Quality Management Systems for Drugs and Devices
15
and defined to the degree required by the standard.
Processes, responsibilities and resources should be
identified, and risks and opportunities considered. Every
organization will have existing policies, procedures and
processes already compatible with the standard’s require-
ments. Others may require amendment, and some may
be redundant. When reviewing the current system, the
following should be addressed:
• define processes to meet objectives
• identify process owners
• establish process inputs and outputs
• identify resources to meet objectives
• define methods for process measures
• include processes to maintain effectiveness
Gap analysis outputs may include:
• an inventory of current documents and records
• current quality objectives
• current monitoring and measurement methods
• gaps in ISO 13485 requirements
• missing documents, records and practices
• implementation plan deliverables and activities
QMS implementation assists in providing controls
to mitigate risks, which should be among the main
drivers for introducing a QMS as a result, risks and
opportunities should be reviewed when performing
the gap analysis (see ISO 14971 for guidance on risk
management throughout product realization). It is good
business practice to determine the day-to-day risks and
decide what controls are required to reduce them to the
financially appropriate extent.
Develop an Implementation Plan
Once the gap analysis determines what has to be
achieved, an implementation plan can be developed.
In developing the plan, key activities, responsibilities,
costs, schedules and resources should be estimated and
refined. The following activities should be considered
when developing the plan:
• establish system scope and objectives
• assign roles and responsibilities
• determine training needs
• identify development areas from gap analysis
• define and schedule activities
• develop system implementation project plan
• establish budget and approve plan
• review progress, update plan and communicate status
• manage project using practices in standard
The plan may change over time due to unforeseen
events, so it should be designed for easy mainte-
nance. At minimum, the plan should list key activities,
estimated start and finish dates and responsibilities.
Any assumptions and dependencies should be listed
to confirm the plan’s foundation. The responsibilities
identify activity ownership. An overall plan owner must
be established to manage the plan’s day-to-day aspects.
Top management will review and approve the plan. The
plan owner will inform management of actual results
compared to the plan. Another important consideration
is the maintenance of the current system’s integrity
while planning and implementing the modified system
(Clause 5.4.2 of ISO 13485). The following paragraphs
and Figure 1-5 demonstrate a sample schedule, which
1-2 months
Training
Planning
Define QMS
Gap analysis
3-4 months
Documentation
Certification
body selection
Implementation
5-6 months
Implementation
Operation
Evidence
7-8 months
Pre-assessment
Internal audit
Management
review
Corrective actions
9-10 months
Stage 1 audit
Stage 2 audit
Corrective
actions
Certification
12+ months
Audit follow-up
Surveillance
audits
Figure 1-5. Sample Schedule for QMS Implementation
15
and defined to the degree required by the standard.
Processes, responsibilities and resources should be
identified, and risks and opportunities considered. Every
organization will have existing policies, procedures and
processes already compatible with the standard’s require-
ments. Others may require amendment, and some may
be redundant. When reviewing the current system, the
following should be addressed:
• define processes to meet objectives
• identify process owners
• establish process inputs and outputs
• identify resources to meet objectives
• define methods for process measures
• include processes to maintain effectiveness
Gap analysis outputs may include:
• an inventory of current documents and records
• current quality objectives
• current monitoring and measurement methods
• gaps in ISO 13485 requirements
• missing documents, records and practices
• implementation plan deliverables and activities
QMS implementation assists in providing controls
to mitigate risks, which should be among the main
drivers for introducing a QMS as a result, risks and
opportunities should be reviewed when performing
the gap analysis (see ISO 14971 for guidance on risk
management throughout product realization). It is good
business practice to determine the day-to-day risks and
decide what controls are required to reduce them to the
financially appropriate extent.
Develop an Implementation Plan
Once the gap analysis determines what has to be
achieved, an implementation plan can be developed.
In developing the plan, key activities, responsibilities,
costs, schedules and resources should be estimated and
refined. The following activities should be considered
when developing the plan:
• establish system scope and objectives
• assign roles and responsibilities
• determine training needs
• identify development areas from gap analysis
• define and schedule activities
• develop system implementation project plan
• establish budget and approve plan
• review progress, update plan and communicate status
• manage project using practices in standard
The plan may change over time due to unforeseen
events, so it should be designed for easy mainte-
nance. At minimum, the plan should list key activities,
estimated start and finish dates and responsibilities.
Any assumptions and dependencies should be listed
to confirm the plan’s foundation. The responsibilities
identify activity ownership. An overall plan owner must
be established to manage the plan’s day-to-day aspects.
Top management will review and approve the plan. The
plan owner will inform management of actual results
compared to the plan. Another important consideration
is the maintenance of the current system’s integrity
while planning and implementing the modified system
(Clause 5.4.2 of ISO 13485). The following paragraphs
and Figure 1-5 demonstrate a sample schedule, which
1-2 months
Training
Planning
Define QMS
Gap analysis
3-4 months
Documentation
Certification
body selection
Implementation
5-6 months
Implementation
Operation
Evidence
7-8 months
Pre-assessment
Internal audit
Management
review
Corrective actions
9-10 months
Stage 1 audit
Stage 2 audit
Corrective
actions
Certification
12+ months
Audit follow-up
Surveillance
audits
Figure 1-5. Sample Schedule for QMS Implementation