See Full Document Text
File No:29/MISC/3/2017-DC(288)
Drugs Controller General (India)
Directorate General of Health Services
FDA Bhawan, Kotla Road, New Delhi
Date: 2 \-2-2017
NOTICE
Subject: Finalization of audit fee of Notified Bodies under Medical Devices
Rules, 2017- Reg
As you are aware that Medical Device Rules 2017 has already been published vide
G.S.R. 78 (E) dated 31.01.2017 under Drugs and Cosmetic Act to regulate the
manufacture, import, sale and distribution of the medical devices and said rules are
effective from 01.01.2018.
The notified bodies registered with CDSCO under provisions Medical Devices Rules,
2017, shall carry out audit of manufacturing sites of as per Medical Devices Rules,
2017.
As per the provisions of Rule 16 of Medical Devices Rules, 2017, the fee chargable
by notified bodies, as approved by competent authority of Ministry of Health &
Family Welfare in the Central Government, are as under:
e Rs.20, 000 per man-day for audit of manufacturing site including product
assessment (on site/offsite).
e Rs. 12,500 per man-day with package of Rs. 25000 requiring 2 man-
days. In case, If more man-day required, it would be charged other than
this fee.
e Above fees are excluding travel cost which shall not normally be more
thanRs. 12,000 per auditor/visit.
e Man-day calculation criteria to be followed for assessment by NBs,
which is based on number of products, Risk Class and effective number
of employees, and prior experience as per CE marking/ISO 13485 etc.
as minimum as specified in Table-1.
e Annual Surveillance assessmentshall be 1/3 man-days of total initial
assessment as specified in Table-1.
e Organization/Industry already certified to ISO 13485from a NBand or CE
mark certified for the same product is considered for reduction in man-
days as per the table given below:
Page 1 of 3Table-1 (Man-day Calculation for Assessment as per MDR 2017)
Require | Onsite | Desk | Number of Number of Man | Number of Man
ments audit audit {| Man Days Days (without Days (without
of MDR, | YES/ YES / | (having CE CE/MDD ISO 13485/
2017 NO NO /MDD certification) CE/MDD
certification) certification)
I Il Ill IV V Vi
Forth
Schedule N Y 1.0 2.0 PI. refer Table-2
¥ ¥
Fifth Y ¥ 1.0 1.0 As per Annex D
Schedule of IAF MD 9
Report Y Y 0.5 1.0 1.0
writing as
per
CDSCO
requirem
ents
Note:
Manufacturers holding a valid ISO 13485 / MDD Certificate issued by a Notified
Bodies are considered under column IV&V.
The above review assumes one round of Technical File review, an additional
round of reviews will require additional man days as applicable.
The desktop assessments will be based on QMS and Product Certificate issued
from Notified Bodies.
The manufacturer will have to submit full technical file as per Forth schedule
requirements for review with the Notified Body.
The number of technical files to be reviewed will be derived from the CDSCO
guideline document (Grouping of Medical Devices for submission of Applications)
based on the client application categories (Single, Family, \VD test kit, System,
IVD cluster, Group).
The desktop assessments will be based on MDQMS accredited Certificate issued
by Notified Bodies.
Page 2 of 3Table-2: (Applicable for onsite assessment for Schedule 4 requirements)
No of products 1to5 6to10 | 11 to 15 More than 15 products
Man-days 2 3 4 5
os 2i\2\\¥
(Dr. S. Eswara Reddy)
Drugs Controller General (India)
To,
1. All State /UT Drugs Controllers
2. All registered Notified Bodies
Copy to,
1. PS to DGHS, MOHFW, Nirman Bhawan , New Delhi
2. PPS to JS ( R ), MOHFW, Nirman Bhawan , New Delhi
3. IT Cell for uploading the information on CDSCO website
Page 3 of 3IAF MD 9:2015 International Accreditation Forum, Inc.
IAF Mandatory Document
Application of ISO/IEC 17021 in the
Field of Medical Device Quality
Management Systems (ISO 13485)
Issue 2
(IAF MD 9:2015)
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 2 of 30
Medical Device Quality Management Systems (ISO 13485)
The International Accreditation Forum, Inc. (IAF) facilitates trade and supports
regulators by operating a worldwide mutual recognition arrangement among
Accreditation Bodies (ABs) in order that the results issued by Conformity
Assessment Bodies (CABs) accredited by IAF members are accepted globally.
Accreditation reduces risk for business and its customers by assuring that accredited
Conformity Assessment Bodies (CABs) are competent to carry out the work they
undertake within their scope of accreditation. Accreditation Bodies (ABs) that are
members of IAF and the CABs they accredit are required to comply with appropriate
international standards and the applicable IAF application documents for the
consistent application of those standards.
ABs that are signatories to the IAF Multilateral Recognition Arrangement (MLA) are
evaluated regularly by an appointed team of peers to provide confidence in the
operation of their accreditation programs. The structure and scope of the IAF MLA
is detailed in IAF PR 4 - Structure of IAF MLA and Endorsed Normative Documents.
