Planning a MDQMS implementation based on ISO 13485
What this domain tests
This domain tests how to plan an ISO 13485 implementation before writing procedures. The exam expects scope definition, gap analysis, process ownership, regulatory mapping, project governance, risk-based sequencing, and readiness for internal audit.
Core rules and concepts
- Define the QMS scope by device families, sites, lifecycle roles, and jurisdictions. Include outsourced processes that affect product conformity.
- Build a regulatory requirements matrix. ISO 13485 does not replace national or regional device regulations; the QMS must address both.
- Perform a clause-by-clause gap analysis against ISO 13485:2016 and applicable regulations. Record evidence, gaps, owners, and due dates.
- Map QMS processes and interactions, then assign process owners. Planning is not a documentation project; it changes how work is controlled.
- Use risk to prioritize: design controls, sterile production, suppliers, traceability, and complaint handling usually need early attention.
- Plan resources, training, communication, milestones, and a phased internal audit. Top management must approve and review the plan.
Worked example
A company has two sites, uses a contract sterilizer, and distributes in two regions. Planning should include both sites in scope, control the sterilization process through a quality agreement and validation evidence, map each region's adverse-event and retention rules, and schedule internal audits before the certification audit. Excluding the sterilizer because it is outsourced would be a planning error.
Traps that cost marks
Writing a scope that hides uncomfortable activities; ignoring outsourced processes; copying another company's manual; planning no management review or internal audit; and treating training as a one-time event rather than competence evidence.