Control of Outsourced Processes (not properly described in the quality manual)

D

DrM2u

#31
Like the old saying goes, when you have two auditors you get three different opinions. But the benefit of it is that it stimulates thinking. ;)
 
Elsmar Forum Sponsor
R

Roland Cooke

#32
Absolutely, and getting the take from different auditors and clients, is one of the best ways to learn and improve. Elsmar Cove is great for that.
 

Peter Selvey

Staff member
Super Moderator
#33
Noting some of the comments above, it needs to be remembered that ISO 13485 usually forms the basis of regulatory compliance. It is not just a QM system for the manufacturer's benefit; the QM system also forms a critical part of the evidence of how you meet regulatory requirements. Thus, it needs to be structured so that somebody independent can figure out what is going on. This allows third parties (a) to plan their inspection, based on risk; and (b) to provide a trail of evidence in the case that something goes wrong.

So be careful justifying decisions on outsourced processes purely from a manufacturing control (ISO 9001) point of view. You do need also to think about what the auditors might want to know.
 

jkuil

Quite Involved in Discussions
#34
In directive 2007/47/EC the following was added to Annex II 3.2c of the European Medical Device Directive 93/42/EEC:
It [=quality system] shall include in particular an adequate description of […] the organization of the business and in particular […] where the design, manufacture and/or final inspection and testing of the products, or elements thereof, is carried out by a third party, the methods of monitoring the efficient operation of the quality system and in particular the type and extent of control applied to the third party
A lot of the larger international medical device companies are organized as a franchise or multi-site organization. The term organization is used to designate that the company maintains a quality management system by which all sites are governed. For these organizations one site may be responsible for placing the device on the market, as identified on the labeling of the device, whereas other sites are responsible for the development or manufacturing of the device.
Definition of a Manufacturer
The definition of manufacturer is similar in the European Medical Device Directive, the Canadian Medical Device Regulations and Global Harmonization Task Force (SG1(PD)/N055R6). The wording in the European Medical Device Directive (93/42/EEC) is:
The natural or legal person with responsibility for the design, manufacture, packaging and labeling of a device before it is placed on the market under his own name, regardless of whether these operations are carried out by that person himself or on his behalf by a third party
On the other hand ISO 13485:2003 clause 4.1 specifies
Where an organization chooses to outsource any process that affects product conformity with requirements, the organization shall ensure control over such processes. Control of such outsourced processes shall be identified within the quality management system.
One could argue that as there is no outsourcing outside the scope of the management system, control of outsourced processes by the manufacturer to other sites is not required. GHTF’s guidance on 'Outsourced Processes' (GHTF SG3(PD)N17/R7) specifies a supplier as anyone that is independent from the manufacturer’s quality management system. This includes a supplier that may be part of the manufacturer’s organization but operates under a separate quality management system but excludes a supplier that operates under the same quality management system.
Type of Control
The need for control within a multi-site organization is identified by the ISO Technical Committee 176 on Quality Management and Quality Assurance and specified in the ISO Guidance on 'Outsourced Processes' (ISO/TC 176/SC 2/N 630R2 November 2003):
In some situations, the organization might not "purchase" the outsourced process in the traditional sense. […] it might, for example, receive the service from a corporate head office or from another division within a group of organizations, without any monetary transaction taking place. Under these circumstances, however, ISO 9001:20006 Clauses 7.4 and 4.1 are still applicable
There are good arguments to defend that the manufacturer should execute some type of control on the other sites that execute outsourced processes on behalf of the manufacturer. As the manufacturer has the responsibility of putting the device on the market it must assure that the product conforms to the essential requirements of safety and effectiveness. This must be assured through control of the design process, including the design change process. This does affect the relation between the manufacturer and the designer site as well as the operational site. The intent of Clause 4.1 is to emphasize that when an organization chooses to outsource a process that affects product conformity with the requirements, it can not simply ignore this process, nor exclude it from the quality management system. Likewise, the manufacturer should not make any exclusions in its quality system, even though some processes are executed by other sites. The manufacturer has to demonstrate that it exercises sufficient control to ensure that this process is performed in accordance to the relevant regulatory requirements and the requirements of the organization's quality management system. Outsourced processes will interact with other processes affecting product quality. These interactions need to be managed and defined (see ISO 13485:2003 clause 4.1 and [f]).
 
