Has anyone had experience in moving from multiple single-site certifications to a single multi-site certification with ISO 13485? My company is in the process of consolidating 10+ single certificates into 1 multiple-site certificate, but I need some feedback from others who have completed this process.

1. Did your NB require a re-audit of each site prior to adding to your multiple site certificate?

2. Do you certify your EU sales offices?

3. As all of our sites are currently certified, our plan is to allow them to continue to run their QMS systems as they are with the exception of requiring documented reporting to Corporate of internal audits, CAPAs, complaints, and mgmt rvw. We have corporate wide stds, which are general enough in nature to allow each site to tailor to their needs, but are we missing other important items?

4. Do each of your sites maintain their own quality manual or do you have an overall corporate quality manual covering all sites? We will have an overall corporate manual, but have not decided if each site will keep their own manuals.

Thank you for your feedback,

Greg

Has anyone experienced this?

I have only had multi-site certifications for ISO9001 and AS9100.

The general idea with multi-site certification is that all site are governed by the same quality system. How would a NB otherwise be able to provide a multi-site certificate without auditing all the sites. I can not tell from your question if your general corporate QS documents are specific enough in their requirements to meet the multi-site QS requirement. If each site has their own quality manual it becomes highly doubtfull that you will meet the single QS requirement.
The other requirement is that all sites are managed by the same general management, which you seem to have in place.

The general idea with multi-site certification is that all site are governed by the same quality system. How would a NB otherwise be able to provide a multi-site certificate without auditing all the sites.

I didn't know there is such a thing as a multi-site certification for which some of the sites are not audited. How could the NB, or anyone relying on the certificate, be certain that all of the sites were compliant? Does this approach rely on a sampling concept?

Yes you can have a multi-site certificate. The benifit for a company is that not all their sites need to be audited. The NB will sample the sites. See IAF GD 2:2005 Guidance on the Application of Guide 62:1996 (http://www.compad.com.au/cms/iaf/workstation/upFiles/549378.IAF-GD2-2005_Guide_62_Issue_4_Pub.pdf) annex 3

See IAF GD 2:2005 Guidance on the Application of Guide 62:1996 (http://www.compad.com.au/cms/iaf/workstation/upFiles/549378.IAF-GD2-2005_Guide_62_Issue_4_Pub.pdf) annex 3That document is almost obsolete, now.

See IAF MD 1:2007 Certification of Multiple Sites Based on Sampling
(http://www.compad.com.au/cms/iaf/workstation/upFiles/372197.IAF-MD1-2007_Certification_of_Multiple_Sites_Issue1v2Pub4.pdf)(Issue 1, version 2, issued on 20 November 2007; Application from 15 September 2008)
This document is mandatory for the consistent application of Clause 9.1.5. of ISO/IEC 17021:2006 and is based upon guidance previously provided in IAF GD2: 2005 Annex 3 and IAF GD6:2006, clause G.5.3.5 - G.5.3.13. All clauses of ISO/IEC 17021:2006 continue to apply and this document does not supersede any of the requirements in that standard. This mandatory document is not intended exclusively for Quality Management Systems (QMS) and Environmental Management Systems (EMS) and may be used for other management systems. However, relevant standards may provide specific requirements for multiple sites or preclude the use of sampling (eg. ISO/IEC 27006, ISO/TS 22003).

Keep in mind that certain sector schemes don't allow for sampling of sites. For example, the IATF does not allow sampling during TS-16949 certification audits, and the IAQG does not allow for sampling of AS/EN 9100 and 9110 audits.

An AB might prohibit sampling related to ISO 13485 certification audits.

It'll be interesting to see how the FDA (which AFAIK does not utilize a sampling approach in either QSIT or for-cause inspection prioritization) will react to a request for recognition of an ISO 13485 audit report under the long-discussed and supposedly still-upcoming inspection-recognition program, if the establishment in question is multi-site and the NB utilized a sampling approach.

Thanks to everyone who has responded.

Let me clarify my question on multiple sites...Each of our sites currently gets audited every year based upon their own certificate, so we are simply trying to consolidate these many certificates into one single multiple-site certficate. Our NB stated they would need to re-audit each location prior to adding them to a multiple-site certificate even if they had already audited that site during the current year. Keep in mind, that no significant changes are being made at the sites as the QMS is already set up a global process (i.e. the system consists of standards required for each site in accordance with the requirements of 13485).

