Search results

Is ISO 13485 for fertility company?

Yes, ISO 13485 will be the right option since it includes Research and development part. There are some specialties within ISO 13485 that are requested for the design and development of in vitro medical devices that are not covered in other standards or norms. We have developed Desing and development toolkit that is in compliance with  both ISO 13485 and EU MDR 2017/745.

Preview of the some of documents you can find on the following links:

• Procedure for Design and Development https://advisera.com/13485academy/documentation/procedure-for-design-and-development-iso-13485-2016/
• Design and Development File https://advisera.com/13485academy/documentation/design-and-development-file-iso-13485-2016/
• Project Plan and Review https://advisera.com/13485academy/documentation/project-plan-and-review-iso-13485-2016/
• Change Review Record https://advisera.com/13485academy/documentation/change-review-record-iso-13485-2016/

• Annual Audit Program

  I’m assuming you are referring to a certification audit perspective.

  Considering that, your assumptions are correct. The standard, internal policies and procedures, and applicable legal requirements (e.g., laws, procedures, and contracts) related to the ISMS are mandatory criteria for the internal audit.

  The point about the audit criteria definition in the standard is that you can decide how to perform the audit to cover the ISMS scope (several small audits or a single one). You can use the audit criteria to set groups of elements to be audited. For example, you can decide to audit first IT processes then SW development processes, and then HR processes. Or you can decide to audit first processes related to the higher risks. Or you can perform more than one audit in areas with a history of a high quantity of incidents or non-conformities.

  Additionally, you can decide to include references, like ISO 27002 or NIST Special Publications, if they were used by the organization to implement their controls.

• Expired reagents

  Yes, Clause 6.4.9 does apply, as the expired reagents are “outside specified requirements”. The laboratory must assess whether they can be used without invalidating test method results. This is the performance risk assessment that must be done. Consider the risk. It is the Laboratory’s decision whether to spend resources on testing if the expired reagents can be used or not. It depends on the nature of the reagent and test method in terms of possible breakdown products and interferences, or perhaps the reagent will be ineffective due to other reasons.  Typically use a new batch of reagent (which is not expired) and do a comparison, running the usual QC samples plus test samples in the two batches. You will need to decide on what basis you will continue using the expired reagent as it may change with time. For example if the reagent blank, and control samples fall in the expected analytical range (pass QC) then continue using and run the batch.

• Energy Management

  Unless you have specific legal requirements (e.g., laws, regulations, or contracts) demanding implementation of ISO 27019 controls, you do not need to include them in the ISMS implementation.

  Please note that ISO 27001 controls are comprehensive enough to be applied to any industry, and ISO 27019 only provides specific implementation guidance and controls for the energy utility industry.

  In case you need to include ISO 27019 in your implementation, based on the results of risk assessment and applicable legal requirements, you include relevant additional recommendations to existent controls they refer to (e.g., in case there are specific recommendations for control A.9.1.1 – Access control policy, you included these specific recommendations in the way you implement it), or you include a new control specific of the standard (e.g., control 12.9.1 – Integrity and availability of safety functions).

• How to treat risk with own control?

  I'm assuming that this question is about Conformio.
  
  Considering that, first of all, we are sorry for this situation.

  At this moment it is not possible to include other sources of controls besides ISO 27001 Annex A in the risk register, because large majority of companies do not find it necessary to add controls not listed in Annex A.

  ISO 27001 Annex A is a comprehensive set of controls, and if we know which control you are planning to use, we may be able to link to an equivalent control from ISO 27001 Annex A.

  In case there is no possible relation to Annex A controls, a workaround would be for you to upload to Conformio document informing which risk (i.e., asset, vulnerability, threat, risk value) will be treated by controls not related to ISO 27001 Annex A, also stating the residual risk.

• Responsibilities of Distributors for collection of Medical Devices and incident reporting

  The obligation of the distributors regarding the collection of Medical devices and incident reporting is described in Article 14 - General obligations of distributors points 4, 5, and 6. First of all, this means that the distributor must be available to the manufacturer for any instructions given by the manufacturer regarding a recall or incident. Next, the distributor must be ready to communicate with the competent authority and provide a sample of the product when necessary. Furthermore, if the distributor himself receives a complaint, he must immediately inform the manufacturer about it, and further act in accordance with the manufacturer's instructions.  

  For more information see:

  • EU MDR Article 14 - General obligations of distributors https://advisera.com/13485academy/mdr/general-obligations-of-distributors/

  • Do medical device distributors and 3rd party logistics providers benefit from implementing ISO 13485 and MRD?

    Yes, 3rd party logistics can be certified under ISO 13485. In the standard, in the Scope section is stated that this International Standard specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services. Such organizations can be involved in one or more life cycle stages, including design and development, production, storage and distribution, installation, or servicing of a medical device, and design and development or provision of associated activities (e.g. technical support). Therefore, 3PL can implement ISO 13485.   

  • SoA 2022 version

    Several certification bodies are already accredited for the 2022 revision of ISO 27001.

    Please note that all ISO 27001 certification bodies need to be qualified to be certified against ISO 27001:2022 by the end of October 2023.