Quality Management & ISO 13485

ISO 13485 is a harmonized standard that formulates requirements for Quality Management (QM) or QM systems (QMS) of medical device manufacturers.

These manufacturers can use ISO 13485 to prove that they meet the MDR and IVDR legal requirements for a QM system. Even the FDA references ISO 13485 in its Quality System Management Regulations (21 CFR part 820).

1. Articles on the basics

a) FAQ on quality management and ISO 13485

The FAQ on quality management systems and ISO 13485 is a valuable introduction and answers the following questions, among others:

• Who needs a QM system?
• Does the QM system have to meet the requirements of ISO 13485 or ISO 9001?
• In which cases must the QM system be certified according to ISO 13485?
• What do you have to do to obtain ISO 13485 certification?
• How long does ISO 13485 certification take, and how much does it cost?
• What is the path to ISO 13485 certification?

b) Standards

There are many standards and versions defining requirements for quality management:

• ISO 9001:2015 – Delta to ISO 13485:2016
• Update ISO 13485: The new 2021 version is here
• ISO 14969 or ISO 13485: Which standard do your auditors benefit from

c) QM manual

In contrast to ISO 9001, ISO 13485 requires organizations to have a QM manual. This manual must describe the quality objectives and quality policy.

The Quality Management Representative (QMR) usually maintains this manual.

2. Articles on standard operating procedures

a) General

ISO 13485 requires you to describe your processes and procedures. This is usually done with the help of standard operating procedures and work instructions, which, in turn, reference other specification documents such as templates, forms and checklists.

This article provides you with an overview of the necessary standard operating procedures. When writing these standard operating procedures, it is advisable to choose a risk-based approach.

Another article describes the differences between process orientation and process management.

b) Specific standard operating procedures

You will find further articles on specific standard operating procedures:

• Document control, document release, and retention periods
• Management review
• Corrective action and preventive action
• Handling measurement devices
• Control of suppliers, e.g., with Quality Assurance Agreements (QAA). Dealing with development service providers must also be regulated.
• Vigilance
• Post-market surveillance

c) Validation of procedures, processes, and tools

ISO 13485 insists on the validation of processes and tools. Please refer to the following articles:

• Process validation: Definition & example – What to look out for
• Computerized Systems Validation (CSV)
• ISO 80002-2: Validation of process software
• AAMI TIR 36: Validation of process software
• Tool validation in the development of medical devices

3. Articles on audits

The effectiveness of the QM system is checked as part of external audits by notified bodies and internal audits. The internal auditors are responsible for the latter.

Part of these audits must also include supplier audits. Furthermore, notified bodies are obliged to carry out unannounced manufacturer audits.

At least for the external audits, there are specifications regarding the audit duration. The Medical Device Single Audit Program (MDSAP) also determines requirements for the duration and subject matter of the audits. This enables manufacturers to prove that they meet the regulatory requirements for the QM system in many countries (EU, FDA, Australia, Japan, Brazil).

4. Articles on further topics

The following articles are also relevant for organizations that develop medical devices:

• Dealing with critical parts / devices / components
• Differences between design review and design review