Quality Management System (QMS)
What you need to be compliant and why
A Medical Device Quality Management System (QMS) is a set of policies, processes, and procedures that a medical device manufacturer uses to make sure that their products are safe and effective for their intended use. The QMS includes every aspect of design and development, manufacturing, supplier management, risk management, complaint handling, clinical data, storage, distribution, product labelling, etc.
Medical devices are classified based on risk. Depending on how the device is classified, there are different requirements that must be followed to make sure the device is safe and reliable. To help ensure that a manufacturer is following the regulations, a medical device QMS needs to demonstrate the requirements that apply to its processes.
Nearly every major market requires the implementation and maintenance of a QMS as a condition of device registration.
What is a Quality Management System (QMS)?
A QMS is a structured system that keeps track of the procedures and processes implemented throughout a medical device’s lifecycle. It’s required to ensure quality during the development, manufacturing, and distribution processes throughout – from design to post market surveillance.
Having a QMS is critical for manufacturers that are planning to sell devices and seek approval from Notified Bodies in their intended market. Manufacturers must set up and maintain a quality management system that’s compliant with applicable international and national standards, guidelines, and regulations. This means setting up quality processes while assigning each process responsibilities, resources, and timeframes.
Some of the most important QMS processes for manufacturers include document control, change control, employee training, audit management, CAPA, supplier management, risk management, and complaint handling. The most effective QMS will streamline quality processes, improve workflows, reduce time and costs and interconnect documents.
Standards and Regulations for QMS
Whilst there are a large number of applicable international standards and regulations in place, our focus below is Europe. In the EU, a QMS is required to obtain CE marking and sell a device within the EU market.
ISO 13485 Medical devices — Quality management systems — Requirements for regulatory purposes
This standard specifies the requirements for a QMS where an organisation that is involved in one of more stages of the device lifecycle needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements.
It includes design and development, production, storage and distribution, installation, or servicing of a medical device and design and development or provision of associated activities (e.g. technical support). ISO 13485:2016 can also be used by suppliers or external parties that provide product, including quality management system-related services to such organisations.
Some key areas of a QMS are specified and include the following.
- General Requirements
- Documentation Requirements
- Management Responsibility
- Resource Management
- Product Realisation
- Purchasing
- Production and Service Provision
- Measurement, Analysis, and Improvement
EU MDR 2017/745
This regulation specifies requirements for the design, manufacture and distribution of medical devices and accessories for human use in the EU. Manufacturers are required to set up and maintain a comprehensive QMS in order to be compliant with EU MDR.
The MDR also recognises compliance with ISO 13485 for QMS requirements.
A manufacturer’s QMS will be assessed by a Notified Body as a component of conformity assessment procedures specified in MDR Annex IX to XI.
EU IVDR 2017/746
This regulation has more stringent requirements which manufacturers must comply with. These include risk-based classification, performance evaluation and post market surveillance. Manufacturers are required to set up and maintain a comprehensive QMS to be compliant with EU IVDR.
The IVDR also recognises compliance with ISO 13485 for QMS requirements.
MDR & IVDR Article 10
MDR Article 10(9)1 and IVDR Article 10(8)2 address QMS requirements as follows:
Manufacturers shall ensure that procedures are in place to keep series production in conformity with the requirements of this Regulation. Changes in device design or characteristics and changes in the harmonised standards or CS by reference to which the conformity of a device is declared shall be adequately taken into account in a timely manner. Manufacturers of devices, other than (investigational devices)1 (devices for performance study)2, shall establish, document, implement, maintain, keep up to date and continually improve a quality management system that shall ensure compliance with this Regulation in the most effective manner and in a manner that is proportionate to the risk class and the type of device.
The quality management system shall cover all parts and elements of a manufacturer’s organisation dealing with the quality of processes, procedures, and devices. It shall govern the structure, responsibilities, procedures, processes, and management resources required to implement the principles and actions necessary to achieve compliance with the provisions of this Regulation.
