ISO 13485 vs. FDA QSR (21 CFR Part 820) - Differences - Includes Spreadsheets

[Jimmy Olson]

We are a contract manufacturer (of circuit boards) and our customers are responsible for the design and the final prodcut. Will the FDA be interested in us?

 

[45fan]

I've been doing medical device development for about 5 years now and been QA manager for a start-up for about a year and I'm still confused, so don't feel bad!

13485 is the basis for FDA QSR, but the organization and numbering is different. As long as you show how you address the QSR subjects in your 13485 system, you are OK. This is usually done with a cross-reference table in the Quality Manual.

Certification in and of itself historically has not been accepted as evidence of compliance with FDA, but they have begun an effort to accept third party certifications as evidence of compliance, so this could have changed since I last review the regs. I'm not sure what the status is of this initiative, but you should be able to find the info on the CDRH home page.

http://www.fda.gov/AboutFDA/CentersOffices/OfficeofMedicalProductsandTobacco/CDRH/

Certification of your QS is optional as far as the FDA is concerned. The FDA does not require certification, only compliance, with the QSR. They will, however, inspect your facility at some point, so that in effect is a "certification" if you pass.

Assuming that you are manufacturing only, not designing or distributing the product, the onus is on your customer to ensure that you are in compliance; they will have to audit you at some point, the detail differs by the level of certification and compliance that you choose to achieve. This basically means that you don't need to be certified at all! Not exactly the route that I would recommend, however. You will eventually need to be in compliance with FDA Good Manufacturing Practices (GMP) which is nothing more than QS applied to the manufacturing processes.

This will obviously require a decision by you and your customers whether they want you to be certified to ISO 13485, which would take the burden off of them and decrease their costs. The other consideration is the added value to you of certification. You will be able to use that as a selling point to potential future customers.

For any medical device, the QS is only one part of the equation. There are other requirements of the FDA and in Europe (MEdical Device Directive) in addition to the QS such as labeling, packaging, sterilization, post-market surveillance, incident reporting, etc.

I hope that helps with some of your concerns and doesn't open Pandora's box, but it probably will.

 

[Jimmy Olson]

45fan, thanks for the information.

If I understand you right, the FDA won't really be interested in us. As I stated, we are a contract manufacturer (of circuit boards) and our customers are responsible for the design and the final prodcut.

I'm pretty sure we will look at getting 13485 certified just to make everyone happy, plus it has been discussed as a marketing tool already.

Thanks again for the information. You actually satisfied my confusion (at least for this). I was mainly concerned with how much involvement we would have with the FDA considering our 'role' in all of this.

 

[Harold]

Richard,

As a contract manufacturer of printed circuit boards, you are not required to register with the FDA. You are a sub contractor of the medical device manufacturer who is registered with the FDA and subject to the FDA Quality System Regulation. The medical decive manufacturer will decide the level of control of your operation that is required. This could include requiring you to have a formal quality system, conduct site audits, first article inspections, source inspections etc.

Regarding ISO 13485, I do not think that is something you should be considering. ISO 13485 "specifies in conjunction with ISO 9001, the quality system requirements for the design/development, production and when relevent, installation and servicing of medical devices." This statement was taken from the scope of the ISO 13485 document.

My opinion is that IS0 9001 would be the way to go if you are interested in certifying your Quality System.

 

[Jimmy Olson]

I just found out that in the future we will be doing box builds (final product) for one of our customers (possibly more). As far as I know, the customer will still handle the marketing and distribution though. I talked to our sales and marketing director, but you know what it's like to try and get a straight answer from a salesman

Since we will be building the final product instead of a part of it, would we be required to register us or the product, or do we still fall under the umbrella of subcontractor? The impression I have is that we will go ahead and pursue 13485 since it won't be much more than we are doing already and it will give us a marketing edge around here. But the FDA side of things is still confusing

 

[45fan]

Richard Olson said:

If I understand you right, the FDA won't really be interested in us.

Perhaps my comments about certification being optional were misleading. Although I have never been through an FDA audit, I believe that they WILL be interested in you at some point. ESPECIALLY since you are supplying electronic assemblies.

