Transitioning from ISO 9001:2008 to ISO 13485:2003—Going After Medical Device Business

1. Transitioning from ISO 9001:2008 to ISO 13485:2003—Going After Medical Device Business ASQ Las Vegas section 705 December 16, 2009 Presented by Michelle M. Johnston, RAC Advanced Quality System Solutions

2. The Medical Device Sector • $100B industry • More “recession-proof” than other sectors but hit in 2008/2009 • Ageing US population (baby boomers) • Growth in the following segments: • Cardiac • Orthopedic (record level of private equity) • Neurotechnology (electronic devices interact with the nervous system) • 15k medical device companies • >400k jobs

3. What the Heck is EN ISO 13485:2003? • Quality system standard intended for medical device industry • Format based on ISO 9001, process approach • Intended to promote harmonization in the global market • Regulators don’t recognize ISO 9001

4. What the Heck is EN ISO 13485:2003? • Emphasis on effectiveness of quality management system as opposed to improvement • More controls than ISO 9001 • Higher the risk of the device=more controls • However, if you don’t manufacture the finished device, not all requirements are applicable

5. What the Heck is EN ISO 13485:2003? • It is the medical device manufacturer’s responsibility to define and implement the requirements. • As applicable, they will pass along the requirements to their suppliers, usually in the form of a purchase spec or Supplier Agreement

6. From A Manufacturer’s Perspective • Assurance that their suppliers have adequate controls in place • Selecting a supplier who is registered to ISO 13485 can mean reduced monitoring by the manufacturer • From a regulatory perspective, much greater scrutiny on how manufacturer’s evaluate and monitor their suppliers. High visibility recalls where problems originated at the supplier.

7. What are the Differences? Let’s examine some of the important differences between ISO 9001 and ISO 13485

8. What are the Differences? The biggest difference is the intent of the standard. In the regulatory world, customer satisfaction and continuous improvement are superseded by the safety and effectiveness of medical devices.

9. 1.2 Application • Can only exclude section 7.3, Design and Development—however, other regulations may preclude this • Other requirements in section 7 may be non-applicable based on the nature of the medical device (sterilization, implants) or activities performed by the organization • Exclusions/non-applications to be justified

10. 4.1 General Requirements The organization shall establish, document, implement and maintain a quality management system and maintain its effectiveness in accordance with the requirements of this International Standard.

11. 4.2 Documentation Requirements The quality management system documentation shall include: Any other documentation requirements specified by national or regional regulations.

12. 4.2 Documentation Requirements There is a requirement or a particular type of document, commonly referred to as a Device Master Record. The organization shall establish and maintain a file containing documents defining for each type / model of medical device product specifications and quality system requirements (process and quality assurance) for: • complete manufacturing, and • installation and servicing, if appropriate

13. 4.2 Documentation Requirements • The Quality Manual must outline the structure of the documentation used in the quality management system. • Typically 4-tier structure: • Quality manual • SOPs • Work instructions • Forms/records

14. 4.2.4 Records • The importance of records in the medical device industry cannot be overstated. • Universal rule: If it isn’t documented, it wasn’t done. • Documentation, documentation, documentation • Stringent rules regarding recording of information • Blue or black ink only • No crossouts, write overs • Most organizations have a Good Documentation Practices procedure and intensive training.

15. 4.2.4 Records • Retention requirements based on the lifetime of the device • Retention equivalent to lifetime of device or not less than 2 years from date of release for distribution • Other regulations have more stringent requirements • Most medical device manufacturers do not often destroy records • Records specific to the medical device industry • Device History Record (traveler, work order) • Adverse event reports to regulatory agencies

16. 5—Management Responsibility • Management must maintain the effectiveness of the quality management system • Independence and authority of those who perform tasks affecting quality • Management rep promotes customer and regulatory requirements throughout the organization • Management review must include new or revised regulatory requirements

17. 6—Resource Management • Determine and provide resources to implement the QMS and maintain its effectiveness • And to meet customer and regulatory requirements • May need a documented procedure to satisfy other regulatory requirements

18. 6.3 Infrastructure • Preventive Maintenance • Documented requirements for maintenance • Records maintained

19. 6.4 Work Environment • Can be very critical, dependent on the device • Controls must be established if the environment could adversely impact the medical device (concern for devices intended to be sterilized) • Cleanroom or environmentally controlled manufacturing • Gowning • Documented procedure for environmental controls and monitoring • No food and drink

20. 6.4 Work Environment • Controls for used (returned) product to prevent contamination • Personnel who work under special environmental conditions must be trained

21. 6.4 Work Environment • Can also include ESD controls • Designated ESD work areas • Wrist/ankle straps • Daily testing or continuous monitoring • Handling and storage of ESD sensitive devices • Records

22. 7.1 Planning of Product Realization • Specific reference to ISO 14971—Medical Devices Risk Management • Medical device manufacturers would expect suppliers to have a documented pFMEA in place.

23. 7.3 Design and Development • A documented procedure is required. • More records are required • Design inputs must include safety and performance requirements • Design inputs must be approved • Records of design outputs are required • Independent person required at design review • Clinical evaluation as part of design validation

24. 7.4 Purchasing • Documented procedure required • FDA requirement: Where appropriate, purchasing documents will include an agreement that the supplier will notify the manufacturer of any changes to the product or service so that the manufacturer may assess the impact of the change on the finished device • Unauthorized changes can have a significant impact and result in recalls by the manufacturer • Evaluation of suppliers is typically risk-based

25. 7.5 Production and Service Provision • The availability of documented procedures, requirements, work instructions, and reference materials and reference measurement procedures as necessary • The implementation of defined operations for labelling and packaging • Record that shows manufacturing history including quantity. Record shall be reviewed and approved.

26. 7.5 Production and Service Provision • Cleanliness of product and contamination control • A documented procedure is required • Intended for devices sold sterile or • Devices to be sterilized by the end user • Installation and servicing procedures and controls • Specific requirements for sterile and implantable devices

27. 7.5 Production and Service Provision • Procedure for the validation of computer software • Records of these activities • Procedure for ID and traceability—more stringent controls or implantable devices • Procedure to distinguished returned product from conforming product • Status of product—must be known at all times throughout the product realization process • Procedure for the preservation of product conformity—handling, storage

28. 7.5 Production and Service Provision • Procedure for devices with a limited shelf life or special storage conditions • Storage conditions will be controlled and recorded. • Procedure required for calibration activities

29. 8.2 Monitoring and Measurement • Specific requirements for customer complaints as opposed to customer satisfaction • Some types of complaints must be reported to regulatory agencies

30. 8.2.4 Monitoring and Measurement of Product • Documented procedure for inspection activities • Specific requirements for active implantable and implantable devices

31. 8.3 Control of Nonconforming Product • UAI disposition only if regulatory requirements continue to be met • Must record person who authorizes UAI • Work instructions for rework activities • Determine and document any adverse impact of rework on the device

32. 8.5.1 General (Improvement) • Customer complaints • Documented procedures for product recalls • Must record reason if a complaint is not followed by CAPA • Procedure for notification of complaints to regulatory agencies

33. 8.5.2 CAPA • Record the results of any investigation • Determine the effectiveness of the corrective action taken • Same for preventive action

34. Industry Trade Shows • MD&M shows—annually • East coast • West coast • Midwest

35. Questions? Thanks for your time. Michelle Johnston Advanced Quality System Solutions www.adqvss.com mjohnston@advqss.com 858.722.4471