Is this Quality Policy acceptable in the context of ISO 13485?

[sagai]

Well, I should post because my fingers cannot stop typing in certain situation ...

My recollection over quality policy is that its not necessarily only for the testification of being compliant with whatever standards. It's more about the tangible manifestation of the company holistic understanding and vision as regard to quality principles. With other words with no exposure to any standard a company can have a quality policy and in this particular case my reading is their quality policy is a superset what actually required by the wording of 13485.
The issues i have faced with so far are very much not coming from the wording of the quality policy though
Cheers

 

[Marcelo]

If you are worried about certification and the like, the policy would be ok as most of the answeres mentioned.

If you are worried about something useful instead of a catchphrase, here is some food for thought:

ISO 9001 defines quality policy as :

overall intentions and direction of an organization related to quality as formally expressed by top
management.

A policy is something that should induce attitudes, actions, on the whole organization. They should drive people in the organization to take actions or decisions when faced with situations in which policies must be followed.

For an example of a policy that induces actions, please see the following Privacy Policy from ISO (http://www.iso.org/iso/home/policies.htm)

Privacy Policy

Thank you for visiting ISrg. The International Organization for Standardization is committed to protecting the privacy of its members, customers, and other contacts. Any information you choose to provide on the Web site will only be used to provide or improve the services we offer.

Acceptance

By browsing this Web site, communicating electronically with us and/or submitting your personal data to this Web site, you acknowledge and agree to to the terms of this Privacy Policy and to the processing of personal data by ISO as described below.

Personal information

We will collect personal information about you only with your consent - for example, when you:

use the ISO Store for purchasing International Standards or related publications,
subscribe to our magazine, ISO Focus+,
request specific information or products.
Personally identifying information that you provide by e-mails or Web forms will be used only for such purposes as are described at the point of collection, such as to send information or products to you, to update your membership record, or to respond to your questions or comments.

We will use such personally identifiable data only for business purposes within the International Organization for Standardization, which includes communication with ISO member bodies. We do not share personally identifiable data collected at this site with third parties except in the following cases:

We may transfer your personal data to our partner agencies (service providers) which assist us in administering ISrg. These partner agencies are bound by a contractual agreement to keep your data private and secure.
We may disclose personal data if we are required to do so by law or if such action is reasonably necessary to comply with legal process, to respond to any claims, or to protect the rights of ISO, its customers and the public.
From time to time, we may ask our site visitors to answer survey questions. Surveys generally deal with the site, our products or categories of products and they will not request any personally identifiable data.

Information collected and stored automatically

As you browse through ISrg, we will automatically gather and store information about your visit via cookies. This information does not identify you personally. The data collected may include information on the pages you visited and how often you visited them. We use cookies only to assist us in measuring traffic on our Web site and to enable us to improve the quality of service we offer you via ISrg.

Links to Other Sites

ISrg contains links to other sites. If you access other sites using the links provided, the operators of those sites may collect information from you which will be used by them in accordance with their own privacy policies. ISO is not responsible for the privacy practices of other sites. We encourage you to become familiar with the privacy policies of any other sites which you visit, including sites linked from ISrg.

Revisions

ISO reserves the right to change or modify this Privacy Policy at any time. If we revise our privacy policy, we will post the changes on the site to ensure transparency of what information we collect, how we use it, and under what circumstances, if any, we disclose it.

Accessing, Deleting or Correcting Data

You can consult, revise and correct the personal data that you have provided to the ISO Store via www.iso.org/myaccount.

Alternatively, you can send an e-mail to the ISrg Webmaster.

Referrals

Some ISO Web areas may provide you with the opportunity to e-mail a Web page to another person. For this feature to work, we may need to collect your e-mail address and/or the e-mail addresses of those to whom you send the Web page. The e-mail addresses collected in this context are not used for any purpose other than to send your request. According to applicable law, they are deleted as soon as your request is fulfilled.

Governing Law

Any dispute arising in connection with this Privacy Policy shall be governed exclusively by Swiss law with the exclusion of its international private law. Exclusive place of jurisdiction shall be Zurich, Switzerland.

This policy above clearly has intentions and diections, so people can take actions based on it.


Regarding agreement with the standards:

You really can?t evaluate a policy without understanding the organization purpose, as it?s a requirements in 5.3 a). The policy needs to be apropriate to the purpose (mission) of the organization. So, without you mentioned what is the mission of your supplier, it?s in my opinion impossible to evaluate the policy.

Regarding 5.3 b), where is the commitment to comly with requirements? How are the organization collaborators expected to comply with requirements?