Just to clear the air, certification
to a standard is optional for the FDA since their controlling document is the Quality System Regulation, 21 CFR 820, aka the QSR or current Good Manufacturing Practice, cGMP. It is true that the QSR is based on 13485, but it is not quite the same to say that 13485 certification will stop the FDA from checking you out. Although I would suggest reviewing their info on third party certifications to see if FDA is going to accept these soon.

Another point to consider is that if you are NOT involved in design, then you should only need to certify to ISO 13488 which is the manufacturing only cousin to ISO 13485. 13488 basically is 13485 without design controls. BUT if you are designing the circuit board layouts, and not just manufacturing boards designed by customers, you may need 13485.

Lastly, I'm not sure about Harold's point about just needing 9001. There are specific requirements in 13485 pertaining to medical device manufacturers in many of the elements. Some of the biggies are 4.5.2 Document and Data approval and issue for document retention, many process control requirements in 4.9 for cleanliness, Handling and packaging in 4.5.1 and 4.5.4 respectively, and of course 4.16 control of quality records, which requires records be maintained for batches/lots that identifies traceability. This last one is called a Device History Record, or DHR, by the FDA, and is VERY important.

 

[Jimmy Olson]

Hi 45fan,

Actually I think my statement was a bit misleading. I am sure the FDA would be interested in us, but that we wouldn't be rquired to register directly with them (although I'm not sure now).

As far as 13485, I think we are going to be waiting for the new version to be finalized and pursue that since it resembles 9001:2000 and we were going to exclude the design portion. I am trying to do some research into whether the FDA will be accepting 3rd party certifications or not, as I'm sure this would make things easier. Although navigating through the FDA website is almost a nightmare

Part of the problem is that I am still trying to find out what we will be doing. Oh well, just another fun challenge

 

[Harold]

Richard,

Since you will be manufacturing a finished device, you will need to register your establishment with the FDA. You will need a Quality System in place that complies with the FDA Regulations 21 CFR Part 820. The FDA regulations are very similar to ISO 13485 and ISO 9001.

The company I work for manufactures laboratory instrumentation and several clinical diagnostic devices. In 1999 we acheived ISO 9001 and in 2002 we acheived ISO 13485. ( At the present time ISO 13485 is not a standalone standard and you must have ISO 9001. ISO 13485 has undergone a revision and will be in the format of ISO 9001-2000 and will not require that you also be certified to ISO 9001) Every 3 to 4 years the FDA comes in and spends a week auditing us.

The downside to a company like yours that may only do one or two medical devices is that your quality system must comply with the FDA regulations although only the medical devices are regulated by the FDA.

I would recommend that you contact your customers quality assurance manager and they can provide you with copies of the regulation, establishment listing information etc. If you are not already registered to one of the ISO's and do not have a formal quality system in place, it will be a major undertaking to comply with the FDA regulations.

I hope I have not further confused you.

 

[Jimmy Olson]

Hi Harold, thanks for the info. I had figured we might need to register after finding out we will be doing final products.

We are currently registered to 9001:2000, so it won't be a drastic change to compy with 13485 or 820. I've read through the dratf version of 13485:2003 and have already isolated the differences and what we would need to do and have done the same with 820. I don't think it will be anything extremely difficult to do.

Guess now I need to delve into the FDA registration process. Something new to confuse me now.

 

[Aaron Lupo]

As of right now the FDA does not accept 3rd Party Certifications, it didn't stop them from visiting us! I know this is something the FDA has explored since they are way behind on the inspections they need to perform. Until 13485:2003 is released later this year, if you wanted you can always attain ISO/EN 13485/8 Certification and would not really need ISO 9001.

You would also be correct in that 13485:2003 and ISO 9001:2000 are very similiar, there are a few subtle differences (number of required procedures, no focus on continual improvement or customer satisfaction, specifies retention time for records etc..)

As far as FDA registration Richard- fill out the form and send it in, simple as that. Oh yeah and depending on what calss you fall in will determine how soon you will see them for an inspection.