Job shop seeking QMS intends to manufacture devices, is ISO-13485 appropriate?

[apestate]

Hello

I have not participated in the forum for several months, but it appears that soon I will be back to ask some RIDICULOUSLY minor questions regarding quality management.

I have started working as a machinist for a job shop type company that currently does not have any organized QMS. They are very organized, and employ some excellent manufacturing and quality control techniques through the application of techniques associated with just-in-time.

My question is about ISO 13485 because this company intends to begin manufacturing medical devices such as a bone fixation fastener or cerclage, and they desire information about what it takes to get FDA clearance.

I have been browsing the FDA/CDRH device advice on the web and have come a little way. It appears that the company simply needs a "QS" that employs the GMP's required for each risk level, and then the proper pre-market authorization through FDA procedures.

I have never seen ISO 13485. In my mind the simplest comparison is that like ISO 16949, ISO 13485 is a modification of ISO 9001:2000 for use in a specific manufacturing category.

Is ISO 13485:2003 audited and the company QMS certified to international compliance in the fashion of ISO 9001:2000? Is there any other option for companies who want to manufacture 21CFR800-1200 class I and class II medical devices?

Traditionally, does a company like this register to ISO 13485, sans design?

 

[Al Rosen]

Hello

I have not participated in the forum for several months, but it appears that soon I will be back to ask some RIDICULOUSLY minor questions regarding quality management.

I have started working as a machinist for a job shop type company that currently does not have any organized QMS. They are very organized, and employ some excellent manufacturing and quality control techniques through the application of techniques associated with just-in-time.

My question is about ISO 13485 because this company intends to begin manufacturing medical devices such as a bone fixation fastener or cerclage, and they desire information about what it takes to get FDA clearance.

I have been browsing the FDA/CDRH device advice on the web and have come a little way. It appears that the company simply needs a "QS" that employs the GMP's required for each risk level, and then the proper pre-market authorization through FDA procedures.

I have never seen ISO 13485. In my mind the simplest comparison is that like ISO 16949, ISO 13485 is a modification of ISO 9001:2000 for use in a specific manufacturing category.

Is ISO 13485:2003 audited and the company QMS certified to international compliance in the fashion of ISO 9001:2000? Is there any other option for companies who want to manufacture 21CFR800-1200 class I and class II medical devices?

Traditionally, does a company like this register to ISO 13485, sans design?

To answer your last question first, you can, but you should be concentrating on getting FDA clearance before tackling the overseas market. Once you are cleared, you can easily get your CE mark provided you have developed your Quality system with the long term goal of registration to ISO 13485 and in the short term, meeting the FDA QSR and ISO 13485. This is easily accomplished since they are "Harmonized" and much of what you need for FDA clearance will be used for your CE Technical File.

For the answer to achieving FDA clearance, you can find many threads where this has been discussed here in the cove. Doing a search will ultimately prove more beneficial than an isolated discussion. After you have read some of these threads, you will be able to ask some specific questions. I think the follwing thread will be a good start.

How do I ensure QSR compliance in an FDA company within 12

 

[db]

Hello

I have not participated in the forum for several months, but it appears that soon I will be back to ask some RIDICULOUSLY minor questions regarding quality management.

I can't add too much to what Al said, other than to get a copy of the standard. But I do want to say...


Welcome Back! I've actually noticed your absence.

 

[qualitygoddess - 2010]

Iso 13485

Have to agree with Al Rosen's post concerning FDA QSR. 13485 has quite a few additional documented procedures compared to ISO 9001. Of course, you are already aware of the requirements for risk assessment, which is a process that is really not in ISO 9001.

I recently assisted a company in WI with ISO 13485 compliance, so if you have specific questions when you get to that point, feel free to send me those questions through PM.

--QG

 

[Al Rosen]

Have to agree with Al Rosen's post concerning FDA QSR. 13485 has quite a few additional documented procedures compared to ISO 9001. Of course, you are already aware of the requirements for risk assessment, which is a process that is really not in ISO 9001.

I recently assisted a company in WI with ISO 13485 compliance, so if you have specific questions when you get to that point, feel free to send me those questions through PM.

--QG

I hope that the questions will be posted here on the cove, so that all of us can benefit from the discussion.

 

[apestate]

Thank you for the welcome back. I really appreciate it.

I have moved to Philadelphia in search of bigger and better opportunities, and it didn't take long to land a position in a really excellent company. As I have stated, they are using advanced techniques and have a very good quality culture. However, they do not have a formalized quality system.