Last edited:

RCW

Quite Involved in Discussions
#35
I'm working on my list of outsourced processes. After composing the list, I found that there are a few processes the I both outsource and, at times, do in house. Would it be wise to note this as such? If someone were to review my list and determine that a certain process was outsourced it could lead them to believe "exclusively". Then they walk in back to the shop and see it being performed.

Just trying to avoid confusion and cover all the bases.
 
R

Roland Cooke

#36
I'm working on my list of outsourced processes. After composing the list, I found that there are a few processes the I both outsource and, at times, do in house. Would it be wise to note this as such? If someone were to review my list and determine that a certain process was outsourced it could lead them to believe "exclusively". Then they walk in back to the shop and see it being performed.

Just trying to avoid confusion and cover all the bases.
I think you've answered your own question. :cool:
Avoid confusion by covering all the bases. (N.B. that doesn't mean you have to write War & Peace...)
 
Z

zhang126

#37
I'm working on my list of outsourced processes. After composing the list, I found that there are a few processes the I both outsource and, at times, do in house. Would it be wise to note this as such? If someone were to review my list and determine that a certain process was outsourced it could lead them to believe "exclusively". Then they walk in back to the shop and see it being performed.

Just trying to avoid confusion and cover all the bases.
simply describe the truth and controls in the QM, e.g.

"This process is outsourced or performed in house. If outsource, the company established controls by following the SOP supplier control, SOP incoming control, SOP ...etc; For in house process the controls will follow SOP ...
 

somashekar

Staff member
Super Moderator
#38
I'm working on my list of outsourced processes. After composing the list, I found that there are a few processes the I both outsource and, at times, do in house. Would it be wise to note this as such? If someone were to review my list and determine that a certain process was outsourced it could lead them to believe "exclusively". Then they walk in back to the shop and see it being performed.

Just trying to avoid confusion and cover all the bases.
I have an other situation about the outsourced process and controls....
In the case of manufacturing activities, do we consider processes as outsourced only if we supply our materials outside for processing and return?
 

Stijloor

Staff member
Super Moderator
#39
I have an other situation about the outsourced process and controls....
In the case of manufacturing activities, do we consider processes as outsourced only if we supply our materials outside for processing and return?
That's a good way to look at it.

Stijloor.
 

jkuil

Quite Involved in Discussions
#40
I have an other situation about the outsourced process and controls....
In the case of manufacturing activities, do we consider processes as outsourced only if we supply our materials outside for processing and return?
No, if you have manufacturer responsibility over the product design and the manufacturing process of the component it is an outsourced process. Generally that it the case when you provide the material. But your contract manufacturer may also purchase the materials according specifications at qualified supplier selected by / agreed by the outsourcer.
 
