Process #1: Management | |
1.1. Confirm that quality management system planning is performed to ensure that all required processes are identified, documented, implemented, monitored and maintained in order to conform to the applicable requirements and meet quality objectives. Verify that changes to the quality management system are managed to maintain the conformity of the quality management system and of the devices produced. Verify that a quality manual has been documented. [ISO 13485:2016: 4.1.1, 4.1.2, 4.1.3, 4.2.2, 4.1.4, 5.4.2; TG(MD)R Sch3 P1 1.4(4); RDC ANVISA 16/2013: 2.1, 5.6; MHLW MO169: 5, 7, 14; 21 CFR 820.20] | |
1.2 Confirm top management has documented the appointment of a management representative. Verify the responsibilities of the management representative include ensuring that quality management system requirements are effectively established and maintained, reporting to top management on the performance of the quality management system, and ensuring the promotion of awareness of regulatory requirements throughout the organization. [ISO 13485:2016: 5.5.2; TG(MD)R Sch3 P1 1.4(5)(b)(ii); RDC ANVISA 16/2013: 2.2.5; MHLW MO169: 16; 21 CFR 820.20(b)] | |
1.3 Verify that a quality policy and objectives have been set at relevant functions and levels within the organization. Ensure the quality objectives are measurable and consistent with the quality policy. Confirm appropriate measures are taken to achieve the quality objectives. [ISO 13485:2016: 5.3, 5.4.1; TG(MD)R Sch3 P1 1.4(5)(a); RDC ANVISA 16/2013: 2.2.1; MHLW MO169: 12, 13; 21 CFR 820.20(a)] | |
1.4 Review the manufacturer’s organizational structure and related documents to verify that they include provisions for responsibilities, authorities (e.g., management representative), personnel, resources for infrastructure, competencies, and training to ensure that personnel have the necessary competence to design and manufacture devices in accordance with the planned arrangements and applicable regulatory requirements. [ISO 13485:2016: 5.1, 5.5.1, 5.5.2, 6.1, 6.2; TG(MD)R Sch3 P1 1.4(5)(b); RDC ANVISA 16/2013: 2.2.2, 2.2.3. 2.2.4, 2.3; MHLW MO169: 10, 15, 16, 21, 22, 23; 21 CFR 820.20(b), 820.25] | |
1.5 Determine the extent of outsourcing of processes that may affect the conformity of product with specified requirements and verify the proper documentation of controls in the quality management system. [ISO13485:2016: 4.1.5, 4.2.1; TG(MD)R Sch3 P1 1.4(5) (b)(iii), (d)(ii); RDC ANVISA16/2013: 2.5; MHLW MO169: 5, 6; 21 CFR 820.50] Australia: If an Australian Sponsor undertakes an activity that is preferred by the manufacturer, or required, to be under the control of the manufacturer, verify that the roles and responsibilities of the Australian Sponsor are documented in the manufacturer’s quality management system and that the Sponsor is qualified and controlled as a supplier. For example, but not limited to; a labeling activity to ensure that the name and address of the Australian Sponsor accompanies the device [TG(MD)R Reg 10.2], the installation of a device, or the servicing of a device. Canada: Verify that the roles and responsibilities of any regulatory correspondents, importers, distributors, or providers of a service are clearly documented in the organization’s quality management system and are qualified as suppliers and controlled, as appropriate. Link: Purchasing During audit of the firm’s Purchasing process, ensure that management has assured the appropriate level of control over suppliers, including an assessment of the relationship between supplied products and product risk. | |
1.6. Confirm the organization has determined the necessary competencies for personnel performing work affecting product quality, provided appropriate training, and made personnel aware of the relevance and importance of their activities on product quality and achievement of the quality objectives. Ensure records of training and competencies are maintained. [ISO 13485:2016: 4.2.1, 6.2; RDC ANVISA 16/2013: 2.2.3, 2.2.4, 2.3; MHLW MO169: 6, 22,23, 25.4; 21 CFR 820.20(b)(2), 820.25] Brazil: Confirm that the manufacturer ensures that any consultant who gives advice regarding design, purchasing, manufacturing, packaging, labeling, storage, installation, or servicing of medical devices has proper qualification to perform such tasks. Those consultants shall be contracted as a formal service supplier, according to purchasing controls defined by the manufacturer [RDC ANVISA 16/2013: 2.3.3]. Link: Production and Service Controls During audit of the Production and Service Controls process, ensure that employees who are involved in key operations that affect product realization and product quality have been trained in their specific job tasks, as well as the quality policy and objectives. When appropriate, review the training records for those employees whose activities have contributed to process nonconformities. | |
1.7. Verify that management has committed to and has responsibility for overall risk management planning, including ongoing review of the effectiveness of risk management activities ensuring that policies, procedures and practices are established and documented for analyzing, evaluating and controlling product risk throughout product realization. [ISO 13485:2016: 4.1.2 (b), 7.1; TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.4; MHLW MO169: 26; 21 CFR 820.30(g)] Link: Design and Development Risk management usually starts in conjunction with the design and development planning process at a point in the development when the results of risk analysis can affect the design process. During audit of the Design and Development process, evaluate top management’s commitment to risk management activities. Evidence of commitment to risk management may include the implementation of new or more stringent controls, external controls (e.g. additional supplier-related controls), or design changes to maintain an acceptable level of product risk. | |
1.8 Verify that procedures have been defined, documented, and implemented for the control of documents and records required by the quality management system. Confirm the organization retains records and at least one obsolete copy of controlled documents for a period of time at least equivalent to the lifetime of the device, but not less than two years from the date of product release. [ISO 13485:2016: 4.1.4, 4.2.1, 4.2.4, 4.2.5; TG(MD)R Sch3 P1 1.4(4); RDC ANVISA 16/2013: 3.1; MHLW MO169: 5, 6, 8, 9; 21 CFR 820.40, 820.180] Australia (TGA): Confirm that Quality Management System documentation and records in relation to a device described in TG(MD)R Sch3 P1 1.9 are retained by the manufacturer for at least 5 years. Brazil (ANVISA): Verify that change records include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective [RDC ANVISA 16/2013: 3.1.5]. Confirm that the manufacturer maintains a master list of the approved and effective documents [RDC ANVISA 16/2013: 3.1.5]. Verify that electronic records and documents have backups [RDC ANVISA 16/2013: 3.1.6]. Japan (MHLW): Confirm that Quality Management System documentation and records in relation to a device are retained by the Registered Manufacturing Site for the following periods (5 years for training records and documentation) [MHLW Ministerial Ordinance No.169: 8.4, 9.3, 67, 68]: (1) 15 years for ‘specially designated maintenance control required medical devices’ [or one year plus the shelf life for products when the shelf life or the expiry date (hereinafter simply referred to as the "shelf life") plus one year exceeds 15 years] (2) 5 years for the products other than the ‘specially designated maintenance control required medical devices’ (or one year plus the shelf life for the products of which the shelf life plus one year exceeds 5 years). Note: The ‘specially designated maintenance control required medical device’ is defined as below in PMD Act 2.8: A medical device designated by the Minister of Health, Labour and Welfare after hearing the opinion of the Pharmaceutical Affairs and Food Sanitation Council as those whose potential risk to the diagnosis, treatment or prevention of disease is significant without proper control since this kind of equipment requires expert knowledge and skill in examination for maintenance and inspection, repair and other management. United States (FDA): Verify that electronic records and documents have backups [21 CFR 820.180]. | |
1.9 Verify that management reviews are being conducted at planned intervals and that they include a review of the suitability and effectiveness of the quality policy, quality objectives, and quality management system to assure that the quality management system meets all applicable regulatory requirements. [ISO 13485:2016: 5.6; TG(MD)R Sch3 P1 1.4(5)(b)(iii)(f); RDC ANVISA 16/2013: 2.2.6; MHLW MO169: 18, 19, 20; 21 CFR 820.20(c)] Link: Measurement, Analysis and Improvement During audit of the Measurement, Analysis and Improvement process, confirm when necessary that action items resulting from Management review are considered for corrective or preventive action. | |
1.10. Confirm that the organization has defined and implemented controls to ensure that only devices that have received the appropriate marketing authorization are distributed or otherwise offered for commercial distribution into the applicable markets. [ISO 13485:2016: 4.1.1, 4.2.1, 5.2, 7.2.1, 7.2.3] Link: Device Marketing Authorization and Facility Registration | |
1.11 At the conclusion of the audit, a decision should be made as to whether top management has demonstrated the necessary commitment to ensure a suitable and effective quality management system is in place and being maintained and whether the effectiveness of the system has been communicated to personnel. [ISO 13485:2016: 4.1.1, 4.1.4, 5.1, 5.5.3; RDC ANVISA 16/2013: 2,1, 2.2.1; MHLW MO169: 5, 10, 17; 21 CFR 820.20(a), 820.5] | |
Process #2: Device Marketing Authorization and Facility Registration 1:45pm - | |
2.1 Verify the organization has complied with regulatory requirements to register and/or license device facilities and submit device listing information in the appropriate jurisdictions where the organization markets or distributes devices. [ISO 13485:2016: 4.1.1, 4.2.1, 5.2, 7.2.1, 7.2.3; see the country-specific requirements below] Australia: Therapeutic Goods Act 1989; Therapeutic Goods (Medical Devices) Regulations 2002 Brazil: Brazilian Federal Law 6360/76 Canada: SOR/98-282 Medical Devices Regulations – Part 1 Japan (MHLW): The Act on Securing Quality, Efficacy and Safety of Pharmaceuticals, Medical Devices, Regenerative and Cellular Therapy Products, Gene Therapy Products, and Cosmetics (Law No. 145, 1960):Chapter 5.1 United States: 21 CFR 807 - Establishment Registration and Device Listing for Manufacturers and Initial Importers of Medical Devices Link: Management During audit of the Management process, confirm that management is aware of and has made arrangements for device marketing authorization and facility registration | |
