Integrated CGMP and ISO 13485 quality management system

Translate Request has too much data
Parameter name: request
Translate Request has too much data
Parameter name: request

The ISO 13485 Standard is widely used in the medical device manufacturing industry as a means of establishing compliance with Canadian Medical Device Regulation, European Medical Device Directive and other regulations. Since the majority of medical device manufacturers comply with both 21 CFR 820 QSR and ISO 13485 standards, it is practical to consider establishing an integrated 21 CFR 820 and ISO 13485 Quality Management System (QMS).

Documentation Structure

To establish an integrated QSR and ISO 13485 QMS, an organization may use approaches outlined in the ISO 10013 Standard, Guidelines for Developing Quality Manuals. Among other suggestions, this standard gives an example of a documentation structure that can be used for QSR and ISO 13485 quality management systems. While the standard suggests using a three-level documentation structure, most organizations implement four-level structures to include quality records, as required by both QSR Subpart M - Records and ISO 13485, element 4.2.4. A typical four-level documentation structure includes: Quality Manual, Procedures, Instructions, and Records.

Actually, the documentation structure for an organization should most likely start from the quality policy, as the policy, among other commitments, defines the regulations and standards that a company intends to comply with. If you choose to use this approach, your QMS will have five levels, as shown below:

Quality Policy - level 1
Quality Manual - level 2
Procedures - level 3
Instructions - level 4, and
Records - level 5

Quality Policy

QSR, section 820.20 (a) and ISO 13485, element 5.3 require the establishment of a quality policy. To satisfy these requirements an organization may develop a quality policy that meets requirements of both QSR and ISO 13485 standards. While QSR requires a quality policy to include a commitment to quality and be "...understood, implemented, and maintained at all levels of the organization", ISO 13485 requirements are somewhat broader. Therefore, an organization can adhere to the requirements of ISO 13485 which requires that a quality policy include:

A commitment to comply with requirements,
A commitment to maintain the effectiveness of the QMS,
A framework for establishing and reviewing quality objectives

The organization shall also ensure that the quality policy is:

Appropriate for the organization,
Communicated and understood within the organization, and
Reviewed for continuing suitability

Despite the fact that these requirements appear to be rather simple, many consultants and auditors find that most companies have difficulties with documenting their quality policies by not addressing all the requirements above. It is important to establish a quality policy that, at a minimum, addresses all the requirements above because that quality policy will document a company's commitment to establish a QMS that complies with the given regulations and standards. To demonstrate this point, let's assume that one's quality policy does not require its review "for continuing suitability" or does not include "a framework for establishing and reviewing quality objectives". If there are no "triggers", there is a good chance that these activities will not be performed. Let's take a look at a few examples of quality policies that did not address specified requirements.

"We Practice Continual Improvement to achieve Customer Delight by providing Customer-Centric, Qualitative ... Solutions and Services on time"

Assuming that this quality policy is appropriate to the purpose of the organization and is communicated, it does not appear to contain "a commitment to comply with requirements", a "framework for establishing and reviewing quality objectives", and a commitment to quality. Based on these deficiencies, this policy does not meet our requirements.

The second example of a quality policy states:

"[Company] will earn customer loyalty by providing products, services, and interaction experiences of the highest quality and greatest value. To achieve this result, we will:

Ensure that all of our products comply with relevant safety and regulatory requirements;
Ensure our products meet and/or exceed their published specifications;
Maintain and continually improve the effectiveness of our product and service business management systems;
Continually monitor the quality of our customer interactions, with the intent to improve our customer's total experience;
Establish quality requirements for suppliers, partners, and contractors and hold them accountable to comply


Treat customers in accordance with [Company]'s Standards of Business Conduct and Privacy policies."

