The Food and Drug Administration (FDA) has established and
maintains Part 820 – Quality System Regulation (QSR), also known
as 21 CFR 820 or “current Good Manufacturing Practice” (cGMP).
This regulation applies to medical device manufacturers or
importers of devices intended for “human use”. Compliance with
this regulation is expected from any organization that
manufactures or imports such devices into the USA.
The ISO 13485 Standard is widely used in the medical device
manufacturing industry as a means of establishing compliance
with Canadian Medical Device Regulation, European Medical Device
Directive and other regulations. Since the majority of medical
device manufacturers comply with both 21 CFR 820 QSR and ISO
13485 standards, it is practical to consider establishing an
integrated 21 CFR 820 and ISO 13485 Quality Management System
(QMS).
Documentation Structure
To establish an integrated QSR and ISO 13485 QMS, an
organization may use approaches outlined in the ISO 10013
Standard, Guidelines for Developing Quality Manuals. Among other
suggestions, this standard gives an example of a documentation
structure that can be used for QSR and ISO 13485 quality
management systems. While the standard suggests using a
three-level documentation structure, most organizations
implement four-level structures to include quality records, as
required by both QSR Subpart M – Records and ISO 13485, element
4.2.4. A typical four-level documentation structure includes:
Quality Manual, Procedures, Instructions, and Records.
Actually, the documentation structure for an organization should
most likely start from the quality policy, as the policy, among
other commitments, defines the regulations and standards that a
company intends to comply with. If you choose to use this
approach, your QMS will have five levels, as shown below:
Quality Policy
QSR, section 820.20 (a) and ISO 13485, element 5.3 require the
establishment of a quality policy. To satisfy these requirements
an organization may develop a quality policy that meets
requirements of both QSR and ISO 13485 standards. While QSR
requires a quality policy to include a commitment to quality and
be “…understood, implemented, and maintained at all levels of
the organization”, ISO 13485 requirements are somewhat broader.
Therefore, an organization can adhere to the requirements of ISO
13485 which requires that a quality policy include:
-
A commitment to comply with requirements,
-
A commitment to maintain the effectiveness of the QMS,
-
A framework for establishing and reviewing quality
objectives
The organization shall also ensure that the quality policy is:
-
Appropriate for the organization,
-
Communicated and understood within the organization, and
-
Reviewed for continuing suitability
Despite the fact that these requirements appear to be rather
simple, many consultants and auditors find that most companies
have difficulties with documenting their quality policies by not
addressing all the requirements above. It is important to
establish a quality policy that, at a minimum, addresses all the
requirements above because that quality policy will document a
company’s commitment to establish a QMS that complies with the
given regulations and standards. To demonstrate this point,
let’s assume that one’s quality policy does not require its
review “for continuing suitability” or does not include “a
framework for establishing and reviewing quality objectives”. If
there are no “triggers”, there is a good chance that these
activities will not be performed. Let’s take a look at a few
examples of quality policies that did not address specified
requirements.
"We Practice Continual Improvement to achieve Customer
Delight by providing Customer-Centric, Qualitative … Solutions
and Services on time”
Assuming that this quality policy is appropriate to the purpose
of the organization and is communicated, it does not appear to
contain “a commitment to comply with requirements”, a “framework
for establishing and reviewing quality objectives”, and a
commitment to quality. Based on these deficiencies, this policy
does not meet our requirements.
The second example of a quality policy states:
“[Company] will earn customer loyalty by providing products,
services, and interaction experiences of the highest quality and
greatest value. To achieve this result, we will:
1. Ensure that all of our products comply with relevant safety
and regulatory requirements;
2. Ensure our products meet and/or exceed their published
specifications;
3. Maintain and continually improve the effectiveness of our
product and service business management systems;
4. Continually monitor the quality of our customer interactions,
with the intent to improve our customer’s total experience;
5. Establish quality requirements for suppliers, partners, and
contractors and hold them accountable to comply
6. Treat customers in accordance with [Company]’s Standards of
Business Conduct and Privacy policies.”
This quality policy, while apparently very much
customer-focused, still does not cover a framework for
establishing and reviewing quality objectives and committing to
review it for continuing suitability.
