ISO 13485:2016 Change? Do I Have To?? - UL€¦ · ISO 13485:2016 Change? Do I Have To?? ©2016 The revised ISO 13485 expects a more formalized competency management program. Requires

UL and the UL logo are trademarks of UL LLC © 2016

ISO 13485:2016

Change?

Do I Have To??

Linda M. Chatwin, Esq. RAC

Business Manager, UL LLC

© UL, LLC, 2016. All Rights Reserved

Walt Murray Quality and Compliance Consulting

MasterControl, Inc.

ISO 13485:2016 Change? Do I Have To?? ©2016

Overview Status ISO 9001:2015? Considerations Areas Affected

Agenda



In December, the final of 13485:2016 quality management standard for medical devices was approved

The first revision in over a decade, replaces ISO13485:2003 Disparity from the ISO 9001:2015 standard 3 year transition period

Voting


ISO 13485 2016 excludes some of the requirements of ISO 9001

Why? Not appropriate as regulatory requirements.

Organizations whose quality management systems will conform to ISO 13485:2016 cannot claim conformity to ISO 9001

To do so, must meet all the requirements of ISO 9001

What About ISO 9001:2015?


Stronger regulatory-based standards, leveraging content from the now closed GHTF and EU MDR

Focus on services (calibration, sterilization, etc.)

Includes more risk management concepts (ISO 14971)

Documentation: the technical file must list the information that needs to be in the file

New sections on “Supplier Approval” and “Supplier Monitoring”

Considerations Include


The revised ISO 13485 expects a more formalized competency management program.

Requires competency programs for “workers that affect product safety.”

Must document the process for establishing competency.”

Competency


Managers, supervisors and teams of employees

Define the competencies or qualifications for each critical job

Identify key competencies and incorporate throughout the various processes

Competency Mapping

Tale of Two C’s: From Compliance to Competency, from Dr. Karl Kapp White Paper http://www.uleduneering.com/tale_of_two_cs

http://www.uleduneering.com/tale_of_two_cs

http://www.uleduneering.com/tale_of_two_cs


Risk is mentioned some 15 times throughout the standard

outsourcing and supplier controls

software validations

training of personnel commensurate with risks inherent in the processes they perform.

Risk management activities should be incorporated during the processes of verification, validation, revalidation

Risk, Risk, Risk


The organization shall document one or more processes for risk management in product realization

Records of risk management activities shall be maintained

Performed during monitoring, testing, and traceability

Considered in corrective actions and preventive actions

And More Risk

Areas Affected

Information & Insights | May 5, 2016

Alignment with FDA terms

The standard sports more alignment with FDA terms, such as establish,

implement and maintain documented processes

Clarifies that regulatory requirements includes statutes, regulations,

ordinances or directives, relative to the safety and performance of the

medical device


What is Affected

Leadership – Top Management responsibilities are clarified, with requirement for reviews at

documented, planned intervals. More emphasis is put on results of activities and

effectiveness of the quality system and quality objectives.

Human Resources – more emphasis on training to quality processes, establishing

competence and awareness of personnel duties. The standard now specifies that the

organization shall determine any user training needed to ensure specified performance and

safe use of the medical device.

Facilities must be arranged in order to prevent mix-ups. Manufacturers must ensure control

of contamination and particulate matter where needed for sterile products, and requirements

for documenting work environment requirements are added.


What is Affected

The organization must determine the required verification, validation, monitoring,

measurement, inspection and test, handling, storage, distribution and traceability activities

specific to the product together with the criteria of acceptance for each of these areas.

Design and development planning requirements are stated to more closely reflect regulatory

expectations.

More requirements were added to design inputs, and now requirements must be verified or

validated. The company must produce verification and validation plans and show the

interfaces in the development process. Records of verification and validation must be

maintained.

Design and development review section added details of the contents of review records.


What is Affected

Design and development transfer. The organization shall document procedures for

transfer of design and development outputs to manufacturing

Ensure that design and development outputs are verified as suitable for manufacturing

before becoming final production specifications.

Results and conclusions of the transfer shall be recorded.

For change control, there must be an evaluation of the change effect on products

A new sub-clause now requires design and development files be maintained.

.


Purchasing process

Focuses the supplier selection criteria on the effect of

the supplier performance on the quality of the medical

device

Determine the risk associated with the medical device

How the product meets applicable regulatory

requirements.

New requirement added to include notification of

changes in purchased product.

What is Affected


Cleanliness of product requirements are enhanced for non-sterile product whose use

depends on cleanliness.

Installation and servicing activities include requirements for analysis of records, as well as

record keeping requirements

Specific requirement for software validation, prior to initial use.

Documented procedures are required for traceability

Where there is a local requirement of traceability, the unique device identification is to be

controlled and recorded.

What is Affected


Status identification of product is required

throughout the stages of production and storage,

and details regarding the preservation of product

are added.

Complaint handling is added as a complete new

sub-clause to the standard, and requires much

the same complaint handling process as FDA for

recording, investigating, communication and

moving to CAPAs when indicated or justifying

why they are not. The requirement to report to

the appropriate authorities is also expanded.

What is Affected


Monitoring and measurement of product, and non-conforming product sections add

requirements to identify the test equipment used to perform measurement activities and

details related to kinds of controls that are to be documented.

There is a general requirement to include investigation and rationale for decisions, and

requirements for documenting and justifying concessions. Specific rework issues are also

addressed.

Corrective and preventive actions must verify that the actions do not have an adverse effect

on product, and that corrective actions are taken without undue delay.

What is Affected


Going Forward

Plan the transition – what will be needed? From whom?

When?

Consider ISO 9001 – does the company also need to

maintain that certification?

How to reconcile the requirements of the 2 standards

How to meet the requirements of each

Is some division in the Quality System needed?

Review related procedures – what changes will be needed?


Going Forward

Review related procedures – what changes will be needed?

What paradigm shifts will the company need?

What and when should training be considered?

Don’t wait! Due to the significant divergences and changes, it will take time to comply!

Thank You!

Questions?

Linda Chatwin, JD, RAC Advisory Services, UL LLC

T: 1-360-815-5556

E: [email protected]

W: ulmedicaladvisory.com

Walt Murray Quality & Compliance Consulting

MasterControl, Inc.

T: 801-680-3623

E: [email protected]

W: www.mastercontrol.com

Documents

ISO 13485:2016 Change? Do I Have To?? - UL€¦ · ISO 13485:2016 Change? Do I Have To?? ©2016 The revised ISO 13485 expects a more formalized competency management program. Requires