2.2. Confirm the organization has received appropriate marketing clearance or approval in the regulatory jurisdictions where the organization markets their devices. [ISO 13485:2016: 4.1.1, 4.2.1, 5.2, 7.2.1, 7.2.3; see the country-specific requirements below] Australia (TGA): Obtaining marketing authorization is the responsibility of the Australian sponsor (refer to Therapeutic Goods Act 1989 – Part 4-5). Verify that the manufacturer maintains a list of their Australian Sponsors and the products those Sponsors have included in the Australian Register of Therapeutic Goods. Brazil (ANVISA): Obtaining marketing authorization is the responsibility of the importer (legal representative). Refer to Brazilian Federal Law 6360/76 Canada (HC):SOR/98-282 Medical Devices Regulations – Part 1, section 26 Japan (MHLW):The Act on Securing Quality, Efficacy and Safety of Pharmaceuticals, Medical Devices, Regenerative and Cellular Therapy Products, Gene Therapy Products, and Cosmetics (Law No. 145, 1960): 23-2.1,23-2-5.1, 23-2-23.1, 23-2-12 United States (FDA):21 CFR 807.81: Premarket notification submission;21 CFR 814: Premarket approval of Medical Devices Link: Management, Design and Development During the audit of the Management and Design and Development processes, ensure that management is aware of requirements for device marketing authorization and facility registration, and that these are considered when designing the device. Confirm that management obtains marketing authorization in the appropriate jurisdictions prior to commercial distribution of the device. | |
2.3 Verify the organization has identified changes to marketed devices or the quality management system which require notification to regulatory authorities. [ISO 13485:2016: 4.1.1, 4.2.1, 5.2, 7.2.1, 7.2.3, 7.3.9; see the country-specific requirements below] Australia: Arranging assessment of changes is the responsibility of the organization. Obtaining marketing authorization for changes is the responsibility of the Australian Sponsor. Refer to Therapeutic Goods (Medical Devices) Regulations 2002, Regulation 3.5 – Medical devices manufactured outside Australia, Schedule 3 - The relevant conformity assessment procedure chosen by the manufacturer. Brazil: Arranging assessment of changes is the responsibility of the organization. Obtaining marketing authorization for changes is the responsibility of the importer (legal representative). Refer to Brazilian Law 6360/76 - Art. 13. Canada: SOR/98-282 Medical Devices Regulations – Part 1, sections 1, 34, 43(1), 43(3), and 43.1 Japan: The Act on Securing Quality, Efficacy and Safety of Pharmaceuticals, Medical Devices, Regenerative and Cellular Therapy Products, Gene Therapy Products, and Cosmetics (Law No. 145, 1960): 23-2-5.1, 23-25.11, 23-2-5.17, 23-2-23.1, 23-2-23.6, 23-2-23.7MHLW MO169: 29 United States: 21 CFR 807.81(a)(3); 21 CFR 814.39 Link: Design and Development During the audit of the Design and Development process, the audit team should confirm the organization has considered regulatory requirements for device marketing authorization and facility registration; and has complied with these requirements prior to marketing the changed device in the applicable regulatory jurisdictions. | |
Process #3: Measurement, Analysis and Improvement | |
3.1 Verify that procedures for measurement, analysis and improvement which address the requirements of the quality management system standard and regulatory authorities have been established and documented. Confirm the organization maintains and implements procedures to monitor and measure product conformity throughout product realization, as well as procedures that provide for mechanisms for feedback to provide early warnings of quality problems and the implementation of corrective action and preventive action. [ISO 13485:2016: 4.2.1, 8.1, 8.2.1, 8.2.6, 8.5; TG(MD)R Sch3 P1 1.4(3)(a),(b), (5)(b)(iii), (f); RDC ANVISA 16/2013: 5.3.1, 7.1, 7.2; MHLW MO169: 6, 54, 55, 58, 62, 63, 64; 21 CFR 820.100(a)] Brazil (ANVISA): Verify that the manufacturer has ensured that information about quality problems or nonconforming products are properly disseminated to those directly involved in the maintenance of product quality and to prevent occurrence of such problems [RDC ANVISA 16/2013: 7.1.1.6]. United States: Verify procedures ensure that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of problems [21 CFR 820.100(a)(6)]. Confirm procedures provide for the submission of relevant information on identified quality problems, as well as corrective and preventive actions, for management review [21 CFR 820.100(a)(7)]. | |
3.2 Determine if appropriate sources of quality data have been identified for input into the measurement, analysis and improvement process, including customer complaints, feedback, service records, returned product, internal and external audit findings, and data from the monitoring of products, processes, nonconforming products, and suppliers. Confirm that data from these sources are accurate and analyzed using valid statistical methods (where appropriate) to identify existing and potential product and quality management system nonconformities that may require corrective or preventive action. [ISO 13485:2016: 7.5.4, 8.1, 8.2.1, 8.2.6, 8.4; TG(MD)R Sch3 P1 1.4(3)(a),(b), (5)(b)(iii), (f); RDC ANVISA 16/2013:7.1.1.1, 9.1; MHLW MO169: 43, 54, 55, 58, 61; 21 CFR 820.100(a)] Link: Purchasing During the audit of the Measurement, Analysis and Improvement process, the audit team may en- counter data involving product nonconformities, including complaints involving finished devices, where the underlying cause of the quality problem has been traced to a supplied product. During the audit of the Purchasing process, the audit team should consider selecting suppliers to audit that have corrective action indicators of nonconformities with supplied components or processes. | |
3.3 Determine if investigations are conducted to identify the underlying cause(s) of detected nonconformities, where possible. Confirm investigations are commensurate with the risk of the nonconformity. [ISO 13485:2016: 8.5.2; TG(MD)R Sch3 P1 1.4(3)(a),(b), (5)(b)(iii),(f), TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.4, 6.5.1, 7.1.1.2; MHLW MO169: 63; 21 CFR 820.100 (a)(2)] | |
3.4 Determine if investigations are conducted to identify the underlying cause(s) of potential nonconformities, where possible. Confirm investigations are commensurate with the risk of the potential nonconformity. [ISO 13485:2016: 8.5.3; TG(MD)R Sch3 P1 1.4(3)(a),(b), (5)(b)(iii),(f), TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.4, 7.1.1.1; MHLW MO169: 64; 21 CFR 820.100(a)(2)] | |
3.5 Confirm that corrections, corrective actions, and preventive actions were determined, implemented, documented, effective, and did not adversely affect finished devices. Ensure corrective action and preventive action is appropriate to the risk of the nonconformities or potential nonconformities encountered. [ISO 13485:2016: 8.2.1, 8.2.5, 8.3.1, 8.5.2, 8.5.3; TG(MD)R Sch1 P1 2, TG(MD)R Sch3 P1 1.4(3)(a),(b), (5)(b)(iii), (f);; RDC ANVISA 16/2013: 2.4, 6.5, 7.1.1.3, 7.1.1.4, 7.1.1.5; MHLW MO169: 55, 57, 60, 63, 64; 21 CFR 820.100(a)(3), 820.100 (a)(4), 820.100(a)(6), 820.100(b)] Link: Medical Device Adverse Events and Advisory Notices Reporting Determine whether any of the organization’s corrective actions require reporting to participating MD- SAP authorities. | |
3.6 When a corrective or preventive action results in a design change, verify that any new hazard(s) and any new risks are evaluated under the risk management process. [ISO 13485:2016: 7.1, 7.3.9; TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.4, 4.1.10; MHLW MO169: 26, 36;21 CFR 820.30(i), 820.30(g)] Link: Design and Development If the corrective action or preventive action involves changing the design, design controls should be ap- plied to the change where applicable. When necessary, confirm that design controls were applied to the change according to the organization’s procedures. In addition, design changes should be evaluated under the organization’s risk management process to ensure that changes do not introduce new hazards. | |
3.7 When a corrective or preventive action results in a process change, confirm that the process change is assessed to determine if any new risks to the product are introduced. Verify the manufacturer has performed revalidation of processes where appropriate. [ISO 13485:2016: 4.1.2, 4.1.4, 4.1.6, 4.2.1, 7.1, 7.5.6, 7.5.7; TG(MD)R Sch1 P1 2; Sch3 P1 1.5(4); RDC ANVISA 16/2013: 2.4, 5.6, 7.1.1.4; MHLW MO169: 5, 6, 26, 45, 46; 21 CFR 820.100(a)(4), 820.100(a)(5), 820.70(b), 820.75(c)] Australia: Confirm that when a manufacturer plans to make a substantial change to a critical process (e.g. sterilization, processing materials of animal origin, processing materials of microbial or recombinant origin, or processes that incorporate a medicinal substance in a medical device), the manufacturer notifies the auditing organization who will determine if an assessment of the change is required before implementation [TG(MD)R Sch3 P1 1.5(2)]. Canada: Verify that the manufacturer has a process or procedure for identifying a “significant change” to a class III or IV device. Verify that information about “significant changes” is submitted in a medical device license amendment application [CMDR 1, 34]. Japan (MHLW):Confirm that when the Registered Manufacturing Site plans to make a significant change to a manufacturing processes (e.g. sterilization site change, manufacturing site change), the Registered Manufacturing Site notifies the Marketing Authorization Holder so as the Marketing Authorization Holder can take appropriate regulatory actions. [MHLW MO169: 29] Links: Production and Service Controls, Purchasing If the corrective action or preventive action involves changing a production process, the audit team should consider selecting this change for evaluation during audit of Production and Service Controls. For changes to production processes that are performed by suppliers, the audit team should consid- er selecting those suppliers for evaluation during audit of the Purchasing process. In cases where the organization makes a change to a validated process performed by a supplier, the audit team should evaluate whether re-validation is required. If re-validation of production processes is required, confirm the results show the process meets the planned result. | |
3.8 Verify that controls are in place to ensure that product which does not conform to product requirements is identified and controlled to prevent its unintended use or delivery. Confirm that an appropriate disposition was made, justified, and documented. [ISO 13485:2016: 8.3.1, 8.3.2; TG(MD)R Sch3 P1 1.4(5)(b)(iii); RDC ANVISA 16/2013: 6.5, 7.1.1.6; MHLW MO169: 60 ;21 CFR 820.90(a)] | |
3.9 Confirm that when nonconforming product is detected after delivery or use, appropriate action is taken commensurate with the risk, or potential risks, of the nonconformity [ISO 13485:2016: 8.3.3, 8.5.2; TG(MD)R Sch1 P1 2, TG(MD)R Sch3 P1 1.4(3)(a),(b), (5)(b)(iii), (f); RDC ANVISA 16/2013: 2.4, 7.1.1.8; MHLW MO169: 60, 63; 21 CFR 820.100(a)] Link: Medical Device Adverse Events and Advisory Notices Reporting If the organization has taken field action on products already distributed, confirm that the appropriate MDSAP regulatory authorities have been notified, as necessary. | |
3.10 Verify that internal audits of the quality management system are being conducted according to planned arrangements and documented procedures to ensure the quality management system is in compliance with the established QMS requirements and applicable regulatory requirements, and to determine the effectiveness of the quality system. Confirm that the internal audits include provisions for auditor independence over the areas being audited, corrections, corrective actions, follow-up activities, and the verification of corrective actions. [ISO 13485:2016: 6.2, 8.2.4; TG(MD)R Sch3 P1 1.4(5)(b)(iii); RDC ANVISA 16/2013: 7.3; MHLW MO169: 22, 23 56; 21 CFR 820.22, 820.100] Link: Management During the audit of the Management process, the audit team should confirm that the output of internal audits is an input to management review. | |
