Seven months to certificate: sequencing an MDQMS build at an 11-person IVD start-up
Nordlys Diagnostics has 11 employees and a point-of-care CRP assay for use in clinics. A European distributor has offered a supply contract conditional on an ISO 13485 certificate within seven months. Current state: the design history file covers roughly 60% of the required elements; the risk management file is a single FMEA written 18 months ago and never updated after a reagent formulation change; there is no internal audit programme, no management review, and no calibration programme for the pipettes, plate reader or temperature loggers in the laboratory. Three suppliers are critical - the antibody, the nitrocellulose membrane and the cassette moulder. Evaluation lots are produced in a university laboratory under a research agreement; transfer to a contract manufacturer is planned for month four. About 200 units have already gone to three evaluation sites. The company has a part-time QA consultant at two days per month and can fund 0.5 FTE of internal QA. The CEO's plan is to 'write the SOPs in the last six weeks and book the audit in month seven'.
1. Assess the CEO's sequencing and set out a credible order of work for the seven months.
Read the worked answer
The CEO's plan inverts cause and effect. Documents written in the final six weeks will describe processes that have no records behind them for the preceding months - an auditor sampling design review, supplier evaluation or calibration records will find empty folders, and the resulting nonconformities will be systemic rather than clerical.
A defensible sequence:
Months 1–2 - gap analysis and foundation. Map existing processes against the standard; identify the regulatory markets and their additional requirements. Fix the things that take time to generate evidence: start calibration of laboratory instruments now (6.3, 7.6), open the risk management file rewrite (7.1), and set up document and record control (4.2.4, 4.2.5) so later work is recorded properly. Define quality objectives and the process map (4.1, 5.4.1).
Months 2–4 - product realisation controls. Complete design controls and design transfer documentation (7.3), qualify the three critical suppliers (7.4.1), and validate the assay production process (7.5.6). This is the heaviest work and cannot be compressed, because validation needs stability and reproducibility data that take weeks.
Month 4 - contract manufacturer transfer. Supplier qualification, quality agreement, process validation at the new site, and a documented transfer plan with acceptance criteria.
Month 5 - training, competence and dry running. Records must show people were trained before they performed the activity (6.2).
Month 6 - internal audit and management review. The internal audit must be complete and its findings actioned before the certification body arrives; the management review must follow the audit so it can consider the results (5.6).
Month 7 - closure, corrective actions verified, certification audit. SOP writing happens in months 2–5, in parallel with implementation, not at the end.
2. Define the scope statement and process architecture, including which processes are outsourced and how the contract manufacturer transfer should be controlled.
Read the worked answer
Scope. Something like: 'Design, development, manufacture and distribution of in vitro diagnostic reagents and associated reader-based assay systems for point-of-care use.' Exclusions need regulatory justification - for an IVD developer, design exclusion is not available, and servicing may be excluded only if Nordlys genuinely never services instruments and the exclusion does not affect the ability to meet requirements (1.2, 4.2.2). The scope must not name a site that is not under the QMS; if evaluation lots are made at the university, that activity either falls under Nordlys' QMS controls or is treated as an outsourced process with a written agreement.
Processes to identify (4.1): design and development; supplier management; incoming, in-process and final testing; production and process validation; calibration and measurement; nonconforming product; complaint handling and regulatory reporting; internal audit; CAPA; management review. Each needs an owner, inputs/outputs, indicators and interaction with other processes.
Outsourced, not excluded (4.1.5): antibody and membrane supply, cassette moulding, the university laboratory production of evaluation lots, and later the contract manufacturer's assembly and packaging. Controls proportionate to risk: documented approval, written agreements with change-notification clauses, specified acceptance criteria, retained records, and periodic re-evaluation.
Transfer to the contract manufacturer: a written transfer plan with deliverables and dates; process validation at the receiving site (installation, operational and performance qualification with pre-defined acceptance criteria); a quality agreement covering specification, deviations, change control, batch records and release responsibilities; a first-article or parallel-run comparison against university-produced lots; and a defined point after which the university laboratory is formally decommissioned as a production site and records are archived.
3. What should the go/no-go decision at month five be based on, and what should Nordlys tell the distributor now?
Read the worked answer
Month five is the last realistic point at which a slip can be absorbed, so the decision needs objective criteria rather than optimism.
Go criteria - all must be met:
- Gap analysis closed, with the remaining open items limited to records that will be generated before the audit.
- Risk management file current, including the formulation change, and linked to design and production controls.
- The three critical suppliers evaluated and approved with agreements in place; contract manufacturer qualified and process validation complete or on schedule with data already in hand.
- Calibration programme operational with certificates for all measurement equipment used for acceptance decisions.
- Design history file complete and internally reviewed, with design transfer documented.
- Internal audit scheduled with sufficient lead time for corrective actions to be implemented and verified - an internal audit that finishes two weeks before the certification audit cannot produce closed actions.
No-go triggers: missing validation data for the contract manufacturer, unresolved critical supplier qualification, or an incomplete risk file. In these cases the audit date should move, because a failed certification audit is more damaging commercially and reputationally than a delayed one, and the certification body will re-audit at full cost.
What to tell the distributor: the truth, in writing - the milestones, the audit window, and what happens if a delay occurs. ISO 13485 certification is not a substitute for the distributor's own regulatory requirements (registration, technical documentation, local representation), and the distributor should be told explicitly which of those Nordlys will hold and which it will not. Committing to an unachievable date creates a commercial liability the company cannot manage.