Implementing ISO13485:2016 in the Middle of a New Device Project



Hi Covers, thanks for taking the time to read.

The company is new (2 years), and the project I'm working on is our first. It is a Class IIa device for the treatment of symptomatic hemorrhoids.

I am a biomedical engineer by training, hired by my company to do medical device design work. But my job scope has evolved over time to also encompass both setting up the company QMS (ISO13485:2016) as well as to handle our regulatory submissions. As you can imagine, we are a very small company of 5 employees, and for the longest time we were so focused on the R&D work that we have completely neglected our QMS. We are now at the stage where R&D work is complete and in the process of transferring the design to manufacturing.

Section 7.3 of the standard talks about the requirements for design and development planning, inputs and outputs, review, verification and validation etc. My question is - if we did not formally document some of these items at the start of the project simply because we were not aware (at that time) of the requirements, how do we best go about patching these up?

We have given it some thought and our solutions are:

1. Identify the documents we are lacking and draft them retroactively, backdate them. Feels a little illegal to me.
2. Define a date, and state that we claim compliance to the standard only after this date.
3. Identify the documents we are lacking during an internal audit, and issue a CAPA. Corrective action would be to draft the documents retroactively but with current dates. Provide assurance that this was an oversight and commit to preventing that from happening in the future.

I am sure that this is not an isolated problem with companies that are trying to get ISO13485 certification. How do we best go about fixing this?


Super Moderator
Never backdate!

Either 2 or 3 would work. Remember, you don't have to go under design controls while doing the research. Although if you're ready to transfer to manufacturing, you may be too far along for that option. Going with 3 allows you to also 'seed' your CAPA system and demonstrate it's working. You don't necessarily need to do an internal audit, though. Just a gap assessment should be sufficient to drive the effort.
Top Bottom