Certifying medical device quality management systems with ISO 13485

This article originally appeared in the April'24 magazine issue of Electronic Specifier Design – see ES's Magazine Archives for more featured publications.

ISO 13485, Medical devices – Quality management systems – Requirements for regulatory purposes, addresses the development, implementation, and maintenance of a quality management system intended for use by medical device manufacturers and suppliers. Originally developed in the 1990s, the revised standard (ISO 13485:2016) was published on 1st March 2016. The standard details requirements for a quality management system that meets both customer requirements and regulations in the UK, European Union (EU), Canada, and other major jurisdictions around the world.  

Although ISO 13485 is similar in scope and intent to ISO 9001, it also includes additional quality management system requirements specifically appropriate to an organisation involved in one or more stages of the medical device life cycle. As a result, ISO 9001 certification is generally not an acceptable substitute for certification to the requirements of ISO 13485. 

Process validation 

ISO 13485 stipulates validation of manufacturing processes for medical devices, where the resulting process output cannot be or is not verified by subsequent monitoring or measurement. This entails activities that are not only limited to the validation of the manufacturing process itself, but may also include equipment qualification, computer system validation, and test method validation. 

When carrying out process validation activities, additional points to consider include statistical sampling plans, process monitoring, validation change control, and good documentation practice. Manufacturers of medical devices should also note that the requirements on process validations are not limited to their own premises but also apply to processes conducted offsite by suppliers.  

Prior to undertaking any validation activities, thorough planning is essential. Validation will include Installation Qualification (IQ) for equipment and machines, as well as Operational Qualification (OQ) and Performance Qualification (PQ) for the manufacturing process. It must be emphasised that additional process and/or product-specific requirements must be considered. This includes but is not limited to sterilisation and sterile packaging processes where PQ also includes challenging of process tolerances and limits. 

Documented procedures describing the approach for process validation are a requirement of ISO 13485. Beyond listing the definitions used, this documentation should describe responsibilities and delineate authorities. The different elements of process validation and the sequence of execution must be clarified, including requirements for re-validation. 

Procedures for process validation should also contain further details regarding testing, training, documentation, review, and approval. 

Manufacturers often choose to develop a Validation Master Plan (VMP) as a tool to control and monitor the status of validation activities. As VMPs are not required by regulations, the content and structure can vary widely. 

Once OQ samples are tested, results are recorded and evaluated thoroughly, including statistical analyses. In most cases, OQ should be successfully completed as a prerequisite before starting Performance Qualification. 

Performance qualification 

To determine the scope, range, and size of the performance qualification (PQ), it is vital to understand the natural process variability and other influences that routine manufacturing may be exposed to. 

The PQ plan should therefore clearly describe how many routine manufacturing runs are required to show repeatability and stability of the processes under consideration. Additionally, sampling plans need statistically sound justifications. Successful completion of the PQ will enable the manufacturer to initiate approval of the new or changed manufacturing process. 

Once the manufacturing process has been validated, it is a requirement to maintain the validated state. This entails monitoring and controlling validated process parameters to ensure that the specified requirements continue to be met.  

The application of statistically sound sampling plans is a requirement of ISO 13485, and manufacturers are responsible fordetermining and justifying them. However, these plans will not replace proper process development or monitoring of critical process parameters. The Global Harmonization Task Force (GHTF) guidance SG3/N99-10:2004 (ed.2) defines process validation as ‘a term used in the medical device industry to indicate that a process has been subject to such scrutiny that the result of the process … can be practically guaranteed’. Technical understanding of the manufacturing processes is therefore key to ensure that the process results ‘can be practically guaranteed’.