3.11 Determine if relevant information regarding nonconforming product, quality management system nonconformities, corrections, corrective actions, and preventive actions has been supplied to management for management review. [ISO 13485:2016: 5.6.2; TG(MD)R Sch3 P1 1.4(5)(b)(iii); RDC ANVISA 16/2013: 2.2.6, 7.1.1.7; MHLW MO169:19; 21 CFR 820.100 (a)(7)] Link: Management During your audit of the Management process, the audit team should have confirmed that the status of corrective and preventive actions is an input to the management review. During the audit of the Measurement, Analysis and Improvement process, determine that top management is aware of Higher risk quality problems, as well as significant corrective and preventive actions, when necessary. | |
3.12 Confirm that the manufacturer has made effective arrangements for gaining experience from the post-production phase, handling complaints, and investigating the cause of nonconformities related to advisory notices with provision for feedback into the Measurement, Analysis and Improvement process. Verify that information from the analysis of production and post-production quality data was considered for amending the analysis of product risk, as appropriate. [ISO 13485:2016: 4.2.1, 7.2.3, 7.5.4 (a), 8.2.1, 8.2.2; TG(MD)R Sch1 P1 2, Sch3 P1 1.4(3), 1.4(5)(b)(iii) &1.4(5)(f); RDC ANVISA 16/2013: 7.2; CMDR 57-58; MHLW MO169: 6, 29, 43, 55, 62.6; 21 CFR 820.198] Australia: Verify that the organization has procedures for a post-marketing system that includes a systematic review of post-production experience (e.g. from; expert user groups, customer surveys, customer complaints and warranty claims, service and repair information, literature reviews, post-production clinical trials, user feedback other than complaints, device tracking and registration schemes, user reactions during training, adverse event reports). Investigation should take place in a timely manner to ensure that reporting timeframes for adverse events or advisory notices may be met [TG(MD)R Sch3 P1 1.4(3)(a)]. Note: Investigation should take place in a timely manner to ensure that reporting time-frames for adverse events or advisory notices can be met by the Australian Sponsor. The manufacturer should be aware that recalls are to be conducted in Australia by the Australian Sponsor in accordance with the Australian Uniform Recall Procedure for Therapeutic Goods. Brazil: Verify that each manufacturer has established and maintains procedures to receive, examine, evaluate, investigate and document complaints. Such procedures must ensure that: (1) Complaints are received, documented, analyzed, evaluated, investigated and documented by a formally designated unit; (2) Where applicable, complaints must be reported to the competent health authority; (3) Complaints must be examined to determine whether an investigation is necessary. When an investigation is not done, the unit must maintain a record that includes the reason that the investigation was not performed and the name of the responsible for that decision; (4) Each manufacturer must examine, evaluate and investigate all complaints involving possible nonconformities of the product. Any claim for death, injury or threat to public health must be immediately reviewed, evaluated and investigated. (5) The records of the investigation must include: Product name; Date of receipt of the complaint; Any control number used; Name, address and telephone number of the complainant; Nature of complaint; and Data and research results including actions taken [RDC ANVISA 16/2013: 7.2]. Canada: Verify that the manufacturer maintains records of reported problems related to the performance characteristics or safety of a device, including any consumer complaints received by the manufacturer after the device was first sold in Canada, and all actions taken by the manufacturer in response to the problems referred to in the complaints [CMDR Section 57]. Verify that the manufacturer has established and implemented documented procedures that will enable it to carry out an effective and timely investigation of the problems reports through the customer complaints, and to carry out an effective and timely recall of the device [CMDR Section 58]. Japan: Confirm that the person operating the Registered Manufacturing Site has determined and implemented effective arrangement for communicating with the Japanese Marketing Authorization Holder in relation to customer feedback, including customer complaints, and advisory notices [MHLW MO169: 29]. United States: Verify procedures have been defined, documented, and implemented for receiving, reviewing, and evaluating complaints by a formally designated unit. Procedures must ensure that: (1) All complaints are processed in a uniform and timely manner (2) Oral complaints are documented upon receipt (3) Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA Each manufacturer must review and evaluate all complaints to determine whether an investigation is necessary. When no investigation is made, the manufacturer must maintain a record that includes the reason no investigation was made and the name of the individual responsible for the decision not to investigate. Any complaint of the failure of the device, labeling, or packaging to meet any of its specifications must be reviewed, evaluated, and investigated, unless such investigation has already been made for a similar complaint and another investigation is not necessary. Any complaint that represents an event which must be reported to FDA must be promptly reviewed, evaluated, and investigated by a designated individual(s) and must be maintained in a separate portion of the complaint files or otherwise clearly identified. Records of investigation must include a determination of: (1) Whether the device failed to meet specifications (2) Whether the device was being used for treatment or diagnosis (3) The relationship, if any, of the device to the reported incident or adverse event When an investigation is made, a record of the investigation must be maintained by the formally designated unit. The record of investigation must include: (1) The name of the device (2) The date the complaint was received (3) Any device identification(s) and control number(s) used (4) The name, address, and telephone number of the complainant (5) The nature and details of the complaint (6) The dates and results of investigation (7) Any corrective action taken When the manufacturer’s formally designated unit is located at a site separate from the manufacturing establishment, the investigated complaint(s) and the record(s) of investigation must be reasonably accessible to the manufacturing establishment [21 CFR 820.198]. Link: Medical Device Adverse Events and Advisory Notices Reporting During the review of complaints and feedback, confirm that individual medical device reports were made to the appropriate regulatory authorities when necessary. | |
3.13 Where investigation determines that activities outside the organization contributed to a customer complaint, verify that records show that relevant information was exchanged between the organizations involved. [ISO 13485:2016: 4.1.5, 7.4.1, 8.3.1; RDC ANVISA 16/2013: 7.1.1.6; MHLW MO169: 5, 37, 60; 21 CFR 820.100(a)(6)] Link: Purchasing During the audit of the Measurement, Analysis and Improvement process, if significant nonconformities are related to supplied product, the audit team should consider selecting those suppliers for evaluation during the audit of the organization’s Purchasing process. | |
3.14 Verify that the organization has defined and documented procedures for the notification of adverse events. Confirm adverse event reporting is performed according to the applicable regulatory requirements. [ISO 13485:2016: 4.2.1, 7.2.3, 8.2.3; TG(MD)R Sch3 P1 1.4(3)(c); RDC ANVISA 16/2013: 7.1.1.8, RDC ANVISA 67/2009; CMDR 59-61.1; MHLW MO169: 6, 29, 62; 21 CFR 803] Additional country-specific requirements: Refer to MDSAP process Medical Device Adverse Events and Advisory Notices Reporting | |
3.15 Confirm that the manufacturer has made effective arrangements for the timely issuance and implementation of advisory notices. Confirm that reporting of advisory notices is performed according to the applicable regulatory requirements. [ISO 13485:2016: 4.2.1, 7.2.3, 8.3.3; TG(MD)R Sch3 P1 1.4(3)(c); RDC ANVISA 16/2013: 7.1.1.8, RDC ANVISA 23/2012; CMDR 63-65.1; MHLW MO169: 6, 29, 60; 21 CFR 806] Additional country-specific requirements: Refer to MDSAP process Medical Device Adverse Events and Advisory Notices Reporting | |
3.16 Determine, based on the assessment of the Measurement, Analysis and Improvement process overall, whether management provides the necessary commitment to detect and address product and quality management system nonconformities, and ensure the continued suitability and effectiveness of the quality management system. [ISO 13485:2016: 4.1.3, 5.2, 8.1, 8.5.1; RDC ANVISA 16/2013: 2.2.1; MHLW MO169: 5, 11, 54, 62] | |
Process #4: Medical Device Adverse Events and Advisory Notices Reporting | |
4.1 Verify that the organization has a process in place for identifying device-related events that may meet reporting criteria as defined by participating regulatory authorities. Verify that the complaint process has a mechanism for reviewing each complaint to determine if a report to a regulatory authority is required. Confirm that the organization’s processes meet the timeframes required by each regulatory authority where the product is marketed. [ISO 13485:2016: 4.2.1, 7.2.3, 8.2.2, 8.2.3; see the country-specific requirements below] Australia (TGA): For Manufacturers: TG(MD)R Sch3 Cl1.4(3)(c)(i) For Sponsors: Manufacturers and Australian Sponsors are to establish through a written agreement, the arrangements that are necessary to ensure that Sponsors are able to comply with reporting requirements and timeframes. Therapeutic Goods Act 1989, 41FN(3) & (4), TG(MD)R, 5.7, 5.8 Brazil (ANVISA): RDC ANVISA 67/2009 RDC ANVISA 16/2013: 7.1.1.7 Canada (HC): Medical Device Regulations SOR/98-282, CMDR 1, 59-61.1 Japan (MHLW): MHLW MO169:62.6 United States (FDA): 21 CFR 803: Medical Device Reporting Link: Measurement, Analysis and Improvement Reports of individual adverse events are a form of feedback and must be analyzed as appropriate for trends requiring improvement or corrective action. During the audit of the Measurement, Analysis and Improvement process, confirm that the organization has considered individual adverse events and trends of adverse events in the analysis of data. | |
4.2 Verify that advisory notices are reported to regulatory authorities when necessary and comply with the timeframes and recordkeeping requirements established by participating regulatory authorities. [ISO 13485:2016: 4.2.1, 7.2.3, 8.2.3, 8.3.3; see the country-specific requirements below] Australia (TGA): For Manufacturers: TG(MD)R Sch3 Cl1.4(3)(c)(ii) For Sponsors: Manufacturers and Australian Sponsors are to establish through written agreement the arrangements that are necessary to ensure that Sponsors are able to comply with recall requirements and timeframes. Therapeutic Goods Act 1989, 41FN(3) & (4), and the requirements imposed in writing that are referenced in the TG Act 41KA and documented in the “TGA Uniform recall procedure for therapeutic goods (URPTG)” Brazil (ANVISA): RDC ANVISA 67/2009 RDC ANVISA 23/2012 RDC ANVISA 16/2013: 7.1.1.8 Canada (HC): CMDR 1, 63 – 65.1 Japan (MHLW): The Act on Securing Quality, Efficacy and Safety of Pharmaceuticals, Medical Devices, Regenerative and Cellular Therapy Products, Gene Therapy Products, and Cosmetics (Law No. 145, 1960): 68-11MHLW MO169: 29 United States (FDA): 21 CFR 806 – Medical Devices; Reports of Corrections and Removals Link: Measurement, Analysis and Improvement Corrections and removals are indicative that the product or process does not meet specified requirements or planned results and the nonconformity was not detected prior to distribution. When specified requirements or planned results are not achieved, correction and corrective action must be taken as necessary. During the audit of the Measurement, Analysis and Improvement process, confirm the organization has taken appropriate correction regarding devices already distributed, and taken appropriate corrective action to prevent recurrence of the condition(s) that caused the nonconformity. | |