The IAF MLA is structured in five levels: Level 1 specifies mandatory criteria that
apply to all ABs, ISO/IEC 17011. The combination of a Level 2 activity(ies) and the
corresponding Level 3 normative document(s) is called the main scope of the MLA,
and the combination of Level 4 (if applicable) and Level 5 relevant normative
documents is called a sub-scope of the MLA.
e The main scope of the MLA includes activities e.g. product certification and
associated mandatory documents e.g. ISO/IEC 17065. The attestations made
by CABs at the main scope level are considered to be equally reliable.
e The sub scope of the MLA includes conformity assessment requirements e.g.
ISO 9001 and scheme specific requirements, where applicable, e.g. ISO TS
22003. The attestations made by CABs at the sub scope level are considered
to be equivalent.
The IAF MLA delivers the confidence needed for market acceptance of conformity
assessment outcomes. An attestation issued, within the scope of the IAF MLA, by a
body that is accredited by an IAF MLA signatory AB can be recognized worldwide,
thereby facilitating international trade.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 3 of 30
Medical Device Quality Management Systems (ISO 13485)
TABLE OF CONTENTS
O INTRODUCTION... eee eeeceeeeeceeeeeeeeeeseaeeeeeeceeeseeeeseaeeseeeseeeeneeseeeeneeesneseneeeniess 5
1 SCOPE Lio. eececccececcceecceteeneeeeesaeceeeneceeeeseeeeeeeeecaeeaeeeeeseseaeeaeeesesaeseesaesessseeeseaeeaees 5
2 NORMATIVE REFERENCES .........cccccccceeessceseesseeceseeeeseceeeceseeneeceeeeeeeeneeeeseeenees 5
3 TERMS AND DEFINITIONS 0000... eeeeeeeeceeceeeeeeeeeceeeeteeeeeeeeeeeaeeneeeeeeeseeeeseeeeseeeneeena 6
4 PRINCIPLES 0... ceecccceeseececseceeeeeeeseeeeeeeeeeeceeeeeececeeeseesseeaeesaessesseeeaeeeeeseesseeeeeees 6
5 GENERAL REQUIREMENT S wrscisscreesssssanceverecansszeuscesareveneerservreneseeseremevecnvsneeerness 7
6 STRUCTURAL REQUIREMENTS weesssssrsssronzsseesmneseercscnnameeneremeenas 8
~ RESOURCE REQUIREMENTS wessccsrevcrnsesesesssnnsvespressesszevscexcnersersenteasataest 9
8 INFORMATION REQUIREMENTS ....... cee ceceesseeeeceeeeseeeeeeeeeeeeeeeeeeneesseeeneeeesaee 10
9 PROCESS REQUIREMENTS .........cceccccececeseceeeeeeeeeeeeeseeeeneeeeeeseeeesenesesaeenneeeeseee 11
10 MANAGEMENT SYSTEM REQUIREMENTS FOR CERTIFICATION BODIES .17
Annex A (Normative) Medical Devices Technical Areas ...........:ccceesceeeseereeeeeereeensnnees 19
Annex B (Normative) Required types of knowledge and skills for personnel
involved with the ISO 13485 activities... cece ceececceceeeteeeeeenecteeeeeneeenseeeeneeenees 25
Annex C (Normative) Auditor qualification, training and experience .............:c ee 26
Annex D (Normative) Relationship between effective number of personnel and
audit duration (Initial Auditsonly) cescceseeseceseecorseeepeseeeerrrinimnmvaceanemeemenres 28
BiDIIOGrAPHY ......ceceecccescsessccseccesecessceesscesecesecsseeceseccsusessecssesecseceseecssccesececseeeneeeeeeeneess 29
Issue 2
Prepared by: IAF Technical Committee Date: 20 October 2014
Approved by: IAF Members Date: 06 December 2014
Issue Date: 08 January 2015 Application Date: 08 January 2016
Name for Enquiries: Elva Nilsen
IAF Corporate Secretary
Contact Phone: +1 (613) 454 8159
Email: secretary@iaf.nu
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 4 of 30
Medical Device Quality Management Systems (ISO 13485)
Introduction to IAF Mandatory Documents
The term “should” is used in this document to indicate recognised means of meeting
the requirements of the standard. A CAB can meet these in an equivalent way
provided this can be demonstrated to an AB. The term “shall” is used in this
document to indicate those provisions which, reflecting the requirements of the
relevant standard, are mandatory.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 5 of 30
Medical Device Quality Management Systems (ISO 13485)
Application of ISO/IEC 17021 in the Field of Medical Device Quality Management
Systems (ISO 13485)
This document is mandatory for the consistent application of ISO/IEC 17021. All
clauses of ISO/IEC 17021 continue to apply and this document does not supersede
any of the requirements in that standard. This mandatory document is exclusively for
the certification of organizations’ management systems to 1SO13485.
0 INTRODUCTION
ISO/IEC 17021 is an International Standard that sets out the general requirements
for bodies operating audit and certification of organizations’ management systems.
If such bodies are to be accredited as complying with ISO/IEC 17021 with the
objective of auditing and certifying Medical Device Quality Management System in
accordance with ISO 13485, some additional requirements and guidance to ISO/IEC
17021 are necessary.
