ISO 13485 Reporting Requirements

[Ed Panek]

Hypothetical - If an ISO 13485 auditor makes an observation that should have been reported to governmental authorities such as FDA, are they mandated to do so?

 

[Sidney Vianna]

I don’t think so. However, as a third party auditor, I would make abundantly clear to the registrant organization that they themselves should bring the issue up to the relevant regulatory authority. And request evidence of the communication. If an organization refuses to self report, as the auditor I would approach the CB management and trigger a decertification proceeding. Any organization that is not serious about regulatory compliance is obviously failing to address a fundamental tenant of conformity to ISO 13485.

 

[Swimming In The Soup]

Critical NC's and Safety issues are supposed to be brought to executive managements attention at the earliest possible time, depending on the details. I also believe that applies if something illegal is observed. Safety issues are supposed to pause the audit until remedied. To qualify, I attended a 2 day 13485 internal auditor training with Oriel Stat A Matrix. It's not much but it was informative.

 

[DannyK]

If the auditor is performing an MDSAP ISO 13485:2016 audit, the reportable issue becomes a grade 4 or 5 Nonconformity and the auditing organization is obligated to report it to the regulatory authorities within 5 days.

 

[Ed Panek]

Thanks all!