Search results

ISO 45001 Mandatory Documents

I would like to start by pointing out that the audit is not a pass/fail. Implementing a management system is not just meeting the ISO 45001 requirements but rather ensuring your management system is effective and efficient as well as meeting all requirements. This means implementing the processes required to prevent injury and ill health in your workplace using the ISO 45001 requirements as a framework, but also meeting legal and other requirements around OH&S management.

The mandatory documents are what the ISO 45001 standard requires, but others may be needed to promote consistency of processed or to meet legal requirements. While these might be the only document you end up needing, just preparing the documents is not all that is required to implement the system, you need to put in place the processes needed to prevent injury and ill health for your unique organization.

Documentation is not everything.

Contingency Plan / 6.1.2.3

You must take SI-3 into account; SI-17 has been deleted and superseded by SI-3.

h) You must provide training on contingency plans to the relevant employees in accordance with item (b). You may tailor this training to specific employee roles; for instance, the training for operators may differ somewhat from that for white-collar staff.

ISO 9001:2026 Changes and IATF

Nothing will happen regarding the IATF 16949:2016 standard until it is revised. Assuming the revision of the IATF standard takes place around the end of 2027, the transition period will then begin. It seems a bit too early to write down the details for now.

REVIEW OF RISK REGISTER AND ASSESSMENT - TREATMENT REPORT

Good morning,

We are trying to update the risk register based on our internal audit program. We would like to keep the same risks currently listed, but we need the related assessment and treatment report, as well as the statement of acceptance of residual risks, to be dated within this period and not from last year. 

We’ve tried several different approaches, but none have worked. We need the documents to show a current date because they must be filed with the auditor for the annual audit. How should we proceed?

Thank you, 

kind regards.

How to comply with 7.1.5.3.1.d

You could investigate whether there is a standard regarding the calibration of load cells for international traceability.

If such a standard exists, you might be referred to the relevant instruction.

Regarding MSA, a GRR study is applicable to measuring instruments where operator influence is a factor—such as calipers, micrometers, and the like.

For instance, it is not typically a suitable method for precision balances. For such devices measuring instruments where operator influence is negligible, a stability study is conducted.

Variations in the equipment over time are monitored and reported using either Cg/Cgk or Cp/Cpk indices. The VDA 5 MSA manual references Cg/Cgk, whereas the AIAG MSA (Revision 4) manual references bias, stability, and linearity studies.

These analyses can be performed using software, or the results can be analyzed graphically using X-R charts.

Expired consumables and reagents

Probably a national institution or a laboratory specialising in diagnostics, biology, or a related field.

Templates: Technical Documentation for Medical Device & CER

Hello. Thank you for your inquiry. Here are my answers:

1. Regarding the CER - no, we do not provide sample wording. However, each of our documents includes guidelines and additional explanations on how to complete the relevant sections.

2. The “Technical Documentation for Medical Device” template should be understood mainly as a technical documentation index / summary file rather than a complete MDR Annex II and Annex III template.

It provides a useful high-level structure for collecting and referencing key elements of the technical documentation, such as device identification, intended purpose, Declaration of Conformity, GSPR, applicable standards, design and manufacturing information, materials, risk management, biocompatibility, pre-clinical data, stability, sterilization, software, usability, labelling, IFU, clinical evaluation and post-market surveillance.

Should you wish to review the document in more detail, we can organize an online meeting and go through the template together. During the meeting, we can clarify which sections are already covered by the template, which supporting documents need to be prepared separately, and what additional content would be required to make the technical documentation fully aligned with MDR Annex II and Annex III.

The validation of LIMS

You are correct that LIMS validation is not as straightforward as checking a spreadsheet, but it is also important to distinguish between a standard commercial LIMS package and laboratory-specific customisation.

For a commercial off-the-shelf LIMS, the laboratory would not normally be expected to validate the entire software package from first principles. However, the laboratory should be able to demonstrate that the system selected is suitable for its intended use, that the correct version is controlled, and that supplier information, access control, backup, recovery, support, and maintenance arrangements are in place.

The validation or verification effort should focus mainly on the parts of the LIMS that are configured or customised for the laboratory’s own use. This includes any areas where incorrect configuration or system failure could affect sample identity, result validity, calculations, reporting, confidentiality, traceability, or data integrity.

Key elements to consider include:

1. Intended use and scope
   Define which laboratory processes the LIMS supports, such as sample registration, result entry, calculations, review, authorisation, reporting, storage, or data transfer.
   
   
2. Configured workflows and user requirements
   Document laboratory-specific workflows, user roles, access levels, approval steps, report templates, test methods, units, limits, flags, and decision rules.
   
   
3. Risk assessment
   Identify where errors in configuration, customisation, data transfer, or user access could affect the validity or integrity of laboratory results.
4. Testing of customised or configured functions
   Test the LIMS using realistic laboratory scenarios, including sample login, result entry, amendments, review and approval, report generation, and retrieval of records.
   
   
5. Calculations and data transfers
   Verify any laboratory-specific calculations, rounding rules, unit conversions, reference ranges, specification limits, decision rules, instrument imports, exports, and interfaces.
   
   
6. Access control and audit trails
   Confirm that permissions are appropriate, unauthorised changes are prevented, and changes to data or configuration are traceable.
   
   
7. Backup, recovery and business continuity
   Confirm that records can be protected, restored, and accessed when needed.
   
   
8. Change control
   Ensure that software updates, configuration changes, new methods, calculation changes, report template changes, and interface changes are assessed, tested, approved, and recorded before use.

The evidence should therefore show that the laboratory has assessed the commercial LIMS as suitable for its intended use and has tested the laboratory-specific configuration, customisation, calculations, interfaces, reports, access controls, and data integrity controls before routine use.

Certification Scope

First, clearly describe what activities are planned outside the current certified scope. This can be documented as a planned scope extension, business decision, regulatory strategy, or change-control record. Then, perform a gap analysis and impact assessment to determine what new activities are required in terms of regulatory requirements, ISO 13485 clauses, competence, infrastructure, suppliers, records, risk management, validation, PMS, technical documentation, etc. According to the results of this GAP analysis, develop or revise procedures before implementation. The next step is to train relevant personnel, assign responsibilities, qualify suppliers if needed, establish records, and begin operating the new processes under controlled conditions.                                                                                                                                                                  Before asking the certification body to extend the certified scope, the new activities should be included in the internal audit programme and discussed in management review, at least to the extent that implementation and readiness can be demonstrated. Only after the QMS has been updated, implemented, and evidence exists, you can ask the certification body to assess and formally extend the certified scope.

The risks of losing the ISO 13485 Accreditation

Assuming SSD = Sterile Services Department, the hospital would be at potentially high risk, but the actual level depends on why ISO 13485 was lost.

Loss of certification does not automatically mean instruments are unsafe, but it removes an important independent assurance that the SSD’s QMS is controlled. Your hospital would likely be at medium risk if the loss was administrative, but high risk if it resulted from process-control failures. If the SSD cannot demonstrate validated sterilization, effective cleaning, controlled release, traceability, competent staff, maintained equipment, and effective CAPA, the risk becomes patient-safety critical, not merely a quality-system issue.