Regulatory Open Forum

However, when I read ISO 13485:2016 clause 7.4.1, to me it says that I must retain the supplier evaluation, selection, monitoring, and re-evaluation of the supplier in accordance with clause 4.2.5 but I do not see in the standard where it says that I must ask my suppliers to retain all their documents for as long as my medical device is on the market.

I am wondering if anyone else has been asked to ensure that their suppliers conform to this requirement
I would appreciate some input on this from the greater community

However, when I read ISO 13485:2016 clause 7.4.1, to me it says that I must retain the supplier evaluation, selection, monitoring, and re-evaluation of the supplier in accordance with clause 4.2.5 but I do not see in the standard where it says that I must ask my suppliers to retain all their documents for as long as my medical device is on the market.

I am wondering if anyone else has been asked to ensure that their suppliers conform to this requirement
I would appreciate some input on this from the greater community

With the possible exception of one case, I'm unable to find the requirement "indicated" by your AO. It is not in ISO 13485:2016, the companion document, or the MDSAP audit model.

I infer that the AO issued a nonconformity. As such, it should have been written in the format prescribed by IMDRF/MDSAP WG/N24 FINAL: 2015 Medical Device Regulatory Audit Reports. Section 4.2.5 requires four elements:

- identify the requirement against which the nonconformity is raised

- make a statement of how that requirement has not been fulfilled

- reference the supporting objective evidence in the audit summaries

- assign the grade according to IMDRF/MDSAP WG/N3 – 9.1.2

 It would be valuable if you were to provide the wording of, at least, the first two requirements.

You said, "require all our suppliers to retain all their records for what they supply us". This is, in my opinion an overreach when applied to "all" suppliers. This is the requirement I cannot find.

There is a case when the supplier performs an outsourced process as described in 4.1.5. In that case it is your process performed at an external supplier's site so the record retention requirements for that process are your obligation.

However, when I read ISO 13485:2016 clause 7.4.1, to me it says that I must retain the supplier evaluation, selection, monitoring, and re-evaluation of the supplier in accordance with clause 4.2.5 but I do not see in the standard where it says that I must ask my suppliers to retain all their documents for as long as my medical device is on the market.

I am wondering if anyone else has been asked to ensure that their suppliers conform to this requirement
I would appreciate some input on this from the greater community

Deviation:

Supplier Quality Agreement are not always in compliance with the document retention and supplier evaluation/ re-evaluation criteria.

 Evidence: 

Part 1:

Purchase Agreement: Quality system documentation at the supplier's site must be retained for at least 5 years after the lifecycle of the products design or following manufacturing activities termination; manufacturing records shall be retained by the seller for at least 5 years after the lot/batch lifecycle.

SOP Record Retention Requirement: Based on a lifetime of the medical device of 10 years.

With the possible exception of one case, I'm unable to find the requirement "indicated" by your AO. It is not in ISO 13485:2016, the companion document, or the MDSAP audit model.

I infer that the AO issued a nonconformity. As such, it should have been written in the format prescribed by IMDRF/MDSAP WG/N24 FINAL: 2015 Medical Device Regulatory Audit Reports. Section 4.2.5 requires four elements:

- identify the requirement against which the nonconformity is raised

- make a statement of how that requirement has not been fulfilled

- reference the supporting objective evidence in the audit summaries

- assign the grade according to IMDRF/MDSAP WG/N3 – 9.1.2

 It would be valuable if you were to provide the wording of, at least, the first two requirements.

You said, "require all our suppliers to retain all their records for what they supply us". This is, in my opinion an overreach when applied to "all" suppliers. This is the requirement I cannot find.

There is a case when the supplier performs an outsourced process as described in 4.1.5. In that case it is your process performed at an external supplier's site so the record retention requirements for that process are your obligation.

