by Josée Adam

If the thought of adapting your quality management system to meet every nation’s individual code of regulations scares you, it shouldn’t. Since ISO Technical Committee 210 launched the ISO 13485:2003 standard, getting your medical devices to customers without jumping through numerous time-consuming regulatory hoops has become more possible than ever before.

ISO 13485:2003 Medical devices--Quality management systems--Requirements for regulatory purposes was written for organizations that design, develop, produce, install or service medical devices. It’s intended to promote global harmonization for medical devices and set a basis for quality system regulations worldwide.

The standard’s practical benefits include reducing barriers between international manufacturers and customers. Moreover, increased competition between medical device manufacturers could well lead to higher quality, lower prices and greater availability in developing countries.

ISO 13485:2003 is the single standard for all classes of medical devices. Its scope includes design and manufacture, but where regulatory requirements permit, design and development controls can be excluded from a company’s management system.

Whether it’s called CAN/CSA-ISO 13485:2003 in Canada, EN ISO 13485:2003 in the European Union or another ISO-copyrighted name elsewhere, it’s the same standard. It replaces ISO 13485:1996 and ISO 13488:1996, standards currently used within the medical device industry.

ISO 13485/88:1996 was used in conjunction with ISO 9001/2:1994. The revised standard is aligned with ISO 9001:2000 and includes process management principles. Because many components of ISO 9001 are excluded from ISO 13485:2003, management can’t claim ISO 9001:2000 registration unless it seeks this QMS certification separately.

Convergence of regulation

The Global Harmonization Task Force, a committee of medical device manufacturing representatives and governmental regulation bodies, convened in 1992 to consider how to converge regulatory practices. To this end, the GHTF worked with ISO TC 210 to facilitate the convergence and assist international trade.

ISO 13485:2003 is the successful result of ISO TC 210 teamwork. Representatives from 29 countries participated in the process to develop the revised standard.

Although the U.S. Food and Drug Administration maintains its independent quality system regulations, it recognizes the importance of maintaining consistency with ISO 13485 requirements. Accordingly, the FDA has changed regulations in response to comments received from those in the industry.

Because the two systems are closely related, medical device manufacturers can develop a quality management system that blends FDA requirements with ISO 13485:2003.

In Canada, ISO 13485/88 was adopted in 1998. The Canadian Medical Devices Conformity Assessment System required medical device manufacturers to conform to ISO 13485/88 by Nov. 1, 2003, although not all suppliers were able to make this date.

Because of administrative restrictions, Health Canada demands compliance with ISO 13485:2003 by March 14, 2006, four months ahead of ISO’s deadline. Most medical device manufacturers selling to Canada are expected to quickly convert to ISO 13485:2003.

In the European Union, EN ISO 13485:2003 will gradually replace the EN ISO 13485/88:2000 standards. Medical devices sold in the European Union must bear the CE Mark in conformity with the Medical Device Directives.

The EU adopted ISO 13485 as a harmonized standard for quality system requirements, replacing the European standard EN 46001.

Customer satisfaction not included

One component of ISO 9001:2000 excluded from ISO 13485:2003 is customer satisfaction, which ISO TC 210 decided is inappropriate for medical devices. Customer satisfaction is subjective, not always placing device safety and efficiency above other factors, including price, convenience or availability.

ISO 13485:2003 demands that manufacturers specify requirements for all aspects of the product, including delivery and post-delivery activities, requirements necessary for the device’s intended use, and statutory and regulatory requirements.

Continuous improvement excluded

Continuous improvement is another component of ISO 9001 missing from ISO 13485:2003. Instead, companies monitor their QMSs regularly to determine whether they maintain effectiveness. Consistent with regulations around the world, this component is intended to ensure the QMS’s effectiveness and its ability to produce safe and effective products consistently.

Registration to ISO 13485 means that a third-party registrar recognizes that the company consistently designs, produces, installs or services the product in accordance with documented procedures. Now, registrars are obligated to judge effectiveness of the company’s QMS in meeting criteria for the operation and control of the various processes as well.

ISO 13485:2003 mandates 18 documented procedures in specific areas. These areas include control of documents, control of records, design and development, purchasing, validation of computer software, validation of sterilization processes, identification, traceability, preservation of product, control of monitoring and measuring devices, feedback system, internal audits, control of nonconforming product, analysis of data, issue of advisory notice/adverse event reporting, corrective action and preventive action.

These documentation requirements mirror the demands of most regulators.

Risk management

ISO 13485:2003 specifically notes and refers to ISO 14971:2000 for guidance regarding risk management.

ISO 14971 distinguishes the manufacturer’s management commitment as critical for an effective risk-management process. In particular, ISO 14971 demands that management identify and use individuals trained in risk-management techniques.

