White Paper

cGMP and ISO 13485

Integrated Quality
Management System
By Mark Kaganov, Director of Operations, Quality Works
 White Paper

The Food and Drug Administration (FDA) has established and maintains Part
820 – Quality System Regulation (QSR), also known as 21 CFR 820 or “Current
good manufacturing practice” (cGMP). This regulation applies to medical device
manufacturers or importers of devices intended for “human use.” Compliance with
this regulation is expected from any organization that manufactures or imports
such devices into the USA.

The ISO 13485 Standard is widely used in the medical device manufacturing
industry as a means of establishing compliance with Canadian Medical Device
Regulation and European Medical Device Directive. Since the majority of medical
device manufacturers comply with both 21 CFR 820 QSR and ISO 13485
standards, it is practical to consider establishing an integrated 21 CFR 820 and
ISO 13485 Quality Management System (QMS).

Documentation Structure

To establish an integrated QSR and ISO 13485 QMS, an organization may use
approaches outlined in the ISO 10013 Standard, Guidelines for Developing
Quality Manuals. Among other suggestions, this standard gives an example
of a documentation structure that can be used for QSR and ISO 13485 quality
management systems. While the standard suggests using a three-level structure,
most organizations implement four-level documentation structures to include
quality records, as required by both QSR Subpart M – Records and ISO 13485,
element 4.2.4. A typical four-level documentation structure includes: Quality
Manual, Procedures, Instructions, and Records.

Actually, the documentation structure for an organization should most likely start
from the quality policy, as the policy, among other commitments, defines the
regulations and standards that a company intends to comply with. If you choose to
use this approach, your QMS will have five levels, as shown below:

• Quality Policy – level 1

• Quality Manual – level 2
• Procedures – level 3
• Instructions – level 4
• Records – level 5

Quality Policy

QSR, section 820.20 (a) and ISO 13485, element 5.3 require the establishment
of a quality policy. To satisfy these requirements an organization may develop a
quality policy that meets requirements of both QSR and ISO 13485 standards.
While QSR requires a quality policy to include a commitment to quality and be “…
understood, implemented, and maintained at all levels of the organization,” ISO
13485 requirements are somewhat broader. Therefore, an organization can adhere
to the requirements of ISO 13485 which requires that a quality policy include:

cGMP and ISO 13485 Integrated Quality Management System 1

 White Paper

• A commitment to comply with requirements,

• A commitment to maintain the effectiveness of the QMS,
• A framework for establishing and reviewing quality objectives,

The organization shall also ensure that the quality policy is:

• Appropriate for the organization,

• Communicated and understood within the organization, and
• Reviewed for continuing suitability

Despite the fact that these requirements appear to be rather simple, many
consultants and auditors find that most companies have difficulties with
documenting their quality policies by not addressing all the requirements above.
It is important to establish a quality policy that--at a minimum--addresses all
the requirements above because that quality policy will document a company’s
commitment to establish a QMS that complies with the given regulations and
standards. To demonstrate this point, let’s assume that one’s quality policy
does not require its review “for continuing suitability” or does not include “a
framework for establishing and reviewing quality objectives.” If there are no
“triggers,” there is a good chance that these activities will not be performed.
Let’s take a look at a few examples of quality policies that did not address
specified requirements.

“We Practice Continual Improvement to achieve Customer Delight by providing

Customer-Centric, Qualitative … Solutions and Services on time”

Assuming that this quality policy is appropriate to the purpose of the

organization and is communicated, it does not appear to contain “a commitment
to comply with requirements,” a “framework for establishing and reviewing
quality objectives,” and a commitment to quality.” Based on these deficiencies,
this policy does not meet our requirements.
The second example of a quality policy states:

“[Company] will earn customer loyalty by providing products, services, and

interaction experiences of the highest quality and greatest value. To achieve this
result, we will:

1. Ensure that all of our products comply with relevant safety and regulatory
requirements;
2. Ensure our products meet and/or exceed their published specifications;
3. Maintain and continually improve the effectiveness of our product and
service business management systems;
4. Continually monitor the quality of our customer interactions, with the intent
to improve our customer’s total experience;
5. Establish quality requirements for suppliers, partners, and contractors and
hold them accountable to comply;
6. Treat customers in accordance with [Company]’s Standards of Business
Conduct and Privacy policies.”

cGMP and ISO 13485 Integrated Quality Management System 2

 White Paper

This quality policy, while apparently very much customer-focused, still does not
cover a framework for establishing/reviewing quality objectives and committing
to review it for continuing suitability.

One of our clients came up with a quality policy that won our “The Worst Quality
Policy” Grand Prize. Their quality policy simply stated:

“I improve the Quality of Patient Care and all things [Company name]”
This sorry example of a quality policy has been restated verbatim! (The
company name has been omitted). Obviously, this quality policy has met only one
requirement: that it has in fact been “established.”