This document follows the structure of ISO/IEC 17021:2011. IAF specific criteria are
identified by the letter "MD" followed with a reference number that incorporates the
related requirements clause in ISO/IEC 17021. In all cases a reference in the text of
this document to "clause XXX" refers to a clause in ISO/IEC 17021 unless otherwise
specified.
1 SCOPE
This document specifies normative criteria for CABs auditing and certifying
organizations’ Quality Management Systems to ISO 13485, in addition to the
requirements contained with ISO/IEC 17021. It is also appropriate as a requirements
document for the peer evaluation process for the IAF Multilateral Recognition
Arrangement (MLA) among Accreditation Bodies.
2 NORMATIVE REFERENCES
For the purposes of this document, the normative references given in ISO/IEC
17021 and the following apply. For dated references, only the edition cited applies.
For undated references, the latest edition of the referenced document (including any
amendments) applies.
ISO/IEC 17021 Conformity Assessment - Requirements for bodies providing audit
and certification of management systems
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 6 of 30
Medical Device Quality Management Systems (ISO 13485)
ISO 13485 Medical devices — Quality management systems — Requirements for
regulatory purposes
ISO/TR 14969:2004 Medical devices — Quality management systems — Guidance
on the application of ISO 13485:2003
ISO 14971:2007, Medical devices — Application of risk management to medical
devices
IAF MD5 Duration of QMS and EMS Audits
Note: The Bibliography sets out the references to the documents which are not
normative references.
3 TERMS AND DEFINITIONS
For the purpose of this document, the terms and definitions given in ISO/IEC 17021,
ISO 13485 and the following apply.
Regulatory Authority (RA)
A government agency or other entity that exercises a legal right to control the use or
sale of medical devices within its jurisdiction, and may take enforcement action to
ensure that medical devices marketed within its jurisdiction comply with legal
requirements.
Note: Within the European Medical Devices Regulation the Regulatory Authority as
defined above is titled - Competent Authority.
4 PRINCIPLES
4.1. General
No additional principles for ISO 13485.
4.2 Impartiality
No additional principles for ISO 13485.
4.3 Competence
No additional principles for ISO 13485.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 7 of 30
Medical Device Quality Management Systems (ISO 13485)
4.4 Responsibility
MD.4.4.1
ISO 13485 requires the organization to comply with the statutory and regulatory
requirements applicable to the safety and performance of the medical devices.
The maintenance and evaluation of legal compliance is the responsibility of the
client organization. The CAB is responsible for verifying that the client organization
has evaluated statutory and regulatory compliance and can show that appropriate
action has been taken in cases of non-compliance with relevant legislation and
regulations, including the notification to the Regulatory Authority of any incidences
that require reporting.
4.5 Openness
MD.4.5.1
In order to increase the confidence from interested parties and specifically regulators
that accept or take into consideration ISO 13485 accredited certification for the
purpose of their recognitions, it is expected that CABs establish appropriate
agreements with their clients to release audit report information to regulators that
recognize ISO 13485.
4.6 Confidentiality
No additional principles for ISO 13485.
4.7 Responsiveness to complaints
No additional principles for ISO 13485.
5 GENERAL REQUIREMENTS
5.1. Legal and contractual matters
5.1.1. Legal responsibility
No additional requirements for ISO 13485.
5.1.2 Certification agreement
No additional requirements for ISO 13485.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 8 of 30
Medical Device Quality Management Systems (ISO 13485)
5.1.3 Responsibility for certification decisions
No additional requirements for ISO 13485.
5.2 Management of impartiality
MD 5.2
The CAB and its auditors shall be impartial and free from engagements and
influences which could affect their objectivity, and in particular shall not be:
a) involved in the design, manufacture, construction, marketing, installation,
servicing or supply of the medical device
b) involved in the design, construction, implementation or maintenance of the
quality management system being audited
c) an authorized representative of the client organization, nor represent the
parties engaged in these activities
The situations hereafter are examples where impartiality is compromised in
reference to the criteria defined in a) to c):
i) the auditor having a financial interest in the client organization being audited
(e.g. holding stock in the organization)
ii) the auditor being employed currently by a manufacturer producing medical
devices
iii) the auditor being a member of staff from a research or medical institute or a
consultant having a commercial contract or equivalent interest with the
manufacturer or manufacturers of similar medical devices
5.3 Liability and financing
No additional requirements for ISO 13485.
6 STRUCTURAL REQUIREMENTS
6.1. Organization structure and top management
No additional requirements for ISO 13485.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 9 of 30
Medical Device Quality Management Systems (ISO 13485)
6.2 Committee for safeguarding impartiality
MD 6.2.3
The committee for safeguarding impartiality shall have access to individual(s) who
have experience and knowledge related to medical devices in order to get expert
opinions.
7 RESOURCE REQUIREMENTS
7.1. Competence of management and personnel
MD 7.1.1 Management and personnel competence
Where ISO/IEC 17021 Clause 7.1.1 refers to (as relevant for the specific certification
scheme) ISO 13485, this should be understood to mean medical devices and
applicable legal requirements.