Process #5: Design and Development | |
5.1 Verify that those devices that are, by regulation, subject to design and development procedures have been identified. (See Annex 1). [ISO 13485:2016: 4.1.1, 4.2.1, 7.1, 7.3.10; TG(MD)R Regs Division 3.2; MHLW MO169: 5, 6, 26; 21 CFR 820.30(a)] Australia: When a manufacturer applies TG(MD)R Regs Division 3.2 and selects the Full Quality Assurance conformity assessment procedures [TG(MR)R Schedule 3, Part1], procedures for design and development must be available. In addition, for all classes of devices, the guidance provided for the audit of technical documentation in Annex 1 is to be followed to ensure the availability of objective evidence that demonstrates compliance with the Essential Principles of Safety and Performance. Brazil: According to Brazilian legislations, there is no exception to design control. If design activities are outsourced, verify that the manufacturer has a complete device master record for the device and records of the design transfer to production [RDC ANVISA 16/2013: 4.1.7, 4.2]. Canada: With respect to Class II devices that are not subject to Design and Development controls, verify that the manufacturer has objective evidence to establish that Class II devices meet the safety and effectiveness requirements of section 10 to 20 [CMDR 9, 10 to 20]. Japan (MHLW): Class 1 devices are not required to comply with the requirements of MHLW MO169:30-36, which are equivalent to the requirement of design and development in ISO13485 [MHLW MO169:4.1]. Link: Purchasing If the organization outsources design and development activities, or any portion of the design and development, confirm that the organization treats the outsourced firm as a supplier, has appropriately qualified and maintains control over the supplier, communicates requirements to the supplier, includ- ing regulatory requirements, and has arrangements to verify that the design and development activities satisfy those requirements. | |
5.2 Select a completed (where applicable) design and development project for review. Priority criteria for selection: • complaints or known problems with a particular device • product risk • recent design changes, particularly design changes made to correct quality problems associated with the device design • age of design (prefer most recent) • designs that have not been recently audited Link: Measurement, Analysis and Improvement At this point in the audit, the audit team will have already reviewed the Measurement, Analysis and Improvement process. If the auditors noted corrective actions that resulted in design changes, or noted product nonconformities that have been attributed to the design of the device, the audit team should consider selecting those designs for review. The audit team should be particularly mindful of how the identified quality problems from the Measurement, Analysis and Improvement process are related to specific aspects of the design and development of the device. For example, if the audi- tors review complaints related to a safety feature of the device that is not performing as intended, the audit team should consider selecting for review the design verification of that safety feature and determine whether appropriate risk control methods were confirmed to be effective. | |
5.3 Verify that the design and development process is planned and controlled. Review the design plan for the selected design and development project to understand the design and development activities; including the design and development stages, the review, verification, validation, and design transfer activities that are appropriate at each stage; and the assignment of responsibilities, authorities, and interfaces between different groups involved in design and development. [ISO 13485:2016: 4.2.1, 7.1, 7.3.2; TG(MD)R Sch3 P1 Cl 1.4(4)&(5)(c); RDC ANVISA 16/2013: 4.1.2, 4.1.11; MHLW MO169: 6, 26, 30; 21 CFR 820.30(b), 820.30(j)] Australia: Verify that effective planning for design and development is documented, typically as part of a Quality Plan [TG(MD)R Sch3 P1 Cl 1.4(4)]. Canada: Verify that manufacturers of Class IV devices maintain a quality plan that sets out the specific quality practices, resources, and sequence of activities relevant to the device [CMDR 32]. | |
5.4 For the device design and development record(s) selected, verify that design and development procedures have been established and applied. [ISO 13485:2016: 4.2.1, 7.3.1, 7.3.10; TG(MD)R Sch3 P1 Cl 1.4(4)&(5)(c); RDC ANVISA 16/2013: 4.1.1; MHLW MO169: 6, 30; 21 CFR 820.30(a), 820.30(j)] United States: Verify that the design input procedures contain a mechanism for addressing incomplete, ambiguous, or conflicting requirements [21 CFR 820.30(c)]. | |
5.5 Verify that design and development inputs were established, reviewed and approved; and that they address customer functional, performance and safety requirements, intended use, applicable regulatory requirements, and other requirements including those arising from human factors issues, essential for design and development. Verify that any risks and risk mitigation measures identified during the risk management process are used as an input in the design and development process. [ISO 13485:2016: 4.2.1, 5.2, 7.2.1, 7.3.3; TG(MD)R Sch1 P1 2, Sch3 P1 Cl 1.4(2)&(5)(c); RDC ANVISA 16/2013: 2.4, 4.1.3, 4.1.11; CMDR 10-20, 21-23, 66, 67,68; MHLW MO169: 6, 11, 27, 31; 21 CFR 820.30(c), 820.30(g)] Australia: Verify that the manufacturer has identified the relevant Essential Principles that apply to the medical device [TG(MD)R Sch1 Essential Principles]. United States: For the selected device(s), verify that the firm has the appropriate marketing clearance [510(k)] or pre-market approval (PMA) if distributing the devices in the United States [21 CFR 807]. Link: Device Marketing Authorization and Facility Registration Confirm the organization has considered regulatory requirements for registration, listing, notification and licensing; and has complied with these requirements prior to marketing the device in the applicable regulatory jurisdictions. | |
5.6 Confirm that the design and development inputs are complete, unambiguous, and not in conflict with each other. [ISO 13485:2016: 7.3.3; TG(MD)R Sch 3 Part 1.4(4), RDC ANVISA 16/2013: 4.1.3; MHLW MO169: 31; 21 CFR 820.30(c)] | |
5.7 Review medical device specifications to confirm that design and development outputs are traceable to and satisfy design input requirements. Verify that the design and development outputs essential for the proper functioning of the medical device have been identified. Outputs include, but are not limited to, device specifications, specifications for the manufacturing process, the quality assurance testing, and device labeling and packaging. [ISO 13485:2016: 4.2.1,4.2.3, 7.3.4; TG(MD)R Sch3 P1 Cl 1.4(5)(c); RDC ANVISA16/2013:4.1.5, 4.1.4, 4.1.11; MHLW MO169: 6, 32; 21 CFR 820.30(d), 820.30(f)] Australia: Confirm that documentation identifies whether relevant state of the art standards have been applied in full or in part. If standards have not been applied, ensure that the manufacturer has documented a rationale to explain why alternative methods have been applied to demonstrate compliance with the Essential Principles [TG(MD)R Sch3 Part 1.4(5)(c)(iii)(C)]. For devices incorporating a medicinal substance, verify that documentation also identifies the data to be derived from tests conducted in relation to the substance, and its interaction with the device [TG(MD)R Sch 3 Part 1.4(5)(c)(v)]. Links: Purchasing, Production and Service Controls During the review of a design project, the audit team should be mindful of production processes and supplied products that are essential to the proper functioning of the device. Production processes can include not only the manufacturing instructions, but also internal controls, such as the type and extent of acceptance activities, equipment calibration and maintenance intervals, environmental controls, and personnel controls. For suppliers that provide products and services related to the essential design outputs, the degree of purchasing controls necessary is commensurate with the effect of the supplied products on the proper functioning of the finished device. During the audits of the Purchasing process and Production and Service Controls process, the audit team should consider reviewing production processes and supplied products that have the highest risk or greatest effect on the essential design outputs. | |
5.8 Verify that risk management activities are defined and implemented for product and process design and development. Confirm that risk acceptability criteria are established and met throughout the design and development process. Verify that any residual risk is evaluated and, where appropriate, communicated to the customer (e.g., labeling, service documents, advisory notices, etc.). Note: In some instances, it may be necessary for the manufacturer to conduct a risk/benefit analysis to justify a risk that cannot be mitigated to an acceptable level. Additionally, it may be necessary to audit other processes (e.g. Production and Service Controls, Purchasing) to verify that risk acceptability criteria are met, risk is controlled or reduced, and residual risk is communicated if necessary. [ISO 13485:2016: 4.2.1, 7.1, 7.3.3, 7.3.4; TG(MD)R Sch1 P1 2, Sch3 P1 Cl 1.4(5)(c)(iii); RDC ANVISA 16/2013: 2.4, 4.1.11, RDC ANVISA 56/2001; CMDR 10, 11, 15, 16; MHLW MO169: 6, 26, 31, 32; 21 CFR 820.30(g)] Brazil: Verify that the manufacturer has established and maintains a continuous process of risk management which covers the entire life cycle of the product. Possible hazards must be identified in both, normal and fault conditions, including those arising from human factors issues. The risk associated with those hazards, shall be calculated. Risks must be analyzed, evaluated and controlled, as necessary. Effectiveness of risk controls implemented shall be evaluated [RDC ANVISA 16/2013: 56/2001, RDC ANVISA 16/2013: 2.4]. United States: Confirm that the manufacturer has identified the possible hazards associated with the device in both normal and fault conditions. The risks associated with the hazards, including those resulting from user error, should be calculated in both normal and fault conditions. If any risk is judged to be unacceptable, it should be reduced to acceptable levels by the appropriate means. Ensure changes to the device to eliminate or minimize hazards do not introduce new hazards [21 CFR 820.30(g); preamble comment 83]. | |
5.9 Confirm that design verification and/or design validation includes assurances that risk control measures are effective in controlling or reducing risk. [ISO 13485:2016: 7.1, 7.3.6, 7.3.7; TG(MD)R Sch1 P1 2, Sch3 P1 Cl 1.4(5)(c); RDC ANVISA16/2013: 2.4, 4.1.4, 4.1.8, 4.1.11; CMDR 10, 11, 15, 16; MHLW MO169: 26, 34, 35; 21 CFR 820.30(f), 820.30(g)] | |
5.10 Verify that design and development validation data show that the approved design meets the requirements for the specified application or intended use(s). Verify that design validation testing is adjusted according to the risk of the product and element being validated. [ISO 13485:2016: 4.2.1, 7.3.7; TG(MD)R Sch1 P1 2; Sch3 P1 Cl1.4(5)(d); RDC ANVISA 16/2013: 2.4, 4.1.8, 4.1.11; CMDR 12, 18, 19; MHLW MO169: 6, 35; 21 CFR 820.30(g)] | |