Thread starter Similar threads Forum Replies Date
Q Control of outsourced processes - drop shipped products ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
A Outsourced Processes Control (Finished Medical Device Delivery, Storage) ISO 13485:2016 - Medical Device Quality Management Systems 10
D Approved Supplier Control Requirements for Outsourced Special Processes Supplier Quality Assurance and other Supplier Issues 4
A The auditor documented that we did not have control of Outsourced Processes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 11
A Additional Control Measures for Outsourced Processes under ISO 9001:2008 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
O Methods used to Control Outsourced Processes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 7
J Control of Outsourced Processes defined within the Quality Management System ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 11
Q Type and Control of Outsourced Processes - ISO 9001 Clause 4.1 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 38
P Definition and control of outsourced processes - Service Company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
R How Can We Show Control Over Outsourced Processes? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 37
somashekar Control Over Outsourced Processes - Share some experiences and methods ISO 13485:2016 - Medical Device Quality Management Systems 6
Sidney Vianna Outsourced Processes - Type and Extent of Control to be Applied - ISO 9001:2008 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 40
F Outsourced special processes - How to control outsourced special processes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
T ISO 9001:2000 - Clause 4.1 - How to control outsourced processes? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
R Outsourcing Processes - What is appropriate control over the outsourced operations? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
I Control of Outsourced Process - Shipping ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 15
L Control of Calibration as an Outsourced Process ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
M Control of Work Transfer vs. Control over Outsourced Process - Differences AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 16
B Control of Outsourced Production (Contract Templates) - ISO 13485:2003 ISO 13485:2016 - Medical Device Quality Management Systems 3
I Outsourced Process Control Procedure review ISO 13485:2016 - Medical Device Quality Management Systems 11
M Design Control - Outsourced Process Requirements Design and Development of Products and Processes 8
D Control Number for Class III and IV devices Canada Medical Device Regulations 0
J Document Control Metrics Document Control Systems, Procedures, Forms and Templates 3
I Document Control Software Document Control Systems, Procedures, Forms and Templates 2
T Controlling Expandable Forms in Paper-Based Document Control System Document Control Systems, Procedures, Forms and Templates 10
N ISO 13485 7.3.9 Change control in medical device software ISO 13485:2016 - Medical Device Quality Management Systems 6
C UDI Questions on Control Units Other US Medical Device Regulations 6
A Quality Control Datasheets Inspection, Prints (Drawings), Testing, Sampling and Related Topics 0
M Control-self assessment Internal Auditing 5
GreatNate Master Control QMS software Quality Tools, Improvement and Analysis 0
A Prototype control plan FMEA and Control Plans 2
J Records Control - Does each individual record need to be numbered? Records and Data - Quality, Legal and Other Evidence 2
shimonv Document Control Procedure Header Content Document Control Systems, Procedures, Forms and Templates 3
W FMEA - Current control and occurrence rating FMEA and Control Plans 3
S Which department should prepare the control plan? could you show me a standard regarding to this matter. FMEA and Control Plans 17
G Control Plan & PFMEA Review Procedure? FMEA and Control Plans 1
N What are the software audit and control steps Reliability Analysis - Predictions, Testing and Standards 2
A Fabric roll inspection - What type of Control Chart to use? Inspection, Prints (Drawings), Testing, Sampling and Related Topics 2
C Monitoring and Control Instruments RoHS, REACH, ELV, IMDS and Restricted Substances 3
M ISO14971:2019 - Verification of implementation and effectiveness of risk control ISO 14971 - Medical Device Risk Management 3
T Risks arising from control measures vs. ineffective control measures ISO 14971 - Medical Device Risk Management 11
J Need Change Control Yes/No Decision Tree Template ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 1
P IQ, OQ, PQ protocol, and report templates for Distributed Control Systems in Pharmaceutical Manufacturing Systems. Qualification and Validation (including 21 CFR Part 11) 0
R Risk control measures as per ISO 14971 ISO 14971 - Medical Device Risk Management 6
T Linking Control Plans and PFMEA's FMEA and Control Plans 3
L How to add exemption or statement to control of document procedure? ISO 13485:2016 - Medical Device Quality Management Systems 5
T PFMEA and Control Plans on legacy product FMEA and Control Plans 5
P IATF 16949 requirement - error-proofing in control plan IATF 16949 - Automotive Quality Systems Standard 3
C 8.5.1.1 Control of Equipment, Tools, and Software Programs - Questions about the extent of control of NC programs AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 5
Q Version/Revision Control of CAD files Document Control Systems, Procedures, Forms and Templates 2

Similar threads

Top Bottom