All personnel involved in ISO 13485 certification shall meet the competency
requirements of Annex B.
7.2 Personnel involved in the certification activities
MD 7.2.1 Auditor
Each auditor shall have demonstrated competence as defined in Annex C.
The CAB shall identify authorizations of its auditors using the Technical Areas in
Tables in Annex A.
MD 7.2.4 Auditor experience
For a first authorization, the auditor shall comply with the following criteria, which
shall be demonstrated in audits under guidance and supervision:
a) Have gained experience in the entire process of auditing medical device
quality management systems, including review of documentation and risk
management of medical devices, implementation audit and audit reporting.
This experience shall have been gained by participation as a trainee in a
minimum of four audits for a total of at least 20 days in an accredited QMS
program, 50% of which shall be against ISO 13485 preferably in an
accredited program, and the rest in an accredited QMS program.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 10 of 30
Medical Device Quality Management Systems (ISO 13485)
In addition to criteria a), audit team leaders shall fulfil the following:
b) Have experienced an audit team leader role under the supervision of a
qualified team leader at least three ISO 13485 audits.
MD 7.2.9 Personnel making the certification decision
The CAB shall ensure that personnel (group or individual) making the certification
decision fulfil the competence in Annex B. This does not mean that each individual
in the group needs to comply with all requirements, but the group as a whole shall
meet all the requirements. When the certification decision is made by an individual,
the individual shall meet all the requirements.
7.3. Use of individual external auditors and external technical experts
No additional requirements for ISO 13485.
7.4 Personnel records
No additional requirements for ISO 13485.
7.5 Outsourcing
No additional requirements for ISO 13485.
8 INFORMATION REQUIREMENTS
8.1. Publicly accessible information
MD 8.1.3
Where it is required by law or by relevant Regulatory Authority, the CAB shall
provide the information about certifications granted, suspended or withdrawn to the
/ Regulatory Authority.
8.2 Certification documents
MD 8.2.1
The CAB shall precisely document the scope of certification. The CAB shall not
exclude part of processes, products or services (unless allowed by regulatory
authorities) from the scope of certification when those processes, products or
services have an influence on the safety and quality of products.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 11 of 30
Medical Device Quality Management Systems (ISO 13485)
8.3 Directory of certified clients
No additional requirements for ISO 13485.
8.4 Reference to certification and use of marks
No additional requirements for ISO 13485.
8.5 Confidentiality
No additional requirements for ISO 13485.
8.6 Information exchange between a certification body and its clients
8.6.1 Information on the certification activity and requirements
No additional requirements for ISO 13485.
8.6.2 Notice of changes by a certification body
No additional requirements for ISO 13485.
8.6.3 Notice of changes by a client
No additional requirements for ISO 13485.
9 PROCESS REQUIREMENTS
9.1 General requirements
MD 9.1.3.2
The audit team shall have the competence for the Technical Area (Annex A in
conjunction with relevant knowledge and skills as defined in Annex B) for the scope
of audit.
If the audit is performed for an organization that only provides associated activities
such as wholesale, retail, transportation or maintenance of equipments etc., the
audit team does not have to demonstrate technical competence at the same level as
that for a manufacturer producing medical devices.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 12 of 30
Medical Device Quality Management Systems (ISO 13485)
To include devices that are sterile or intended for end-user sterilization, the audit
team shall be competent according to sterilization process detailed in Table 1.5 of
Annex A.
MD 9.1.4.1 Determining audit time
The requirements from IAF Mandatory document MD5 (Duration of QMS and EMS
Audits) apply except those for EMS and the table QMS 1. Annex D, table D.1
replaces table QMS 1 and provides a starting point for estimating the duration of an
initial audit (Stage 1 + Stage 2) for ISO 13485 certification.
Audit duration is dependent on factors such as the audit scope, objectives and
specific regulatory requirements to be audited, as well on the range, class and
complexity of medical devices, and the size and complexity of the organization.
When CABs are planning audits, sufficient time shall be allowed for the audit team
to determine the conformity status of the client organization's quality management
system with respect to the relevant regulatory requirements. Any additional time
required to audit national or regional regulatory requirements and dossier reviews
must be justified.
Audit duration for all types of audits includes on site time at a client's premises and
time spent off-site carrying out planning, document review, interacting with client
personnel and report writing. It does not consider the time required for design
dossier reviews, type examinations, pre-market approval audits and other similar
activities. The audit duration should be adjusted to take into account the factors
listed in Annex D, which may increase or decrease the estimated audit time.
For those CABs offering both ISO 9001 and ISO 13485 certification to a client, the
audit time shall be able to demonstrate sufficient time to conduct an effective review
to determine conformity with all requirements of both certification standards.
For integrated audits see IAF MD11.
MD 9.1.5 Multi-site sampling
Design, development and manufacturing sites cannot be sampled.
