Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • ISO 13485 as Importer

    Thank you very much, Kristina. 

    So the main purpose of risk analysis no matter its device and procedure, is for compliance to regulations and safety. 

     

    Best regards, 

  • ISO 9001 - Quality Objectives and Processes

    First, you identified 14 processes.

    Please check ISO 9001:2015 clause 4.4.1 c) – your organization must have a least one indicator/objective per process to monitor its performance. But those indicators/objectives are not necessarily quality objectives, high level objectives aligned and deployed from the quality policy.

    Process performance indicators are one thing, quality objectives are another thing. Some process indicators can also be quality objectives.

    Second, regarding “Can I interpret that as our organization can choose which of the 14 processes, we want to establish quality objectives for?” Yes, you can choose, but should not be a free choose, should be a function of strategy and quality policy.

    Please check the third slide after the agenda of this Free webinar on demand.

  • ISO 27001 version mention

    This 2017 version refers to the British version of ISO 27001 (the BS EN ISO/IEC 27001:2017), which does not include any change that impacts the requirements defined by ISO 27001:2013.

    This article will provide you with further information:

  • Business Continuity Procedure

    Please note that ISO 27001 control A.17.1.2 Implementing information security continuity does not require a "Business Continuity Procedure", only “…processes, procedures, and controls to ensure the required level of continuity for information security…”.

    Considering that, a less complex document like the Disaster Recovery Plan is sufficient to be compliant with this control.

    In the 2022 version the standard, the control A.17.1.2 is now A.5.30 ICT readiness for business continuity. For further information, see:

    Regarding the "List of Required Docs for ISO 27001 / 2013”, it is not clear to which document you are referring to. Could you please send us the link to it, so we can check it?

  • Risk assessment in Conformio

    1- Why are confidentiality, availability, and integrity not considered in the Risk assessment? and how Conformio is addressing them.

    ISO 27001 does not require the impact on confidentiality, integrity, and availability to be explicitly evidenced during the assessment (e.g., as separate values).

    According to the Risk Assessment Methodology, confidentiality, integrity, and availability are represented through impact when assessing risks.

    2- Why is there no prioritization for actions in RTP? This should be identified based on the risk levels. we only see a list but it's not based on the risks identified

    First is important to note that ISO 27001 does not prescribe how to prioritize actions in the Risk Treatment Plan, so organizations can adopt the prioritization criteria that best fit their needs.

    In the Risk Treatment Plan in Conformio you prioritize the activities by defining the deadlines for their implementation.

    This article will provide you with further explanation about risk treatment:

    • Risk treatment https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#treatment

    • Statement of of conformity

      You asked


      how the laboratory will address the regulatory requirement for reporting statement of conformity in the event of a request to calibrate a measuring instrument used for a regulated purpose as per ISO /IEC 17025:2005 CLAUSE 7.1.3"

      Firstly, it is the requirements of the ISO/IEC 17025:2017, that is the Third edition, need to be met. The requirements for statements of conformity are covered in clauses 7.1.3 and 7.8.6.1. Secondly, understand that the decision rule is a rule that describes how measurement uncertainty is accounted for when stating conformity with a specified requirement. To address the regulatory requirement for reporting a statement of conformity, the calibration laboratory needs to understand the impact to the testing laboratory’s use of the measuring device. That is, the level of risk (such as false pass and false fail) if measurement uncertainty is added to the result or not.  For example,  consider if dealing with an upper tolerance, and the MU is not added, is there a risk of a false pass? Start by determining what the client and regulations require, assess the risk, and then document the decision rule to be applied to calibration results. Finally, remember to reference it in the calibration report.

      For more information on ISO 17025 refer to Advisera ISO 17025 – Where to Start? at https://advisera.com/iso-17025/

    • Filling documents

      1. On the risk management matrix, should we include departments such as finance and administration that are not quite an essential part of the process to make and develop our product?
      Considering the risk management according to ISO 14971:2019 particularly for medical device manufacturers, only risks related to the medical product and which may affect the safety of the product must be covered. This means that finance and administration departments usually are not covered with risk management for medical devices. 

      2. On the 9th document "Design and Developempent" there says we should include record of old versions of the designs of the product, but our question is how much records should we include? Should we include since our first design (which is from 2021) or could we just include the designs from a year ago to now? Or is there a minimum record time that must be met?

      You need to include records from your first design and keep those records for at least 10 years after the last device is sold on the market for all classes except for class III and class IIB implantable which is necessary to keep for 15 years.

    • Should nonconformities undergo a documented risk assessment / analysis?

      ISO 27001 does not prescribe risk assessment to be performed over identified nonconformities, so a company is not obliged to perform it.

      This article will provide you with further explanation about handling non-conformities:

    • Distributor and ISO 13485

      There is no MDR requirement that distributors of medical devices need to be certified according to ISO 13485. But, as stated in Article 14 - General Obligations of Distributors, the following elements must be in place: 

      • storage conditions as stated on the medical device and by the manufacturer
      • have in place a complaint system - how they can receive a complaint and how they will inform the manufacturer of the received complaint
      • must have in place a system for recall - distributor of course will never start a recall, but rather will be a part of the process - they must know how they must behave in a situation when they receive information from the manufacturer that they must withdraw the products from their market.
      • communication with a competent authority
      • have and maintain a shorter version of the medical device file - declaration of conformity, EC certificate, instruction of use, storage conditions, installation, and/or service manual (if applicable)

      For more information, see:

Page 21 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +