Quality Record Retention Time - ISO 9001 vs. CFR 820.180(b)

We are a small company, which coats intraocular lenses. This medical device is sold to a US company. The Company sterilizes the product and sells the product to the customer (eye specialist).For how long time should our company retain the quality record?

[Marc]

Which quality record? You probably have more than 1.

Dear marc,

All the Quality records that are mentioned in ISO 9001

Best regards
Monica

[Marc]

ISO9001 does not specify particular records other than to say you have to identify those records your company believes affect quality. I don't have any FDA regs here nor is it my specialty so I don't know if they give any specific times - But ISO9001 does not specify retention times.

In short, your company should have a list of what it considers 'quality records' and each record must have a designated retention time - which your company also determines. Be ready to discuss why your company chose the retention time for each record.

Does that help?

[Don Winton]

21 CFR 820.180(b) states "All records required by this part shall be retained for a period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution by the manufacturer." If, as stated, you supply product to another party, I would think that, as a minimum, that two years would be required. Be sure to justify by objective evidence the reasoning for this decision. Hope this helps.

Dear Don and Marc,

Thanks for answering my question.

Marc according to ISO 9001, I can come up with the following records that are required:

Management review (4.1.3)
Quality planing (4.2.3 h)
Records of contract review (4.3.4)
Records of design review (4.4.6)
Records of design verification measures (4.4.7)
Quality records of acceptable subcontractors (4.6.2c)
Records for damage, loss of customer supplied products (4.7)
Product identification (4.8)
Records for any qualification of process operations etc (4.9)
Where in coming products is released (4.10.2.3 This may not be required)
Records identifying the inspection authority responsible for the release of produc(4.10.5)
Records regarding the extent and frequency of control of inspection (4.11.1)
Calibration records (4.11.2 e)
Record for the description of the nonconformity etc (4.13.2)
Investigation records (4.14.2)
Records of internal audits (4.17)
Training records (4.18)

Did I do my math well?

[Marc]

Pretty much so - looks like a fine list to me - But there *may* be other records in your company.

When I work with a company in compliance one of the first things I do is ask them to take a DETAILED tour of the company at large and make a list of all the paperwork they find taking a copy of each as it is found.

Then comes categorizing and matrixing the documents. The intent is a 'discovery' of all the types of documents in the company.

So in short - yoiur list may serve as a minimum (ISO9001 wise) but does not preclude others.

[Don Winton]

Monica,

Marc is very correct. Your list is complete as far as ISO 900x is concerned. But, the QSR is more stringent than ISO in some areas. It should be prudent to review the QSR, cross tab to ISO and tailor your system to that. The system in place at my firm incorporates the most comprehensive clauses from each (covered on both bases).

As an addendum to my previous post. I do not know the details of your firm's business. The records required shall be for the life of the device but in no case less than two years. Under the assumption you supply a customer (as a vendor) and not an end user, two years should be sufficient. I have *.pdf and *.doc of many publications from the CDRH, if you would like copies, please me know.

Don