MD 9.1.9.6 Identifying and recording audit findings
Examples of nonconformities are as follows:
i) failure to address applicable requirements for quality management systems
(e.g. failure to have a complaint handling or training system)
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 13 of 30
Medical Device Quality Management Systems (ISO 13485)
ii) failure to implement applicable requirements for quality management
systems
iii) failure to implement appropriate corrective and preventative action when an
investigation of post market data indicates a pattern of product defects
iv) products which are put onto the market and cause undue risk to patient
and/or users when the device is used according to the product labelling
v) the existence of products which clearly do not comply with the client’s
specifications and/or the regulatory requirements
vi) repeated nonconformities from previous audits
9.2 Initial audit and certification
9.2.1 Application
No additional requirements for ISO 13485.
9.2.2 Application review
No additional requirements for ISO 13485.
MD 9.2.2.1
If the applicant organization uses outsourced processes, the CAB shall determine
and document whether specific competence in the audit team is necessary to
evaluate the outsourced process.
9.2.3 Initial certification audit
MD 9.2.3
When a certification body has audited a client against a regulatory scheme that
includes or goes beyond the requirements of ISO 13485, it does not need to repeat
the audit for conformity with the elements of ISO 13485 previously covered,
providing the certification body can demonstrate that all of the requirements of this
document have been complied with.
Note: Typical regulatory schemes that include or go beyond the requirements of ISO
13485 are European Medical Device Directives:
i) Medical Device Regulation (MDR)
ii) In-Vitro Diagnostic Devices Directive (IVD)
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 14 of 30
Medical Device Quality Management Systems (ISO 13485)
iii) Active Implantable Medical Devices Directive (AIMD)
Other jurisdictions include:
i) Canada — Health Canada, Canadian Medical Devices Conformity
Assessment System (CMDCAS)
ii) Australia - Therapeutic Goods Administration, Therapeutic Goods
Regulations
Additionally other countries are adopting or considering adopting ISO 13485 into
their Medical Device Regulations.
9.2.3.1 Stage 1 audit
MD 9.2.3.1
Where higher risk medical devices (e.g. GHTF C and D) are concerned, the stage 1
audit should be performed on-site.
9.2.3.2 Stage 2 audit
No additional requirements for ISO 13485.
9.2.4 Initial certification audit conclusions
No additional requirements for ISO 13485.
9.2.5 Information for granting initial certification
No additional requirements for ISO 13485.
9.3 Surveillance activities
9.3.1 General
No additional requirements for ISO 13485.
9.3.2 Surveillance audit
MD 9.3.2.1
In addition to requirements of Clause 9.3.2.1, the surveillance programme shall
include a review of actions taken for notification of adverse events, advisory notices,
and recalls.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 15 of 30
Medical Device Quality Management Systems (ISO 13485)
9.3.3 Maintaining certification
No additional requirements for ISO 13485.
9.4 Recertification
9.4.1 Recertification audit planning
No additional requirements for ISO 13485.
9.4.2 Recertification audit
No additional requirements for ISO 13485.
9.4.3 Information for granting recertification
No additional requirements for ISO 13485.
9.5 Special audits
9.5.1 Extension to scope
No additional requirements for ISO 13485.
9.5.2 Short-notice audits
MD 9.5.2
Short notice audits may be required when:
i) external factors apply such as:
a. available post-market surveillance data known to the CAB on the subject
devices indicate a possible significant deficiency in the quality
management system
b. significant safety related information becoming known to the CAB
ii) significant changes occur which have been submitted as required by the
regulations or become known to the CAB, and which could affect the
decision on the client's state of compliance with the regulatory requirements
The following are examples of such changes which could be significant and relevant
to the CAB when considering that a special audit is required, although none of these
changes should automatically trigger a special audit:
i) QMS — impact and changes:
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 16 of 30
Medical Device Quality Management Systems (ISO 13485)
a. new ownership
b. extension to manufacturing and/or design control
c. new facility, site change
e modification of the site operation involved in the manufacturing
activity (e.g. relocation of the manufacturing operation to a new site
or centralizing the design and/or development functions for several
manufacturing sites)
d. new processes, process changes
e significant modifications to special processes (e.g. change in
production from sterilization through a supplier to an on-site facility
or a change in the method of sterilization)
e. QM management, personnel
e modifications to the defined authority of the management
representative that impact
© quality management system effectiveness or regulatory
compliance
o the capability and authority to assure that only safe and
effective medical devices are released
ii) product related changes:
a. new products, categories
b. addition of a new device category to the manufacturing scope within the
quality management system (e.g. addition of sterile single use dialysis
sets to an existing scope limited to haemodialysis equipment, or the
addition of magnetic resonance imaging to an existing scope limited to
ultrasound equipment)
iii) QMS & Product related changes:
a. changes in standards, regulations
b. post market surveillance, vigilance
An unannounced or short-notice audit may also be necessary if the CAB has
justifiable concerns about implementation of corrective actions or compliance with
standard and regulatory requirements.
9.6 Suspending, withdrawing or reducing the scope of certification
No additional requirements for ISO 13485.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 17 of 30
Medical Device Quality Management Systems (ISO 13485)
9.7 Appeals
No additional requirements for ISO 13485.
