1. Auditing ISO 13485 Nancy Pasquan November 2014

2. Introductions I am….. You are….. And we are here to discuss: Auditing ISO 13485 Quality Systems for Medical Devices

3. Outline Introduction to Auditing ISO 13485 ISO 13485 Overview ISO 13485 Relationship with FDA Regulations Related Regulations and Guidance Applicability of ISO 13485 The Process Approach Quality Systems in Clinical Trials The Audit Process Conclusion

4. Introduction Assessments of suppliers to the medical devices industry are generally conducted in accordance with client established procedures and required regulations. Auditing for certification, whether for ISO 13485 or another standard requires a much more formal approach. Certification, and establishing and maintaining customer/supplier relationships have different requirements for the auditor.

5. ISO 13485 Overview ISO 13845:2012 is one of many standards developed by the International Organization for Standardization (ISO). The standard represents the requirements for a comprehensive quality management system for the design and manufacture of medical devices. Implementation of additional requirements, such as MDD or 21 CFR Part 820, is often (usually) necessary.

6. 21 CFR Part 820 is harmonized with ISO 13485 (for now) in order to assist companies in developing quality systems to standards that are similar 21 CFR Parts 11, 21, and 50 as well as others may apply and fall under the scope of a certification audit in an advisory manner ISO 13485 Relationship with FDA Regulations

7. There is a sea of regulations, standards and guidance documents that companies must navigate. Depending on the nature of the device and where it is to be marketed Examples include ISO 14001 for Environmental Management, ISO 26000 for Social Responsibility, ISO 62304 for Software Development, ISO 14971 for Risk Management Others are more specific – electrical safety, human factors, etc. Related Regulations and Guidance

8. U.S. FDA Quality System Regulation (QSR) - 21 CFR Part 820 ISO 13485 Medical Devices Directive IVD (98/79EC) Canadian Medical Device Regulation (CMDR) Ministry of Health, Labor and Welfare (MHLW) Plus Korean Regulations, China Regulations and several other countries worldwide

9. Related Regulations and Guidance ISO 13485:2003 MDD, Annex I & II CMDCAS/CMDR The world’s strictest regulatory body! FDA/QSR (21 CFR 820) True or false? If I comply with the QSR, all other requirements are included.

10. Related Regulations and Guidance False! Each set of regulatory requirements has its own little “twist”. ISO 13485:2003 MDD, Annex I & II CMDCAS/CMDR FDA/QSR (21 CFR 820) ASIA PACIFIC COUNTRIES REGULATIONS

11. Related Regulations and Guidance

12. Applicability of ISO 13485 A medical device is anything that is not either a drug or a biologic product. This covers a huge range of products in various stages of completion. Everything from tongue depressors and bandages to pace makers and surgical robots are considered medical devices and represent a 100 billion dollar industry. ISO 13485 applies to all of the organizations that produce these devices. Auditor must have documented experience with the type of product being produced

13. The Process Approach A “Process” can be defined as a “set of interrelated or interacting activities, which transforms inputs into outputs”. These activities require allocation of resources such as people and materials. A major advantage of the process approach, when compared to other approaches, is in the management and control of the interactions between these processes and the interfaces between the functional hierarchies of the organization.” (from ISO guidance)

14. Quality Systems in Clinical Trials ISO 13485 does not reference clinical trials specifically, but for the sake of completeness, the discussion is included here. ISO 13485 audits are often timed to support confidence in making submissions to FDA. Medical devices are submitted for approval to the Center for Devices and Radiologic Health (CDRH) or Center for Biologics Evaluation and Research (CBER) at the FDA, while drugs from pharmaceutical companies are submitted for approval to the Center for Drug Evaluation and Research (CDER) or CBER at the FDA

15. Quality Systems in Clinical Trials (continued) A medical device has feasibility, pilot and pivotal study models (vs. Phase I-IV Trials) Device development is iterative and designs may be refined or improved as device development progresses. While user feedback, adverse events or difficulties in deploying or delivering a device can all lead to changes to the device, second or third generation designs do not always require a new clinical trial. In general, devices go through continuous improvement in short intervals. It is not uncommon for a clinical trial to start with one device and end with an improved version of the device.

16. The Process Approach For an auditor, the process approach introduces some challenges in an organizational review. It is necessary to follow a trail of evidence across departments and functions in order to adequately determine whether a process is adequate to meet the needs of that organization and the spirit of the standard.

17. The Audit Process Auditing for certification to ISO 13485 follows the same general process as any audit, except the scope is set by the standard and will be affected by whether the audit is for the first certification, recertification or surveillance. When certifying a company for the first time, a series of preliminary audits are performed to determine readiness and stability of the quality system. The formal certification audit covers all of the organizations defined processes and all of the applicable clauses of the standard. Surveillance audits are then performed for three years, with some processes and standard clauses mandatory and others chosen by the auditor to include a different third of the standard each time. Recertification is then performed on the fourth year.

18. Conclusion ISO 13485 certification audits differ from supplier assessments in the scope and level of formality required. Medical devices are governed by a large number of possible standards and regulations and auditors must be familiar with them all in order to assess compliance. Clinical trials for devices differ from those for pharmaceuticals or biologics, but still must produce data to support claims of safety and effectiveness. Certification of the organizations that conduct these trials can provide confidence in regulatory submissions.