Integrated 21 CFR 820– ISO 13485 Quality Manual

While QSR does not specifically require the establishment of a quality manual,
Section 820.186 requires a manufacturer to establish a quality system record
that: “…shall include or refer to the location of procedures and the documentation
of activities required by [the QSR].” This definition very closely resembles
requirements for a quality manual for an ISO 13485 compliant QMS. Since a
majority of medical device manufacturers dealing with the US market comply
with both, FDA QSR and ISO 13485 standards, it is a good idea to develop an
integrated quality manual to meet requirements of both, FDA cGMP and ISO
13485 requirements.

A quality manual is the top-level document of a QMS. There are at least two
definitions of what a quality manual for a QMS should be.

ISO 10013, Guidelines for Developing Quality Manuals, element 4.2, gives
detailed suggestions for creating a quality manual. It defines a quality manual,
among other requirements, as a document that should “consist of, or refer to,
the documented quality system procedures intended for [the] planning and
administration of activities which [have an] impact on quality.” ISO 13485 2003,
element 4.2.2 requires a quality manual to include:

1. The scope of the QMS;

2. Details of and justification for any exclusion or non-application;
3. The documented QMS procedures or references to them;
4. A description or interaction between the processes of the QMS; and
5. An outline of the structure of the documentation used in the QMS.

The scope of the QMS is usually located in the corresponding section of the
quality manual. It simply states which activities an organization performs
within the scope of its certification. For example: “My Company, Inc. designs,
manufactures and distributes laser generators for cosmetic surgery applications.”
If an organization does not perform some of the processes required by ISO 13485,
such as design or manufacture, this fact, with justification, is documented in the
exclusions section of the manual.

cGMP and ISO 13485 Integrated Quality Management System 3

 White Paper

After we defined the scope and exclusions, let’s describe used processes and
references to the corresponding procedures. The easiest way to start this is to
transform 21 CFR 820 cGMP and ISO 13485 standards from a set of requirements
into your company’s commitments to satisfy those requirements. For example: If
section 820.5, Quality System, requires that

“Each manufacturer shall establish and maintain a quality system that is

appropriate for the specific medical device(s) designed or manufactured, and that
meets the requirements of this part.” our manual will state:

“QW Medical, LLC. Has established and maintains a quality management system
that is appropriate for the specific medical device(s) designed and manufactured,
and that meets the requirements of 21 CFR 820 QSR.”

Following this approach by addressing all applicable sections of the QSR and the
ISO 13485 standard and referencing supporting procedures, we will establish a
manual that can be used to meet requirements of 21 CFR 820 and ISO 13485.

Interaction between the processes may be documented in a number of ways.

Some companies choose to define interaction of the top-level processes by using
variations of Figure 1 in the ISO 9001 2008 Standard. Combining such a diagram
with references to procedures within the manual will, to a particular degree,
define interactions between your processes. For more detailed process interaction
tool, check out Author’s paper in Quality Progress Magazine or his Process
Interaction Matrix article on the Quality-Works Website.

The last requirement of the element 4.2.2 of ISO 13485 is to outline the structure
of the documentation. Very often companies define their structures as four- or
five-level documentation structures in the documentation management section of
the manual.

Another important function of a quality manual, very often overlooked, is to be a

marketing tool. Well written and professionally published, a quality manual may
become a powerful promotional instrument. It can communicate to your potential
customers, suppliers and subcontractors that your company is not only a quality-
conscious organization, but that it also knows how to document and communicate
its commitment to quality and compliance with regulatory requirements.

I always wonder what companies achieve by stamping their quality manuals in

bold red capitol letters “CONFIDENTIAL.” As far as I am concerned, a quality
manual is a company’s resume for quality, and if you hide your resume, there is a
very good chance that you will never get a job! All Quality Works customers are
encouraged to make their quality manuals public!

cGMP and ISO 13485 Integrated Quality Management System 4

 White Paper

Naming Your Documents

As you may have noticed, the titles of the documents above are quite short.
It is a very typical convention in the medical device manufacturing and other
regulated industries to call the second-level documentation “Standard Operating
Procedures,” known as SOPs. Unless one has a level called “Non-standard
Operating Procedures,” I really do not see a practical or economical reason for
long titles. As long as a short title conveys the idea and leads a user to the right
place within the system, let’s use it. Quality Works relentlessly promotes this
optimization and reduction of waste approach throughout all our publications
and consulting work. Let’s not make things more complicated than they need
to be. For example, one of our customers titled their quality manual as “Quality
Management System Quality Manual.” I bet, just “Quality Manual” will mean the
same for users.

Numbering Your Documents

It is not a specific requirement of 21 CFR 820 QSR or any other regulation or

standard to uniquely number a part or a document. It is a worldwide practice
in most documentation systems to give a document or a component a number
and a title, and to identify its revision level. As long documentation titles that
we discussed earlier, use of document numbering formats very often present
opportunities for improvement.

Once I worked with a cGMP compliant business of less than 100 people,
manufacturing fairly simple surgical instruments. Their documentation system
included a few numeration formats depending on the type of a document. One
of the procedures had a number 000023-001, which they simply called “twenty
three.” Drawings were numbered in a format like 987-323-11-02.