9.8 Complaints
No additional requirements for ISO 13485.
9.9 Records of applicants and clients
No additional requirements for ISO 13485.
10 MANAGEMENT SYSTEM REQUIREMENTS FOR CERTIFICATION BODIES
10.1 Options
10.2 Option 1: Management system requirements in accordance with ISO
9001
10.2.1 General
No additional requirements for ISO 13485.
10.2.2 Scope
No additional requirements for ISO 13485.
10.2.3 Customer focus
No additional requirements for ISO 13485.
10.2.4 Management review
No additional requirements for ISO 13485.
10.2.5 Design and development
No additional requirements for ISO 13485.
10.3 Option 2: General management requirements
10.3.1 General
No additional requirements for ISO 13485.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 18 of 30
Medical Device Quality Management Systems (ISO 13485)
10.3.2 Management system manual
No additional requirements for ISO 13485.
10.3.3 Control of documents
No additional requirements for ISO 13485.
10.3.4 Control of records
No additional requirements for ISO 13485.
10.3.5 Management review
10.3.5.1 General
No additional requirements for ISO 13485.
10.3.5.2 Review inputs
No additional requirements for ISO 13485.
10.3.5.3 Review outputs
No additional requirements for ISO 13485.
10.3.6 Internal audits
No additional requirements for ISO 13485.
10.3.7 Corrective actions
No additional requirements for ISO 13485.
10.3.8 Preventive actions
No additional requirements for ISO 13485.
End of IAF Mandatory Document for the Application of ISO/IEC 17021 in ISO 13485.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 19 of 30
Medical Device Quality Management Systems (ISO 13485)
Annex A
(Normative)
Medical Devices Technical Areas
The CAB shall use the Technical Areas described in the tables of this Annex to:
a) help define the scope of certification
b) identify if any technical qualification, including competence in sterilization
processes of its auditors is necessary for that particular technical area
c) select a suitably qualified audit team
When using technical areas other than specified in the tables, the technical areas
shall be detailed.
Where the organization provides associated activities such as wholesale, retail,
transportation or maintenance of equipments etc, Main Technical Area(s) are
determined by the devices within the scope of the organization’s activity (e.g. the
product that is being transported).
Any other product that does not have medical or therapeutic purposes (border line
products, such as cosmetic, herbal, nutritional supplements, beauty equipment, etc.)
or not directly connected to the prevention or restoration of the health state of the
persons, can not be classified as a medical device. To this end, the choice of
provider to fall into the classification of the medical device must be supported by a
decision of the RA and indicated in official Guidelines or Specifications issued to that
purpose.
Table A.1.1 - NON-ACTIVE MEDICAL DEVICES
Main Technical Technical Areas Product Categories Covered by
Areas the Technical Areas
Non-active General non-active, non- e Non-active devices for
Medical implantable medical devices anaesthesia, emergency and
Devices intensive care
e Non-active devices for
injection, infusion, transfusion
and dialysis
e Non-active orthopedic and
rehabilitation devices
e Non-active medical devices
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 20 of 30
Medical Device Quality Management Systems (ISO 13485)
with measuring function
Non-active ophthalmologic
devices
Non-active instruments
Contraceptive medical
devices
Non-active medical devices
for disinfecting, cleaning,
rinsing
Non-active devices for in vitro
fertilisation (IVF) and assisted
reproductive technologies
(ART)
Non-active medical devices
for ingestion
Non-active implants Non-active cardiovascular
implants
Non-active orthopedic
implants
Non-active functional implants
Non-active soft tissue
implants
Devices for wound care Bandages and wound
dressings
Suture material and clamps
Other medical devices for
wound care
Non-active dental devices and Non-active dental
accessories devices/equipment and
instruments
Dental materials
Dental implants
Non-active medical devices
other than specified above
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 21 of 30
Medical Device Quality Management Systems (ISO 13485)
Table A.1.2 - ACTIVE (NON-IMPLANTABLE) MEDICAL DEVICES
Main Technical Technical Areas Product Categories Covered by
Areas the Technical Areas
Active Medical General active medical devices | e Devices for extra-corporal
Devices circulation, infusion and
(Non- haemopheresis
Implantable) Respiratory devices, devices
including hyperbaric
chambers for oxygen therapy,
inhalation anaesthesia
Devices for stimulation or
inhibition
Active surgical devices
Active ophthalmologic devices
Active dental devices
Active devices for disinfection
and sterilization
Active rehabilitation devices
and active prostheses
Active devices for patient
positioning and transport
Active devices for in vitro
fertilisation (IVF) and assisted
reproductive technologies
(ART)
Software
Medical gas supply systems
and parts thereof
Devices for imaging e Devices utilizing ionizing
radiation
e Devices utilizing non-ionizing
radiation
Monitoring devices e Monitoring devices of non-
vital physiological parameters
Monitoring devices of vital
physiological parameters
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015International Accreditation Forum, Inc.