The goal of top management is to achieve ISO 9001:2000 certification by the end of '05, using a job-shop management software package such as Visio or E^2 business solutions. We are waiting for the installation of this package to begin coordinating the ISO 9000 effort.

Short term goals begin at producing class II medical devices for other companies who are building the finished product.

My first question is about this detail. If we produce the finished bone screws to a spinal pedical screw system that is assembled and marketed by our customer, do we immediately fall under CFR requirements? I do not know that our fasteners could be used independent of the pedical system, or if the device is considered an accessory to the system. What would be the deciding factor here?

Is there any servicing of such a product? I can't think of any service necessary, I mean, we're not orthopedic surgeons who might see that the screws remain tight. Are there servicing requirements after the sale that we should be aware of? Say a product is de-ionized, sterilized, and packaged but only remains ready to use for 12 months. Could the product be returned and re-treated or something that might fall under servicing?

As you can see, I'm just scratching the surface here and trying to define what our product will be, who our customers are, and what requirements will be immediately applicable to us.

In the future, we aspire to perform all sorts of regulated activities in the production of finished medical devices--from design through sterilized packaging and storage. At that point will we be required to have ISO 13485 registration, or is 13485 simply another way to meet FDA and CE requirements?

 

[Al Rosen]

Short term goals begin at producing class II medical devices for other companies who are building the finished product.

My first question is about this detail. If we produce the finished bone screws to a spinal pedical screw system that is assembled and marketed by our customer, do we immediately fall under CFR requirements? I do not know that our fasteners could be used independent of the pedical system, or if the device is considered an accessory to the system. What would be the deciding factor here?

The short answer is, your a supplier. If you go back to the Device Advice page and read about Device Registration and Establishment Registration, you will find that you do not have to register since you do not market the device to the end-user. This is not to say that your customer will not impose some or all of the QSR requirements, but the FDA will most likely not be visiting you unless there is a problem or you are performing special processes like sterilization.

Is there any servicing of such a product? I can't think of any service necessary, I mean, we're not orthopedic surgeons who might see that the screws remain tight. Are there servicing requirements after the sale that we should be aware of? Say a product is de-ionized, sterilized, and packaged but only remains ready to use for 12 months. Could the product be returned and re-treated or something that might fall under servicing?

You mean they're not re-usable??

As you can see, I'm just scratching the surface here and trying to define what our product will be, who our customers are, and what requirements will be immediately applicable to us.

It's apparent. First learn about the the product and its end-use.

In the future, we aspire to perform all sorts of regulated activities in the production of finished medical devices--from design through sterilized packaging and storage. At that point will we be required to have ISO 13485 registration, or is 13485 simply another way to meet FDA and CE requirements?

I guess I wasn't clear when I responded to your first post. FDA does not recognize ISO 13485 Registration. But if you want to go the third party route, develop your system to meet ISO 9001, and if you want, ISO 13485 as well. You do not have to register to ISO 13485 yet. ISO 13485 has regulatory requirements that 9001 does not. You need to compare the two standards before you can make a decision. Annex B of 13485 explains the differences of the two standards.

Also, look at this thread. It contains a discussion of some of the same issues.

 

[Wes Bucey]

When I ran a high tech contract machining business in the 90's, we had a very similar situation to yours.

We manufactured bone screws on contract for a customer who chose to do the final sterilization himself as part of a "kit."

Since we made a variety of products for the medical field, from those inserted into people (bone screws) to components for devices (housings and parts for anesthesia regulators among other things), we were not required to, but did approach FDA for registration as CYA:ca: in the event we decided to convert from subcontractor of someone else's designs to designer and manufacturer of our own designs. (We never made that transition.) Back then, it was pretty straightforward dealing with FDA.

As you describe your business now, you will NOT have to register with FDA. (Similarly for getting CE approval - not necessary with your scope of business)

Except as a marketing ploy, you probably will not have to register to ISO 13485, but you might consider registering to ISO 9001:2000 and being "compliant to" 13485, unless bone screws become the primary focus of your business - we never rose above 1 per cent of our sales in bone screws and our entire medical device business was only about 8 or 10% of our annual sales. Except for the care in using dedicated machines and tooling to avoid contamination of the titanium, making bone screws to someone else's design was really "no brainer" work for a shop designed to routinely maintain tolerances of 50 millionths of an inch.

I recognize your comment about resterilizing the bone screws was meant for the products which exceed shelf life of sterile packaging before sale or use in a human.

Good luck in your new position and welcome back to the Cove.