Is it acceptable to have long and difficult-to-read (and difficult-to-remember)

document numbers? Yes, of course! Is it practical? I do not believe so! In the
example above, the procedure number, without the tab, contained six digits. This
meant that the system was prepared to handle almost one million documents
or part numbers. The company had approximately 150 documents and about
the same number of parts and probably would never go beyond doubling those
numbers. If nothing else, just reading these numbers with sequential zeros in
the front may give one a headache. Surprisingly, this is not the worst case. The
business that won our “The Worst Part Number” Grand Prize assigned twelve (!)
characters their part numbers in the alphanumeric format.

cGMP and ISO 13485 Integrated Quality Management System 5

 White Paper

If you are designing or manufacturing a sophisticated X-ray, CAT scan or other

complex piece of equipment, you will need thousands or even millions of parts
and documents. In this case, a long part number format would be needed and will
make business sense. Otherwise, save yourself the trouble of writing all those
zeros and make your numbering system practical. One of my customers, who won
my “The Best Part Number” Grand Prize, numbered their QMS documents as 101,
102, 103, and so on. Short and sweet! Most small- and medium-size companies
will benefit from this optimization approach. After all, isn’t the part title the best
designator? Throughout my entire professional career, I worked only with a couple
of companies that did not use document numbers. Their documents were simply
identified by unique titles and a two-digit revision level, like Quality Manual 01.

Another debatable issue with part-numbering formats is part number designation.

Some management systems associate a part number with a particular part
type. For example, 20-xxx indicates a procedure, 30-xxx indicates a drawing,
P-xxx indicates a policy-level document, and so on. My experience with a number
of medical device manufacturers has convinced me in the benefits of a “no
designation” system. Three of our clients’ systems that used designation failed.
Just recently, one of our clients reported that he ran out of range in his company’s
part-numbering format. The documentation system allowed for assigning
materials through a two-digit designator within the part number. When the
system was designed a few years ago, needing more than 99 materials was not
considered possible. Unfortunately, company’s needs change over time, and just a
few years later, the QMS needed more than 99 materials causing the existing part
number format to fail.

An alternative approach to numbering parts and documents within your

management system is a “no designation” approach. In such a system, documents
or parts are given sequential unique numbers within a specified format, regardless
of their level, type, material, application or other attributes.

For more information on FDA QSR / ISO 13485 Integrated Quality Manual,
Process Interaction Matrix and other documents and services, visit Quality Works
Website at www.quality-works.com.

About the Author

Mark Kaganov was born and raised in Moscow, Russia. He graduated from
Moscow University of Radio-electronics and Automation, where he earned his
Bachelor’s and Master’s degrees in design and technology of electro-mechanical
equipment. While attending the university, he worked for the Institute of Plastics,
the former USSR’s leading organization in the research and development of plastic
materials.

cGMP and ISO 13485 Integrated Quality Management System 6

 White Paper

In 1981, Mr. Kaganov immigrated to the United States and continued his
professional career in Quality Management Systems and Research &
Development in the plastics, electronics, and medical device manufacturing
industries. He has worked for major US corporations such as Capitol Records,
RCA, COBE Laboratories and Medtronic. Through his professional career Mark
Kaganov authored five international patents, numerous publications and a book in
the field of quality and environmental management systems.

Since 1990, Mark Kaganov has been a Director of Operations and a Lead Consultant
at Quality Works. For many years he is a certified QMS and EMS Lead Auditor.

About Quality Works

Quality Works is the one-stop-shop for information, documentation sets,

training, auditing and consulting in the areas of ISO 9001, ISO 13485, FDA QSR,
ISO 14001, AS9100 and BS OHSAS 18001 quality, environmental and health
& safety management systems. The company is an international expert in
management systems and has published a number of authoritative publications
and documentation systems. Quality Works approaches management system
issues from a non-technology approach and talks to client management in their
own language. Its customer base spans the Americas, Europe, the Middle East and
Asia. More information on services and products provided worldwide by Quality
Works is available at http://www.quality-works.com.

Contact:
Mark Kaganov
Director of Operations
Quality Works
303-985-7942

© Quality Works

About MasterControl

MasterControl Inc. creates software solutions that enable life science and other
regulated companies to deliver life-improving products to more people sooner.
MasterControl’s integrated solutions accelerate ROI and increase efficiencies by
automating and securely managing critical business processes throughout the
entire product lifecycle. More than 1,000 companies worldwide, ranging in size
from five employees to tens of thousands, rely on MasterControl cloud solutions
to automate processes for new product development, clinical, regulatory, quality
management, supplier management, manufacturing and postmarket surveillance.
MasterControl solutions are well-known for being scalable, easy to implement, easy
to validate and easy to use. For more information, visit www.mastercontrol.com.

© 2019 MasterControl Inc. All rights reserved.

WPXXXXUSENLT-02/19

cGMP and ISO 13485 Integrated Quality Management System 7