5.11 Verify that clinical evaluations and/or evaluation of the medical device safety and performance were performed as part of design validation if required by national or regional regulations. [ISO 13485:2016: 4.2.1, 7.3.7; TG(MD)R Reg 3.11, Sch3 P1 Cl 1.4(5)(c)(vii), Sch3 P8; RDC ANVISA 16/2013: 4.1.8, 4.1.11, RDC ANVISA 56/2001; CMDR 12, 18, 19; MHLW MO169: 6, 35; 21 CFR 820.30(g)] Australia: Verify that records of the validation include clinical evidence as required by the clinical evidence procedures [TG(MD) Sch3 P1 Cl 1.4(5)(c)(vii) and TG(MD) Sch3 P8]. | |
5.12 If the medical device contains software, verify that the software was subject to the design and development process. Confirm that the software was included within the risk management process. [ISO 13485:2016: 7.3.2, 7.3.10; TG(MD)R Sch1 P1 2, Sch1 EP12.1; RDC ANVISA 16/2013: 2.4, 4.1.8, 4.1.11; CMDR 20; MHLW MO169: 30; 21 CFR 820.30(g)] | |
5.13 Verify that design and development changes were controlled, verified (or where appropriate validated), and approved prior to implementation. Confirm that any new risks associated with the design change have been identified and mitigated to the extent practical. [ISO 13485:2016: 4.2.1, 4.2.3, 7.1, 7.3.9, 7.3.10; TG(MD)R Sch1 P1 2, Sch3 P1 Cl 1.4(5)(f), Sch3 P1Cl1.5(4); RDC ANVISA 16/2013: 2.4, 4.1.4, 4.1.8, 4.1.10, 4.1.11, Brazilian Law 6360/76 -Art. 13; CMDR 1, 34; MHLW MO169: 6, 26, 36; 21 CFR 820.30(i)] Australia (TGA): Verify that the manufacturer has a process or procedure for notifying the auditing organization of a substantial change to the design process or the range of products to be manufactured [TG(MD)R Sch3 Cl1.5]. Verify that the manufacturer has a process or procedure for identifying a proposed substantial change to the design, or the intended performance, of a Class AIMD or Class III device, and to notify the assessment body prior to implementing the change [TG(MD)R Sch3 P1 Cl 1.6(4)]. Brazil (ANVISA): If the medical device evaluated is already registered/notified with ANVISA, verify that the design change was correctly and promptly submitted to ANVISA for approval, when applicable [Brazilian Law 6360/76 -Art. 13]. Canada (HC): Verify that the manufacturer has a process or procedure for identifying a “significant change” to a Class III or IV medical device. Verify that information about “significant changes” is submitted in a medical device license amendment application [CMDR 1, 34]. Japan (MHLW): For the Marketing Authorization Holder, confirm if the Marketing Authorization Holder has submitted a new application, a change application, or a change notification to PMDA/ a Registered Certification Body, when applicable.[PMD Act 23-2-5.1, 23-2-5.11, 23-2-5.17, 23-2-23.1, 23-2-23.6, 23-2-23.7]. For the Registered Manufacturing Site, confirm if the site has a mechanism to communicate with the Marketing Authorization Holder about device modifications, so the Marketing Authorization Holder can take appropriate actions. If a critical medical device modification has happened in the Registered Manufacturing Site, confirm if the Registered Manufacturing Site has communicated with Marketing Authorization Holder about the change. [MHLW MO169: 29] United States (FDA): Verify that the organization obtained a new 510(k) or supplement to the pre-market approval if required [21 CFR 807]. Link: Measurement, Analysis and Improvement process (if a design change was made to correct a quality problem with the device); Device Marketing Authorization and Facility Registration During the audit of the Measurement, Analysis and Improvement process, the auditors may encounter corrective actions or preventive actions that resulted in design changes. When corrective action or preventive action involves changing the design, confirm that design controls have been applied to the change, in accordance with the organization’s procedures. Confirm these design changes were effective in addressing the quality issues or potential quality issues identified in corrective or preventive action. In addition, the design change should be evaluated under the organization’s risk management process to ensure that changes do not introduce new hazards. Some changes may require revalidation where it is not possible to verify that requirements have been met after the change has been implemented. The audit team should also confirm the organization has considered regulatory requirements for registration, listing, notification and licensing; and has complied with these requirements prior to marketing the changed device in the applicable regulatory jurisdictions. | |
5.14 Verify that design reviews were conducted at suitable stages as required by the design and development plan. Confirm that the participants in the reviews include representatives of functions concerned with the design and development stage being reviewed, as well as any specialist personnel needed. [ISO 13485:2016: 4.2.1, 7.3.2, 7.3.5; TG(MD)R Sch3 P1 C1.4(5)(c)(i); RDC ANVISA 16/2013: 4.1.6, 4.1.11; MHLW MO169: 6, 30, 33; 21 CFR 820.30(e)] United States: Verify that procedures ensure that participants include representatives of all functions concerned with the design stage being reviewed and an individual(s) who does not have direct responsibility for the design stage being reviewed, as well as any specialists needed [21 CFR 820.30(e)]. | |
5.15 Verify that design changes have been reviewed for the effect on products previously made and delivered, and that records of review results are maintained. [ISO 13485:2016: 7.3.9; RDC ANVISA 16/2013: 4.1.10; MHLW MO169: 36; 21 CFR 820.30(i)] | |
5.16 Determine if the design was correctly transferred to production. [ISO 13485:2016: 4.2.1, 4.2.3, 7.3.8; RDC ANVISA 16/2013: 4.1.7, 4.1.9, 4.1.11, 4.2; MHLW MO169: 6, 30; 21 CFR 830.30(h)] Brazil: Confirm that the manufacturer ensures that the design release occurs only after the approval(s) of a designated person. Before the final release, design and development records must be reviewed to confirm that the design is complete and that the final design meets the approved design. Final release, including signature(s) (manual or electronic) and dates, shall be documented [RDC ANVISA 16/2013: 4.1.9, 4.1.11]. Link: Production and Service Controls, Purchasing Verify that production processes for the device, including process validation (if required) have been defined, documented, and implemented. Confirm that potential hazards that could be introduced or exacerbated by the production process have been identified, and production controls have been established. Production processes include not only the manufacturing instructions, but also internal controls, such as the type and extent of acceptance activities, equipment calibration and mainte- nance intervals, environmental controls, and personnel controls. Confirm that the manufacturer has determined the type and extent of supplier controls based on the relationship between the supplied products and services and product risk. | |
5.17 Determine, based on the assessment of the design and development process overall, whether management provides the necessary commitment to the design and development process. [ISO 13485:2016: 4.1.3, 5.1, 5.5.1; TG(MD)R Sch3 P1 Cl 1.4(5)(b)(ii); RDC ANVISA 16/2013: 2.2.1 ; MHLW MO169: 5, 10, 15] | |
Process #6: Production and Service Controls | |
6.1 Verify that the product realization processes are planned, including any necessary controls, controlled conditions, and risk management activities required for the product to meet the specified or intended uses and the statutory and regulatory requirements related to the product. Confirm that the planning of product realization is consistent with the requirements of the other processes of the quality management system and performed in consideration of the quality objectives. [ISO 13485:2016: 7.1, 7.2.1, 7.5.1; TG(MD)R Sch 1 P1 2, Sch3 P1 Cl1.4(4), Sch3 P1 Cl1.4(5)(d)&(e); RDC ANVISA 16/2013: 2.2.1, 2.4, 4.1.2, 4.1.7, 5.1; MHLW MO169: 26, 27, 40; 21 CFR 801, 820.30(b), 820.20(a), 820.30(h), 820.70(a), 830] United States (FDA): Confirm that the organization has determined the applicability of unique device identifier requirements per 21 CFR 801 and 21 CFR 830, has obtained the unique device identifiers from an FDA-accredited UDI-issuing agency, and the required data elements have been entered in the Global Unique Device Identification Database (GUDID) [21 CFR 801, 830]. Link: Management Confirm when necessary that the quality objectives related to the product were considered for inclusion in management review. | |
6.2 Review production processes considering the following criteria. Select one or more production processes to audit. Reminder: Information the audit team has learned about device and quality management system nonconformities during audit of the Measurement, Analysis and Improvement process, as well as higher risk elements and essential design outputs from the design projects reviewed during audit of the Design and Development process should be used to make decisions as to the production processes to be reviewed. Priority criteria for selection: • Corrective and preventive action indicators of process problems or potential problems • Use of the production process for higher risk products • Use of production processes that directly impact the ability of the device to meet its essential design outputs • New production processes or new technologies • Use of the process in manufacturing multiple products • Processes that operate over multiple shifts • Processes not covered during previous audits | |
6.3 For each selected process, determine if the production and service process is planned and conducted under controlled conditions that include the following: • the availability of information describing product characteristics • the availability of documented procedures, requirements, work instructions, and reference materials, reference measurements, and criteria for workmanship • the use of suitable equipment • the availability and use of monitoring and measuring devices • the implementation of monitoring and measurement of process parameters and product characteristics during production • the implementation of release, delivery and post-delivery activities • the implementation of defined operations for labeling and packaging • the establishment of documented requirements for changes to methods and processes [ISO 13485:2016: 7.5.1, 8.2.5, 8.2.6; TG(MD)R Sch3 P1 Cl1.4(5)(d)&(e); RDC ANVISA 16/2013: 3.1.3, 4.2, 5.1, 5.2, 5.3, 5.4, 5.6, 5.6.1, 5.6.2; MHLW MO169: 40, 57, 58, 59; 21 CFR 820.70(a), 820.70(b), 820.75, 820.120, 820.130] | |
6.4 Determine if the organization has established documented requirements for product cleanliness including any cleaning prior to sterilization, cleanliness requirements if provided non-sterile, and assuring that process agents are removed from the product if required. [ISO 13485:2016: 4.2.1, 4.2.3, 6.4.2, 7.5.2; TG(MD)R Sch3 P1 Cl1.4(5)(d); RDC ANVISA 16/2013: 5.1.3.1, 5.1.3.4, 5.1.5.3; MHLW MO169: 6, 25, 41; 21 CFR 820.70(c), 820.70(d), 820.70(e), 820.70(h)] Brazil: Confirm that a pest control program has been established and where chemicals are used as part of the pest control program, the company must ensure that they do not affect product quality [RDC ANVISA 16/2013: 5.1.3.4]. Verify that the manufacturer has established and maintains housekeeping procedures and schedules for production areas and warehouses, in conformance with production specifications [RDC ANVISA 16/2013: 5.1.3.1]. | |