This quality policy, while apparently very much customer-focused, still does not cover a framework for establishing and reviewing quality objectives and committing to review it for continuing suitability. One of our clients came up with a quality policy that won our "The Worst Quality Policy" Grand Prize. Their quality policy simply stated:

"I improve the Quality of Patient Care and all things [Company name]"

This sorry example of a quality policy has been restated verbatim! (The company name has been omitted). Obviously, this quality policy has met only one requirement: that it has in fact been "established."

Integrated 21 CFR 820- ISO 13485 Quality Manual

While QSR does not specifically require the establishment of a quality manual, Section 820.186 requires a manufacturer to establish a quality system record that: "...shall include or refer to the location of procedures and the documentation of activities required by [the QSR]." This definition very closely resembles requirements for a quality manual for an ISO 13485 compliant QMS. A quality manual is the top-level document of a QMS. There are at least two definitions of what a quality manual for a QMS should be.

ISO 10013, Guidelines for Developing Quality Manuals, element 4.2, gives detailed suggestions for creating a quality manual. It defines a quality manual, among other requirements, as a document that should "consist of, or refer to, the documented quality system procedures intended for [the] planning and administration of activities which [have an] impact on quality". ISO 13485 2003, element 4.2.2 requires a quality manual to include:

The scope of the QMS,
Details of and justification for any exclusion or non-application,
The documented QMS procedures or references to them,
A description or interaction between the processes of the QMS; and
An outline of the structure of the documentation used in the QMS.

The scope of the QMS is usually located in the corresponding section of the quality manual. It simply states which activities an organization performs within the scope of its certification. For example: "My Company, Inc. designs, manufactures and distributes laser generators for cosmetic surgery applications". If an organization does not perform some of the processes required by ISO 13485, clause 7, such as design or manufacture, this fact, with justification, is documented in the exclusions section of the manual.

After we defined the scope and exclusions, let's describe used processes and references to the corresponding procedures. The easiest way to start this is to transform 21 CFR 820 cGMP and ISO 13485 standards from a set of requirements into your company's commitments to satisfy those requirements. For example: If section 820.5, Quality System, requires that:

"Each manufacturer shall establish and maintain a quality system that is appropriate for the specific medical device(s) designed or manufactured, and that meets the requirements of this part." our manual will state:

"QW Medical, LLC. Has established and maintains a quality management system that is appropriate for the specific medical device(s) designed and manufactured, and that meets the requirements of 21 CFR 820 QSR."

Following this approach by addressing all applicable sections of the QSR and the ISO 13485 standard and referencing supporting procedures, we will establish a manual that can be used to meet requirements of 21 CFR 820 and ISO 13485.

Interaction between the processes may be documented in a number of ways. Some companies choose to define interaction of the top-level processes by using variations of Figure 1 in the ISO 9001 2008 Standard. Combining such a diagram with references to procedures within the manual will, to a particular degree, define interactions between your processes.

The last requirement of the element 4.2.2 of ISO 13485 is to outline the structure of the documentation. Very often companies define their structures as four- or five-level documentation structures in the documentation management section of the manual.

Another important function of a quality manual, very often overlooked, is to be a marketing tool. Well written and professionally published, a quality manual may become a powerful promotional instrument. It can communicate to your potential customers, suppliers and subcontractors that your company is not only a quality-conscious organization, but that it also knows how to document and communicate its commitment to quality and compliance with regulatory requirements.

I always wonder what companies achieve by stamping their quality manuals in bold red capitol letters "CONFIDENTIAL". As far as I am concerned, a quality manual is a company's resume for quality, and if you hide your resume, there is a very good chance that you will never get a job! All Quality Works customers are encouraged to make their quality manuals public!

Naming Your Documents

As you may have noticed, the titles of the documents above are quite short. It is a very typical convention in the medical device manufacturing and other regulated industries to call the second-level documentation "Standard Operating Procedures", known as SOPs. Unless one has a level called "Non-standard Operating Procedures," I really do not see a practical or economical reason for long titles. As long as a short title conveys the idea and leads a user to the right place within the system, let's use it. Quality Works relentlessly promotes this optimization and reduction of waste approach throughout all our publications and consulting work. Let's not make things more complicated than they need to be. For example, one of our customers titled their quality manual as "Quality Management System Quality Manual." I bet, just "Quality Manual" will mean the same for users.

