Creating a QMS that is ISO 13485 is a major undertaking and can be very complicated for people who are new to the medical device industry. To help you get started, I’m breaking down the five key elements of ISO 13485 and explaining the importance of the standard.
Element 1: Management Responsibility
The single most important element in ISO 13485 is top management’s commitment to the Quality Management System (QMS). Employees can try their best to create high-quality, effective medical devices, but this will be impossible to achieve unless top management has bought into the process.
Top management are the ones who can dedicate the needed personnel and resources for implementing and maintaining the QMS. They make key decisions about where to focus improvement efforts when there are major concerns or negative trends.
Everything involving Quality and the QMS is made easier with top management’s commitment. If they view Quality as a means to the end of conforming to regulations, that is what the QMS will become. However, if they view the QMS as a tool for improving every process in the company and supporting the production of safe medical devices, they will see how much more power lies in the processes found in ISO 13485.
ISO 13485 has an entire section on Management Responsibility (section 5). Some of the ways top management can demonstrate their commitment to the QMS are through participation in management reviews, creation of the Quality Policy and Objectives, and appointing a Management Representative.
Element 2: Customer Focus
The next key element of ISO 13485 is Customer Focus. Customers are essential for any business, but there are two types of customers that should be considered for a Medical Device company.
The first are the direct customers of the business, such as doctors, hospitals, or other medical device companies. Organizations need to understand and respond to their customers’ requirements as well as requirements not stated by their customers that are still essential for use.
Section 7.2 of ISO 13485, titled Customer-Related Processes, is all about how the company will determine and meet these requirements. However, many of the other sections, such as Installation, Servicing, Complaint Handling, and more, involve heavy interaction with customers, and the customers’ needs should be considered. Organizations should also examine how they can help doctors use their products during the design and development phases.
The second type of customers are the patients who depend on the medical devices being produced. A medical device company should do everything in its power to support the safety and performance of its devices. Sections related to design and development, cleanliness of product, and sterilization are not there to check a box but rather to support the safety of devices used with patients.
Element 3: Risk-Based Decision Making
One principle of ISO 13485 that is unique to medical device companies is the reliance on risk-based decision-making. While other standards involve the idea of risk, there is a definition of risk that is unique to medical devices, which is:
The combination of the probability of the occurrence of harm and the severity of that harm.
If you are part of the medical device industry, you are familiar with the role risk plays. As part of supporting the patients who need their products, organizations need to look at many decisions through the lens of risk.
When a company is setting up a supplier management process, it should consider the risk the purchased products have on the device. When it is determining how to handle a nonconformity, it should consider the risk of different dispositions. Every step of the design and development process is deeply intertwined with the concept of risk.
While risk is mentioned many times in ISO 13485, there is an additional standard that talks about risk: ISO 14971. Both of these standards are essential to the operation of a medical device QMS.
Element 4: Document Everything
While risk is specific, the next key element of ISO 13485 applies to many QMS standards, and that is to document everything!
Documentation is the foundation of a QMS. The first requirement in ISO 13485 is that:
The organization shall document a quality management system and maintain its effectiveness in accordance with the requirements of this International Standard and applicable regulatory requirements.
All of your processes, work instructions, specifications, labels, etc., need to be documented. Not only that, but the documents need to be controlled so that they are approved by appropriate functions, any changes are managed, and they are available where they are needed.
Once you’ve documented all of the processes, you also need to document the outputs of those processes. The outputs are considered records and should be kept as records for customers, auditors, and regulatory bodies to see evidence that you followed your documented process.
The ISO 13485 sections focused on documentation are 4.2.4 Control of Documents and 4.2.5 Control of Records. However, nearly every section of ISO 13485 states that a process must be “documented”, and when it’s not explicitly stated, it is implied.
So, get to writing!
Element 5: Improvement is Essential.
The final key element of ISO 13485 is that the organization must always be working to improve itself and its QMS.
A QMS should never be seen as a static system that can be set up and forgotten. There are constant changes to regulations, standards, and the business environment, and a company that does not update its QMS is at risk of losing its position or failing to remain in compliance.
The inputs for improvement can come from many places: internal and external audits, customer feedback, customer complaints, corrective and preventive actions, management reviews, and nonconformances. Improvement can also come from a desire to make the QMS as good as possible, both to support customers and different employees at the company.
Improvement ties in all of the principles discussed in this article. Management has a responsibility to determine which areas to improve and dedicate resources to improvement activities. Improving processes and devices is crucial for supporting customers. Risk-based decisions can help guide the organization to the specific issues that warrant the most attention.
Not only is improvement essential for the operation of a QMS, but it is also one area that can bring the most joy to employees. People want to be a part of improvement efforts and see processes change for the better. The ability to provide input to a company can go a long way to keeping employees interested and committed to the organization.
Wrapping Up
By learning these 5 key elements, you are on your way to understanding ISO 13485 and its role in the medical device industry. If you found this article helpful and want to learn more about the standard, the ISO 13485 page features articles on many of the different processes and requirements. To stay up to date, be sure to sign up for the newsletter below.