Search results

ISO 13485:2016 vs 13485:2012

The European standard, EN ISO 13485:2012 Medical Devices - Quality Management Systems - Requirements for Regulatory Purposes, has been published, after approval by CEN on January 24, 2012. This replaces EN ISO 13485: 2003, although the text of the global standard ISO 13485:2003 is unchanged, only the foreword and annexes in the European version have been revised. Therefore, there is no different requirements in ISO 13485:2012 compared to ISO 13485:2003. 

To identified new  requirements of ISO 13485:2016 vs 13485:2003, at the end of the new ISO 13485:2016, in Annex A there is a table - Comparison of content between ISO 13485:2003 and ISO 13485:2016, where you can see all new requirements and differentiation between these two versions. 

On the following link, there is an article with the list of mandatory documents required by ISO 13485:2016: https://advisera.com/13485academy/blog/2017/01/18/list-of-mandatory-documents-required-by-iso-134852016/ 

On the following link you can download free matrix ISO 13485:2016 vs. ISO 13485:2003: https://info.advisera.com/13485academy/free-download/iso-13485-2016-vs-iso-13485-2003-matrix

Also, you can find on Advisera 13485 blog a lot of articles considering certain requirements from ISO 13485: 2016 and how you can fulfill them: ISO 13485 Blog https://advisera.com/13485academy/blog/

Internal Auditor

First, each organization has the authority to define the competency requirements of its internal auditors. 

Second, as good practice internal auditors should comply with two basic requirements:

They know the standard;
They know good auditing practices
 

So, your internal auditors for ISO 9001:2015 already know good auditing practices. Do they know ISO 13485:2016? Can you certify their knowledge?

As long as they meet those two criteria, they can be your internal auditors.

The following material will provide you information about internal audits:

- Five main steps in the ISO 13485:2016 internal audit - https://advisera.com/13485academy/knowledgebase/five-main-steps-in-the-iso-134852016-internal-audit/
- Free webinar - How to perform an ISO 14001:2015 internal audit - https://advisera.com/14001academy/webinar/how-to-perform-an-iso-14001-2015-internal-audit-free-webinar/
- free online training ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/ />- Book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/
 

Business Continuity and Disaster Recovery Plans

Please note that these templates have different purposes, and will be used separately by different teams during a disruptive event, so it is crucial that some commonly needed information, such as contact details, or authorizations, is displayed in every document.

This article will provide you further explanation about BCP and DRP:
- Disaster recovery vs Business continuity https://advisera.com/27001academy/blog/2010/11/04/disaster-recovery-vs-business-continuity/

ISO 13485 and Staff morale

In order for a staff to have confidence in their company they must first have confidence in their management. Implementing ISO 13485 will show that management are committed to taking the steps necessary to running an up to date and competitive company which will give the vital sense of pride that staff needs. When outlining what employees role within the company, it is important that the instructions are explained as clearly and specifically as possible. 

Regardless of that the following article is about ISO 9001, this article that explaines what are the benefits for employees of introducing a quality system, so please read it at the following link: What are the benefits of ISO 9001 for your employees?

https://advisera.com/9001academy/blog/2016/06/14/what-are-the-benefits-of-iso-9001-for-your-employees/

Plan de transicion de normativa en calidad/inocuidad

Para llevar a cabo la transición de la norma ISO 9001:2008 a la nueva versión de ISO 9001:2015 le sugiero que realice los siguientes pasos:

1. Definir el contexto de la organización: se trata de un njuevo requisito de ISO 9001:2015 donde la organización debe determinar tanto las cuestiones internas como externas que afecten a su sistema de gestión de calidad. 

2. Hacer un listado de las partes interesadas: también debe de definir en este paso las necesidades y expectativas de las mismas.

3. Realizar una revisión del alcance del sistema de gestión de calidad de su organización.

4. Demostrar el liderazgo:  la alta dirección de la organización tiene que demostrar su responsabilidad con el SGC, proporcionar recursos y establecer una política de calidad y objetivos de calidad.

5. Alinear los objetivos del SGC con la dirección estratégica de la organización.

6. Evaluar los riesgos y las oportunidades así como llevar a cabo un plan para poder abordarlos

7. Control operacional: en esta nueva versión se requiere llevar a cabo un mayor control de los procesos

8. Revisar el proceso de diseño y desarrollo

9. Llevar a cabo un control de los proveedores externos: mediante una serie de criterios que establece la organizació

10. Evaluación del desempeño: la organización necesita establecer qué es lo que va a ser monitoreado, cómo y con qué frecuencia.

