Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Guest
ISO 13485:2016 is the international standard requirement for a medical device manufacturing quality management system. ISO 13485:2016 standard is based on the requirements of ISO 9001:2008. ISO 13485 includes the entire ISO 9001:2008 standard with additional requirements included in blue italics text. One major distinction of ISO 13485 is that it is intended to also be required for regulatory purposes as well as a non-statutory requirement for a quality management system.
For more information on this topic, please see the following article:
Also, the following articles can be helpful in understanding the ISO 13485:2016:
I would need more information. It depends on who processes personal data. The processor collects and processes personal data on behalf of the controller, according to the article 28 GDPR. So if the contractor software company will process data on your behalf, you will be the controller and the contractor will be the processor.
On the contrary, if you are developing a software and license it to the contractor who will processes data on its own behalf and on its own servers, the contractor will be the controller and you might be the processor if you have any access to personal data (i.e. for maintenance reason).
You can also find more information here:
You can consider enrolling in our free EU GDPR Foundations Course
In the procedure 12.4 Procedure for ionizing radiation sterilization, you need to fulfill only elements that are marked with comments. Of course, your data depends on your specific process of radiation, and only you know which they are (for example in section 3.4 Alara Principle).
If you have anything else that you consider important, of course, that you can add to the procedure.
If your sterilization process is outsourced, take into consideration to make this procedure in collaboration with the company that provides this process for you.
For more information about common mistakes with ISO 13485:2016 documentation control and how to avoid them, please see the following article:
Management review is more than just a meeting, it is the whole process of collecting inputs, transforming data into information, study and make decisions. So, using your language, management review is a working meeting. The purpose is not to make a presentation, the purpose is to evaluate management system adequacy, suitability and effectiveness and make decisions about improvement opportunities, need for changes and resource needs.
You can find more information below:
How is a pharmaceutical company performing it's own drug stability testing in their own lab required to be certified?
If I understand correctly, your question is for medical device software. For manufactures of medical device software, necessary is that ISO 13485:2016 must be implemented. The next important requirement is a validation of that software that needs to be in compliance with ISO IEC 62304:2006 Medical device software — Software life cycle processes.
If you do not own the product and are not responsible for placing the software on the market, you only have to have implemented ISO 13485:2016. Product owners also need to have implemented ISO 134895:2016, but also the manufacturer is responsible for preparing the Technical documentation in accordance with Medical device regulation (2017/745). Each medical device must be classified according to the rules stated in MDR Annex 8 – Classification rules - https://advisera.com/13485academy/mdr/classification-rules/.
Medical devices can be classified into the following 6 classes: Class I, Is (sterilized medical devices), Ir (reusable medical devices), IIa, IIb, and class III. Class, I medical devices can be placed on the market without Notify body, while other classes require to Notify body.
After preparing the Technical file, the manufacturer is responsible for certified medical device software with Notify body for class Is, Ir, IIa, IIb, and class III.
More information you can find on the following link:
For any other particular question, do not hesitate to contact me.
You asked About
1) techniques of extracting objective evidence in auditing
Objective evidence is obtained by starting with a well define purpose and scope for the specific audit. For each activity you should specify the audit criteria, meaning what the requirements are that you will compare your audit evidence to, in order to determine if audit criteria are met or not (finding of compliance or noncompliance). The techniques to obtain objective evidence involve making factual observations during a witnessing of a process; interviewing personnel to obtain statements; as well as document and record review by cross checking that stipulated data and information is available and controlled .
You also asked
2) how to improve on my auditing competency
You can improve you auditing skills and competency by the following means
You also asked
3) how do you relate ISO 9001 with other quality ISO like ISO 15189:2012?
The ISO 9001 principles (for example evidence based decision making, process approach) are incorporated into ISO 15189 and many other standards (including ISO 17025). Further more the management requirements such as corrective actions, are part of both standards.
You also asked
Do I need ISO 9001 to implement ISO 15189:2012?
No you do not, however a knowledge of the standard would be useful.
For more information on Auditing, see the Expert Advice Q&A to Auditing impartiality https://community.advisera.com/topic/auditing-impartiality/
The ISO 17025 toolkit at https://advisera.com/17025academy/iso-17025-documentation-toolkit/, covers the requirements for ISO 17025.
The separate ISO 17025 document templates and links to their related documents are available as follows:
Internal Audit Procedure is available at https://advisera.com/17025academy/documentation/internal-audit-procedure/
Addressing Risks and Opportunities Procedure is available at at https://advisera.com/17025academy/documentation/addressing-risks-and-opportunities-procedure/
ISO 17025:2017 addresses the topic of scope of accreditation in clause 5.3, Structural Requirements. A laboratory is required to have a defined and documented scope for ISO 17025 accredited laboratory activities, meaning those that they perform themselves on an ongoing basis (do not subcontract) and which conform to ISO 17025:2017.7
The ISO 17025 toolkit at https://advisera.com/17025academy/iso-17025-documentation-toolkit/, covers this requirement; specifically through the Quality Manual https://advisera.com/17025academy/documentation/quality-manual/