However, when I read ISO 13485:2016 clause 7.4.1, to me it says that I must retain the supplier evaluation, selection, monitoring, and re-evaluation of the supplier in accordance with clause 4.2.5 but I do not see in the standard where it says that I must ask my suppliers to retain all their documents for as long as my medical device is on the market.

I am wondering if anyone else has been asked to ensure that their suppliers conform to this requirement
I would appreciate some input on this from the greater community

Thank you for providing this information. In my opinion, this goes into the examples of poorly written nonconformances.

I agree that clause 7.4.1 is the correct clause for supplier management issues. However, I could make the case that this is also record retention.

There are two ways to read the non-conformance.

In the first way, the AO says that your purchase agreement does require record retention for 5 years and that you are not following your own procedure.

In the second way, the AO says that your purchase agreement must have a provision for record retention for "at least 5 years after the lifecycle of the products design or following manufacturing activities termination". The assertion is that your procedure is deficient because it doesn't include this requirement.

In my view, the AO had the second way in mind, which raises some issues.

The first issue is the record retention period. ISO 13485:2016 clause 4.2.5 says, "The organization shall retain the records for at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements, but not less than two years from the medical device release by the organization."

Since the nonconformance states the device life-cycle is 10 years, I don't understand where 5 years comes from, in terms of ISO 13485:2016.

I looked at the MDSAP Companion Document. The Management Process, Task #8 covers record retention. It cites both Australian and Japanese record keeping requirements that include requirements with "5 years".

The second issue is application to the QMS. I cannot find an ISO 13485:2016 requirement that says, in general, that a device manufacturer must require a supplier to maintain records based on the manufacturer's record retention. However, if there is an outsourced process, then purchasing and record retention would apply to that process.

My conclusion is that is bad auditing. One of two things happened. Either the AO made up a "requirement" not supported by ISO 13485:2016 or the AO applied a country specific requirement without citing the requirement.

ISO 13485:2016 has a potential ambiguity in that the record retention period is either the manufacturer's lifetime or the regulatory requirement with a floor of two years from device release. It doesn't say, "which ever is longer".

My recommendation is that you ask the AO for the source of the "5 year" requirement. Ask them to withdraw the nonconformance if they it up or to rewrite the nonconformance to cite a country specific requirement. If so, you need to understand the country specific requirements, since it could include record retention by the supplier.

Deviation:

Supplier Quality Agreement are not always in compliance with the document retention and supplier evaluation/ re-evaluation criteria.

 Evidence: 

Part 1:

Purchase Agreement: Quality system documentation at the supplier's site must be retained for at least 5 years after the lifecycle of the products design or following manufacturing activities termination; manufacturing records shall be retained by the seller for at least 5 years after the lot/batch lifecycle.

SOP Record Retention Requirement: Based on a lifetime of the medical device of 10 years.

With the possible exception of one case, I'm unable to find the requirement "indicated" by your AO. It is not in ISO 13485:2016, the companion document, or the MDSAP audit model.

I infer that the AO issued a nonconformity. As such, it should have been written in the format prescribed by IMDRF/MDSAP WG/N24 FINAL: 2015 Medical Device Regulatory Audit Reports. Section 4.2.5 requires four elements:

- identify the requirement against which the nonconformity is raised

- make a statement of how that requirement has not been fulfilled

- reference the supporting objective evidence in the audit summaries

- assign the grade according to IMDRF/MDSAP WG/N3 – 9.1.2

 It would be valuable if you were to provide the wording of, at least, the first two requirements.

You said, "require all our suppliers to retain all their records for what they supply us". This is, in my opinion an overreach when applied to "all" suppliers. This is the requirement I cannot find.

There is a case when the supplier performs an outsourced process as described in 4.1.5. In that case it is your process performed at an external supplier's site so the record retention requirements for that process are your obligation.

However, when I read ISO 13485:2016 clause 7.4.1, to me it says that I must retain the supplier evaluation, selection, monitoring, and re-evaluation of the supplier in accordance with clause 4.2.5 but I do not see in the standard where it says that I must ask my suppliers to retain all their documents for as long as my medical device is on the market.