And in the case of effectiveness continual improvement, as mentioned the continual improvement concept was removed from ISO 13485 because it clashes with an controlled regulatory environment as is the case of medical devices.

And finally, in the case of 5.3 c) the policy has to provide a framework for establishing and reviewing quality objectives.

I can see that the example ISO Privacy Policy above provide a framework for establishing and reviewing quality objectives, because the several parts of the policy, besides inducing actions, permit to derive objectives from the internal process the organization has related to those several parts.

Well, as I said, only food for thought.

 

[sagai]

as mentioned the continual improvement concept was removed from ISO 13485 because it clashes with an controlled regulatory environment as is the case of medical devices.

Another day next to a bonfire in a company of a bottle of highland drum we could have a long chat about it

 

[SGquality]

Thanks Marcelo for detailed reply.

The Mission statement is "To be best in the world in precision plastic injection molding qnd related manufacturing solutions creating value to our customers, employees and communities".

So the Mission and Quality Policy look absolutely fine for ISO 9001 but when it deals with ISO 13485, there is no where a commitment to comply with regulatory requirements.

 

[Ronen E]

So the Mission and Quality Policy look absolutely fine for ISO 9001 but when it deals with ISO 13485, there is no where a commitment to comply with regulatory requirements.

Pardon me, but when people do silly things they get silly results...

If a company only makes parts for medical devices, that are not finished medical devices (or accessories to) in their own right, then ISO 13485 is not for them. The only reason such companies would want such a certification is because someone thought it'd be "nice" to have a QMS standard with the word "Medical" in its title, when serving others in the medical industry. In ISO 13485's context, regulatory requirements apply to finished medical devices and their accessories; such requirements relate to outsourced components only indirectly, via purchasing controls (i.e. via contracts and agreements). So why should compliance with medical devices regulatory requirements guide the conduct of a component manufacturer, who is not even focused on the medical industry (I didn't see it in their mission statement)?... They could add the missing words and technically be in agreement with ISO 13485, but that would be a rather meaningless statement, if you ask me.

If you really want to know what's important to an organization's top management, have a look at their annual budget (if they let you). Words are cheap.

Cheers,
Ronen.

 

[Ronen E]

as mentioned the continual improvement concept was removed from ISO 13485 because it clashes with an controlled regulatory environment as is the case of medical devices.

This might be the formal reason, but IMO there's another, deeper reason why this is appropriate. I don't particularly see a clash between continual improvement and a controlled regulatory environment -- this can be resolved by stating that continual improvement is welcome as long as the regulatory minimum is not violated. The real problem with continual improvement in medical devices is that the medical industry, just like most of the medical field, is very conservative, and its mainstay is "if it's not broken, don't fix it". This is not to say that there is no innovation in the field; there is, but it's always very very cautious. Technological or medical innovation is not the same thing as management systems innovation, however, there is an effect because we are dealing with humans and not robots, and sometimes the lines are blurred.

Just my opinion.
Ronen.

 

[JaneB]

Any issue that you believe is possibly there can and would be fixed very easily by the purchaser having their own reasonable management controls over purchasing.

Just make sure your purchase documentation clearly specifies your requirements including a statement about the need to have the parts you purchase comply with applicable regulatory requirements. (You'd do that anyway, right?)

Issue solved.

Wanting them to change their policy seems like a strange way to go, distinctly circuitous - and you'd still want to have that kind of detail in your purchase documents, surely??

 

[sagai]

Pardon me, but when people do silly things they get silly results...

Well spotted !!! And it is not a rare example.

Just another stuff, recently I have come across with a patient medical kind of service facility yearns for ISO13485 certificate.

Cheers!

 

[treesei]

Good discussion.

Moving away from continuous improvement and customer satisfaction into continuous regulatory compliance is a noticeable characteristics of ISO 13485 and there is a reason behind it. Therefore, strictly speaking, a 13485 certified facility should be careful about using those phrases especially in cases which reflect the management's mind-setting. Blindly focusing on continuous improvement and customer satisfaction in the traditional context of ISO 9001 can be dangerous in medical industries.

With that said, it would be a better use of audit resources to focus on other more practical issues. Instead of writing a finding about the policy, just mention it in a meeting as an education matter.

After all, why is this part supplier certified to ISO 13485?

 

[sagai]

Blindly focusing on continuous improvement and customer satisfaction in the traditional context of ISO 9001 can be dangerous in medical industries.

May I ask you to elaborate the kind of dangers are hiding for the bastards focusing on customer satisfaction and improvements?
Many thanks.