The personnel hired to perform these tasks should have knowledge of how the device is constructed, how the device works, what its intended use will be and how to apply the risk management process.

Manufacturers must analyze risk, evaluate probability for failure, make all possible attempts to control risk and then evaluate residual risks throughout the product life cycle. If a risk is identified during the design phase of a class III medical device, for example, it might be managed through actions taken at theproduction phase later in the cycle.

A risk can be identified during the production phase of a class I medical device and managed through actions taken during the post-production phase, once the product is on the market.

Risk management doesn’t stop when the device goes into production, either. Manufacturers must monitor post-market information for events that might affect risk-management decisions. In this way, risk management becomes a closed-loop process.

Process approach paves the road

The process approach works because it’s easier to manage processes than elements of a quality system. A QMS ensures products are designed and manufactured in a consistent manner. Because some manufacturers might be unfamiliar with the process approach identified in ISO 9001:2000, a gap analysis might be a beneficial first step.

Imagine yourself outside the world of ISO 13485, ISO 9001 and all other regulations. Adopt the process approach, and you add value to the organization. In almost all cases, it also improves the product’s quality. Simply put, the process approach is popular because it’s successful.

By examining processes, manufacturers can identify deficiencies that lead to medical device failure. ISO 13485:2003 can serve as a model for government regulators developing QMS requirements for medical devices. This means that in any country in the world, you’re in perfect harmony.

Trudell Medical International, based in London, Ontario, designs, develops, manufactures and distributes aerosol drug-delivery products around the world. Previously registered to ISO 9001:1994, the company chose to upgrade to ISO 13485:1996 to satisfy customer demands and government regulations.

According to John Straatman, director of quality assurance for Trudell, the company has already adopted the process format and its QMS is fully prepared to upgrade to ISO 13485:2003 well before the deadline.

“The process approach doesn’t break the system into 20 separate elements because one process flows into every other process to enhance the entire quality system,” explains Straatman. “All employees, from engineers, to technologists to the people building the product on the assembly line, are aware of the benefits of our QMS.”

Customers also expressed pleasure with the QMS, Straatman notes, after auditing the company. “Our QMS integrates ISO 13485, FDA quality system regulations, Canadian Medical Devices Regulations and the European Medical Device Directive.”

Not required but adds value

Regulations might not always require registration to ISO 13485. Just as manufacturers selling class I medical devices in Canada choose to register their QMSs on a voluntary basis, so too do distributors of class I, II, III and IV medical devices. But although the standard might be voluntary in these cases, it’s universal. These companies can work in harmony with customers across the planet.

Sometimes, the client demands ISO 13485 registration. In other cases, medical device companies seek new business opportunities and pursue the benefits of registration before attempting to penetrate a market. Customers often rely on ISO standard registration as a qualifier when choosing a supplier.

When comparing potential suppliers, customers commonly analyze medical device products for price, reliability and quality--not necessarily in this order. ISO 13485:2003 registration, especially voluntary registration, clearly identifies a QMS focused on quality.

Smith & Nephew, a multinational corporation that develops and markets medical devices, implemented ISO 13488 because it facilitates communication among its three divisions and customers, according to Janine Lepage, the company’s technical director in Montreal.

“It’s a regulatory requirement in Canada and now in Europe, but registration to this standard also allows us to set common objectives and speak the same language as importers,” says Lepage. “Customers may not always know we’re registered to ISO 13488, but when we tell customers we’re ISO-registered, they have a positive reaction.”

The company’s orthopedics, wound management and endoscopy divisions had been registered to the ISO 9001:1994 standard, and therefore a migration to ISO 13488 caused few problems for its QMS.

The future of multinational trade

ISO 13485:2003 is destined to serve as a catalyst for multinational trade. Although it’s not the only regulatory hurdle, ISO 13485:2003 does improve the chances for any medical device provider, from any country, to successfully compete for a share in the global market.

According to the Advanced Medical Technology Association, the medical device industry grows at a 7 percent annual rate and will reach $314 billion by 2010. Clearly, a strategic investment in ISO 13485:2003 registration is well worth the tangible benefits of a $314 billion market.

About the author

Josée Adam, internal sector expert on medical devices for QMI, a division of the CSA group, is a professional engineer and National Quality Institute-certified lead auditor with more than 10 years of experience as a quality systems auditor. She has audited medical device manufacturers to the ISO 9001:1994, ISO 9001:2000, ISO 13485/8:1996 and ISO 13485:2003 standards. Adam acts as QMI’s representative on Health Canada Registrars’ Forums and CSA Canadian Advisory Committee to ISO TC 210.