UL and the UL logo are trademarks of UL LLC © 2016
ISO 13485:2016
Change?
Do I Have To??
Linda M. Chatwin, Esq. RAC
Business Manager, UL LLC
© UL, LLC, 2016. All Rights Reserved
Walt Murray Quality and Compliance Consulting
MasterControl, Inc.
ISO 13485:2016 Change? Do I Have To?? ©2016
Overview Status ISO 9001:2015? Considerations Areas Affected
Agenda
ISO 13485:2016 Change? Do I Have To?? ©2016
ISO 13485:2016 Change? Do I Have To?? ©2016
In December, the final of 13485:2016 quality management standard for medical devices was approved
The first revision in over a decade, replaces ISO13485:2003 Disparity from the ISO 9001:2015 standard 3 year transition period
Voting
ISO 13485:2016 Change? Do I Have To?? ©2016
ISO 13485 2016 excludes some of the requirements of ISO 9001
Why? Not appropriate as regulatory requirements.
Organizations whose quality management systems will conform to ISO 13485:2016 cannot claim conformity to ISO 9001
To do so, must meet all the requirements of ISO 9001
What About ISO 9001:2015?
ISO 13485:2016 Change? Do I Have To?? ©2016
Stronger regulatory-based standards, leveraging content from the now closed GHTF and EU MDR
Focus on services (calibration, sterilization, etc.)
Includes more risk management concepts (ISO 14971)
Documentation: the technical file must list the information that needs to be in the file
New sections on “Supplier Approval” and “Supplier Monitoring”
Considerations Include
ISO 13485:2016 Change? Do I Have To?? ©2016
The revised ISO 13485 expects a more formalized competency management program.
Requires competency programs for “workers that affect product safety.”
Must document the process for establishing competency.”
Competency
ISO 13485:2016 Change? Do I Have To?? ©2016
Managers, supervisors and teams of employees
Define the competencies or qualifications for each critical job
Identify key competencies and incorporate throughout the various processes
Competency Mapping
Tale of Two C’s: From Compliance to Competency, from Dr. Karl Kapp White Paper http://www.uleduneering.com/tale_of_two_cs
ISO 13485:2016 Change? Do I Have To?? ©2016
Risk is mentioned some 15 times throughout the standard
outsourcing and supplier controls
software validations
training of personnel commensurate with risks inherent in the processes they perform.
Risk management activities should be incorporated during the processes of verification, validation, revalidation
Risk, Risk, Risk
ISO 13485:2016 Change? Do I Have To?? ©2016
The organization shall document one or more processes for risk management in product realization
Records of risk management activities shall be maintained
Performed during monitoring, testing, and traceability
Considered in corrective actions and preventive actions
And More Risk
Areas Affected
Information & Insights | May 5, 2016
Alignment with FDA terms
The standard sports more alignment with FDA terms, such as establish,
implement and maintain documented processes
Clarifies that regulatory requirements includes statutes, regulations,
ordinances or directives, relative to the safety and performance of the
medical device
Information & Insights | May 5, 2016
What is Affected
Leadership – Top Management responsibilities are clarified, with requirement for reviews at
documented, planned intervals. More emphasis is put on results of activities and
effectiveness of the quality system and quality objectives.
Human Resources – more emphasis on training to quality processes, establishing
competence and awareness of personnel duties. The standard now specifies that the
organization shall determine any user training needed to ensure specified performance and
safe use of the medical device.
Facilities must be arranged in order to prevent mix-ups. Manufacturers must ensure control
of contamination and particulate matter where needed for sterile products, and requirements
for documenting work environment requirements are added.
Information & Insights | May 5, 2016
What is Affected
The organization must determine the required verification, validation, monitoring,
measurement, inspection and test, handling, storage, distribution and traceability activities
specific to the product together with the criteria of acceptance for each of these areas.
Design and development planning requirements are stated to more closely reflect regulatory
expectations.
More requirements were added to design inputs, and now requirements must be verified or
validated. The company must produce verification and validation plans and show the
interfaces in the development process. Records of verification and validation must be
maintained.
Design and development review section added details of the contents of review records.
Information & Insights | May 5, 2016
What is Affected
Design and development transfer. The organization shall document procedures for
transfer of design and development outputs to manufacturing
Ensure that design and development outputs are verified as suitable for manufacturing
before becoming final production specifications.
Results and conclusions of the transfer shall be recorded.
For change control, there must be an evaluation of the change effect on products
A new sub-clause now requires design and development files be maintained.
.
Information & Insights | May 5, 2016
Purchasing process
Focuses the supplier selection criteria on the effect of
the supplier performance on the quality of the medical
device
Determine the risk associated with the medical device
How the product meets applicable regulatory
requirements.
New requirement added to include notification of
changes in purchased product.
What is Affected
Information & Insights | May 5, 2016
Cleanliness of product requirements are enhanced for non-sterile product whose use
depends on cleanliness.
Installation and servicing activities include requirements for analysis of records, as well as
record keeping requirements
Specific requirement for software validation, prior to initial use.
Documented procedures are required for traceability
Where there is a local requirement of traceability, the unique device identification is to be
controlled and recorded.
What is Affected
Information & Insights | May 5, 2016
Status identification of product is required
throughout the stages of production and storage,
and details regarding the preservation of product
are added.
Complaint handling is added as a complete new
sub-clause to the standard, and requires much
the same complaint handling process as FDA for
recording, investigating, communication and
moving to CAPAs when indicated or justifying
why they are not. The requirement to report to
the appropriate authorities is also expanded.
What is Affected
Information & Insights | May 5, 2016
Monitoring and measurement of product, and non-conforming product sections add
requirements to identify the test equipment used to perform measurement activities and
details related to kinds of controls that are to be documented.
There is a general requirement to include investigation and rationale for decisions, and
requirements for documenting and justifying concessions. Specific rework issues are also
addressed.
Corrective and preventive actions must verify that the actions do not have an adverse effect
on product, and that corrective actions are taken without undue delay.
What is Affected
Information & Insights | May 5, 2016
Going Forward
Plan the transition – what will be needed? From whom?
When?
Consider ISO 9001 – does the company also need to
maintain that certification?
How to reconcile the requirements of the 2 standards
How to meet the requirements of each
Is some division in the Quality System needed?
Review related procedures – what changes will be needed?
Information & Insights | May 5, 2016
Going Forward
Review related procedures – what changes will be needed?
What paradigm shifts will the company need?
What and when should training be considered?
Don’t wait! Due to the significant divergences and changes, it will take time to comply!
Thank You!
Questions?
Linda Chatwin, JD, RAC Advisory Services, UL LLC
T: 1-360-815-5556
W: ulmedicaladvisory.com
Walt Murray Quality & Compliance Consulting
MasterControl, Inc.
T: 801-680-3623
W: www.mastercontrol.com