Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Guest
A coding system in our toolkit is just a suggestion. It means that you can use your own system however it suits you and how you feel you and your employees will do better. It is just necessary to ensure that current revision status of and changes to documentation are identified; that relevant versions of applicable documents are available at the point of use, and to that documents remain legible and readily identifiable.
If you would like to differentiate stated documents and records, you can use the system from your previous company. So, you can code your documents with SOP, WI, FORM, and REP and just add a number, or you can also add a department code. Here are some examples:
SOP-01 can be procedure for Document management, SOP-02 can be Internal audit procedure.SOP-Q-01 can be code for the first standard operating procedure for Quality department; SOP-SAL-01 can be first standard operating procedure in the Sales department.
This is only the suggestion.
For more details please see the following article:
You are right, there is no procedure for translation labels and instruction of use. We concentrated on this toolkit on documentation related to ISO 13485 and documented requirements from MDR. Nowhere in the MDR is it stated that it is necessary to document the translation procedure. Your labels and Instruction for use must have proper symbols according to harmonized standards, and you need to ensure that translation is correct and professional. Usually, medical device manufacturers use certified translation companies for this.
For more details on mandatory documentation from MDR, please see the following white paper:
I am looking for the needs and expectations of interested parties as per the ISO 9001:2015 standard.
ISO 27001:2013 does not have requirements for preventive actions, however, preventive actions are in fact included in the risk assessment and treatment because the essence of risk management is to recognize a potential problem before it happens, and by treating it to prevent such an incident from happening.
Your assumption is correct. Even for organizations of the same size and industry there may be different relevant requirements because each organization has its own view of the business and market, so they develop different strategies, and also may have different approaches toward risks
This article will provide you a further explanation about the identification of requirements:
These materials will also help you regarding the identification of requirements:
One initial question I have is whether there is a “required” number of controls that need to be audited for a certification? I was thinking that an auditor would check 15-20 randomly selected controls?
For a certification audit, all controls identified as applicable in the Statement of Applicability will be audited, and this number will vary depending on the results of risk assessment and legal requirements you have to comply to. A reduced number of controls will be audited only during surveillance audits, where the auditor will focus on the controls applicable in the scope of the audit.
For further information, see:
Any thoughts or recommendations for how best to approach this would be helpful and appreciated!
The best way to approach this situation is to prepare a proper internal audit checklist for your internal audit (performing at least one internal audit is also mandatory for certification). This way you will have a good understanding of the status of your ISMS before the certification audit
This article will provide you a further explanation about internal audit:
These materials will also help you regarding internal audit:
It is very hard to understand through this way why the auditor concludes this way. To me personally, this does not seem as a non-conformity. In requirement 7.4.2 Purchasing information is stated that, when applicable, there should be written agreement that supplier will notify the organization about changes in the purchased product prior the implementation of any change that affect ability of the purchased product to meet specified requirements. Therefore, if you stated that this is internal change order that did not effect form, fit or function of the assembly if there is no “no change agreement”, to me than it is not a non-confomrity.
Although this is for ISO 9001, following material will provide you information about audit nonconformities:
- Article – How to write a good ISO 9001 audit nonconformity? - https://advisera.com/9001academy/blog/2018/04/24/how-to-write-a-good-iso-9001-audit-nonconformity/
It does not make a difference if the laboratory has its own ISO 9001 certification or the entire facility has ISO 9001 certification, which includes the laboratory. The laboratory will, as an organisation, only have ISO 9001 certification. ISO 17025:2017 international standard accreditation requires more of a laboratory than just meeting the requirements of a quality management system (such as 9001). It is conformity assessment standard where the technical and overall competence of the laboratory is established, peer-assessed, confirmed and recognised by an accreditation body.
Have a look at the following expert answer ISO 9001:2015 vs ISO 17025 at https://community.advisera.com/topic/iso-90012015-vs-iso-17025/ for further information on how ISO 9001 is integrated into ISO 17025 so the management requirements do not need to be re-addressed separately within ISO 17025.
Also have a look at the article ISO 17025 vs. ISO 9001 – Main differences and similarities for some more information, available at https://advisera.com/17025academy/blog/2019/07/11/iso-17025-vs-iso-9001-main-differences-and-similarities//
According to the MDR, the manufacturer must have implemented a quality management system. It does not need to be certified (there is no such requirement), but documentation and processes need to be implemented. Notified Body will during MDR audit also audit the quality management system.
The Notified Body must be mentioned on the Declaration of Conformity for all classes besides class I – only for medical devices that are issued on the market as self-declaration.
These articles can provide you further information:
EU MDR – Easy-to-understand basics https://advisera.com/13485academy/what-is-eu-mdr/
First-, Second- & Third-Party Audits for medical device manufacturers & suppliers https://advisera.com/13485academy/knowledgebase/first-second-third-party-audits-for-medical-device-manufacturers-suppliers/