The most frequently asked questions about the quality management system

This FAQ provides answers to the most common questions that companies such as medical device manufacturers have about quality management systems (QM systems) and ISO 13485.

Question 1: Who needs a QM system?

The EU medical device regulations (MDR and IVDR) as well as the FDA set requirements for QM systems. These requirements are relevant for:

• medical device manufacturers
• distributors and importers who have manufacturer obligations under Article 16 of the MDR/IVDR
• organizations that reprocess or sterilize medical devices as new

Question 2: Does the QM system have to comply with ISO 13485?

The short answer is yes, because EN ISO 13485 is the only standard that is harmonized for the MDR and IVDR. The FDA also makes mandatory reference to the requirements of ISO 13485 in 21 CFR part 820. The more precise answer is, that in EU the QM system has to be conform with MDR/IVDR requirements. ISO 13485 helps proving, that these requirements are met.

Question 3: Is ISO 9001 allowed as an alternative?

Other standards are permitted, but they are not suitable on their own for proving that the statutory requirements for the QM system are met.

Question 4: Does the QMS have to be ISO 13485 certified?

Manufacturers must involve a notified body in the conformity assessment unless the devices fall into class I. The usual conformity assessment procedure follows Annex IX of the MDR or IVDR. For this purpose, the manufacturers require an appendix certificate. Strictly speaking, no ISO 13485 certificate is required. But because ISO 13485 almost completely covers the requirements of Article 10 and Annex IX of the MDR and IVDR, it makes no sense to dispense with the ISO 13485 certificate.

Thus, the short statement that an ISO 13485 certificate is mandatory for all manufacturers (except those of class I devices) is sufficiently correct.

Question 5: What are the requirements of ISO 13485?

ISO 13485 obligates manufacturers to, among other things:

• QM manual, including quality objectives and quality policy
• Quality management representative
• Description of standard documents such as standard operating procedures. These include, among other things, standard operating procedures on/for
  • Document control, including document release and retention periods
  • Management review
  • Internal audits
  • Corrective action and preventive action
  • Handling of measuring equipment
  • Control of suppliers, e.g., with quality assurance agreements (QAA)
• Work in conformity with these standard operating procedures

The requirement documents can be divided, for example, into standard operation procedures (SOPs) and work instructions, templates, forms, and checklists. ISO 13485 requires approximately 25 SOPs to be documented, which you will find listed here.

Question 6: How to get the certification?

Step 1: Select certifier (notified body)

The German accreditation body DAkkS publishes on its website the notified bodies or certifiers accredited for ISO 13485 certification. Note that the notified bodies may only perform ISO 13485 certification for a certain type of medical device (e.g., in vitro diagnostic devices, non-active medical devices, extra-corporeal circuits).

Step 2: Establish quality management system

As described above, this includes creating the QM manual, describing standard operating procedures, and establishing the QM representative.

Step 3: Live quality management system

In order to apply for an audit, you must not only have defined a QM system, but you must already be working according to the rules of this (new) QM system. For example, technical documentation for a medical device should already have been developed following the respective SOPs such as the development SOP (as far as possible). Typically, you should also have performed an internal audit as well as a management review.

Step 4: Invite notified bodies for audit

You then invite the selected notified body to an audit. If you pass this audit, the notified body will (in all likelihood) issue you with an ISO 13485 certificate and, if applicable, an Annex XI certificate. Among other things, this authorizes you to market medical devices.

Question 7: How long does it take to get the certificate?

We typically guide companies to ISO 13485 certification in six to nine months (more on the process). Currently, the overload of notified bodies may delay this timeframe. What matters most is the commitment of the organization.

Question 8: How much does it cost, what are the expenses?

The amount of time and effort required depends mainly on the size of the organization and the areas to be certified. Small and medium-sized companies spend between 30 and 90 days to set up their QM system.

Maintaining the QM system on a permanent basis also means an expenditure, but this should be more than compensated for by lower consequential failure costs (recalls, rework, unnecessary iterations in development).

External certification costs are incurred in any case for the certification of their quality management system. For the preparation, the on-site audit, and the follow-up of the audit, the certification body will charge you costs that depend on the size of the company. These range from 20 to 60,000 EUR. This includes the inspection of the technical documentation.

Question 9: Where can I get support?

Johner Institute's QM experts support medical device manufacturers and their service providers in setting up and continuously improving QM systems.

a) Education and training

The Johner Institute offers seminars for beginners and advanced users, e.g., on the basics of ISO 13485 or internal auditor.

b) Tool to master all regulatory hurdles 

The Medical Device University enables manufacturers to create QM systems themselves with support. It combines:

• An onboarding that provides an overview of the roadmap
• Video trainings
• Complete set of sample templates that only need to be adapted to your own situation
• Weekly expert sessions where questions are answered

c) Consulting and assumption of roles

Johner Institute consultants also provide direct support. They... 

• create QM systems for and with you,
• check these systems and prepare them for audits (e.g., with mock audits),
• operate a QM system for manufacturers and act as legal manufacturer, and
• take on the role of QM representative(s).

Interested? Then contact us right away.