IAF MD 9:2015
Issue 2 Application of ISO/IEC 17021 in the Field of Page 22 of 30
Medical Device Quality Management Systems (ISO 13485)
Devices for radiation therapy e Devices utilising ionizing
and thermo therapy radiation
e Devices utilising non-ionizing
radiation
e Devices for hyperthermia /
hypothermia
e Devices for (extracorporal)
shock-wave therapy
(lithotripsy)
Active (non-implantable)
medical devices other than
specified above
Table A.1.3 - ACTIVE IMPLANTABLE MEDICAL DEVICES
Main Technical Technical Areas Product Categories Covered by
Areas the Technical Areas
Active General active implantable e Active implantable medical
Implantable medical devices devices for stimulation /
inhibition
Medical
Devices e Active implantable medical
devices delivering drugs or
other substances
e Active implantable medical
devices substituting or
replacing organ functions
Implantable medical devices
other than specified above
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 23 of 30
Medical Device Quality Management Systems (ISO 13485)
Table A.1.4 - IN VITRO DIAGNOSTIC MEDICAL DEVICES
Main Technical Areas Product Categories Covered by
Technical the Technical Areas
Areas
In Vitro Reagents and reagent
Diagnostic products, calibrators and
Medical control materials for:
Devices Clinical Chemistry
(IVD) Immunochemistry
(Immunology)
Haematology/Haemostasis/
Immunohematology
Microbiology
Infectious Immunology
Histology/Cytology
Genetic Testing
In Vitro Diagnostic Instruments
and software
IVD medical devices other than
specified above
Table A.1.5 - STERILIZATION METHODS FOR MEDICAL DEVICES
Main Technical | Technical Areas Product Categories Covered
Areas by the Technical Areas
Sterilization Ethylene oxide gas sterilization
Method for (EOG)
Medical
Devices Moist heat
Aseptic processing
Radiation sterilization (e.g.
gamma, x-ray, electron beam)
Sterilization method other than
specified above
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 24 of 30
Medical Device Quality Management Systems (ISO 13485)
Table A1.6 — DEVICES INCORPORATING / UTILIZING SPECIFIC SUBSTANCES /
TECHNOLOGIES
Main Technical Areas Technical Areas Product Categories
Covered by the
Technical Areas
Devices Medical devices incorporating
incorporating/utilizing medicinal substances
specific substances/
Medical devices utilizing tissues of
technologies
animal origin
Medical devices incorporating
derivates of human blood
Medical devices utilizing
micromechanics
Medical devices utilizing
nanomaterials
Medical devices utilizing biological
active coatings and/or materials or
being wholly or mainly absorbed
Medical devices incorporating or
utilizing specific
substances/technologies/elements,
other than specified above.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 25 of 30
Medical Device Quality Management Systems (ISO 13485)
Annex B
(Normative)
Required types of knowledge and skills for personnel involved with the ISO
13485 activities
The following table specifies the type of knowledge and skills that a CAB shall define
for specific functions in addition to ISO/IEC 17021 Annex A
Table B.1 — Table of knowledge and skills
Personnel conducting the
Certification ik .
application review to
. determine audit team Personnel reviewing
functions | competence required, to audit reports and . Personnel managing
4 ‘ wee ge Auditor
select the audit team making certification program
knowledge members, and to decisions
determine the audit
and skills duration
Knowledge of generic
quality management x xX x xX
system practices
Knowledge of legal
framework of x x x x
regulations and role of
the CAB
Knowledge of medical
device risk x x x x
management, e.g. ISO
14971
Knowledge of intended x*
use of medical devices
Knowledge of risks
associated with the x
medical device
Knowledge of relevant
product standards in x*
the assessment of
medical devices
Knowledge of CAB's x 4 x Xx
ISO 13485 processes
Knowledge of Medical
Device x x x x
business/technology
* The knowledge in the areas marked with *could be provided by a technical expert.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 26 of 30
Medical Device Quality Management Systems (ISO 13485)
Annex C
(Normative)
Auditor qualification, training and experience
C.1 Education
The CAB shall ensure that auditors have the knowledge corresponding to post-
secondary education or equivalent work experience. Appropriate professional areas
are listed below as examples:
i) biology or microbiology
ii) | chemistry or biochemistry
iii) | computer and software technology
iv) electrical, electronic, mechanical or bioengineering
v) | human physiology
vi) medicine
vii) pharmacy
vill) physics or biophysics
C.2 Work Experience
The CAB shall ensure that auditors have adequate experience to perform their
tasks. In general, auditors shall have a minimum of four years of full-time work
experience in the field of medical devices or related sectors (e.g. industry,
healthcare, audit or research in medical devices or related area).
Successful completion of other formal qualification (advanced degrees) can
substitute for a maximum of two years of working experience.
Exceptionally, shorter duration of experience or experiences in the fields other than
medical devices or related sectors may be considered as appropriate. In such
cases, the CAB shall demonstrate that the experience of the auditor is equivalent
and shall record the justification for the acceptance.
C.3 Auditor Competency
See Annex B.