I am wondering if anyone else has been asked to ensure that their suppliers conform to this requirement
I would appreciate some input on this from the greater community

Thank you for providing this information. In my opinion, this goes into the examples of poorly written nonconformances.

I agree that clause 7.4.1 is the correct clause for supplier management issues. However, I could make the case that this is also record retention.

There are two ways to read the non-conformance.

In the first way, the AO says that your purchase agreement does require record retention for 5 years and that you are not following your own procedure.

In the second way, the AO says that your purchase agreement must have a provision for record retention for "at least 5 years after the lifecycle of the products design or following manufacturing activities termination". The assertion is that your procedure is deficient because it doesn't include this requirement.

In my view, the AO had the second way in mind, which raises some issues.

The first issue is the record retention period. ISO 13485:2016 clause 4.2.5 says, "The organization shall retain the records for at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements, but not less than two years from the medical device release by the organization."

Since the nonconformance states the device life-cycle is 10 years, I don't understand where 5 years comes from, in terms of ISO 13485:2016.

I looked at the MDSAP Companion Document. The Management Process, Task #8 covers record retention. It cites both Australian and Japanese record keeping requirements that include requirements with "5 years".

The second issue is application to the QMS. I cannot find an ISO 13485:2016 requirement that says, in general, that a device manufacturer must require a supplier to maintain records based on the manufacturer's record retention. However, if there is an outsourced process, then purchasing and record retention would apply to that process.

My conclusion is that is bad auditing. One of two things happened. Either the AO made up a "requirement" not supported by ISO 13485:2016 or the AO applied a country specific requirement without citing the requirement.

ISO 13485:2016 has a potential ambiguity in that the record retention period is either the manufacturer's lifetime or the regulatory requirement with a floor of two years from device release. It doesn't say, "which ever is longer".

My recommendation is that you ask the AO for the source of the "5 year" requirement. Ask them to withdraw the nonconformance if they it up or to rewrite the nonconformance to cite a country specific requirement. If so, you need to understand the country specific requirements, since it could include record retention by the supplier.

Deviation:

Supplier Quality Agreement are not always in compliance with the document retention and supplier evaluation/ re-evaluation criteria.

 Evidence: 

Part 1:

Purchase Agreement: Quality system documentation at the supplier's site must be retained for at least 5 years after the lifecycle of the products design or following manufacturing activities termination; manufacturing records shall be retained by the seller for at least 5 years after the lot/batch lifecycle.

SOP Record Retention Requirement: Based on a lifetime of the medical device of 10 years.

With the possible exception of one case, I'm unable to find the requirement "indicated" by your AO. It is not in ISO 13485:2016, the companion document, or the MDSAP audit model.

I infer that the AO issued a nonconformity. As such, it should have been written in the format prescribed by IMDRF/MDSAP WG/N24 FINAL: 2015 Medical Device Regulatory Audit Reports. Section 4.2.5 requires four elements:

- identify the requirement against which the nonconformity is raised

- make a statement of how that requirement has not been fulfilled

- reference the supporting objective evidence in the audit summaries

- assign the grade according to IMDRF/MDSAP WG/N3 – 9.1.2

 It would be valuable if you were to provide the wording of, at least, the first two requirements.

You said, "require all our suppliers to retain all their records for what they supply us". This is, in my opinion an overreach when applied to "all" suppliers. This is the requirement I cannot find.

There is a case when the supplier performs an outsourced process as described in 4.1.5. In that case it is your process performed at an external supplier's site so the record retention requirements for that process are your obligation.

However, when I read ISO 13485:2016 clause 7.4.1, to me it says that I must retain the supplier evaluation, selection, monitoring, and re-evaluation of the supplier in accordance with clause 4.2.5 but I do not see in the standard where it says that I must ask my suppliers to retain all their documents for as long as my medical device is on the market.

