Don't Risk It! ISO 13485:2016 and How to Determine Compliance Level
Total Page:16
File Type:pdf, Size:1020Kb
Don’t Risk It! ISO 13485:2016 and How to Determine Compliance Level August 18, 2016 John Beasley, RAC(US) MedTech Review, LLC Thought of the Day: “Act after having made assessments. The one who first knows the measure of far and near wins.” - Sun Tzu, The Art of War 2 Today’s Topics • Overview of changes in ISO 13485, 3rd Edition – Risk management – Usability – Outsourced processes • Supplier evaluation – determining LSP level of compliance • Concluding remarks • Q&A ISO 13485:2016 1 Overview of Changes in the 3rd Edition History of ISO 13485 13485 13485 13485 9001 9001 9001 1994 / 2000 / 2003 2015 / 1996 2008 / 2009 2016 5 Publication History 1996 - Publication of standards ISO 13485 and ISO 13488. • 13485 variant intended for manufacturers responsible for design, manufacture and distribution of devices. • 13488 variant intended for manufacturers not responsible for designing devices. Variants must be used with ISO 9001:1994 and ISO 9002:1994 as applicable. 2003 - Publication of 2nd edition ISO 13485:2003. Considered to be “stand alone”. ISO 13488 now obsolete. Organizations that previously used 13488 must now use 13485 but can exclude section 7.3 “design and development” if allowed by regulations. Device specific requirements that do not apply to the manufacturer are tagged as “not applicable”. 6 Publication History 2004 - Publication of guidance document ISO/TR 14969. Its purpose is to provide a single source of guidance on the interpretation and implementation of 13485. 2009 - Corrigendum to 13485:2003 published to change reference from ISO 9001:2000 to ISO 9001:2008. 2012 - CEN (European standards organization) publishes EN ISO 13485:2012 as the European adoption of ISO 13485:2003 (2009 corrigendum). 7 Publication History Oct 2015 - Publication of ISO FDIS 13485 (2016) for 2 month international vote to accept or reject. Mar 2016 - Publication of 3rd Edition; ISO 13585:2016. 8 Why Was ISO 13485:2003 Amended? Four general principles guided revision process. i) Develop requirements that are unambiguous and that will allow for objective and consistent assessment by regulatory bodies and auditing organizations. ii) Ensure requirements are compatible with existing ISO and regulatory quality management system requirements like ISO 9001:2008 and the US quality system regulations. iii) Requirements relate to the life-cycle of a device. iv) Requirements could be used by suppliers to the device manufacturer. 9 ISO 13485:2016 2 Risk Management Risk Management • ISO Guide 73:2009 • ISO 31000:2009 • ISO 14971:2007 • EN ISO 14971:2012 11 Risk Management Area of interest: Risk management (All sections) What’s new: • “Risk” and “risk management” (RM) now defined in section 3. Taken from ISO 14971:2007. • RM practices extended to other processes of the quality management system not just product realization. • Organization now expected to apply a “risk” based approach to the control of QMS processes (e.g. purchasing, validation of software used in the QMS, verification of purchased product etc.) • Based on GHTF SG3 N15 R8 Implementation of risk management principles and activities within a Quality Management System 12 The new requirements and how to implement them… How to implement : • In the context of a medical device, “Risk” is defined as the combination of the probability of occurrence of harm and the severity of that harm • “Risk management” is defined as the systematic application of management policies, procedures, and practices to the tasks of analyzing, evaluating, controlling and monitoring risk 13 The new requirements and how to implement them… How to implement : When the term “risk” is used in the standard, it is meant to relate to two things: 1) the safety and performance of the organization’s medical devices, and 2) the device or organization’s ability to meet regulatory requirements The organization is expected to take appropriate action that is based on the risks that have been identified and controlled 14 The new requirements and how to implement them… How to implement : Obvious applications of “Risk” based thinking – Organization has documented process for risk management in product realization. (ISO 14971:2007) – Applicable outputs of Risk Management process used as inputs to Design and Development of a device – The type and extent of control applied to an outsourced process is proportionate to the risk(s) (to device or organization) involved with the process – Criteria used to evaluate and select suppliers are proportionate to the risk associated with the medical device 15 The new requirements and how to implement them… How to implement : Not so obvious applications of “Risk” based thinking – Personnel performing work affecting product quality must have the appropriate education, training, skills and experience (Section 6.2) – Method used to check the effectiveness of the training of personnel performing work that affects product quality, is proportionate to the risk associated with the work being performed (Note to Section 6.2) 16 ISO 13485:2016 3 Usability The new requirements and how to implement them… Area of interest: Design & development input / Usability (Section 7.3.3 a)) What’s new: • A new “product requirement input” in the R & D process is the consideration of device usability according to the device’s intended use (along with functional, performance and safety requirements) • The user is instructed to consult the most recent version of IEC 62366-1 Medical devices – Part 1: Application of usability engineering to medical devices for guidance and information on usability 18 The new requirements and how to implement them… How to implement : 19 20 ISO 13485:2016 4 Outsourced Processes Clause: 4 Quality management system 4.1 General requirements 4.1.5 Outsourcing • monitor and control any outsourced process that affects product conformity with requirements and this control to be proportionate to the risk involved and the ability of the external party to meet requirements. • Control includes a written quality agreement • ISO 13485:2003 relied on the ISO/TC176 SC 2 guidance document N630R2 (2003) “ISO 9000 Introduction and Support Package: Guidance on ‘Outsourced Processes’” to provide an understanding of what an “outsourced process” is. • ISO 13485:2016 still relies on this interpretation but…ISO 9000:20015 (new vocabulary document) now defines “outsource” as “make an arrangement where an external organization performs part of an organization’s function or process” 22 5 LSP - Determining Compliance Level Life Sciences Translation Quality Compliance Quality Certifications Language Quality Frameworks • Proactive front-end approach to avoid back-end vortex and • ISO 9001:2009 • SAE J2450 • TAUS DQF (Dynamic Quality clock resetting • ISO 17100:2015 Framework) • LQA strategy supersedes EN 15038 • TQM (Total Quality • KPIs Service Level • ISO 13485:2003 for Management) Agreements • Taus DQF (Dynamic Quality medical devices • Sampling Framework) • DFKI’s Multidimensional Quality • QA results monitored and Metrics (MQM) analysed • Regular feedback to translation teams 24 Q&A.