One of our clients came up with a quality policy that won our
“The Worst Quality Policy” Grand Prize. Their quality policy
simply stated:
“I improve the Quality of Patient Care and all things
[Company name]”
This sorry example of a quality policy has been restated
verbatim! (The company name has been omitted). Obviously, this
quality policy has met only one requirement: that it has in fact
been “established.”
Integrated 21 CFR 820– ISO 13485 Quality Manual
While QSR does not specifically require the establishment of a
quality manual, Section 820.186 requires a manufacturer to
establish a quality system record that: “…shall include or refer
to the location of procedures and the documentation of
activities required by [the QSR].” This definition very closely
resembles requirements for a quality manual for an ISO 13485
compliant QMS. A quality manual is the top-level document of a
QMS. There are at least two definitions of what a quality manual
for a QMS should be.
ISO 10013, Guidelines for Developing Quality Manuals, element
4.2, gives detailed suggestions for creating a quality manual.
It defines a quality manual, among other requirements, as a
document that should "consist of, or refer to, the
documented quality system procedures intended for [the] planning
and administration of activities which [have an] impact on
quality". ISO 13485 2003, element 4.2.2 requires a quality
manual to include:
-
The scope of the QMS,
-
Details of and justification for any exclusion or
non-application,
-
The documented QMS procedures or references to them,
-
A description or interaction between the processes of the
QMS; and
-
An outline of the structure of the documentation used in the
QMS.
The scope of the QMS is usually located in the corresponding
section of the quality manual. It simply states which activities
an organization performs within the scope of its certification.
For example: “My Company, Inc. designs, manufactures and
distributes laser generators for cosmetic surgery applications”.
If an organization does not perform some of the processes
required by ISO 13485, clause 7, such as design or manufacture,
this fact, with justification, is documented in the exclusions
section of the manual.
After we defined the scope and exclusions, let’s describe used
processes and references to the corresponding procedures. The
easiest way to start this is to transform 21 CFR 820 cGMP and
ISO 13485 standards from a set of requirements into your
company’s commitments to satisfy those requirements. For
example: If section 820.5, Quality System, requires that:
“Each manufacturer shall establish and maintain a quality
system that is appropriate for the specific medical device(s)
designed or manufactured, and that meets the requirements of
this part.” our manual will state:
"QW Medical, LLC. Has established and maintains a quality
management system that is appropriate for the specific medical
device(s) designed and manufactured, and that meets the
requirements of 21 CFR 820 QSR."
Following this approach by addressing all applicable sections of
the QSR and the ISO 13485 standard and referencing supporting
procedures, we will establish a manual that can be used to meet
requirements of 21 CFR 820 and ISO 13485.
Interaction between the processes may be documented in a number
of ways. Some companies choose to define interaction of the
top-level processes by using variations of Figure 1 in the ISO
9001 2008 Standard. Combining such a diagram with references to
procedures within the manual will, to a particular degree,
define interactions between your processes. For more detailed
process interaction tool, check out Author’s
Process Interaction
Matrix article on this Website.
The last requirement of the element 4.2.2 of ISO 13485 is to
outline the structure of the documentation. Very often companies
define their structures as four- or five-level documentation
structures in the documentation management section of the
manual.
Another important function of a quality manual, very often
overlooked, is to be a marketing tool. Well written and
professionally published, a quality manual may become a powerful
promotional instrument. It can communicate to your potential
customers, suppliers and subcontractors that your company is not
only a quality-conscious organization, but that it also knows
how to document and communicate its commitment to quality and
compliance with regulatory requirements.
I always wonder what companies achieve by stamping their quality
manuals in bold red capitol letters “CONFIDENTIAL”. As far as I
am concerned, a quality manual is a company’s resume for
quality, and if you hide your resume, there is a very good
chance that you will never get a job! All Quality Works
customers are encouraged to make their quality manuals public!
Naming Your Documents
As you may have noticed, the titles of the documents above are
quite short. It is a very typical convention in the medical
device manufacturing and other regulated industries to call the
second-level documentation “Standard Operating Procedures”,
known as SOPs. Unless one has a level called “Non-standard
Operating Procedures,” I really do not see a practical or
economical reason for long titles. As long as a short title
conveys the idea and leads a user to the right place within the
system, let’s use it. Quality Works relentlessly promotes this
optimization and reduction of waste approach throughout all our
publications and consulting work. Let’s not make things more
complicated than they need to be. For example, one of our
customers titled their quality manual as “Quality Management
System Quality Manual.” I bet, just “Quality Manual”
will mean the same for users.
