A Question of Sorts - Why register to both ISO 13485:2003 and ISO 9001

[Pataha]

I was looking at press releases and discovered several Medical Device companies stating that the were ISO 13485:2003 and ISO 9001 certified. Why would they need the ISO 9001 certification? If it is unnecssary, couldn't they save money by just being ISO 13485:2003 certified?

 

[Jen Kirley]

I was looking at press releases and discovered several Medical Device companies stating that the were ISO 13485:2003 and ISO 9001 certified. Why would they need the ISO 9001 certification? If it is unnecssary, couldn't they save money by just being ISO 13485:2003 certified?

I found a reference comparing the two: (broken link removed)

Perhaps in addition to the regulatory focus, the medical device companies also want to show their compliance with the continuous improvement and customer satisfaction that ISO 9001:2000 includes.

They have two sets of different customers and demands, you see: regulators and buyers.

 

[Al Rosen]

I was looking at press releases and discovered several Medical Device companies stating that the were ISO 13485:2003 and ISO 9001 certified. Why would they need the ISO 9001 certification? If it is unnecssary, couldn't they save money by just being ISO 13485:2003 certified?

It doesn't cost us extra. We are assesed to both standards at the same time.

 

[DannyK]

ISO 13485:2003 & 9001:2000

It could be that the company produces/sells medical devices and other products and wants the whole company to be registered.

Danny

 

[Aaron Lupo]

It could be that the company produces/sells medical devices and other products and wants the whole company to be registered.

Danny

That is exactly why they do it. There are a number of Medical device companies that also manufacture non-medical products. As Al stated you can be assessed for them both at the same time so any extra cost would be minimal.

 

[Carl Keller]

They do it because ISO and the registrars are in cahoots to sqeeze every last dime out of you that they can, therefore, they made the two just different enough that most med device companies need both.

If they are honest, they do both at the same time and reduce the cost as suggested by Al Rosen (BTW Al, are they not charging you the certificate fee for the 9001 cert? and for the added hours to look at your continuous improvement and customer satisfaction documents?)

At least some are not honest and have two different audits and charge seperately for each.

ISO and the registrars could have just as easily added the 9001 elements to 13485 to make it easier on everyone, but that would not make them as much money, now would it?

Carl-

 

[Al Rosen]

BTW Al, are they not charging you the certificate fee for the 9001 cert? and for the added hours to look at your continuous improvement and customer satisfaction documents?

Not as far as I can tell. I was reassesed recently to ISO 9001 and upgraded from ISO 13485:1996 to ISO 13485:2003 including CMDCAS. This included a complete document review plus two auditors for three days for approx 250 employees and yearly surveillance visits of one auditor for three days. There is also an annual fee for the Notified Body located in Europe.

 

[Sidney Vianna]

ISO and the registrars could have just as easily added the 9001 elements to 13485 to make it easier on everyone, but that would not make them as much money, now would it?Carl-

Would you care to elaborate? ISO 13485:2003 is based on ISO 9001:2000 and was developed by ISO TC 210, not registrars. ISO does not exist in a vacuum; they develop and promote standards that Industry is willing to support.

 

[RegistrarGirl]

Sidney is completly correct, as usual. ISO doesn't allow ISO 9001:2000 to be printed on a certificate in tandem with ISO 13485:2003 and many companies do not manufacture medical device products only. Most supply to a variety of customers and not all customers even know that 13485:2003 is based upon 9001:2000. So, these companies generally want certificates for both standards to satisfy both types of customers. For example, with TS16949:2002 the automotive standard, the IATF which oversees TS certification bodies does not allow the TS mandays to be used to provide a 9001:2000 certificate, the audit days must be separated. Basically, registrars are just trying to provide options for clients, since they are all different and have different needs. It is up to each individual company to decide what certifications they need to have (what their own customers expect of them), Registrars don't make those decisions for any of their clients, they just offer the choices.

 

[rose24m03]

ISO 9001 vs ISO 13485

If you are in medical devices, use ISO 13485 (since it is required for EU and Canada, plus other countries recognizing it). There's no point in paying to maintain 2 certificates.

If you are not in device industry, then use ISO 9001, since ISO 13485 does not apply to you.

However, Contract Manufacturer for medical device products/components/sub-assemblies is a different story. Check with your customer(s) and find out what their expectations are from you. Usually they would prefer that their contract manufacturers are certified to ISO 13485, as we do with our contract manufacturers.

ISO 9001 requires continual improvement and customer satisfaction. Like Microsoft products, most device products that have software components usually have patches released later on to either fix something that was flawed in initial product release or enhance some functions/features that were there initially but weren't perfect. With this in mind, the customer satisfaction might be hard go gauge for device companies. All those software patches would lead one to speculate how effective (or rather how uneffective) was the design controls process, and that would open another can of worms (e.g. adequate assessment of customer requirements, adequate V&V activities, intended use and human factor issues, design transfer process, production & process controls, post-marketing activities, etc)...

In our case, we dropped ISO 9001:1994 and kept ISO 13485:1996 (plus CMDCAS) which we upgraded to ISO 13485:2003 (plus CMDCAS) this year. There were occasions that we got questioned about ISO 9001:2000; it just takes some time to explain the difference and applicability of the 2 standards to our industry. Everyone was satisfied with our explanations and our ISO 13485.