6.5 Verify that the organization has determined and documented the infrastructure requirements to achieve product conformity, including buildings, workspace, process equipment, and supporting services. Confirm that buildings, workspaces, and supporting services allow product to meet requirements. Verify that there are documented and implemented requirements for maintenance of process equipment where important for product quality, and that records of maintenance are maintained. [ISO 13485:2016: 4.2.1, 6.3, 7.5.1; RDC ANVISA 16/2013: 5.1.2, 5.1.5; CMDR 14; MHLW MO169: 6, 24, 40; 21 CFR 820.70(g), 820.70(f)] Brazil (ANVISA): Verify that manufacturing facilities are configured in order to provide adequate means for people flow. [RDC ANVISA 16/2013: 5.1.2]. | |
6.6 Verify documented requirements have been established, implemented and maintained for: health, cleanliness, and clothing of personnel that could have an adverse effect on product quality monitoring and controlling work environment conditions that can have an adverse effect on product quality training or supervision of personnel who are required to work under special environmental conditions controlling contaminated or potentially contaminated product (including returned products) in order to prevent contamination of other product, the work environment, or personnel [ISO 13485:2016: 4.2.1, 6.4; TG(MD)R Sch1 P2 7.2, 8; RDC ANVISA 16/2013: 5.1.3; MHLW MO169: 6, 25; 21 CFR 820.70(c), 820.70(d), 820.70(e)] Brazil (ANVISA): Verify that biosafety standards are used, when applicable [RDC ANVISA 16/2013: 5.1.3.6]. | |
6.7 Determine if the selected process(es) and sub-process(es) have been reviewed, including any outsourced processes, to determine if validation of these processes is required. [[ISO 13485:2016: 4.2.1, 4.1.6, 7.5.6; TG(MD)R Sch1 P2 8.2, 8.3; Sch3 P1 1.4(5)(d), RDC ANVISA16/2013: 5.5.2, 5.5.3; MHLW MO169: 6, 45; 21 CFR 820.75(a)] Brazil: Verify that analytical methods, utilities, computer systems and automated software that can adversely affect product quality or the quality system are validated, periodically reviewed and, when necessary, revalidated [RDC ANVISA 16/2013: 5.5.2, 5.5.3]. United States: Process validation is required for sterilization, aseptic processing, injection molding, and welding [21 CFR 820.75; preamble comment 143]. Link: Purchasing The audit team may encounter situations where the organization outsources processes that require validation. During the review of the Purchasing process, review the controls the organization has instituted over suppliers that perform validated processes. This can be particularly important for higher risk validated processes performed by suppliers, since the finished device manufacturer does not have immediate control over those processes. | |
6.8 Verify that the selected process(es) has been validated if the result of the process cannot be fully verified. Confirm that the validation demonstrates the ability of the process(es) to consistently achieve the planned result. In the event changes have occurred to a previously validated process, confirm that the process was reviewed and evaluated, and re-validation was performed where appropriate. [ISO 13485:2016: 4.2.1, 7.5.6; TG(MD)R Sch1 P1 2(1), Sch3 P1 1.4(5)(d); RDC ANVISA 16/2013: 1.2.18, 5.5.1; MHLW MO169: 6, 45; 21 CFR 820.75(a), 820.75(c)] Australia: Confirm that methods of validation have regard to the generally acknowledged state of the art (e.g. current Medical Device Standard Orders - MDSO, ISO/IEC Standards, BP, EP, USP etc.) [TG Act s41CB, TG(MD)R Sch 1 P1 2(1)]. | |
6.9 If product is supplied sterile: • Verify the sterilization process is validated, periodically re-validated, and records of the validation are available • Verify that devices sold in a sterile state are manufactured and sterilized under appropriately controlled conditions • Determine if the sterilization process and results are documented and traceable to each batch of product [ISO 13485:2016: 4.2.1, 7.5.5, 7.5.6, 7.5.7; TG(MD)R Sch1 2(1) & 8.3, Sch3 P1 1.4(5)(d); RDC ANVISA 16/2013: 5.1.6, 5.5; CMDR 17; MHLW MO169: 6, 44, 45, 46; 21 CFR 820.75, 820.184(d)] Australia: Verify that methods of sterilization validation have regard to the generally acknowledged state of the art (e.g. current Australian Medical Device Standard Orders - MDSO, ISO 11135, ISO 11137) [TG(MD)R Sch1 P1 2(1)]. | |
6.10 Verify that the system for monitoring and measuring of product characteristics is capable of demonstrating the conformity of products to specified requirements. Confirm that product risk is considered in the type and extent of product monitoring activities [ISO 13485:2016: 7.1, 7.5.1, 8.1, 8.2.6; TG(MD)R Sch1 P1 2, Sch3 P1 1.4(5)(b)&(e); RDC ANVISA 16/2013: 2.4, 5.1.1, 9.1; MHLW MO169: 26, 40, 54, 58; 21 CFR 820.70(a), 820.250(a)] | |
6.11 Verify that the processes used in production and service are appropriately controlled, monitored, and operated within specified limits. In addition, verify that risk control measures identified by the manufacturer for production processes are implemented, monitored and evaluated [ISO 13485:2016: 7.1, 7.5.1, 8.1, 8.2.5, TG(MD)R Sch1 P1 2, Sch3 P1 1.4(5)(b)&(e); RDC ANVISA 16/2013: 2.4, 5.1.1, 5.1.6, 8.2, 9.1; MHLW MO169: 26, 40, 54, 57; 21 CFR 820.70(a), 820.75(b), 820.250] Link: Design and Development The design outputs for a device include documents such as diagrams, drawings, specifications, procedures, and the production processes that are essential to the proper manufacturing of the device. Production processes can include not only the manufacturing instructions, but also internal controls, such as the type and extent of acceptance activities, equipment calibration and maintenance intervals, environmental controls, and personnel controls. During the audit of the Production and Service Controls process, consider reviewing production processes that have the highest risk or greatest effect on the essential design outputs. | |
6.12 Verify that personnel are competent to implement and maintain the processes in accordance with the requirements identified by the organization. [ISO 13485:2016: 6.2; RDC ANVISA 16/2013: 2.3.2; MHLW MO169: 22; 21 CFR 820.25, 820.70(d), 820.75(b)] Link: Management During the audit of the Production and Service Controls process, ensure that employees who are involved in key operations that affect product realization and product quality have been trained in their specific job tasks, as well as the quality policy and objectives. When appropriate, review the training records for those employees whose activities have contributed to process nonconformities. | |
6.13 Confirm that the organization has determined the monitoring and measuring devices needed to provide evidence of conformity to specified requirements. Verify that the monitoring and measuring equipment used in production and service control has been identified, adjusted, calibrated and maintained, and capable of producing valid results. [ISO 13485:2016: 7.5.1, 7.6; TG(MD)R Sch3 P1 1.4(5)(e); RDC ANVISA 16/2013: 5.1.5, 5.4; MHLW MO169: 40, 53; 21 CFR 820.70(g), 820.72] | |
6.14 Confirm that the organization assesses (and records) the validity of previous measurements when equipment is found not to conform to specified requirements, and takes appropriate action on the equipment and any product affected. Verify that the control of the monitoring and measuring devices is adequate to ensure valid results. Confirm that monitoring and measuring devices are protected from damage or deterioration. [ISO 13485:2016: 7.6; TG(MD)R Sch3 P1 1.4(5)(e); RDC ANVISA 16/2013: 5.4; MHLW MO169: 53; 21 CFR 820.72(a)] | |
6.15 If the selected process is software controlled or if software is used in production equipment or the quality management system, verify that the software is validated for its intended use. Software validation may be part of equipment qualification. [ISO 13485:2016: 4.1.6, 7.5.6, 7.6; RDC ANVISA 16/2013: 5.5.2; MHLW MO169: 45, 53; 21 CFR 820.70(i)] | |
6.16 Determine if the manufacturer has established and maintained a file for each type of device that includes or refers to the location of device specifications, production process specifications, quality assurance procedures, traceability requirements, and packaging and labeling specifications. Confirm that the manufacturer determined the extent of traceability based on the risk posed by the device in the event the device does not meet specified requirements [ISO 13485:2003: 4.2.1; 4.2.4; 7.1; 7.5.3.2.1; TG(MD)R Sch3 P1 1.4(5) (c),(d),(e) & 1.9; RDC ANVISA 16/2013: 1.2.26, 2.4, 4.2, 5.2, 6.4; CMDR 9(2), 21-23, 52-56, 66-68; 21 CFR 820.65, 820.181] Brazil: Verify that the manufacturer has established and maintains procedures to ensure integrity and to prevent accidental mixing of labels, instructions, and packaging materials [RDC ANVISA 16/2013: 5.2.2.1]. Confirm that the manufacturer has ensured that labels are designed, printed and, where applicable, applied so that they remain legible and attached to the product during processing, storage, handling and use [RDC ANVISA 16/2013: 5.2.2.2]. Canada: Verify that the manufacturer maintains objective evidence that devices meet the safety and effectiveness requirements of the CMDR [CMDR 9(2)]. Verify that devices sold in Canada have labeling that conforms to Canadian English and French language requirements and contains the manufacturer’s name and address, device identifier, control number (for Class III and IV devices), contents of packaging, sterility, expiry, intended use, directions for use and any special storage conditions [CMDR 21-23]. Verify that the manufacturer maintains distribution records in respect of a device that will permit a complete and rapid withdrawal of the device from the market [CMDR 52-56]. United States: If a control number is required for traceability, confirm that such control number is on or accompanies the device throughout distribution [21 CFR 820.120(e)]. Link: Design and Development During the design and development of the device, the essential design outputs for the proper functioning of the device should have been identified. Raw materials, components, and subassemblies should have been considered for traceability if their nonconformance could result in the finished device not meeting its specified requirements and essential functions. | |
6.17 Determine if the manufacturer has established and maintained a record of the amount manufactured and approved for distribution for each batch of medical devices, the record is verified and approved, and the device is manufactured according to the file referenced in task 16. [ISO 13485:2016: 4.2.1, 7.5.1, 7.5.8, 7.5.9.1, 8.2.6; RDC ANVISA 16/2013: 3.2, 5.2, 6.4; MHLW MO169: 6, 40, 47, 48, 58; 21 CFR 820.120, 820.184] Brazil: Verify that the device history record of the product includes or refers to the following information: date of manufacture; components used; quantity manufactured; results of inspections and tests; parameters of special processes; quantity released for distribution; labeling; identification of the serial number or batch of production; and final release of the product [RDC ANVISA 16/2013: 3.2.1]. Verify that labeling has not been released for storage or use until a designated individual has examined the labeling for accuracy. The approval, including date, name, and physical or electronic signature of the person responsible, must be documented in the device history record [RDC ANVISA 16/2013: 5.2.2.3]. United States: Verify that labeling is not released for storage or use until a designated individual has examined the labeling for accuracy. The release, including the date and signature of the individual performing the examination must be documented in the device history record (i.e. batch record) [21 CFR 820.120(b)]. Confirm that labeling is stored in a manner that provides proper identification and prevents mix-ups. Verify that labeling and packaging operations are controlled to prevent labeling mix-ups [21 CFR 820.120(c) and (d)]. Verify that the label and labeling used for each production unit, lot, or batch are documented in the batch record, as well as any control numbers used [21 CFR 820.120(e), 820.184(e)]. | |
