Quality Management Systems for Drugs and Devices
23
findings during the course of the audit (typically by
handwritten notes) and produce a formal report at the
end of the audit or shortly thereafter.
Before the closing meeting, the auditors will
require some time to prepare their conclusions, to
determine whether the audit’s objectives have been
accomplished and whether to recommend certification
(initial audit), continued certification (surveillance
audit) or re-certification (re-assessment audit). During
the meeting, an audit summary will be provided,
including any findings (observations and nonconfor-
mities) and agreed actions. A corrective action plan
will be required for any identified nonconformities to
be corrected within the certification body’s defined
time period. The corrective action plan should contain
a number of elements, including traceability to the
original nonconformity, the correction and containment
to address the nonconformity initially, the nonconfor-
mity root cause analysis and investigation, the corrective
action to be implemented, preventive action (if applica-
ble), responsibilities, timelines and how the corrective
action’s effectiveness will be verified.
Additional audits may be required outside the
surveillance cycle (e.g., to close a major nonconformity,
verify critical or significant suppliers or perform a scope
extension for new products or processes). Once the
audits have been performed and corrective action plans
accepted, the certification body reviews the auditors’
recommendation independently before making the final
certification decision. The certification body also reviews
the contract with its client to ensure that when the
initial application is received by the certification body,
the required assessments can be delivered in terms of
resources and competence. The initial audit comprises
Stage 1 and 2 audits, as described above. Stage 1 is an
on-site documentation check to ensure the company
has the basic and mandatory element in its QMS and
to confirm readiness for Stage 2. The Stage 2 audit
then will be performed (typically one to six months
later to ensure there is adequate design and production
documentation and the management review, CAPA
and internal audit processes have generated auditable
documented evidence). The Stage 2 audit covers appli-
cable parts of the standard. The recertification audit
again covers applicable parts of the standard, with the
objective of recommending recertification (typically
about three months before the end of the three-year
certificate life). In surveillance audits, not all standard
clauses typically will be audited, as the audit’s duration
will be shorter than the initial and recertification audits.
FDA has conducted unannounced inspections for a
number of years. A relatively new development is notified
bodies performing unannounced audits under the EU
Medical Devices Directive (MDD) (always a provision in
the MDD but a requirement under the new EU Medical
Devices Regulation).21,22 These are in addition to sched-
uled audits and focus on assessing ongoing production of
CE-marked devices and linking devices in production to
technical documentation and specifications. Taking this
into consideration, companies need to have in place one
or more Standard Operating Procedures (SOPs) defin-
ing their structures, considerations and roles in handling
audits, whether anticipated or unannounced. These SOPs
should include responsibilities for handling the audits,
accessing and tracking documentation and communica-
tion within the organization regarding audit initiation
and continuation.
Quality System Regulation (QSR), 21
CFR Part 820 (US FDA)
The QSR defines quality system requirements that must
be fulfilled to place medical devices on the US market.
This section does not detail the requirements but pro-
vides an overview of some key aspects to be considered
when setting up a QMS to meet QSR requirements.
Setting up a QMS that meets QSR requirements is the
same as for an ISO 13485 QMS, but consideration must
be given to ensuring QSR requirements are included.
The QSR was developed to ensure medical devices
used in the US are safe and effective, which is the
regulation’s prime goal. The regulation has evolved over
the years.
• In 1906, the Pure Food &Drug Act was enacted
following poisoning related to drugs.23
23
findings during the course of the audit (typically by
handwritten notes) and produce a formal report at the
end of the audit or shortly thereafter.
Before the closing meeting, the auditors will
require some time to prepare their conclusions, to
determine whether the audit’s objectives have been
accomplished and whether to recommend certification
(initial audit), continued certification (surveillance
audit) or re-certification (re-assessment audit). During
the meeting, an audit summary will be provided,
including any findings (observations and nonconfor-
mities) and agreed actions. A corrective action plan
will be required for any identified nonconformities to
be corrected within the certification body’s defined
time period. The corrective action plan should contain
a number of elements, including traceability to the
original nonconformity, the correction and containment
to address the nonconformity initially, the nonconfor-
mity root cause analysis and investigation, the corrective
action to be implemented, preventive action (if applica-
ble), responsibilities, timelines and how the corrective
action’s effectiveness will be verified.
Additional audits may be required outside the
surveillance cycle (e.g., to close a major nonconformity,
verify critical or significant suppliers or perform a scope
extension for new products or processes). Once the
audits have been performed and corrective action plans
accepted, the certification body reviews the auditors’
recommendation independently before making the final
certification decision. The certification body also reviews
the contract with its client to ensure that when the
initial application is received by the certification body,
the required assessments can be delivered in terms of
resources and competence. The initial audit comprises
Stage 1 and 2 audits, as described above. Stage 1 is an
on-site documentation check to ensure the company
has the basic and mandatory element in its QMS and
to confirm readiness for Stage 2. The Stage 2 audit
then will be performed (typically one to six months
later to ensure there is adequate design and production
documentation and the management review, CAPA
and internal audit processes have generated auditable
documented evidence). The Stage 2 audit covers appli-
cable parts of the standard. The recertification audit
again covers applicable parts of the standard, with the
objective of recommending recertification (typically
about three months before the end of the three-year
certificate life). In surveillance audits, not all standard
clauses typically will be audited, as the audit’s duration
will be shorter than the initial and recertification audits.
FDA has conducted unannounced inspections for a
number of years. A relatively new development is notified
bodies performing unannounced audits under the EU
Medical Devices Directive (MDD) (always a provision in
the MDD but a requirement under the new EU Medical
Devices Regulation).21,22 These are in addition to sched-
uled audits and focus on assessing ongoing production of
CE-marked devices and linking devices in production to
technical documentation and specifications. Taking this
into consideration, companies need to have in place one
or more Standard Operating Procedures (SOPs) defin-
ing their structures, considerations and roles in handling
audits, whether anticipated or unannounced. These SOPs
should include responsibilities for handling the audits,
accessing and tracking documentation and communica-
tion within the organization regarding audit initiation
and continuation.
Quality System Regulation (QSR), 21
CFR Part 820 (US FDA)
The QSR defines quality system requirements that must
be fulfilled to place medical devices on the US market.
This section does not detail the requirements but pro-
vides an overview of some key aspects to be considered
when setting up a QMS to meet QSR requirements.
Setting up a QMS that meets QSR requirements is the
same as for an ISO 13485 QMS, but consideration must
be given to ensuring QSR requirements are included.
The QSR was developed to ensure medical devices
used in the US are safe and effective, which is the
regulation’s prime goal. The regulation has evolved over
the years.
• In 1906, the Pure Food &Drug Act was enacted
following poisoning related to drugs.23