It wasn't until I actually had to operate quality management systems day-to-day and through audits that the value of a well-written Quality Manual and Quality Policy became clear to me. For example, the Quality Manual should be a primary output of quality management system planning (e.g., regarding ISO 13485clause 5.4.2). If we fail to plan, then we're planning to fail.
I have also repeatedly avoided nonconformities in audits when the operating procedures were lacking and I directed the auditor to the corresponding section of the Quality Manual. So a Quality Manual is, for me and my clients, far from an antiquated dust-collecting relic. It has real value that reduces compliance costs, facilitates organizational synchrony, and improves public health.
Regarding the Quality Policy, a key value there, as much as anything, is as a stark reminder for top management of its ultimate accountability for quality. The need for this goes way back to the time when top management accountability wasn't so clearly mandated (if at all); when the quality "department" (oftentimes consisting of only one individual) was stuck on an island holding all of the responsibility without the necessary support and resources from the business. Top management is more engaged and aware and accountable when their signature(s) are sought and put on the Quality Policy, and when they are reminded that the applicable regulatory requirements (e.g., from U.S. law) and standards place responsibility for quality squarely on the shoulders of top management.
© Copyright 2023 by ComplianceAcuity, Inc. All rights reserved.
Original Message:
Sent: 10-Nov-2023 08:15
From: D Michelle Williams
Subject: Quality Manual Scope and Quality Policy
I can speak from personal experience about the QM and the QP. While I agree 100% with Richard on the thoughts of a QP, we received an NC on our last ISO 13485 surveillance audit as our QP did not state we produced medical devices and it did not explicitly state improvement of the effectiveness of our QMS. While it stated we met 3 different medical device regulations which to me inferred that we produced medical devices and had to review and implement improvement in the effectiveness of our QMS, the argument fell on deaf ears. During our certification audit, my mention of the inference was taken into account and no NC was issued.
During the previous year's surveillance audit we received an NC because our QM did not explicitly state what our role was in the US, Canada, and the EU. This issue was not brought up on our certification audit.
While it will depend on the auditor, you could end up in the same boat as us with 2 NCs for those items depending on the auditor.
------------------------------
D Michelle Williams
VP - Operations
United States
Original Message:
Sent: 09-Nov-2023 04:45
From: Richard Vincins
Subject: Quality Manual Scope and Quality Policy
Anon,
The words I will say will probably be met with harsh eyes, but the concept of a Quality Manual and Quality Policy are so 1990s. In fact, most of the time a Quality Policy is there to check the box on the auditors checklist. Why not just update it now with the "standard wording" which everyone else uses? There is specific wording auditors look for in a Quality Policy, so it would not take much to update currently regardless of where you are in the design control implementation. Quality Policy is hung on the wall, put on the badges, posted on screens, posters, etc, but ultimately it is the top management attitude and each individual manager/supervisor attitude supporting how an organisation applies Quality Principles. Reflect how your Quality Policy has been/is used in the ISO 9001 world and update to the "medical device" world as appropriate ... either fully embraced or using some standard wording.
A Quality Manual should reflect what your company does as a business. It is not a repeat of ISO 9001 or ISO 13485 statements, but should describe what your organisation does, how it does it, interactions with stakeholders and external entities, top management interaction, relationship of a ISO 9001 and ISO 13485 QMS system (if keeping both). Think of a Quality Manual more as a business purpose document describing what the company does and why. In fact, the process in ISO 9001 is much better as there is no Quality Manual requirement with ISO 13485 "quality manual" very antiquated. With that said, if your company is embarking on a medical device path, with design controls starting, your quality system should reflect accordingly such as having a Standard Operating Procedure or other documented information for how you manage design controls. And obviously without saying, there should be a procedure and process defined before those activities start. As far as a Quality Manual, update a section or include a section saying, "Cool, we do design controls !" Though seriously, if you have a quality manual it may be minimal impact to add a section of a paragraph or two stating how you do design controls, through life cycle of device, and support then through SOP number 123. With US FDA, for a Class II device, this would be reviewed during a FDA inspection at some point in the future, so implications probably in the short term are minimal.
------------------------------
Richard Vincins ASQ-CQA, MTOPRA, RAC
Vice President Global Regulatory Affairs
Original Message:
Sent: 08-Nov-2023 19:36
From: Kevin Randall
Subject: Quality Manual Scope and Quality Policy
This sounds a lot like a scenario recently discussed in the Forum (see 'Timing of Release of QMS Procedures...' in 'Related Content' below).
Under FDA's current 21 CFR Part 820, if I was at the doorstep of starting design controls and forced to choose between having a proper design control procedure or having a proper Quality Manual and Quality Policy, I would choose a proper design control procedure. Indeed, an FDA 483 Observation for lack of proper design control procedures is a much more serious observation than lacking a proper Quality Manual (FDA calls it a Quality System Record - "QSR") or Quality Policy. In other words, both deficiencies are worthy of an FDA 483 Observation, but a late Quality Manual and Policy, if ever discovered at all by FDA, would be a less serious observation. So from that perspective, you could be in much worse shape than you are, presuming that your design control procedure really is a proper design control procedure, for example, one that systematically identifies applicable regulatory requirements as part of the design inputs.
And while the aforesaid compliance considerations are generally the same regarding FDA's impending plan to "converge" Part 820 with ISO 13485:2016, a lack of a Quality Manual and Quality Policy should be viewed more seriously at that point. As I mentioned offline with the poster of the prior similar thread, if the organization launches into QMS operations without a Quality Manual, then it leaves open the possibility that fundamental requirements of the QMS may go unmet. For example, some fundamental requirements of an ISO 13485 Quality Manual (and soon to be the same for FDA) is for us to predefine/preplan the scope of regulated operations, identify the applicable regulatory requirements, state the scope of the QMS (even if it's a partial QMS), list the exclusions and non-applications, etc. These fundamental requirements intrinsically show, for example, that it's not appropriate to pursue regulatory compliance before the organization has even documented the applicable regulatory requirements. Similarly, it's not appropriate to operate the QMS before its scope and non-applications have been specified. Failure to do so is contrary to a key tenet of an ISO 13485 or FDA QMS, specifically the PDCA cycle.
For practical intents and purposes, you may want to consider hiring an expert to accelerate revision of your Quality Manual and Quality Policy if those tasks are outside your current bandwidth. A qualified expert should be able to get this done for you in a matter of a few days thus quickly resolving this compliance risk in short order.
------------------------------
Kevin Randall, ASQ CQA, RAC (U.S., Europe, Canada)
Principal Consultant
Ridgway, CO
United States
© Copyright 2023 by ComplianceAcuity, Inc. All rights reserved.
Original Message:
Sent: 08-Nov-2023 12:02
From: Anonymous Member
Subject: Quality Manual Scope and Quality Policy
This message was posted by a user wishing to remain anonymous
Greetings, forum.
Working with a small startup that has/had ISO 9001 QMS and is moving to re-scope and construct a QMS that is compliant to 21 CFR 820 in order to design and develop a Class II medical device in US. As the group is about to move into design control of a Class II (US) device, there is an appropriately scoped Design Control procedure that outlines a process compliant to CFR. However, the current Quality Manual and Quality Policy do not reflect a scope as a medical device designer/developer/manufacturer in the US or at all, and the Quality Policy does not identify the purpose of the organization as medical device design/developer, nor does it state anything about compliance to regulations. What are the implications of moving forward into design control under 21 CFR 820 without a properly scoped Quality Manual and without stating anywhere in the Quality Policy that the org is "medical device" and cognizant/compliant to the applicable regulatory obligations?