6.18 If the organization manufactures active or nonactive implantable medical devices, life-supporting or life-sustaining devices, confirm that the manufacturer maintains traceability records of all components, materials, and work environment conditions (if these could cause the medical device to not satisfy its specified requirements) in addition to records of the identity of personnel performing any inspection or testing of these devices. Confirm that the organization requires that agents or distributors of these devices maintain distribution records and makes them available for inspection. Verify that the organization records the name and address of shipping consignees for these devices. [ISO 13485:2016: 4.2.1, 7.5.9.2, 8.2.6; MHLW MO169: 6, 49, 59; 21 CFR 820.65] Canada: Verify that the manufacturer has identified Schedule 2 implants and provides implant registration cards with devices or employs another suitable system approved by Health Canada [CMDR 66-68]. Verify that the manufacturer of devices that are listed on Schedule 2 of the Medical Devices Regulations maintains distribution records of these devices as well as any information received on implant registration cards related to these Schedule 2 devices [CMDR 54]. United States: Verify that the manufacturer has implemented a tracking system for devices for which the manufacturer has received a tracking order from FDA. The tracking system must ensure the manufacturer is able to track the device to the end-user. The manufacturer must conduct periodic audits of the tracking system [21 CFR 821]. | |
6.19. Verify that product status identification is adequate to ensure that only product which has passed the required inspections and tests is dispatched, used, or installed. [ISO 13485:2016: 7.5.8; RDC ANVISA 16/2013: 6.1.2, 6.4; MHLW MO169: 47, 50; 21 CFR 820.86] | |
6.20 Verify that the organization has implemented controls to identify, verify, protect, and safeguard customer property provided for use or incorporation into the product. Verify that the organization treats patient information and confidential health information as customer property. [ISO 13485:2016: 7.5.10; MHLW MO169: 51] | |
6.21 Verify that acceptance activities assure conformity with specifications and are documented. Confirm that the extent of acceptance activities is commensurate with the risk posed by the device Note: Acceptance activities apply to any incoming component, subassembly, or service, regardless of the manufacturer’s financial or business arrangement with the supplier. [ISO 13485:2016: 4.2.1, 7.4.3, 7.5.8, 8.2.6; TG(MD)R Sch1 P1 2, Sch3 P1 Cl1.4(5)(d); RDC ANVISA 16/2013: 5.3.1, 5.3.2, 5.3.3, 5.3.4, 9.2; MHLW MO169: 6, 39, 47, 58, 59; 21 CFR 820.80, 820.250(b)] Brazil: Verify that sampling plans are defined and based on valid statistical rationale. Each manufacturer must establish and maintain procedures to ensure that sampling methods are suitable for their intended use and are reviewed regularly. A review of sampling plans should consider the occurrence of nonconforming product, quality audit reports, complaints and other indicators [RDC ANVISA 16/2013: 9.2]. United States: Verify that the manufacturer establishes and maintains procedures to ensure that sampling methods are adequate for their intended use and ensure that when changes occur, the sampling plans are reviewed [21 CFR 820.250(b)]. Link: Purchasing, Design and Development The audit team should consider reviewing the purchasing controls and requirements for suppliers of higher risk products. The audit team should also consider reviewing the purchasing controls and requirements for suppliers of products that undergo minimal acceptance activities at the device manufacturer, particularly if the supplied product is manufactured using a process that requires validation. During the review of acceptance activities, if the audit team encounters situations where records of acceptance activities for supplied product reveal products that do not meet specified requirements, consider selecting those suppliers for review during the audit of the organization’s Purchasing process. The establishment of the necessary purchasing controls and required acceptance activities is a design output. The degree of the purchasing controls necessary and extent of acceptance activities should be based on the risk posed by the product not meeting its specified requirements and essential design outputs. | |
6.22 Verify that the identification, control, and disposition of nonconforming products is adequate, based on the risk the nonconformity poses to the device meeting its specified requirements. [ISO 13485:2016: 7.5.8, 8.3; TG(MD)R Sch1 P1 2, Sch3 P1 Cl1.4(5)(b); RDC ANVISA 16/2013: 6.5.1, 6.5.2; MHLW MO169: 47, 50, 60; 21 CFR 820.60, 820.90(a), 820.86, 820.100(a)] Link: Measurement, Analysis and Improvement The audit team should be mindful of any instances where the acceptance of nonconforming product has led to finished devices not meeting specified requirements. This information can often be found in records of acceptance activities and complaint records. During the review of the organization’s corrective and preventive actions, the auditors may have noted instances where nonconforming products were found to be the underlying cause of quality problems and complaints. The audit team should consider reviewing the organization’s handling and evaluation of nonconforming products that were determined to be the underlying cause of quality problems. Ensure that the analysis of data regarding nonconforming product is considered as an input to the organization’s Measurement, Analysis and Improvement process and that corrective or preventive actions have been implemented when necessary. | |
6.23 If a product needs to be reworked, confirm that the manufacturer has made a determination of any adverse effect of the rework upon the product. Verify that the rework process has been performed according to an approved procedure, that the results of the rework have been documented, and that the reworked product has been re-verified to demonstrate conformity to requirements [ISO 13485:2016: 8.3.4; RDC ANVISA 16/2013: 6.5.3; MHLW MO169: 60; 21 CFR 820.90(b)] | |
6.24 Verify that procedures are established and maintained for preserving the conformity of product and constituent parts of a product during internal processing, storage, and transport to the intended destination. This preservation encompasses identification, handling, packaging, storage, and protection, including those products with limited shelf-life or requiring special storage conditions. [ISO 13485:2016: 7.5.8, 7.5.11; TG(MD)R Sch1 P1 5; RDC ANVISA 16/2013: 5.2.1, 6.1.1, 6.2.1; CMDR 14; MHLW MO169: 47, 52; 21 CFR 820.130, 820.140, 820.150, 820.160(a)] | |
6.25 Confirm that the organization performs a review of the customer’s requirements, including the purchase order requirements, prior to the organization’s commitment to supply a product to a customer. Verify that the organization maintains documentation required by regulatory authorities regarding maintenance of distribution records. [ISO 13485:2016: 4.2.1, 5.2, 7.2.2, 7.5.9; RDC ANVISA 16/2013: 6.3; MHLW MO169: 6, 11, 28, 48, 49; 21 CFR 820.160(a)] Brazil: Verify that the manufacturer maintains distribution records which include or make reference to: the name and address of the consignee, the identification and quantity of products shipped, the date of dispatch, and any numerical control used for traceability [RDC ANVISA 16/2013: 6.3]. Canada: Verify that the manufacturer maintains distribution records that contain sufficient information to permit complete and rapid withdrawal of the medical device from the market [CMDR 52-53]. Verify that distribution records of a device are retained by the manufacturer in a manner that will allow for timely retrieval, for the longer of (a) the projected useful life of the device; and (b) two years after the date the device was shipped [CMDR 55-56]. United States: Verify that the manufacturer maintains distribution records which include or refer to the location of the name and address of the initial consignee, the identification and quantity of devices shipped; and any control numbers used [21 CFR 820.160(b)]. | |
6.26. If installation activities are required, confirm that records of installation and verification activities are maintained. [ISO 13485:2016: 7.5.3; RDC ANVISA 16/2013: 8.1; MHLW MO169: 42; 21 CFR 820.170] | |
6.27 Determine if servicing activities are conducted and documented in accordance with defined and implemented instructions and procedures. Confirm that service records are used as a source of quality data in the Measurement, Analysis and Improvement process. [ISO 13485:2016: 4.2.1, 7.5.4, 8.4; RDC ANVISA 16/2013: 8.2; MHLW MO169: 6, 43, 61; 21 CFR 820.200] Brazil: Confirm that the manufacturer has established and maintains procedures to ensure that records of servicing activities are kept with the following information: the product serviced; the control number of product serviced; the date of completion of service; identification of the service provider; description of service performed; and results of inspections and tests performed [RDC ANVISA 16/2013: 8.2.1]. Verify that the manufacturer periodically reviews the records of servicing activities. In cases where the analysis identifies trends that pose danger or records involving death or serious injury, a corrective or preventive action must be initiated [RDC ANVISA 16/2013: 8.2.2]. United States: Verify that each manufacturer who receives a service report that represents an event that must be reported to FDA as a medical device report automatically considers the report a complaint [21 CFR 820.200(c)]. Confirm that service reports are documented and include the name of the device serviced, any device identification(s) and control number(s) used, and the date of service [21 CFR 820.200(d)]. Link: Measurement, Analysis and Improvement During the audit of the organization’s Measurement, Analysis and Improvement process, the audit team may have already confirmed that quality data from the analysis of servicing activities is analyzed for possible corrective or preventive action. When reviewing the organization’s service reports, the audit team should be mindful of service reports that appear to be product complaints. Ensure that service reports that appear to be complaints have been appropriately addressed. In some instances, a similar quality problem for a particular device may be found in the service reports and the complaint records. In these instances, confirm that the organization is taking appropriate corrections and/or corrective actions considering a similar quality problem is observed in multiple data sources. | |
6. 28 When appropriate, verify that risk control and mitigation measures are applied to transport, installation and servicing, in accordance with the organization’s risk management practices. [ISO 13485:2016: 7.1, 7.5.1, 7.5.3, 7.5.4, 7.5.11; TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.4; MHLW MO169: 26, 40, 42, 43, 52; 21 CFR 820.160(a), 820.170(a), 820.200(a)] | |
6. 29 Determine, based on the assessment of the production and service control process overall, whether management provides the necessary commitment to the production and service control process to ensure devices meet specified requirements and quality objectives. [ISO 13485:2016: 5.1; 5.2; RDC ANVISA 16/2013: 2.2.1; MHLW MO169: 10, 11] | |