I am wondering if anyone else has been asked to ensure that their suppliers conform to this requirement
I would appreciate some input on this from the greater community

Thank you for providing this information. In my opinion, this goes into the examples of poorly written nonconformances.

I agree that clause 7.4.1 is the correct clause for supplier management issues. However, I could make the case that this is also record retention.

There are two ways to read the non-conformance.

In the first way, the AO says that your purchase agreement does require record retention for 5 years and that you are not following your own procedure.

In the second way, the AO says that your purchase agreement must have a provision for record retention for "at least 5 years after the lifecycle of the products design or following manufacturing activities termination". The assertion is that your procedure is deficient because it doesn't include this requirement.

In my view, the AO had the second way in mind, which raises some issues.

The first issue is the record retention period. ISO 13485:2016 clause 4.2.5 says, "The organization shall retain the records for at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements, but not less than two years from the medical device release by the organization."

Since the nonconformance states the device life-cycle is 10 years, I don't understand where 5 years comes from, in terms of ISO 13485:2016.

I looked at the MDSAP Companion Document. The Management Process, Task #8 covers record retention. It cites both Australian and Japanese record keeping requirements that include requirements with "5 years".

The second issue is application to the QMS. I cannot find an ISO 13485:2016 requirement that says, in general, that a device manufacturer must require a supplier to maintain records based on the manufacturer's record retention. However, if there is an outsourced process, then purchasing and record retention would apply to that process.

My conclusion is that is bad auditing. One of two things happened. Either the AO made up a "requirement" not supported by ISO 13485:2016 or the AO applied a country specific requirement without citing the requirement.

ISO 13485:2016 has a potential ambiguity in that the record retention period is either the manufacturer's lifetime or the regulatory requirement with a floor of two years from device release. It doesn't say, "which ever is longer".

My recommendation is that you ask the AO for the source of the "5 year" requirement. Ask them to withdraw the nonconformance if they it up or to rewrite the nonconformance to cite a country specific requirement. If so, you need to understand the country specific requirements, since it could include record retention by the supplier.

Deviation:

Supplier Quality Agreement are not always in compliance with the document retention and supplier evaluation/ re-evaluation criteria.

 Evidence: 

Part 1:

Purchase Agreement: Quality system documentation at the supplier's site must be retained for at least 5 years after the lifecycle of the products design or following manufacturing activities termination; manufacturing records shall be retained by the seller for at least 5 years after the lot/batch lifecycle.

SOP Record Retention Requirement: Based on a lifetime of the medical device of 10 years.

With the possible exception of one case, I'm unable to find the requirement "indicated" by your AO. It is not in ISO 13485:2016, the companion document, or the MDSAP audit model.

I infer that the AO issued a nonconformity. As such, it should have been written in the format prescribed by IMDRF/MDSAP WG/N24 FINAL: 2015 Medical Device Regulatory Audit Reports. Section 4.2.5 requires four elements:

- identify the requirement against which the nonconformity is raised

- make a statement of how that requirement has not been fulfilled

- reference the supporting objective evidence in the audit summaries

- assign the grade according to IMDRF/MDSAP WG/N3 – 9.1.2

 It would be valuable if you were to provide the wording of, at least, the first two requirements.

You said, "require all our suppliers to retain all their records for what they supply us". This is, in my opinion an overreach when applied to "all" suppliers. This is the requirement I cannot find.

There is a case when the supplier performs an outsourced process as described in 4.1.5. In that case it is your process performed at an external supplier's site so the record retention requirements for that process are your obligation.

However, when I read ISO 13485:2016 clause 7.4.1, to me it says that I must retain the supplier evaluation, selection, monitoring, and re-evaluation of the supplier in accordance with clause 4.2.5 but I do not see in the standard where it says that I must ask my suppliers to retain all their documents for as long as my medical device is on the market.

