ISO 13485 and OBL (Own Brand Label) Agreement

[Luisiso]

We are pursuing ISO 13845. However, we are not the manufacturer but Obl. Our consultant sent us a bunch of file that covers the QMS but we do not know where to start. Our vendor or manufacturer is already ISO certified so can we use their ISO QMS and replace their name with ours so we can show the auditor that we control production of the product we sell? Does the ISO authorities requires a contract between vendor and obl? or it is only requiered for CE mark certification? Can someone tell us what is the best route for a Obl to achieve ISO certification?

 

[Ronen E]

Hello and welcome to the Cove

can we use their ISO QMS and replace their name with ours so we can show the auditor that we control production of the product we sell?

Absolutely no. The QMS is expected to be relevant to the organization being certified, and cover operations that actually occur under this organization's direct responsibility. Your (indirect) control over production should be achieved through contractual means and supplier (manufacturer) audit / monitoring.

Our consultant sent us a bunch of file that covers the QMS but we do not know where to start.

Then what good is that "consultant"?... He/she should be guiding / mentoring you through the implementation.

Does the ISO authorities requires a contract between vendor and obl?

What do you mean by "ISO authorities"?... The ISO itself (International Standardization Organization) has nothing to do with certification, it only published the standard. The certifying bodies are not directly related to ISO. A contract between the vendor and the OBL is highly desirable to keep things clear and under control.

Can someone tell us what is the best route for a Obl to achieve ISO certification?

You will have to set up your ISO-13485-compliant QMS and live by it. If you want/need someone to assist you in doing that, I recommend you look for someone who is not afraid "to get their hands dirty", and willing to come on site and guide you as much as necessary, rather then dump a bunch of files and leave.

Cheers,
Ronen.

 

[somashekar]

If you are an OBL, I believe you have CE (with a notified body involved) CE xxxx.
The xxxx is the NB number.
Do check with them if they can also issue you with an EN ISO 13485:2012 certificate when they assess the MDD in the audit.
Discuss with them what specifics you need to accomplish towards this.
This will be a more meaningful 13485 for your requirement.
>
>>
>>> ... and a warm welcome to the COVE.
Do come back with more specifics as you continue to respond here. Good luck.

 

[Ronen E]

You might also be interested in the contents of this document, and in particular appendix 2.

Please note that formally the OBL is considered "The medical device manufacturer", as referred to in appendix 2.

 

[Luisiso]

We are currently working on the agreement between OBL (us) and the OEM.

To be honest I do not understand what you guys propose, how can we set the quality system and have the OEM follow our procedures?. How can we have our OEM followed everything that is dictated in our quality system if we do not even know how to make to make the product? How can we accomplish this. we are two employees companies so this is overwhelming? Would not be easier takes what is in already place (OEM QS) then modified and make it relevant to our business as you guys said? Going the other way around means to have 500 hundreds people follow our system.. I am not sure but I obviously missing something here..

 

[Ronen E]

We are currently working on the agreement between OBL (us) and the OEM.

To be honest I do not understand what you guys propose, how can we set the quality system and have the OEM follow our procedures?. How can we have our OEM followed everything that is dictated in our quality system if we do not even know how to make to make the product? How can we accomplish this. we are two employees companies so this is overwhelming? Would not be easier takes what is in already place (OEM QS) then modified and make it relevant to our business as you guys said? Going the other way around means to have 500 hundreds people follow our system.. I am not sure but I obviously missing something here..

Yes, you are missing something...

Your QMS should only cover activities you actually perform. Use your ISO 13485 copy to redline what is relevant (=what relates to what you actually do) and what isn't. For exclusions, focus on the product realization requirements (however, don't automatically exclude everything in there).

You should be telling your contract manufacturer (OEM) what you require of them, not how to achieve that. They will still have their QMS running, and given the size-relationship between you and them, I don't think you should be monitoring or auditing how well their QMS operates. Monitor them by their outcomes, based on the criteria which will be spelled out in the contract/agreement. I recommend you make sure that every clause from ISO 13485 that is excluded from your QMS because "they actually do it", is reflected in a requirement (or more than one) in your agreement with your contract manufacturer, to ensure that in total everything relevant is covered.

Creating your own QMS, I believe it'd be more effective to start with a blank slate rather than take someone else's QMS and start chopping chunks off.

Give us a buzz if you need more help.

Cheers,
Ronen.

 

[Luisiso]

I appreciate all the answers you guys giving me, this is overwhelming specially when you do not have the time to put on this. I am preparing the contract between my business and OEM and I believe I am covering most of the requirements. Like mentioned before, my consultant send be all the files for our QS that include the manuals, procedures and forms. Since I am not the manufacturer what should I do with the manufacturing process part of the system? What about reports, testing, equipment etc which are things that I do not handle myself but my OEM? According to some of you I have to set my QS related to my business but how they will follow it if they already has one in place? and in case they do not have to follow my system then how this can be done if the auditors are expecting that the OEM follow my system? According what I have learn so far AUDITORS OR NB are expecting my business to have control on the manufacturing..

 

[Luisiso]

Rone,
Answering your question: What do you mean by "ISO authorities"?... I meant the person or company who will be auditing my business and issue the ISO. I refer to the auditors and the notified of body such as TUV etc.. Please understand that I am not familiar with some terms since this is all new for me. I am just mechanical engineer running an small business and who has not clue about to implement these standardization to the business. By the way, are you a consultant or work for business related to this field?

 

[Ronen E]

Since I am not the manufacturer what should I do with the manufacturing process part of the system? What about reports, testing, equipment etc which are things that I do not handle myself but my OEM?

You should either eliminate the manufacturing process part of the system or substitute it with "shell" or reference procedures, that explain that those processes are outsourced, refer to the contract / agreement with the OEM and describe the controls you have over their outcomes (your inputs). This may be a little tricky if you don't have any substantial QMS establishment experience. That's why I wrote that your consultant should have guided you through it. It's not rocket science but it's also not trivial if you haven't been exposed to an OBL QMS before.

According to some of you I have to set my QS related to my business but how they will follow it if they already has one in place? and in case they do not have to follow my system then how this can be done if the auditors are expecting that the OEM follow my system? According what I have learn so far AUDITORS OR NB are expecting my business to have control on the manufacturing..

Your org and the OEM are not expected to operate under a single QMS. It's all right and common that each of you have your own QMS, tailored to your operations. The control your auditors expect would normally be through the contract - it would spell out requirements you pose on your OEM, relating to their outputs, which are your inputs. Your QMS should be well synchronized with those controls. The OEM could / should similarly ensure that their QMS is synchronized on their side, but this is not your main / initial concern. What you need to ensure is that the contract includes all the necessary provisions, and that the OEM is reasonably set up to match those provisions (you could initially audit them, including an on-site visit, if you have the resources / ability to do that).

I am just mechanical engineer running an small business and who has not clue about to implement these standardization to the business. By the way, are you a consultant or work for business related to this field?

I am an independent consultant, and BTW I'm also a mechanical engineer...

Cheers,
Ronen.

 

[somashekar]

The control your auditors expect would normally be through the contract - it would spell out requirements you pose on your OEM, relating to their outputs, which are your inputs. Your QMS should be well synchronized with those controls.

This contract can also spell out about your periodic audit, by yourself OR your appointed auditors. It can also spell out that the OEM must be prepared to take the audit from your NB, in case your NB decides that they want to audit the OEM manufacturer...