ISO 13485:2003 Documentation Requirements for Outsourced Processes and Services

[yf02055]

Hello. I am trying to obtain more detailed information for ISO 13485:2003 outsourced processes requirements.

 

[Al Rosen]

Do you have a specific question?

 

[yf02055]

Yes, my question is where can I access more information for ISO 13485:2003 outsourcing requirements, including documentation requirements.

 

[Al Rosen]

That is very broad in scope. What are you outsourcing, design services, sterilization processes, manufacturing or assembly? The requirements are dependent upon the nature of the outsourced process. Your supplier should have the same controls in place that you would need to have and you need to have a process in place for oversight or verification.

 

[yf02055]

We are wondering what kind of documentation per ISO 13485 is required for suppliers (outsourced subcontractors)?

 

[Al Rosen]

The standard leaves it for you to decide. If you were performing the out sourced process, what documentation would you have? Do you have a specific example? With something concrete, someone else may be able to offer some ideas.

 

[Aaron Lupo]

We are wondering what kind of documentation per ISO 13485 is required for suppliers (outsourced subcontractors)?

Do you have a copy of ISO 13485:2003, that would be a good place to start. Also ISO/TS14969 the guidance document for 13485 would be another valuable resource.

The more detail you put in your question the more we can help you.

 

[yf02055]

Questions on outsourced processes

I have more specific questions on "outsourced processes":

1. Do companies typically identify the specific suppliers of outsourced processes within their QS, such as on the Approved Supplier List?

2. If a company outsources calibration and record retention, would these fall under the category of an outsourced process?

3. What are examples of additional/appropriate controls applied to outsourced processes?

 

[jewels]

I have more specific questions on "outsourced processes":
> Do companies typically identify the specific suppliers of outsourced processes within their QS, such as on the Approved Supplier List?
> If a company outsources calibration and record retention, would these fall under the category of an outsourced process?
> What are examples of additional/appropriate controls applied to outsourced processes?

If a company or person provides an important service to you, they should be on your Approved Supplier List. Unless it's not a critical supply such as one you could get readily (we look at office supplies such as paper, pens, toner, etc. as non-critical, hence not a critical supplier). You should also collect information and review it on a scheduled basis to make sure they are providing you with the service you need. For companies such as a calibration source, maybe this is a very limited file. Do they calibrate to NIST standards. This should be a "yes". Do they have any certifications? Such as ISO or other? That would be nice. If not, how do you know they are providing the service you need? Maybe providing them with a questionnaire to show that they have procedures they follow when they do the calibration would help. How are they qualified to provide the service? Do they have a quality manual? Do they have a quality control department? Do they have a quality assurance department? Do they control records? Do they monitor complaints? How do they maintain traceability to NIST standards?

If the process is more complicated, the records needed for the outsourcing become more complex. For example, we are going to have a company make a product for us that we will label with our name. They will design it, they will validate it, they will manufacture it. Now, we need to make sure they provide us with product according to ISO13485 standards. Design controls must be applied, they need to have procedures for producing the product, we need to provide them with specifications in a form of a contract, we will need to apply some sort of acceptance procedure to ensure the product is what we expect it to be. The list goes on......

Whatever you would need to show that the service, if done in your facility, complies with ISO13485---that's what proof you need that the outsourcing company provides the same degree of assurance.

 

[Pataha]

Are you also a FDA registered company?

Do you outsource your sterilization?

Besides records and calibration, what other sources are you outsourcing?