Quality Management Systems for Drugs and Devices
31
process is outsourced does not mean it can be
excluded or not applied in the QMS it may need
to be covered in supplier agreements and audits.
• The company’s assignment of responsibilities
should be clearly documented, e.g., through an
organizational chart and job descriptions.
• The internal audit program should allow all processes
to be covered in a reasonable time period. This can be
adapted based on the organization’s size and particular
processes’ risk and importance in the QMS.
• Management review frequency and format, like the
internal audit program, will depend on the orga-
nization’s size and maturity. A monthly meeting
onsite may be appropriate for a small organization
for a larger organization, each site may dial into a
meeting chaired by the corporate site.
• A reasonable amount of objective documented
evidence must be in place before the initial audit.
Ideally, a batch or lot of medical devices will have
undergone the entire production process and be
documented (this can be prototype product).
• Common mistakes and areas of nonconformities
under ISO 13485:2016 include:
º not fulfilling the internal audit schedule or
setting an unrealistic internal audit plan (8.2.4)
the schedule can be adjusted over time if this is
documented with a reasonable rationale
º not following up on CAPAs in timely manner
(8.5) extending CAPAs for various reasons may be
acceptable, but repeatedly missing CAPA deadlines
indicates the CAPA process is not effective, and the
process may need to be amended and addressed
º not following up on previous audit nonconformities
(8.3) again, this indicates an ineffective CAPA
process, and the certification body likely will
upgrade the nonconformance to a major
nonconformance, requiring immediate attention
º not reporting adverse events (8.3) is an often-cited
major nonconformance due to the manufacturer’s
failure to fulfill its regulatory obligations
º document/record retention time not based on
device lifetime (4.2) when clinical data indicate
device lifetime is longer than that defined
º incomplete training records (6.2) no personnel
training records verifying individuals are trained
and competent for their defined roles and
responsibilities
º training effectiveness not verified (6.2) or documented
º CAPA or internal audit findings not verified (8.2,
8.5) or documented
º change process does not contain provisions for
informing regulatory authorities or notified body of
significant changes (7.5)
º changes implemented but not verified and validated
(7.5)
º no documented environmental control or condition
requirements (6.4)
º product regulatory requirements not considered
(7.2), including product-specific standards and
requirements
º inadequately defined team roles and responsibilities
(7.3)
º no design and development plan (7.3)
º undocumented or poorly defined design inputs and
outputs (7.3)
º product placed on market or progressed to design
transfer stage before verification and validation
completed (7.3)
º process risks not considered in addition to design
and clinical risks (7.1)
º no evidence of new or revised regulatory requirements
considered in management review (5.6)
º inadequate supplier control in terms of audits,
contracts, monitoring and evaluation (7.4)
º limited or no process and product monitoring (8.2)
º instruments calibrated, but with reference materials
not calibrated themselves (7.6)
º inadequate segregation or marking of
nonconforming product (8.3)
º quality manual does not list and justify non-applicable
or excluded clauses (4.2)
31
process is outsourced does not mean it can be
excluded or not applied in the QMS it may need
to be covered in supplier agreements and audits.
• The company’s assignment of responsibilities
should be clearly documented, e.g., through an
organizational chart and job descriptions.
• The internal audit program should allow all processes
to be covered in a reasonable time period. This can be
adapted based on the organization’s size and particular
processes’ risk and importance in the QMS.
• Management review frequency and format, like the
internal audit program, will depend on the orga-
nization’s size and maturity. A monthly meeting
onsite may be appropriate for a small organization
for a larger organization, each site may dial into a
meeting chaired by the corporate site.
• A reasonable amount of objective documented
evidence must be in place before the initial audit.
Ideally, a batch or lot of medical devices will have
undergone the entire production process and be
documented (this can be prototype product).
• Common mistakes and areas of nonconformities
under ISO 13485:2016 include:
º not fulfilling the internal audit schedule or
setting an unrealistic internal audit plan (8.2.4)
the schedule can be adjusted over time if this is
documented with a reasonable rationale
º not following up on CAPAs in timely manner
(8.5) extending CAPAs for various reasons may be
acceptable, but repeatedly missing CAPA deadlines
indicates the CAPA process is not effective, and the
process may need to be amended and addressed
º not following up on previous audit nonconformities
(8.3) again, this indicates an ineffective CAPA
process, and the certification body likely will
upgrade the nonconformance to a major
nonconformance, requiring immediate attention
º not reporting adverse events (8.3) is an often-cited
major nonconformance due to the manufacturer’s
failure to fulfill its regulatory obligations
º document/record retention time not based on
device lifetime (4.2) when clinical data indicate
device lifetime is longer than that defined
º incomplete training records (6.2) no personnel
training records verifying individuals are trained
and competent for their defined roles and
responsibilities
º training effectiveness not verified (6.2) or documented
º CAPA or internal audit findings not verified (8.2,
8.5) or documented
º change process does not contain provisions for
informing regulatory authorities or notified body of
significant changes (7.5)
º changes implemented but not verified and validated
(7.5)
º no documented environmental control or condition
requirements (6.4)
º product regulatory requirements not considered
(7.2), including product-specific standards and
requirements
º inadequately defined team roles and responsibilities
(7.3)
º no design and development plan (7.3)
º undocumented or poorly defined design inputs and
outputs (7.3)
º product placed on market or progressed to design
transfer stage before verification and validation
completed (7.3)
º process risks not considered in addition to design
and clinical risks (7.1)
º no evidence of new or revised regulatory requirements
considered in management review (5.6)
º inadequate supplier control in terms of audits,
contracts, monitoring and evaluation (7.4)
º limited or no process and product monitoring (8.2)
º instruments calibrated, but with reference materials
not calibrated themselves (7.6)
º inadequate segregation or marking of
nonconforming product (8.3)
º quality manual does not list and justify non-applicable
or excluded clauses (4.2)