Numbering Your Documents

It is not a specific requirement of 21 CFR 820 QSR or any other regulation or standard to uniquely number a part or a document. It is a worldwide practice in most documentation systems to give a document or a component a number and a title, and to identify its revision level. As long documentation titles that we discussed earlier, use of document numbering formats very often present opportunities for improvement.

Once I worked with a cGMP compliant business of less than 100 people, manufacturing fairly simple surgical instruments. Their documentation system included a few numeration formats depending on the type of a document. One of the procedures had a number 000023-001, which they simply called "twenty three." Drawings were numbered in a format like 987-323-11-02.

Is it acceptable to have long and difficult to read and remember) document numbers? Yes, of course! Is it practical? I do not believe so! In the example above, the procedure number, without the tab, contained six digits. This meant that the system was prepared to handle almost one million documents or part numbers. The company had approximately 150 documents and about the same number of parts and probably would never go beyond doubling those numbers. If nothing else, just reading these numbers with sequential zeros in the front may give one a headache. Surprisingly, this is not the worst case. The business that won our "The Worst Part Number" Grand Prize assigned twelve (!) characters to their part numbers in the alphanumeric format.

If you are designing or manufacturing a sophisticated X-ray, CAT scan or other complex piece of equipment, you will need thousands or even millions of parts and documents. In this case, a long part number format would be needed and will make business sense. Otherwise, save yourself the trouble of writing all those zeros and make your numbering system practical. One of my customers, who won my "The Best Part Number" Grand Prize, numbered their QMS documents as 101, 102, 103, and so on. Short and sweet! Most small- and medium-size companies will benefit from this optimization approach. After all, isn't the part title the best designator? Throughout my entire professional career, I worked only with a couple of companies that did not use document numbers. Their documents were simply identified by unique titles and a two-digit revision level, like Quality Manual 01.

Another debatable issue with part-numbering formats is part number designation. Some management systems associate a part number with a particular part type. For example, 20-xxx indicates a procedure, 30-xxx indicates a drawing, P-xxx indicates a policy-level document, and so on. My experience with a number of medical device manufacturers has convinced me in the benefits of a "no designation" system. Three of our clients' systems that used designation failed. Just recently, one of our clients reported that he ran out of range in his company's part-numbering format. The documentation system allowed for assigning materials through a two-digit designator within the part number. When the system was designed a few years ago, needing more than 99 materials was not considered possible. Unfortunately, company's needs change over time, and just a few years later, the QMS needed more than 99 materials causing the existing part number format to fail.

An alternative approach to numbering parts and documents within your management system is a "no designation" approach. In such a system, documents or parts are given sequential unique numbers within a specified format, regardless of their level, type, material, application or other attributes.  

Mark Kaganov was born and raised in Moscow, Russia. He graduated from Moscow University of Radio-electronics and Automation, where he earned his Bachelor's and Master's degrees in design and technology of electronic equipment. While attending the university, he worked for the Institute of Plastics, the former USSR's leading organization in the research and development of plastic materials.

In 1981, Mr. Kaganov immigrated to the United States and continued his professional career in Quality Assurance and Research & Development in the plastics, electronics, and medical device manufacturing industries. He has worked for major US corporations such as Capitol Records, RCA, COBE Laboratories and Medtronic.

Since 1990, Mark Kaganov is the Director of Operations and Lead Consultant at Quality Works. The company specializes in providing businesses with consulting, documentation, training, implementation and auditing in the areas of ISO 9001, ISO 13485, 21 CFR 820, ISO 14001 and other management systems. Among other products, Quality Works offers Integrated cGMP / ISO 13485 Quality Manual.

Copyright Quality Works