For example, a German facility gets audited say in January in support of their individual site certificate. In August, we want to add Germany to a new multiple site certificate and remove their individual cert. Our NB stated that they would need to return to Germany to cover this portion with that location before they could add them to the certificate even if no significant changes had occurred. This appears to be over-kill (or "over-charge") in my opinion.

Our NB stated they would need to re-audit each location prior to adding them to a multiple-site certificate even if they had already audited that site during the current year. Do you want to know the magic words? *

"I think we will have to put this out for competitive bidding, then...."

Back tracking is faster than count Dracula towards his casket, at the first sight of dawn....Try it. And give us feedback....
*Just make sure that you talk to someone high enough in the organization, and not just a sales person, whom might see this as a chance for another quote....In other words, make sure you talk to someone who would be concerned with the loss of your business.

My basic advice on this is don't do it for the financial savings. There may be some, but they will generally be minor in the scheme of things. Do what makes most sense for your business, and if you save some money at the corporate level, that's a nice bonus.

I deal with a few companies that have a multi-site ISO13485 certificate. The main site is typically the Corporate HQ, that does regulatory, sales, marketing etc.
There are usually then one or two manufacturing facilities described on the certificate.

All sites have to be covered by a single top-level quality system, covering things like management review, document control etc, even if certain other individual processes, and the procedures to control those processes are very different from site to site.

The audit time at the manufacturing facilities will typically be reduced if there is sufficient overlap of procedures/processes to justify that.


In terms of sampling of sites, that's pretty rare. The only example I can think of is a company that has an HQ, one or two manufacturing facilities, and about 30 sales offices, all in the same country, all doing the same simple thing. We don't audit every sales office every year, I don't know the sampling regime.


I can't comment on the need to do re-audits of everywhere, that certainly sounds excessive, but I can think of some situations where that might be the case. You should certainly consider getting a more detailed explanation from your Notified Body as to why that might be required.

Hi,
Currently we are in the process of consolidating our manufacturing and corporate site to one address. Our manufacturing site currently has ISO 13485 and it needs to be transferred to the our corporate address where we are consolidating all operations. The QMS will be the same. I would apprecaite if anyone has similar experiances and would be thankful in knowing procedures. Also since the QMS is same would it need a separte audit/special audit.

Thanks

Hi,
Currently we are in the process of consolidating our manufacturing and corporate site to one address. Our manufacturing site currently has ISO 13485 and it needs to be transferred to the our corporate address where we are consolidating all operations. The QMS will be the same. I would apprecaite if anyone has similar experiances and would be thankful in knowing procedures. Also since the QMS is same would it need a separte audit/special audit.

Thanks

Hi Biomargam, welcome to the Cove.

You need to talk to your Registrar. For myself, I have all sorts of questions, you haven't given me enough information.

You didn't state whether the HQ is also moving (I assume not).
You didn't state whether the HQ also holds ISO13485 already (it sounds like it does)

In terms of whether a re-audit is required after a manufacturing facility move, my default answer is "Yes, unless you can justify why one wouldn't be absolutely necessary".

For example, if you have ten people doing a simple manual assembly operation, it may not be a big deal if there is a relocation. The Registrar may decide to follow up at the next audit, if it is due within the next six months anyway.

But if you have to commission a new cleanroom, revalidate the automated assembly equipment, train new employees etc, it's a whole different discussion.

Hi Roland,
Thanks for the information. When we got the certification done initially, we were located at the same place where the current manufacturing is and later we moved only admin and management to new location. Since 13485 was for manufacturing facility it was not considered during surveillance. However, from operational perspective we find it easier to consolidate under one address and so we are planning for the move. The manufacturing facility consists of a clean room and so it is definitely re certification of clean room at the new address. In this case from your reply I presume, we have to go through an audit. Appreciate knowing if this would be considered as fresh audit as we are still within the 3 year period of 1st certification.

Thanks

Well again, there is a difference between an out-of-sequence surveillance audit, and a complete re-audit (i.e. full-scale initial audit). The latter is rarely required.

What might make sense to both sides is to conduct an early re-certification audit. Talk things over with your Registrar, and let us know how you get on. :)