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 27 of 30
Medical Device Quality Management Systems (ISO 13485)
C.4 Development and maintenance of competency
C.4.1 Continuous Professional Development (CPD)
Each auditor shall undertake CPD activities such as training, participation in
scientific meetings, and self-study. Such activities should ensure timely awareness
of new or modified regulatory requirements, policies, procedures, etc., as well as
emerging technologies. Training in emerging technologies may be provided through
co-operation with manufacturers developing or using the concepts. Knowledge is
also gained from experience in enforcing regulatory requirements, implementing
procedures, and applying policies and interpretations.
It is recognised that medical device manufacturing constitutes a highly specialised,
technology driven and fast evolving sector. Additionally, new regulatory
requirements, standards, policies, and procedures are introduced, and existing ones
are modified from time to time. Therefore, the CAB shall ensure maintenance of the
knowledge and skills of the auditors appropriate to cover the scope of audits of
organizations, through appropriate and timely training and encouraging CPD.
C.4.2 Advanced training elements for auditors
As auditors gain competence in conducting audits, advanced and specialised
training is recommended. The auditor's needs, weaknesses, and desires for career
development may influence specific advanced training courses selected by an
auditor. Subjects suggested for advanced training include:
i) risk management, including risk analysis
ii) | process validation
iii) sterilization and related processes
iv) electronics manufacture
v) plastics manufacturing processes
vi) development and validation of software or hardware for devices and
manufacturing processes
vii) in-depth knowledge of specific medical devices and/or technologies
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 28 of 30
Medical Device Quality Management Systems (ISO 13485)
Annex D
(Normative)
Table D.1
Relationship between effective number of personnel and audit duration (Initial
Audit only)
Effective Number | Audit Duration | Effective Number Audit Duration
of Personnel Stage 1 + Stage of Personnel Stage 1 + Stage 2
2 (days) (days)
1-5 3 626-875 15
6-10 4 876-1175 16
11-15 45 1176-1550 17
16-25 5 1551-2025 18
26-45 6 2026-2675 19
46-65 7 2676-3450 20
66-85 8 3451-4350 21
86-125 10 4351-5450 22
126-175 11 5451-6800 23
176-275 12 6801-8500 24
276-425 13 8501-10700 25
426-625 14 >10700 Fale een
Factors used to determine the audit time
i) Some factors which may increase the audit duration from table D.1 are:
a. number of ranges and/or complexity of medical devices
b. manufacturers using suppliers to supply processes or parts that are
critical to the function of the medical device and/or the safety of the user
or finished products, including own label products. When the
manufacturer cannot provide sufficient evidence for conformity with audit
criteria, then additional time may be allowed for each supplier to be
audited
c. manufacturers who install product on customer’s premises
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 29 of 30
Medical Device Quality Management Systems (ISO 13485)
Note: Time may be required for customer site visits or installation records
review
d. poor regulatory compliance by the manufacturer
e. multiple shifts, number of production lines etc. may increase audit
duration
ii) Some factors that may reduce the audit duration, but not by more than 20%
in total from table D.1, are:
a. the organization’s scope does not include manufacturing and is activities
such as wholesale, retail, transportation or maintenance of equipment,
etc.
b. reduction of the manufacturer product range since last audit
c. reduction of the design/or production process since last audit
Bibliography
GHTF/SG4/N28R4:2008 Guidelines for Regulatory Auditing of Quality Management
Systems of Medical Device Manufacturers — Part 1: General Requirements
GHTF/SG4/N30R20:2006 Guidelines for Regulatory Auditing of Quality
Management Systems of Medical Device Manufacturers — Part 2: Regulatory
Auditing Strategy
GHTF/SG4/N33R16:2007 Guidelines for Regulatory Auditing of Quality
Management Systems of Medical Device Manufacturers — Part 3: Regulatory Audit
Reports
GHTF/SG4 (00) 3:2000 Training Requirements for Auditors (Guidelines for
Regulatory Auditing of Quality Systems of Medical Device Manufacturers - Part 1:
General Requirements - Supplement 2)
GHTF/SG4/N83:2010 Guidelines for Regulatory Auditing of Quality Management
System of Medical Device Manufactures — Part 4: Multiple Site Auditing
GHTF/SG4/N84:2010 Guidelines for Regulatory Auditing of Quality Management
System of Medical Device Manufactures — Part 5: Audits of Manufacturer Control of
Suppliers
GHTF/SG1-N29R16:2005, Information Document Concerning the Definition of the
Term "Medical Device"
GHTF/SG1/N77:2012 Principles of Medical Devices Classification
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015IAF MD 9:2015 International Accreditation Forum, Inc.
Issue 2 Application of ISO/IEC 17021 in the Field of Page 30 of 30
Medical Device Quality Management Systems (ISO 13485)
Further Information
For further Information on this document or other IAF documents, contact any
member of IAF or the IAF Secretariat.
For contact details of members of IAF see the IAF website: http://www.iaf.nu.
Secretariat:
Elva Nilsen
IAF Corporate Secretary
Telephone: +1 (613) 454-8159
Email: secretary@iaf.nu
Issued: 08 January 2015 Application Date: 08 January 2016 IAF MD 9:2015 Issue 2
© International Accreditation Forum, Inc. 2015