Scope statement, outsourcing and the own-brand pivot at a contract moulder

Three separate issues are bundled together in one sentence; separating them is the actual judgement being tested.

1. The 7.3 exclusion. Clause 1.2 allows design and development to be excluded only where applicable regulatory requirements permit the exclusion, and clause 4.2.2 requires the justification to be documented (typically in the quality manual). Customer ownership of the design does not by itself justify exclusion. MOC receives customer drawings, evaluates and implements changes to them, and may propose design changes - those activities sit in 7.3. If the customers' regimes permit exclusion for the pure contract-manufacturing activity, the exclusion must be justified on that regulatory basis and worded narrowly. It certainly cannot stand as a blanket exclusion once MOC places its own clamps on the market, because MOC then holds design responsibility.

2. 'Sterilisation excluded'. Outsourcing is not exclusion. Clause 4.1.5 requires outsourced processes affecting product conformity to be controlled, with controls proportionate to the risk involved; sterilisation is a special process addressed by 7.5.5 and 7.5.7. The scope statement should identify the process as outsourced and controlled.

3. Relying on the customer's certificate. The customer is a customer, not an evaluated supplier. Clause 7.4.1 requires evaluation and selection against criteria and controls proportionate to risk; a certificate held by another organisation gives no evidence about MOC's shared processes.

Output: one scope statement describing what MOC actually does, documented justifications for anything excluded, and outsourced processes named as controlled rather than excluded.

The auditor is looking for the control loop, not a certificate.

Sterilisation (7.4 plus 7.5.5/7.5.7):

• The contract steriliser on the approved supplier list, evaluated against defined criteria (relevant certifications, audit or questionnaire results, capacity, history) with the evaluation dated and risk-based.
• A written quality agreement covering specification, change notification, deviation handling, records, complaints and recall cooperation (7.4.2).
• Validation evidence: the sterilisation process validated for the specific product family and packaging, including dose or parameter setting, half-cycle overkill or equivalent justification, and the rationale for bioburden assumptions.
• Routine release evidence per batch: process parameters, dosimetry or biological indicator results, and defined acceptance criteria before release (8.2.6).
• Re-evaluation triggers: changes to packaging, load pattern, bioburden or subcontractor equipment.

Customer-supplied designs:

• A documented boundary of responsibilities with each customer, showing who owns which design output.
• Design transfer records demonstrating that MOC verified it can manufacture to the drawing and specification (7.3.8, 7.5.1).
• A change-control route: customer change notices received, impact assessed, verification performed, effective date implemented, obsolete drawings withdrawn (7.3.9 and 4.2.4).
• Customer property controls for supplied tooling, moulds and drawings (7.5.10), including identification, protection and reporting of loss or damage.

Ultrasonic welding: process validation records (installation, operational and performance qualification), operator competence records, and a subcontractor approval file with a written agreement - none of which currently exists.

Placing devices on the market under its own name changes MOC's role. Under ISO 13485 the organisation that takes responsibility for design and/or manufacture with the intention of making the device available under its own name is the manufacturer, with the obligations that follow. The previous customer-facing position ('we only make what we are told') no longer describes reality.

QMS changes:

• The scope statement must be rewritten to include design and development, or a second, separately justified scope must cover the contract-manufacturing activity.
• Design controls apply in full: design inputs, outputs, review, verification, validation, transfer, and design history file (7.3).
• Risk management per 7.1, with the risk management file maintained across the lifecycle, not a one-off FMEA.
• A medical device file per device or family (4.2.3) containing the specification, drawings, BOM, labelling, and the records required by the standard.
• Labelling, instructions for use and unique device identification controls, including translation and review.

'Applicable regulatory requirements': The phrase in 1.1 and throughout the standard means MOC must identify and meet the requirements of the jurisdictions where the clamps are sold - market registration or notification, a local authorised representative or importer arrangement, post-market surveillance, complaint handling (8.2.2), reporting to regulatory authorities (8.2.3) and advisory-notice capability. MOC should be able to show a regulatory register per market, not a claim that the customer's clearances transfer.

If MOC cannot resource design controls, the defensible option is to stop selling the own-brand clamps or to source the design from a partner with a documented design-control interface - not to leave the scope statement unchanged.