PECB ISO 13485 Foundation cheat sheet

ISO 13485:2016 is a standalone QMS standard for organizations in the medical device lifecycle; it is built on the ISO 9001 process-model structure but is not certified against ISO 9001 by default, and it excludes ISO 9001 requirements that are not appropriate as regulatory requirements.

The standard is built on a process approach: processes and their interactions are identified, their sequence determined, criteria and methods established, resources and information supplied, and processes monitored, measured and analysed, with improvement actions taken.

Risk-based thinking applies across the QMS: risk management activities are proportionate to the risk associated with the device, and risk management is not confined to product realization but also covers supplier controls, process validation and software validation.

Roles: top management establishes quality policy and objectives and provides evidence of commitment; a member of management is appointed as quality management representative with defined authority; the organization determines and provides resources needed for the QMS.

Document hierarchy: quality policy and objectives, quality manual (scope, documented procedures or references, process interaction description), documented procedures required by the standard, documents needed for effective operation, and records.

Records are a special class of document: they are retained as evidence of conformity, must remain legible, identifiable and retrievable, and their retention period is at least the lifetime of the device as defined by the organization, and not less than two years from the release date.

The standard requires a documented procedure for the control of documents (approval, review, update, identification of changes, availability, legibility, prevention of unintended use of obsolete documents) and a separate documented procedure for control of records.

Nonconformity grading logic: a major nonconformity is a failure to fulfil a requirement that would result in the QMS not achieving its intended result, or a significant doubt about the effectiveness of a process or the conformity of product; a minor nonconformity is an isolated lapse that does not indicate a systemic failure.

The PDCA cycle underpins the standard: Plan (policy, objectives, risk identification, planning), Do (implementation and control of processes), Check (monitoring, measurement, internal audit, analysis), Act (correction, corrective action, improvement).

Management review inputs include feedback, complaint handling, reporting to regulatory authorities, audits, process monitoring and measurement, corrective and preventive actions, follow-up actions from previous reviews, changes affecting the QMS, and new or revised regulatory requirements; outputs include actions to maintain effectiveness and to improve the QMS and its processes.

Competence rule: personnel performing work affecting product quality must be competent on the basis of education, training, skills and experience; records of education, training, skills and experience are maintained, and effectiveness of actions taken to obtain competence is evaluated.

Design and development control requires documented procedures covering planning, inputs, outputs, review, verification, validation, transfer to manufacturing, and control of design changes; design and development records are maintained for each design and development activity.

Purchasing control is risk-based: criteria for evaluation and selection of suppliers are proportionate to the risk of the purchased product and its effect on device quality; suppliers are monitored and re-evaluated, and purchasing information specifies product and applicable regulatory requirements.

Process validation applies where output cannot be verified by subsequent monitoring or measurement; validation confirms the process consistently achieves planned results, and revalidation is triggered by changes in the process, product or its intended use.

Product identification and traceability: the organization documents procedures for identification and uses suitable means to identify product by monitoring and measurement status; traceability is established and records maintained for implantable devices and, where required by regulation, other devices.

Sterile medical devices: records of parameters for the sterilization process used for each batch must be traceable to each production batch, and implantable devices require traceability of all components, materials and, where applicable, the work environment conditions.

Measurement, analysis and improvement require documented procedures for monitoring and measurement of product at appropriate stages, control of nonconforming product (identification, segregation, evaluation, disposition, notification to the customer and, where applicable, regulatory authorities), and for corrective and preventive action.

Internal audit is planned, taking into consideration the status and importance of the processes and areas to be audited, as well as previous audit results; auditors do not audit their own work, and the procedure defines responsibilities for planning, conducting, reporting and maintaining records.

Post-market surveillance is a required process: the organization documents procedures for feedback, complaint handling and reporting to regulatory authorities, and uses this information as input to risk management and to improvement.