Process #7: Purchasing | |
7.1 Verify that planning activities describe or identify products to purchase and processes to outsource, the specified requirements for purchased products, the requirements for purchasing documentation and records, purchasing resources, the activities for purchased product acceptance, and risk management in supplier selection and purchasing. [ISO 13485:2016: 4.1.2, 4.1.3, 4.1.5, 7.1, 7.4.1, 7.4.2, 7.4.3; TG(MD)R Sch1 P1 2, Sch3 P1 Cl1.4(5)(d)(ii); RDC ANVISA16/2013: 2.5.1, 2.4; MHLW MO169: 5, 26, 37, 38, 39; 21 CFR 820.20, 820.50] Links: Design and Development, Management During the review of a design project, confirm that the organization has considered the effect of purchased product on the essential design outputs. For suppliers that provide product and services related to the essential design outputs, the degree of purchasing controls necessary is commensurate with the effect of the supplied product on the proper functioning of the finished device. During the audit of the Purchasing process, confirm when necessary that the degree of control over suppliers of purchased product has been made based on the risk the supplied product poses to the ability of the finished device to meet specified requirements. Additionally, confirm when necessary that the quality objectives related to the purchased product were considered for inclusion in management review. | |
7.2 Select one or more supplier evaluation files to audit. Priority criteria for selection: Indications of problems with supplied products or processes from audit of the Measurement, Analysis and Improvement process Suppliers of higher risk products or processes Suppliers who provide products or services that directly impact the design outputs required for proper functioning of the device Suppliers of processes that require validation or revalidation Newly approved suppliers of products or services Suppliers of products or services used in the manufacturing of multiple products Suppliers of components or services not covered during previous audits | |
7.3 Verify that procedures for ensuring purchased product conforms to purchasing requirements have been established and documented. [ISO 13485:2016: 7.4.1; TG(MD)R Sch3 P1 Cl1.4(5)(d)(ii); RDC ANVISA 16/2013: 2.5.1; MHLW MO169: 37; 21 CFR 820.50] | |
7.4 Verify that the procedures assure the type and extent of control applied to the supplier and the purchased product is dependent upon the effect of the purchased product on subsequent product realization or the final product. Verify that criteria for the selection, evaluation and re-evaluation of suppliers have been established and documented. [ISO 13485:2016: 7.4.1; RDC ANVISA 16/2013: 2.5.2, 2.5.3; MHLW MO169: 37; 21 CFR 820.50] | |
7.5 Verify that suppliers are selected based on their ability to supply product or services in accordance with the manufacturer’s specified requirements. Confirm that the degree of control applied to the supplier is commensurate with the significance of the supplied product or service on the quality of the finished device, based on risk. Verify that records of supplier evaluations are maintained. [ISO 13485:2016: 4.2.1, 7.1, 7.4.1; TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.3,3, 2.5.3, 2.4; MHLW MO169: 6, 26, 37; 21 CFR 820.50(a)] Australia (TGA): If the manufacturer outsources to the Australian Sponsor; a quality management system requirement, an obligation on the manufacturer from the Australian regulations, or where the manufacturer appoints the Sponsor to act on their behalf for dealings with the TGA, verify that the manufacturer treats the Sponsor as a supplier and has adequate supplier controls included in a written agreement [TG Act 41FN] for those activities. For example, making applications on behalf of the manufacturer to the TGA [TG Act s41EB], representing the manufacturer in interactions with the TGA [TG Act s41FN(3)], adverse event reporting, as the first point for handling customer complaints, or as an intermediary in recalls of products [TG(MD) Regs Schedule 3 - Part 1:1.4(3)], in the notification of substantial changes to a kind of medical device (TG Act s41BE) that may require a variation to an entry in the Australian Register of Therapeutic Goods (TG Act s9D), for the provision of records [TG(MD) Regs Schedule 3 - Part 1:1.5, 1.9 ], or other matters that may be required to allow the Sponsor to fulfill market authorisation conditions [TG Act Part 4-5 Div 2]. Canada (HC): Verify that any regulatory correspondent used by the manufacturer is treated as a supplier and is adequately qualified. Japan (MHLW): (For Marketing Authorization Holder) If the Marketing Authorization Holder (MAH) has outsourced any process that affects product conformity with requirements, to a Registered Manufacturing Site(RMS), then verify the MAH has performed the necessary verification that the RMS has an appropriate quality management system. If the site of a supplier is a Registered Manufacturing Site, then verify the MAH has performed the necessary verification that the supplier has an appropriate quality management system [MHLW MO169: 65]. (For Registered Manufacturing Site) If the RMS has outsourced any process that affects product conformity with requirements, to another RMS, then verify the outsourcing RMS has performed the necessary verification that the outsourced RMS has an appropriate quality management system. If the site of a supplier is a RMS, then verify the purchase controlling RMS has performed the necessary verification that the supplier has an appropriate quality management system [MHLW MO169: 65]. Links: Design and Development, Production and Service Controls The establishment of the necessary purchasing controls and required acceptance activities is a design output. The degree of the purchasing controls necessary and extent of acceptance activities should be based on the risk posed by the product not meeting its specified requirements and essential design outputs. | |
7.6 Verify that the manufacturer maintains effective controls over suppliers and product, so that specified requirements continue to be met. [ISO 13485:2016: 7.4.1; RDC ANVISA 16/2013: 2.5.3; MHLW MO169: 37; 21 CFR 820.50(a)] Links: Production and Service Controls, Measurement, Analysis and Improvement Organizations are expected to define, document, and implement systems and procedures for acceptance activities to verify that supplied products conform to specified requirements. Effective acceptance procedures and systems directly affect the ability of an organization to demonstrate that supplied products meets specifications. During the audit of the Production and Service Controls process, confirm that the appropriate acceptance activities have been implemented and monitored to ensure the received product meets specified requirements. Additionally, organizations are required to determine, collect, and analyze appropriate data to demonstrate the ability of suppliers to provide acceptable product. During the audit of the Measurement, Analysis and Improvement process, confirm that analysis of supplier performance data has been performed and considered for corrective or preventive action when necessary. | |
7.7 Confirm that the re-evaluation of the capability of suppliers to meet specified requirements is performed at intervals consistent with the significance of the product on the finished device. [ISO 13485:2016: 7.4.1; TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.5.2, 2.4; MHLW MO169: 37; 21 CFR820.50(a)] Link: Measurement, Analysis and Improvement The frequency and extent of supplier re-evaluation activities may be based, in part, on the performance of the supplier as demonstrated by such activities as statistical monitoring of the supplier, monitoring of complaints and nonconformities related to supplied product, and corrective or preventive actions related to the supplier. | |
7.8 Verify that the organization assures the adequacy of purchasing requirements for products and services that suppliers are to provide, and defines risk management activities and any necessary risk control measures. Confirm that the manufacturer ensures the adequacy of specified purchase requirements prior to their communication to the supplier and that a written agreement with the supplier is established in which suppliers has to notify the organization about changes in the product. [ISO 13485:2016: 4.2.1, 7.4.2, TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.4, 2.5.4, 2.5.6; MHLW MO169: 6, 38; 21 CFR 820.50(b)] Additional country-specific requirements: Brazil (ANVISA): Confirm that purchase orders are approved by a designated person. This approval, including date and signature, shall be documented [RDC ANVISA 16/2013: 2.5.4]. | |
7.9 Verify that the organization documents purchasing information, including where appropriate the requirements for approval of product, procedures, processes, equipment, qualification of personnel, sterilization services, and other quality management system requirements. Confirm that documents and records for purchasing are consistent with traceability requirements where applicable. [ISO 13485:2016: 7.4.2, 7.5.9; RDC ANVISA 16/2013: 2.3.3, 2.5.4, 2.5.5, 6.4; MHLW MO169: 38, 48, 49; 21 CFR 820.50(b), 820.65, 820.160] | |
7.10 Confirm that the verification (inspection or other activities) of purchased products is adequate to ensure specified requirements are met. Confirm that the manufacturer has implemented an appropriate combination of controls applied to the supplier, the specification of purchase requirements, and acceptance verification activities that are commensurate with the risk of the supplied product upon the finished device. Verify that records of verification activities are maintained. [ISO 13485:2016: 4.2.1, 7.1, 7.4.3; TG(MD)R Sch1 P1 2, Sch3 1.4(5)(e); RDC ANVISA 16/2013: 2.4, 2.5.2, 3.35.3.1, 5.3.2, 5.3.3; MHLW MO169: 6, 26, 39; 21 CFR 820.50, 820.80(b)] Brazil (ANVISA): Verify that the manufacturer has established and maintains procedures to ensure the retention of components, raw materials, in-process products and returned products until inspections, tests or other specified verifications have been performed and documented [RDC ANVISA 16/2013: 5.3.3]. | |
7.11 Verify that data from the evaluation of suppliers, verification activities, and purchasing are considered as a source of quality data for input into the Measurement, Analysis and Improvement process. [ISO 13485:2016: 8.4; RDC ANVISA 16/2013: 7.1.1.1; MHLW MO169: 61; 21 CFR 820.100] Link: Measurement, Analysis and Improvement The organization must determine the appropriate acceptance activities for supplied product, based on the essential design outputs of the device and the risk the device poses if specified requirements are not met. Confirm as necessary that supplied product was evaluated as to the effect on the essential design outputs. Additionally, verify that the appropriate acceptance activities were implemented, based on the potential effect the supplied product poses to the essential design outputs. Organizations are required to determine, collect, and analyze appropriate data to demonstrate the ability of suppliers to provide acceptable product. During your audit of the Measurement, Analysis and Improvement process, confirm that analysis of supplier performance data from evaluation and monitoring supplier process activities has been performed and considered for corrective or preventive action when necessary. | |
7.12 Determine, based on the assessment of the overall purchasing, whether management provides the necessary commitment to the purchase process. [ISO 13485:2016: 4.1.3, 4.1.5, 5.2; RDC ANVISA 16/2013: 2.2.1; MHLW MO169: 5, 11] | |