At a recent medical device industry event in San Francisco, speaker Vee Arya from Cannon Quality Group asked the audience for a show of hands regarding their transition status to the 2016 version of the ISO 13485 standard for Quality Management Systems, which must be completed by March 31, 2019.
Less than half the audience raised their hand to say they’d completed the transition; a third said they were still in transition; and a smattering of hands went up when asked who hasn’t started the process yet.
Ideally, with the deadline being less than nine months off, your organization would have transitioned by now to give yourselves a full year to conduct business under the new standard and conduct the requisite internal audits – and to iron out the kinks.
But maybe the reality is that for many good reasons (and perhaps a few not-so-good reasons), you’re not that far along yet. At a minimum, you’ll want to approach the deadline with an eye to avoiding some of the pitfalls that have caught up with others in the medical device world.
You’ll also want to talk to your registrar about the certification process and what they require. You might discover that if you haven’t performed a regular internal audit to the new standard in advance of the notified body recertification, you will automatically be hit with a finding.
Some things might be unavoidable at this point given the looming deadline, but how can you mitigate the risk of findings and their severity?
Nicolle Cannon, founder/CEO of the Cannon Quality Group, says: “You need to think through every part of your quality system. The auditors want to see that you thought through every piece of it and then depending on the stage of the business, the depth and data for that thinking will grow.”
At a minimum, have a plan and make sure you get credit for having a plan. Your auditors will want to see the steps that went into your transition. Your plan can and should take into account the stage of your business.
“You don’t need to do something super burdensome early on, but if you put some thought into it, put a plan together, have something to talk to – whether or not you got it 100% accurate will be less of a big deal in the auditor’s view,” says Cannon. “It’s more that they want to see that you’re trying; that you made an effort and you’re really working toward it.”
Pay attention to training, because whatever your timetable, auditors will want to see how people were trained, as in how often and how well.
“How big of a risk there is to your training process definitely aligns with where you are, at what stage of your business,” says Cannon. “When you’re early on in development, there are fewer people interacting in the quality system than once you’re commercial. The more people who are engaged in the process, the more risk; and that needs to be addressed per the new standard and should be included in your plan or your process.”
Audit early and often. Many plans include not only a gap assessment but also a Phase 1 internal audit (are the new and/or modified SOPs compliant?) and a Phase 2 internal audit (are we doing the things we said we were going to do?).
“One of my philosophies on internal audits is to steer clear of trying to do a full system audit too soon, because the hardest part is not having enough time with the process to have anything to audit. It’s going to be a while before you have enough for the whole system in order to audit. If you can do a first section in three months, and then in another three months do another section and build the data, the auditors will be happy with that. Again, they want to see that you’re trying and you’re assessing and iterating.”
Realize that help is available. Quality management contractors and consultants can be deployed to take critical items off your plate and help you meet your milestones. Outsourced talent will also bring a wealth of experience helping other industry players transition, some of whom probably faced many of the same challenges you do. It’s often a lot faster than recruiting, hiring, and training your way to the deadline.
“We see so many ways people implement quality systems, and can bring that to the table to help you make changes that fit for your organization, based on a whole palette of changes we’ve seen that have worked,” says Cannon. “We’ve also seen that a lot of people want to own this change so in order to do that, maybe they need us to support them in other ways by taking something else off their plate. They can then make the change and have us come back in to check it. I think it’s something that is best done together as a partnership because it’s a system you want to understand, and understand why you made the changes so you can speak to an auditor. No matter what you do, it should be a collaborative relationship.”
Cannon Quality Group has a long background of supporting medical device start-ups in meeting their milestones. Regardless of the status of your transition to ISO 13485:2016, we can help you be in the best position possible when the registrar knocks on your door.