Documenting Design Verification Test Results (ISO 9001)

[Shayne]

This is probably a very obvious question, but hopefully someone can point me in the right direction.

My company currently has ISO 13485 certification and we have a particular way of conducting design verification testing (ie have an approved/controlled protocol (using our electronic document control system) which is printed and completed as a hard copy). We are now developing a non-medical device under ISO 9001. Our development team want to reduce the paper trail and not use hardcopies to capture verification test results. They also don't see the requirements of ISO 9001 to be as stringent as ISO 13485. So their new approach is to use an approved/controlled protocol, take an uncontrolled electronic copy, type the outcome/results of the testing into it and then put it into the document control system and have people approve the content.

One of the issues I'm struggling with, is ensuring Good Documentation Practices are being followed with this approach - in particular the ALCOA principle - especially the fact that information is entered contemporaneously and whether it is original. It appears they are documenting a date and typing their name, but then the document is not approved in the document control system for sometime after the tests were supposed to have been completed. And also where normally we would have a signature with the date (for a hard copy), they refer off to their approval in the electronic document control system - which is not, of course, the same date of the test.

I know that ISO 9001 is not directive into how things are to be done and that you just have to have documented records of verification, but something just doesn't quite sit right with me for this approach and was hoping someone could assist with determining if I'm concerned about nothing?

Thanks!

 

[Tagin]

I know that ISO 9001 is not directive into how things are to be done and that you just have to have documented records of verification, but something just doesn't quite sit right with me for this approach and was hoping someone could assist with determining if I'm concerned about nothing?

There seems to be two separate concerns that you have:
1) Compliance with 9001
2) Validity of your records

You are right that 9001 does not explicitly mandate ALCOA. Instead, 9001 is risk-based, so it is up to your organization to determine the risks associated with the methods used to capture this data, store it, approve it, and maintain it as records, etc. If you feel that changing your process to enforce ALCOA is necessary to reduce risks of invalid records, then you can certainly do that. Every organization has to determine their own risk aversion.

If the same development teams were working on both 9001 and 13485 projects, I would be concerned that looser 9001 methods might breed laxity or confusion in the 13485 methods. That in itself would be a risk that would concern me enough to mandate a single method for those records, as a means to ensure consistency for the the more stringent requirements.