Chapter 1: Setting up a Quality Management System
16
can be shortened or lengthened depending on the orga-
nization’s size, existing gaps and system status.
The first one to two months typically are spent
organizing, training, planning and performing the gap
analysis. The next few months are allocated to corrective
actions for any nonconforming practices, preparing the
necessary documents and selecting the certification body
(certification body selection considerations may include
costs, scope of activities, resources and timelines).
After five to six months, it is time to implement
the system and make it operational. Records should be
kept as evidence of conformity, and conformity must be
documented in writing. The next few months are used
for pre-assessment to take any corrective actions and
undergo the certification audit. After the certification
audit, the implementation team responds to any findings,
and the QMS is certified and listed in public registries of
certified systems. After being certified, the organization
prepares for its first surveillance audit by the certifica-
tion body. Internal audits are conducted to verify closure
of identified issues and examine selected system parts
defined in the company’s internal audit program.
When developing the implementation plan, costs
to be considered include certification body (onsite
audits and offsite reviews), training (external and
in-house), consulting and other internal resource costs.
The budget should be agreed with top management.
When identifying resources, committed people
should be selected for the implementation team. The
workload should be shared across the organization to
reduce the impact on other business activities and raise
awareness. Management should support resourcing and
understand team members’ time demands to minimize
any changes to the team at a later date that could cause
delays and impact the project. Responsibilities and
authorities should be clearly defined. The organization
already may have job descriptions that define roles,
responsibilities, education, experience, training and skill
requirements these may need to be developed, revised
or created as part of the implementation process. All
of the standard’s elements should have a process owner
within the organization (Figure 1-6).
If a formal certification audit does not exist, special
audits are conducted. These audits should only be used
when necessary and should focus on specific elements
of the manufacturer’s QMS. Special audits may include
audits conducted:
• in response to an application for the extension to
the scope of an existing certification
• to determine whether the extension can be granted
• as short-notice audits conducted to investigate
potentially significant complaints
• if specific information provides reasons to suspect
serious non-conformities of the devices
Special audits should be conducted in accordance with
the applicable requirements of ISO/IEC 17021-1:2015
Clause 9.6.4 as well as any additional requirements of
the MDSAP-recognized auditing organization and/or
the MDSAP participating regulatory authorities.18,19
Implementation Plan Approval
Top management will decide whether to proceed with
the implementation plan or send it back to the project
team for revisions. Before requesting approval, the plan
should cover:
• assumptions and dependencies
• intermediate milestones
Figure 1-6. QMS Documentation Defining
Responsibilities
Quality manual--management
Procedures--departmental
Work instructions--individual
16
can be shortened or lengthened depending on the orga-
nization’s size, existing gaps and system status.
The first one to two months typically are spent
organizing, training, planning and performing the gap
analysis. The next few months are allocated to corrective
actions for any nonconforming practices, preparing the
necessary documents and selecting the certification body
(certification body selection considerations may include
costs, scope of activities, resources and timelines).
After five to six months, it is time to implement
the system and make it operational. Records should be
kept as evidence of conformity, and conformity must be
documented in writing. The next few months are used
for pre-assessment to take any corrective actions and
undergo the certification audit. After the certification
audit, the implementation team responds to any findings,
and the QMS is certified and listed in public registries of
certified systems. After being certified, the organization
prepares for its first surveillance audit by the certifica-
tion body. Internal audits are conducted to verify closure
of identified issues and examine selected system parts
defined in the company’s internal audit program.
When developing the implementation plan, costs
to be considered include certification body (onsite
audits and offsite reviews), training (external and
in-house), consulting and other internal resource costs.
The budget should be agreed with top management.
When identifying resources, committed people
should be selected for the implementation team. The
workload should be shared across the organization to
reduce the impact on other business activities and raise
awareness. Management should support resourcing and
understand team members’ time demands to minimize
any changes to the team at a later date that could cause
delays and impact the project. Responsibilities and
authorities should be clearly defined. The organization
already may have job descriptions that define roles,
responsibilities, education, experience, training and skill
requirements these may need to be developed, revised
or created as part of the implementation process. All
of the standard’s elements should have a process owner
within the organization (Figure 1-6).
If a formal certification audit does not exist, special
audits are conducted. These audits should only be used
when necessary and should focus on specific elements
of the manufacturer’s QMS. Special audits may include
audits conducted:
• in response to an application for the extension to
the scope of an existing certification
• to determine whether the extension can be granted
• as short-notice audits conducted to investigate
potentially significant complaints
• if specific information provides reasons to suspect
serious non-conformities of the devices
Special audits should be conducted in accordance with
the applicable requirements of ISO/IEC 17021-1:2015
Clause 9.6.4 as well as any additional requirements of
the MDSAP-recognized auditing organization and/or
the MDSAP participating regulatory authorities.18,19
Implementation Plan Approval
Top management will decide whether to proceed with
the implementation plan or send it back to the project
team for revisions. Before requesting approval, the plan
should cover:
• assumptions and dependencies
• intermediate milestones
Figure 1-6. QMS Documentation Defining
Responsibilities
Quality manual--management
Procedures--departmental
Work instructions--individual