Certifying medical device quality management systems

Perhaps more than any other type of manufactured product, the quality of medical devices has a direct impact on their effectiveness and the safety of patients and users. For these reasons, most national regulatory schemes require manufacturers and medical device suppliers to establish an internal, independently audited, and verified quality management system (QMS). Medical devices manufactured or supplied by organizations without a verified QMS are routinely denied legal entry into major markets, usually resulting in extended delays in gaining access and lost revenue opportunities.

ISO 13485 for medical devices

ISO 13485 addresses the development, implementation, and maintenance of a QMS intended for use by medical device manufacturers and suppliers. Originally developed in the 1990s, the revised standard (ISO 13485:2016) was published on March 1, 2016. It details requirements for a QMS meeting both customer requirements and regulations in the European Union (EU), Canada, and other major jurisdictions around the world.

Although ISO 13485 is similar in scope and intent to ISO 9001, it also includes additional QMS requirements specifically appropriate to an organization involved in one or more stages of the medical device life cycle. As a result, ISO 9001 certification is generally not an acceptable substitute for certification to the requirements of ISO 13485.

In the European Union (EU), the requirements of ISO 13485 have been harmonized with the essential requirements of the EU Medical Device Regulation (EU MDR) and In-Vitro Diagnostic Medical Device Regulation. Certification to ISO 13485 by an accredited certification body provides a presumption of conformity with the essential requirements of these important directives.

In the U.S., the Food and Drug Administration (FDA) permits device manufacturers to submit ISO 13485 audit reports as a substitute of the evidence of compliance with its quality systems regulations (QSR). Health Canada also requires medical device manufacturers marketing their products in Canada have their quality management system certified to ISO 13485.

Process validation

ISO 13485 stipulates validation of manufacturing processes for medical devices, where the resulting process output can’t be verified by subsequent monitoring or measurement. This entails activities such as validation of the manufacturing process, equipment qualification, computer system validation, and test method validation.

When carrying out process validation activities, additional points to consider include statistical sampling plans, process monitoring, validation change control, and good documentation practice. Manufacturers of medical devices should also note the requirements on process validations aren’t limited to their own premises but also apply to processes conducted offsite by suppliers.

Prior to undertaking any validation activities, thorough planning is essential. Validation will include installation qualification (IQ) for equipment and machines, as well as operational qualification (OQ) and performance qualification (PQ) for the manufacturing process. It must be emphasized that additional process- and/or product-specific requirements must be considered. This includes sterilization and sterile packaging processes where PQ also includes challenging process tolerances and limits.

Documented procedures describing the approach for process validation are a requirement of ISO 13485. Beyond listing the definitions used, this documentation should describe responsibilities and delineate authorities. The different elements of process validation and the sequence of execution must be clarified, including requirements for re-validation.

Procedures for process validation should also contain further details regarding testing, training, documentation, review, and approval.

Manufacturers often choose to develop a Validation Master Plan (VMP) as a tool to control and monitor the status of validation activities. As VMPs aren’t required by regulations, content and structure can vary widely.

Equipment qualification

Equipment qualification (EQ) adds value for manufacturers by helping to prevent future issues. When done properly, it ensures equipment operates in a reliable and predictable manner.

All equipment and machines used in the manufacturing process of medical devices require EQ. It supports manufacturers in properly establishing key areas of operation such as maintenance plans, calibration tolerances, and intervals, as well as cleaning or microbiological procedures.

Recommendations or instructions from third-party equipment suppliers are an essential source of information and must be considered during installation activities. Applicable support systems and utilities must also be verified and completed during installation.

Functional testing of the equipment, including alarm and control systems, must also be carried out. Furthermore, operating instructions for the equipment and training documentation needs to be prepared accordingly. Any documentation such as manuals, drawings, or codes needed to operate, maintain, or repair the equipment should be compiled and retained for future use. Validation provides objective evidence that computerized systems and software tools are suitable for their intended purpose.

Operational qualification

An OQ is usually accomplished in two main steps:

1. Identification of critical process parameters

2. Provision of evidence that production at worst-case settings will still result in a product that meets specifications

Once OQ samples are tested, results are recorded and evaluated thoroughly, including statistical analyses.

Performance qualification

To determine the scope, range, and size of the PQ, it’s vital to understand the natural process variability and other influences that routine manufacturing may be exposed to.

The PQ plan should clearly describe how many routine manufacturing runs are required to show repeatability and stability of the processes under consideration. Additionally, sampling plans need statistically sound justifications. Successful completion of the PQ will enable the manufacturer to initiate approval of the new or changed manufacturing process.

Once the manufacturing process has been validated, it’s a requirement to maintain the validated state. This entails monitoring and controlling validated process parameters to ensure that the specified requirements continue to be met.

The application of statistically sound sampling plans is a requirement of ISO 13485, and manufacturers are responsible for determining and justifying them. However, these plans won't replace proper process development or monitoring of critical process parameters. The Global Harmonization Task Force (GHTF) defines process validation as ‘a term used in the medical device industry to indicate that a process has been subject to such scrutiny that the result of the process … can be practically guaranteed.’ Technical understanding of the manufacturing processes is therefore key to ensure that the process results ‘can be practically guaranteed.’

About the author: David Goodfellow is the UK business assurance manager for TÜV SUD.

TÜV SUD
https://www.tuvsud.com/en-us