Sterile Drape Contract Manufacturer: Bioburden Excursion After an Unannounced EO Cycle Change
You are the quality manager at a 14-person contract manufacturer that has held ISO 13485 certification since 2019. The company makes sterile single-use surgical drapes for three legal manufacturers. Ethylene oxide (EO) sterilization is outsourced to a contractor 60 km away. In March the contractor changed its EO cycle loading pattern to accommodate a new customer and did not notify you. Your quarterly bioburden monitoring now averages 48 CFU per device, up from 12; the alert limit is 30 and the action limit is 50. One recent lot exceeded 50 CFU. Packaging seal strength remains within specification. You have eight weeks before a surveillance audit. Two legal manufacturers are asking for an impact assessment, and the sterilization contractor's ISO 13485 certificate expired two months ago with its renewal audit still pending.
1. How should you classify and handle the bioburden excursion and the contractor's unannounced process change under ISO 13485? Explain the clauses and the immediate actions.
Read the worked answer
Treat the excursion as a potential nonconformity in the sterilization validation basis, not merely a monitoring result. Bioburden is an input to the validated EO process; a sustained shift from 12 to 48 CFU, with one lot above the action limit, means the prior validation may no longer be representative. Under 8.3, quarantine and segregate affected lots pending disposition, open a nonconformity, and perform a risk-based impact assessment covering product still in distribution. Review 7.5.6 and 7.5.2: sterilization is a special process requiring validated parameters, and changes to loading patterns require change control and revalidation before release. The contractor's change should have been controlled under 7.4.2 purchasing information and any quality agreement. Immediate actions: stop release from the contractor, obtain the changed cycle validation records, request bioburden and sterility data, notify the three legal manufacturers with a preliminary impact assessment, and initiate a CAPA. Do not rely on seal strength alone; it does not address microbiological assurance.
2. What supplier control actions and records are required for the sterilization contractor, including the expired certificate?
Read the worked answer
ISO 13485 7.4.1 requires supplier evaluation, selection, monitoring and re-evaluation based on risk and product impact. The expired certificate is a trigger for evaluation, not an automatic disqualification, but it must be investigated: request the renewal audit status, any certification body findings, and evidence that the EO process remains validated. Check the approved supplier list, purchasing information (7.4.2) and verification of purchased product (7.4.3). A written quality agreement should define change notification, validation responsibilities, deviation handling and record retention. The contractor must not change the cycle without your approval. Records to obtain and file: supplier audit or desk assessment, certificate status, revalidation protocol and report, change notification, bioburden trend, sterility test results, release records and CAPA. Update supplier monitoring frequency and consider a for-cause audit. If the contractor cannot demonstrate control, escalate to the legal manufacturers and assess alternate sterilization capacity.
3. What should be communicated to the legal manufacturers, and what should you verify before the surveillance audit?
Read the worked answer
Communicate promptly and factually: the observed bioburden shift, the contractor's unannounced cycle change, affected lot numbers, quarantine status, preliminary risk assessment and the timeline for disposition. Under 8.2.3, if distributed product may present a risk, the legal manufacturers must evaluate advisory notice or recall obligations; as the contract manufacturer you supply the information they need. Do not wait for the audit. Before the surveillance audit, verify that the nonconformity, risk assessment, CAPA and supplier records are complete; that management review has considered the event; and that the sterilization validation file reflects current practice. Check 4.2.4 records and 4.2.5 document control for the changed cycle parameters. Also confirm that release procedures prevent shipment of quarantined lots. Audit readiness depends on evidence of control, not on a promise to fix the contractor. Be prepared to show why the expired certificate was accepted or escalated.