One further comment about a "well organized" machine shop.
It is my experience than almost all high tech machine shops have routine practices about procedures and record keeping that are as good as any and better than most ISO-registered organizations. The conversion to compliance or registration for them is simple, because they are already customer-centric and passionate about Quality of the finished product.

The job shop software is very helpful in scheduling and record keeping, as well as generating necessary quality documents as they are needed during the process. Almost all job shop software is capable of generating hard copy or electronic copy travelers to accompany each order and maintain tight control over raw material and expendable tooling.

If you have any specific questions, there are many in the Cove who can answer questions about your type of organization and how it relates to a Standard.

 

[apestate]

Thank you all for the consideration and in-depth responses.

I am satisfied that this organization may want to, say, purchase ISO 13485:2003 and the accompanying 14969 guidance but, as top management began the conversation, the correct first step is ISO 9001:2000.

I guess my next question is about combining the GMP's of 21CFR820's in an ISO 9001:2000 QMS... a question well suited for Wes.

Would it be difficult to build a QMS covering all of ISO 9001:2000 that also complies with 13485:2003, right from the outset?

As for the logistics of that, I know I've seen discussions of such here on The Cove. That's probably where I'll head next. I guess the question is whether or not it is worth our time to tackle the FDA regulations now, during the installation of job shop software, and get those things out of the way or if it makes more sense to meet ISO 9001:2000 fully and add 13485 compliance down the road.

I feel we would want to be familiar with medical device regulations before making a presentation to our potential customers.

OK here's a lucid question: Is ISO 13485:2003 and ISO/TR 14969 easier to work with than the FDA codes and guidance? Would there be an advantage to buying these documents now or is everything already available to me?

 

[Wes Bucey]

Thank you all for the consideration and in-depth responses.

That's why we come - to answer questions.

I am satisfied that this organization may want to, say, purchase ISO 13485:2003 and the accompanying 14969 guidance but, as top management began the conversation, the correct first step is ISO 9001:2000.

Wow. That's a big bite right out of the box. What kind of pressure does the company see from customers to do any of this? Do they feel they are not getting business because they don't have the bragging rights of an ISO logo or an FDA certification?

I guess my next question is about combining the GMP's of 21CFR820's in an ISO 9001:2000 QMS... a question well suited for Wes.

Would it be difficult to build a QMS covering all of ISO 9001:2000 that also complies with 13485:2003, right from the outset?

Difficult, yes. Impossible, no.

As for the logistics of that, I know I've seen discussions of such here on The Cove. That's probably where I'll head next. I guess the question is whether or not it is worth our time to tackle the FDA regulations now, during the installation of job shop software, and get those things out of the way or if it makes more sense to meet ISO 9001:2000 fully and add 13485 compliance down the road.

Without knowing more about your business, customers, and plans for future design and manufacture of your own medical device products, it's almost impossible to give you a reasonable answer.

I feel we would want to be familiar with medical device regulations before making a presentation to our potential customers.

OK here's a lucid question: Is ISO 13485:2003 and ISO/TR 14969 easier to work with than the FDA codes and guidance? Would there be an advantage to buying these documents now or is everything already available to me?

At least one registrar has written:
The guidance is applicable to the design, development, production, installation and servicing of medical devices of all kinds.

The principles and examples contained in PD ISO/TR 14969:2004 can be useful as background information for those representing quality management system assessors, Conformity Assessment Bodies and regulator enforcement bodies.

ISO says (in its sale listing):
ISO/TR 14969:2004
Medical devices -- Quality mangement systems -- Guidance on the application of ISO 13485: 2003
(available in English only)

Edition: 1 (Monolingual)
Number of pages: 74
Technical committee / subcommittee: TC 210; ISO Standards
ICS: 11.040.01; 03.120.10
Status: Published standard
Current stage: 60.60
Stage date: 2004-10-18
Revision information: (Show)

Add to shopping basket Size Price
ISO/TR 14969:2004 PDF version (en) 2444 KB CHF 176,00
ISO/TR 14969:2004 paper version (en) CHF 176,00
Abstract
ISO/TR 14969:2004 provides guidance for the application of the requirements for quality management systems contained in ISO 13485. It does not add to, or otherwise change, the requirements of ISO 13485. It does not include requirements to be used as the basis of regulatory inspection or certification assessment activities.

This guidance can be used to better understand the requirements of ISO 13485 and to illustrate some of the variety of methods and approaches available for meeting the requirements of ISO 13485.


Draw your own conclusion.