I am wondering if anyone else has been asked to ensure that their suppliers conform to this requirement
I would appreciate some input on this from the greater community

Thank you for providing this information. In my opinion, this goes into the examples of poorly written nonconformances.

I agree that clause 7.4.1 is the correct clause for supplier management issues. However, I could make the case that this is also record retention.

There are two ways to read the non-conformance.

In the first way, the AO says that your purchase agreement does require record retention for 5 years and that you are not following your own procedure.

In the second way, the AO says that your purchase agreement must have a provision for record retention for "at least 5 years after the lifecycle of the products design or following manufacturing activities termination". The assertion is that your procedure is deficient because it doesn't include this requirement.

In my view, the AO had the second way in mind, which raises some issues.

The first issue is the record retention period. ISO 13485:2016 clause 4.2.5 says, "The organization shall retain the records for at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements, but not less than two years from the medical device release by the organization."

Since the nonconformance states the device life-cycle is 10 years, I don't understand where 5 years comes from, in terms of ISO 13485:2016.

I looked at the MDSAP Companion Document. The Management Process, Task #8 covers record retention. It cites both Australian and Japanese record keeping requirements that include requirements with "5 years".

The second issue is application to the QMS. I cannot find an ISO 13485:2016 requirement that says, in general, that a device manufacturer must require a supplier to maintain records based on the manufacturer's record retention. However, if there is an outsourced process, then purchasing and record retention would apply to that process.

My conclusion is that is bad auditing. One of two things happened. Either the AO made up a "requirement" not supported by ISO 13485:2016 or the AO applied a country specific requirement without citing the requirement.

ISO 13485:2016 has a potential ambiguity in that the record retention period is either the manufacturer's lifetime or the regulatory requirement with a floor of two years from device release. It doesn't say, "which ever is longer".

My recommendation is that you ask the AO for the source of the "5 year" requirement. Ask them to withdraw the nonconformance if they it up or to rewrite the nonconformance to cite a country specific requirement. If so, you need to understand the country specific requirements, since it could include record retention by the supplier.

Deviation:

Supplier Quality Agreement are not always in compliance with the document retention and supplier evaluation/ re-evaluation criteria.

 Evidence: 

Part 1:

Purchase Agreement: Quality system documentation at the supplier's site must be retained for at least 5 years after the lifecycle of the products design or following manufacturing activities termination; manufacturing records shall be retained by the seller for at least 5 years after the lot/batch lifecycle.

SOP Record Retention Requirement: Based on a lifetime of the medical device of 10 years.

With the possible exception of one case, I'm unable to find the requirement "indicated" by your AO. It is not in ISO 13485:2016, the companion document, or the MDSAP audit model.

I infer that the AO issued a nonconformity. As such, it should have been written in the format prescribed by IMDRF/MDSAP WG/N24 FINAL: 2015 Medical Device Regulatory Audit Reports. Section 4.2.5 requires four elements:

- identify the requirement against which the nonconformity is raised

- make a statement of how that requirement has not been fulfilled

- reference the supporting objective evidence in the audit summaries

- assign the grade according to IMDRF/MDSAP WG/N3 – 9.1.2

 It would be valuable if you were to provide the wording of, at least, the first two requirements.

You said, "require all our suppliers to retain all their records for what they supply us". This is, in my opinion an overreach when applied to "all" suppliers. This is the requirement I cannot find.

There is a case when the supplier performs an outsourced process as described in 4.1.5. In that case it is your process performed at an external supplier's site so the record retention requirements for that process are your obligation.

However, when I read ISO 13485:2016 clause 7.4.1, to me it says that I must retain the supplier evaluation, selection, monitoring, and re-evaluation of the supplier in accordance with clause 4.2.5 but I do not see in the standard where it says that I must ask my suppliers to retain all their documents for as long as my medical device is on the market.