11. Medición y reporte: este requisito se enfatiza en la nueva versión de la norma. 

Estos materiales pueden serle de ayuda para entender mejor la transición a la nueva norma ISO 9001:2015

- Artículo - How to make the transition from the ISO 9001:2008 revision to the 2015 revision: https://advisera.com/9001academy/blog/2015/10/06/how-to-make-the-transition-from-iso-90012008-revision-to-the-2015-revision/

- Inscríbase gratis en este curso -  Curso de Fundamentos de la nroma ISO 9001:2015 - https://advisera.com/es/formacion/curso-fundamentos-iso-9001/

- Libro – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/  

Performing an AS9102 FAI inspection

AS9102 is a guidance document on how to perform first article inspection, and can be used by anyone. It is not possible to be certified to AS9102, and you do not need to be certified to AS9100 to use the FAI guidelines.

For a quick summary of AS9102 see the article: How Does AS9101, AS9102 & AS9103 Relate to AS9100 Rev D?, https://advisera.com/9100academy/blog/2017/10/23/how-does-as9101-as9102-as9103-relate-to-as9100-rev-d/

Cybersecurity audit

First, it is important to note that ISO 27001 certifications for auditors (internal auditor, and lead auditor) refers to information security, not cybersecurity (which covers only a small part of information security).

Considering that, there are no prerequisites for a person to attend an ISO 27001 auditor course and take the exam.

These articles will provide you further explanation about ISO 27001 certification for auditors:
- ISO 27001 Internal Auditor training – Is it good for my career? https://advisera.com/27001academy/blog/2016/03/29/iso-27001-internal-auditor-training-is-it-good-for-my-career/
- How to become ISO 27001 Lead Auditor https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/
- What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/

These materials will also help you regarding ISO 27001 certification for auditors:
- ISO 27001:2013 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/

Risk Assessment

Please note that the steps to define residual risks are:
- Risk identification (i.e., identification of elements that compose the risk, and already implemented controls)
- Risk analysis (i.e., the definition of risk value, considering any already implemented controls)
- Risk evaluation (i.e., comparing the risk value to risk acceptance criteria to decide if additional treatment is required)
- Risk treatment (i.e., defining which treatment is to be applied, and its effect on the risk)

In case you evaluate that no additional treatment is required (i.e., the risk is accepted), then the identified risk is the residual risk.

In case you evaluate that additional treatment is required (e.g., avoid, mitigate, or transfer the risk), then, in this case, you have to define the new value of the risk, considering the new applicable controls and this one will be the residual risk.

Surveillance audits

1. Does the external auditor have to do complete surveillance for all controls in the SOA the same as the first year of certification?

Only during certification audits all controls in the SoA must be audited. During each surveillance audit, the auditor can cover only part of the controls, provided that all controls are audited during the certification cycle (e.g., if you have 3 surveillance audits between certification audits, all controls must be audited at least once in these three audits).

This article will provide you further explanation about surveillance audits:
- Surveillance visits vs. certification audits https://advisera.com/27001academy/knowledgebase/surveillance-visits-vs-certification-audits/

2. How long does it take to complete the surveillance audit with regard to the initial certification audit duration?

The total days to complete a surveillance audit will depend on the defined ISMS scope (e.g., number of locations, number of employees, etc.), so without detailed information we cannot provide a precise answer for your case.

As a general example, we can say that if the certification audit took 5 days to be performed, the surveillance audits will take between 2 to 3 days.

Product complaints

There is no prescribed deadline for handling product complaints in ISO 13485:2016, in requirement 8.2.2. Complaint handling. It is the manufacturer who must define the time within which the complaint must be resolved in accordance with applicable regulatory requirements. 

For more information on complying with ISO 13485:2016 requirements, please read the article:

How to comply with ISO 13485:2016 requirements for handling complaints  https://advisera.com/13485academy/blog/2017/03/21/how-to-comply-with-iso-134852016-requirements-for-handling-complaints/

For more information managing recalls and advisory notices for medical devices according to ISO 13485, please read the following article:
How to manage recalls and advisory notices for medical devices according to ISO 13485  https://advisera.com/13485academy/blog/2017/08/31/how-to-manage-recalls-and-advisory-notices-for-medical-devices-according-to-iso-13485/