by William I. White
In structuring quality management systems, most medical device companies choose a medical device quality system framework based on an FDA model or ISO 13485 model depending upon their unique needs, regulatory requirements, and the international marketplace. Let’s look at each model and a methodology for choosing which model works best for organizations globally.
Soon after implementation of 21 CFR 820, the FDA determined a need to recast the elements of the regulation in a manner that would facilitate examination during inspections. This “restructuring” is shown in figure 1 and has become commonly known as the QSIT structure (quality system inspection technique).
A company choosing to use a quality management system structure based on the FDA QSIT structure will need to add an additional subsystem related to marketing and sales. (Although the quality system regulation has no provisions related to sales, there are laws and regulations governing marketing and sales practices that companies must heed and that should be addressed in a complete quality system.) The resulting structure will thus have eight subsystems.
- Management controls
- Design controls
- Production and process controls
- Corrective and preventive actions
- Material controls
- Equipment and facility controls
- Records, documents, and change controls
- Marketing and sales
We should note as well that the FDA has emphasized the connection of additional regulatory requirements (medical device reporting, corrections and removals, and medical device tracking) with the quality system regulation CAPA subsystem.
ISO 13485 Model
The ISO 13485 framework is an approach introduced with the general quality management system standard ISO 9001:2000, adopted for ISO 13485:2003 and continued with the next revision as ISO 13485:2016. As indicated in figure 2, this approach emphasizes the interactions of business processes to achieve desired results.
Figure 2. ISO 13485 Process Model
The Two Choices
We can see graphically how either can work by considering the quality system in a little more detail. The ISO 13485 quality standard requires identification of key processes for the company. This is also a good practice for companies whose only regulatory concern is the FDA. Let’s assume we have identified our key processes as the following:
- Management responsibility
- Risk management
- Documentation management
- Records management
- Internal and external audits
- Qualification and training
- Facilities and equipment
- Software and process validation
- Design control
- Supplier quality management
- Product regulatory compliance
- Inspection, test, disposition
- Handling, storage, preservation, delivery
- Service and support
- Marketing and sales
- Change control
- Customer feedback management
- Corrective and preventive action
- Control of nonconforming product
There is nothing special about this list. Any other list, a little longer or a little shorter, that encompasses all the needed processes affecting quality outcomes will do just as well.
Figure 3 illustrates how this list of key processes will fit within the eight subsystems of the QSIT framework (the subsystems defined by the FDA plus the one that we added, marketing and sales).
This same list of key processes will also fit the ISO framework. See figure 4.
There are reasons both for and against choosing an FDA model.
- The FDA is clearly the most widely respected (read “feared”) regulatory agency in the world. It may be prudent to be able emphasize to FDA investigators that the company is taking FDA concerns very seriously.
- The QSIT framework is well conceived, with the various subsystems often matching well with a company’s organization.
- An increasing number of countries are adopting ISO 13485 as a fundamental component of their regulatory approach.
- For multinational companies, it may appear inappropriate to employees around the world to have a quality management system constructed according to the regulatory approach of a single country.
Similarly, there are reasons both for and against choosing an ISO 13485 model.
- ISO 13485 is an international standard. Its framework is a logical choice for any international company.
- ISO 13485 is based on a process approach to quality management systems – an approach highly beneficial for a quality management system.
- ISO 13485 includes business elements explicitly. (A regulatory agency does not concern itself with whether a company has any sales. It is only concerned that the sales it has are of good products.)
- In principle, a framework based on the ISO 13485 model should facilitate harmonization with other management standards. Regrettably, current status of various international standards indicates that this will not be true for perhaps another decade.
- Because the standard was drafted with the original intent to allow exclusion of items in clause 7 only, there is some separation of items that might more appropriately be addressed together. (For example, it appears somewhat artificial that section 8.2.6, monitoring and measurement of product, is completely separated from section 7.5, product realization.)
- Although ISO auditors provide a valuable service to the companies that they audit and often identify key issues that need to be addressed, FDA investigators represent an organization that can shut down a business or bar products from entering the U.S. One school of thought believes that this means all effort should be focused first on the FDA and everything else should be subordinate.
A few comments are appropriate:
- A small or medium-sized company with facilities only in the United States and no expectation of expanding beyond its borders should choose either the FDA or the ISO framework, depending upon whichever seems more appropriate for the company and its approach to operations.
- An international company should normally choose the ISO framework as a visible commitment to an international approach to quality management.
- An international company currently finding itself in difficulties with the FDA may find it useful to be able to demonstrate a sincere commitment to fulfillment of FDA requirements. If the difficulties have indicated issues throughout the quality management system, a full reconstruction may be the correct approach. In such a case, it may be useful to move to an FDA framework for the remodeled system.
- With the growing number of instances of combination products (drug and medical device), medical device companies planning to sell combination products will need to add the additional required provisions of drug regulations to their quality management systems. Either model can accommodate the addition of such provisions.
A model, once initially established, is likely to become ingrained in employees. It will be changed only with difficulty and thus deserves careful attention in the initial construction or any subsequent reconstruction of a quality management system.
About the author
William I. White started Quality System Strategies LLC in 2006, when he retired after 30 years at Bayer HealthCare LLC. Since retiring from Bayer, White has advised medical device companies ranging in size from a few individuals to several thousand staff, on how best to fulfill requirements of 21 CFR 820 and ISO 13485, while creating quality systems that serve the needs of the companies and their employees.
White holds an A.B. in chemistry from Harvard College and a Ph.D. in chemistry from Cornell University.
 FDA, “Guide To Inspections of Quality Systems,” August 1999
 21 CFR 803, Medical Device Reporting
 21 CFR 806, Medical Devices; Reports of Corrections and Removals
 21 CFR 821, Medical Device Tracking Requirements
 With the publication of Annex SL in 2012, the technical management board of ISO has declared an objective of delivering consistent and compatible management system standards. Unfortunately for medical device companies, its immediate effect will be a divergence in structure between ISO 9001:2015 (which has the structure of Annex SL) and ISO 13485:2016 (which retains the basic structure of ISO 13485:2003). Thus, any medical device companies wishing to maintain certification to both standards will find this effort more challenging (but by no means impossible) in the immediate future.
 ISO 13485:2016 allows exclusions for non-applicable requirements in clauses 6, 7 or 8.
TAG: medical device quality system.