I am wondering if anyone else has been asked to ensure that their suppliers conform to this requirement
I would appreciate some input on this from the greater community

Thank you for providing this information. In my opinion, this goes into the examples of poorly written nonconformances.

I agree that clause 7.4.1 is the correct clause for supplier management issues. However, I could make the case that this is also record retention.

There are two ways to read the non-conformance.

In the first way, the AO says that your purchase agreement does require record retention for 5 years and that you are not following your own procedure.

In the second way, the AO says that your purchase agreement must have a provision for record retention for "at least 5 years after the lifecycle of the products design or following manufacturing activities termination". The assertion is that your procedure is deficient because it doesn't include this requirement.

In my view, the AO had the second way in mind, which raises some issues.

The first issue is the record retention period. ISO 13485:2016 clause 4.2.5 says, "The organization shall retain the records for at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements, but not less than two years from the medical device release by the organization."

Since the nonconformance states the device life-cycle is 10 years, I don't understand where 5 years comes from, in terms of ISO 13485:2016.

I looked at the MDSAP Companion Document. The Management Process, Task #8 covers record retention. It cites both Australian and Japanese record keeping requirements that include requirements with "5 years".

The second issue is application to the QMS. I cannot find an ISO 13485:2016 requirement that says, in general, that a device manufacturer must require a supplier to maintain records based on the manufacturer's record retention. However, if there is an outsourced process, then purchasing and record retention would apply to that process.

My conclusion is that is bad auditing. One of two things happened. Either the AO made up a "requirement" not supported by ISO 13485:2016 or the AO applied a country specific requirement without citing the requirement.

ISO 13485:2016 has a potential ambiguity in that the record retention period is either the manufacturer's lifetime or the regulatory requirement with a floor of two years from device release. It doesn't say, "which ever is longer".

My recommendation is that you ask the AO for the source of the "5 year" requirement. Ask them to withdraw the nonconformance if they it up or to rewrite the nonconformance to cite a country specific requirement. If so, you need to understand the country specific requirements, since it could include record retention by the supplier.

Deviation:

Supplier Quality Agreement are not always in compliance with the document retention and supplier evaluation/ re-evaluation criteria.

 Evidence: 

Part 1:

Purchase Agreement: Quality system documentation at the supplier's site must be retained for at least 5 years after the lifecycle of the products design or following manufacturing activities termination; manufacturing records shall be retained by the seller for at least 5 years after the lot/batch lifecycle.

SOP Record Retention Requirement: Based on a lifetime of the medical device of 10 years.

With the possible exception of one case, I'm unable to find the requirement "indicated" by your AO. It is not in ISO 13485:2016, the companion document, or the MDSAP audit model.

I infer that the AO issued a nonconformity. As such, it should have been written in the format prescribed by IMDRF/MDSAP WG/N24 FINAL: 2015 Medical Device Regulatory Audit Reports. Section 4.2.5 requires four elements:

- identify the requirement against which the nonconformity is raised

- make a statement of how that requirement has not been fulfilled

- reference the supporting objective evidence in the audit summaries

- assign the grade according to IMDRF/MDSAP WG/N3 – 9.1.2

 It would be valuable if you were to provide the wording of, at least, the first two requirements.

You said, "require all our suppliers to retain all their records for what they supply us". This is, in my opinion an overreach when applied to "all" suppliers. This is the requirement I cannot find.

There is a case when the supplier performs an outsourced process as described in 4.1.5. In that case it is your process performed at an external supplier's site so the record retention requirements for that process are your obligation.

However, when I read ISO 13485:2016 clause 7.4.1, to me it says that I must retain the supplier evaluation, selection, monitoring, and re-evaluation of the supplier in accordance with clause 4.2.5 but I do not see in the standard where it says that I must ask my suppliers to retain all their documents for as long as my medical device is on the market.

I am wondering if anyone else has been asked to ensure that their suppliers conform to this requirement
I would appreciate some input on this from the greater community