Numbering Your Documents
It is not a specific requirement of 21 CFR 820 QSR or any other
regulation or standard to uniquely number a part or a document.
It is a worldwide practice in most documentation systems to give
a document or a component a number and a title, and to identify
its revision level. As long documentation titles that we
discussed earlier, use of document numbering formats very often
present opportunities for improvement.
Once I worked with a cGMP compliant business of less than 100
people, manufacturing fairly simple surgical instruments. Their
documentation system included a few numeration formats depending
on the type of a document. One of the procedures had a number
000023-001, which they simply called “twenty three.” Drawings
were numbered in a format like 987-323-11-02.
Is it acceptable to have long and difficult to read and
remember) document numbers? Yes, of course! Is it practical? I
do not believe so! In the example above, the procedure number,
without the tab, contained six digits. This meant that the
system was prepared to handle almost one million documents or
part numbers. The company had approximately 150 documents and
about the same number of parts and probably would never go
beyond doubling those numbers. If nothing else, just reading
these numbers with sequential zeros in the front may give one a
headache. Surprisingly, this is not the worst case. The business
that won our “The Worst Part Number” Grand Prize assigned twelve
(!) characters to their part numbers in the alphanumeric format.
If you are designing or manufacturing a sophisticated X-ray, CAT
scan or other complex piece of equipment, you will need
thousands or even millions of parts and documents. In this case,
a long part number format would be needed and will make business
sense. Otherwise, save yourself the trouble of writing all those
zeros and make your numbering system practical. One of my
customers, who won my “The Best Part Number” Grand Prize,
numbered their QMS documents as 101, 102, 103, and so on. Short
and sweet! Most small- and medium-size companies will benefit
from this optimization approach. After all, isn’t the part title
the best designator? Throughout my entire professional career, I
worked only with a couple of companies that did not use document
numbers. Their documents were simply identified by unique titles
and a two-digit revision level, like Quality Manual 01.
Another debatable issue with part-numbering formats is part
number designation. Some management systems associate a part
number with a particular part type. For example, 20-xxx
indicates a procedure, 30-xxx indicates a drawing, P-xxx
indicates a policy-level document, and so on. My experience with
a number of medical device manufacturers has convinced me in the
benefits of a “no designation” system. Three of our clients’
systems that used designation failed. Just recently, one of our
clients reported that he ran out of range in his company’s
part-numbering format. The documentation system allowed for
assigning materials through a two-digit designator within the
part number. When the system was designed a few years ago,
needing more than 99 materials was not considered possible.
Unfortunately, company’s needs change over time, and just a few
years later, the QMS needed more than 99 materials causing the
existing part number format to fail.
An alternative approach to numbering parts and documents within
your management system is a “no designation” approach. In such a
system, documents or parts are given sequential unique numbers
within a specified format, regardless of their level, type,
material, application or other attributes.
Integrated
cGMP / ISO 13485 Quality Manual is available on this Website
About the Author
Mark Kaganov was born and raised in Moscow, Russia. He graduated
from Moscow University of Radio-electronics and Automation,
where he earned his Bachelor's and Master's degrees in design
and technology of electro-mechanical equipment. While attending
the university, he worked for the Institute of Plastics, the
former USSR's leading organization in the research and
development of plastic materials.
In 1981, Mr. Kaganov immigrated to the United States and
continued his professional career in Quality Management Systems
and Research & Development in the plastics, electronics, and
medical device manufacturing industries. He has worked for major
US corporations such as Capitol Records, RCA, COBE Laboratories
and Medtronic. Through his professional career Mark Kaganov
authored five international patents, numerous publications and a
book in the field of quality and environmental management
systems.
Since 1990, Mark Kaganov has been a Director of Operations and a
Lead Consultant at Quality Works. For many years he is a
certified QMS and EMS Lead Auditor.
© Quality Works
Order a copy of your
Integrated cGMP / ISO 13485 Quality Manual
or
call us to learn
how Quality Works can help you in implementing your quality
management system.