The quality management system shall address at least the following aspects:
- a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for management of modifications to the devices covered by the system;
- identification of applicable general safety and performance requirements and exploration of options to address those requirements;
- responsibility of the management;
- resource management, including selection and control of suppliers and sub-contractors;
- risk management as set out in in Section 3 of Annex I1,2;
- clinical evaluation in accordance with (Article 61 and Annex XIV, including PMCF)1 (Article 56 and Annex XIII, including PMPF)2;
- product realisation, including planning, design, development, production and service provision;
- verification of the UDI assignments made in accordance with (Article 27(3))1 (Article 24(3))2 to all relevant devices and ensuring consistency and validity of information provided in accordance with (Article 29)1 (Article 26)2;
- setting-up, implementation and maintenance of a post-market surveillance system, in accordance with (Article 83)1 (Article 78)2;
- handling communication with competent authorities, notified bodies, other economic operators, customers and/or other stakeholders;
- processes for reporting of serious incidents and field safety corrective actions in the context of vigilance;
- management of corrective and preventive actions and verification of their effectiveness;
- processes for monitoring and measurement of output, data analysis and product improvement.
QMS Requirements
Timing is crucial when implementing a QMS. The ideal time is when enough information and knowledge have been gathered to ensure an efficient QMS development process. This is usually around the design and development phase.
However, improvements may be necessary to existing QMS processes. If you already have a QMS in existence, it may be necessary to refine or update it to ensure you are in line with all the requirements. Some of the key processes are outlined below.
Medical Device File
Every medical device type or device family must have a technical file (MDD) or technical documentation (MDR). The expected contents of the file are listed in the regulation and for EU MDR compliance, manufacturers should familiarise themselves with Annex 2 and 3 of the MDR which outlines requirements.
Document Control
Document control is the process for managing all the different documents that circulate throughout the lifecycle of the device. Documentation is necessary for every aspect of a QMS. The document control procedure should define your criteria for document control. This includes version control along with document review, approval processes, change history and storage.
Record Control
Managing records and managing documents are two different things but are sometimes confused with each other. Document control is outlined above. However, records are evidence that certain processes have been followed. The same criteria are applicable regarding review and approval as it is for document control, but records do not typically have versions.
For example, a record would demonstrate the device realisation process and that the device meets defined requirements. Other record examples are servicing or sterilisation. If the device requires either of these then records must be kept to document this.
Design Control
The purpose of design control is to control the entire design process and ensure the devices’ design meets user needs, intended use(s) and specified requirements. There are various elements manufacturers must account for as shown below.
Management Responsibility
Top Management are integral to QMS. They are responsible for several stages and overseeing the QMS. Other areas they must be involved in include quality policy, quality objectives, communication and review at planned and recorded intervals.
Training
Manufacturers must have specifically trained and competent employees in place. Therefore, a record of all qualifications and training must be kept and maintained. Companies may need to provide training and assess effectiveness to ensure their employees have the required skills to perform their duties.
Audits
A proper audit process must be in place with regular quality audits being conducted. This is to ensure that the whole QMS is compliant. Manufacturers need to fully audit all applicable requirements to ensure compliance. Where any audit findings occur, this must become a non-conformance and be recorded as such.
The best practice for managing a QMS is to continually monitor its effectiveness and ensure any necessary adjustments are made.
Corrective and Preventative Actions (CAPA)
A CAPA process must be implemented.
The purpose of CAPA is to standardize the response when corrective action is required.
This process is essential for manufacturers to resolve and prevent issues which are likely to impact the device quality.
This can mean collecting information/data, identifying, and investigating device and quality problems, and effecting corrective and preventive action.
It also encompasses verifying or validating corrective and preventive actions, communicating corrective and preventive actions as appropriate, and providing information for management review.
All these activities must be documented.
There are several steps in a CAPA process as shown here.
Production Controls
The purpose here is to ensure you are manufacturing products that meet specifications, develop adequate processes, validate them, and then monitor and control the entire manufacturing process.
Manufacturers must monitor production processes to ensure that device manufacturer is continuously planned, executed, monitored, and controlled. Typically, this is to ensure that the device meets defined specifications and the necessary processes and correct environment for this are in place.
Clin-r+ recommendations
QMS is seen by some as a must-have just to check boxes for compliance’s sake. However, by implementing a QMS it can also provide manufacturers with a strategic business advantage. A strong QMS can enable you to run a much more efficient business by allowing you to focus on the quality of your device(s). This will help you to ensure that your device is always able to fulfil its intended purpose.
We know that regulations and requirements change within the MedTech industry and can be hard to keep up with and cross-reference. Clin-r+ provides expert assistance and has a wealth of experience to call upon. We can assist your transition and ensure you are MDR compliant. To learn more about our services and how we can help. Get in touch!
Managing design of a Medical Device
Effective Post Market Surveillance
