Preparing for ISO 13485 Certification

The International Organization for Standardization has developed more than 17,000 international standards on numerous subjects. For medical device companies, the most important of these standards is ISO 13485, which provides internationally recognized guidelines pertaining to quality management systems (QMS). Certification to ISO 13485 doesn’t necessarily fulfill the requirements of regulatory agencies such as the U.S. Food and Drug Administration (FDA), but it will bring a company’s QMS in line with the FDA’s quality system regulation (QSR) standards.

The benefits of ISO 13485 certification are numerous: increased efficiency, cost savings, more effective risk management and quality assurance, and an improved ability to respond to customer requirements are just a few of the potential results that certification to the standard can bring. There are four key activities that your company can undertake to prepare for ISO 13485 certification and ultimately enjoy such benefits.

1. Identify the basic ISO 13485 requirements and how they apply to your business. Because the needs of medical device manufacturers are as varied as the needs of regulatory agencies, the ISO 13485 guidelines have been written so as to present specific medical device requirements in a generic framework. Therefore, the starting point on the journey toward certification is familiarization with the guideline’s basic requirements and understanding how your company fits into the requirements under that broad structure.

When identifying and determining the applicable ISO guidelines, the company seeking certification bears the following responsibilities in regards to the QMS:

• To identify those processes that are vital to the system
• To determine the appropriate sequences and interactions of such processes
• To determine appropriate criteria and methods, thereby making process effectiveness certain
• To determine the availability of required resources
• To track, gauge, and analyze the processes necessary to reach the intended results
• To ensure that any outsourced activities comply with the standard

To identify appropriate guideline requirements, it may be helpful in some instances to employ the services of a quality system registrar that’s authorized to conduct ISO 13485 compliance audits.

2. Establish quality goals and understand how they can best be incorporated into your business operations. Quality objectives should be outlined and compiled in a quality manual, if such a manual hasn’t already been created. Again, this is another instance where it may be necessary to hire a qualified consultant if no in-house personnel have experience with the development of QMS. A quality policy must be developed that can demonstrate exactly how the ISO 13485 requirements are to be met. The quality policy should be evaluated and the regulatory requirements prioritized to insure that they can be met.

During this process it may also be helpful to identify potential connection points between the quality system and the enterprisewide risk management system.

3. Identify the quality management system’s parameters and develop and implement a fully documented plan. Once the quality system has been reviewed and goals have been set—or once a new quality system is in place—a gap analysis should be conducted to assess the system in comparison with ISO 13485. Once the gap analysis is complete, a comprehensive plan can be developed and put into practice.

In a 2004 article from Medical Product Outsourcing “Implementing ISO 13485:2003,” Rich Basler and Raymond Pizinger state that a dependable plan should delineate specific tasks that need to be completed. The authors highlight several suggested activities to conduct when developing and implementing a viable plan:

• Reformat and edit the quality manual
• Identify specific tasks to address gaps highlighted in the gap analysis
• Create specific procedures that require changes
• Assign tasks their expected completion dates

4. Research and select a certification entity. Registration to ISO 13485 by an accredited registrar proves that a medical device company is demonstrating its commitment to its customers and shows that it’s continually striving to improve quality and efficiency. There are several factors to take into account when choosing a certification body, such as:

• Consider that the registrar must be accredited by an accrediting body and that 13485 certification must be included within the scope of the registrar and the accrediting body.
• Make certain that the registrar’s accrediting entity’s range is geographically appropriate relative to those markets where the device will be sold. For companies intending to sell medical devices in North America, the ANSI/ASQ National Accreditation Board (ANAB) is a prominent example of a suitable accreditation organization.
• Registrars should be able to prove that they have worked with similarly sized organizations in the past and be able to provide an ample number of references and credentials.

ISO 13485 is the principle driving force behind the vision of a common set of global quality requirements for the medical device industry. The ISO 13485 guideline is the underpinning factor in the correlation between quality, overall business performance, and public health and safety in the industry. Companies that achieve ISO 13485 certification enjoy the benefits of an increased amount of customers who have more reason to trust and purchase products of consistent high quality. Developing and implementing a plan to achieve ISO 13485 certification, and choosing the right registrar are the first steps on the road toward superior and compliant quality processes.

This article was published originally in GxP Lifeline, the Master Control e-newsletter.

About The Author