Creating standard operating procedures for QM

In a standard operating procedure (SOP), companies define their processes, for example how they develop medical devices or provide services.

Standards such as ISO 9001 and ISO 13485 require standard operating procedures. Companies can define these specifications in their quality management manual directly or in independent documents.

1. Standard operating procedures, introduction, definitions

a) Definition

ISO 9000 defines a procedure as follows:

b) Process instruction versus standard operating procedure

Based on the above definition, a standard operating procedure is the superset of a process description. In practice, however, the two terms are often not precisely differentiated.

A process instruction includes the description of the entire process, e.g., software development process. It defines phases, roles and activities. For example, it requires a software system test at the end of development. How, i.e., using which methods, these tests are carried out (e.g., with equivalence classes) can be part of a referenced work instruction or standard operating procedure.

If the process instruction describes all procedures, the process instruction and standard operating procedure are the same.

2. What should a standard operating procedure contain?

a) Content

The standard operating procedure should describe:

• What role(s),
• What actions,
• How (method),
• Using which aids and tools,
• In what order (e.g., sequentially, in parallel) and therefore,
• Which inputs.
• are converted into which outputs.

b) Meta information

A good standard operating procedure should describe the following at the meta level:

• Clear identification of the standard operating procedure, e.g., document ID
• Standard operating procedure version
• Author(s)
• Responsible people
• Scope
• Objective
• Change history

3. Chapters and structure of the standard operating procedure

Johner Institute advisers and auditors generally use the following chapter structure

1. Meta information
   • Purpose
   • Scope
   • Responsibilities, incl. process owner
   • arget audience & distribution list
   • Training
   • Reference number
2. General information
3. Standard operating procedure
   • Overview (e.g., flow chart)
   • Step 1
     • Input
     • Description of the activity
     • Output
   • Step 2 – n (same)
4. Annex
   1. Referenced documents
   2. Version history

Various modeling languages such as UML activity diagrams, BPMN and classical flow charts are available. Numerous tools, including free tools (e.g., draw.io), are available.

Tables are an alternative way of showing the information. These are only suitable for sequential processes.

Table 1: Example of section of a tabular standard operating procedure

4. List of standard operating procedures

a) Overview of the regulatory requirements

The requirements that establish that manufacturers have to define and follow standard operating procedures can be found in these regulations, among others:

• ISO 13485:2016
• Medical Device Regulation MDR
• FDA 21 CFR part 820

b) ISO 13485:2016

Standards, such as ISO 13485, requires companies to [have] procedures, such as document control, design and development planning, procurement and corrective actions.

ISO 13485:2016 revised the list of standard operating procedures required. The mind map above shows these standard operating procedures in detail. A more general list of the procedures required in given in English below:

• Validation of the application of computer software used in the quality management system
• Control of documents
• Control of records
• Management review
• Design and development including transfer of design and development and control design and development changes
• Purchasing
• Procedures and methods for the control of production
• Servicing (if applicable)
• Validation of processes for production and service provision including validation of the application of computer software
• Validation of sterilization and sterile barrier systems (if applicable)
• Product identification
• Traceability.
• Preserving the conformity of product
• Control of monitoring and measuring equipment including validation of the application of computer software
• Feedback
• Complaint handling
• Reporting to regulatory authorities
• Internal Audits
• Monitoring and measurement of product
• Control of Non-Conforming Products
• Analysis of data
• Corrective Actions
• Preventive Actions

Strictly speaking, these standards (e.g., ISO 13485) require that the manufacturers

• define,
• document (in writing!), This is then the standard operating procedure),
• implement,
• provide training on and
• maintain

all the above procedures.

b) MDR versus ISO 13485

MDR requires fewer standard operating procedures than ISO 13485. At least, explicitly. On the other hand, there are procedures that manufacturers must define according to the MDR, which ISO 13485 does not mention as explicitly, for example, risk management.

It should be noted that ISO 13485 does require risk management as an activity.

Conclusion: If you act in accordance with the current edition of ISO 13485, you essentially fulfill the quality management requirements established in the MDR, e.g., in Article 10 and Annex IX.

5. Other

a) Standard operating procedures as part of the QM manual?

There are arguments in favor of integrating these standard operating procedures directly into the QM system or QM manual, and there are arguments against it. Arguments against the integration of standard operating procedures into the quality management manual are:

1. Separation of confidential and non-confidential content
   A lot of manufacturers want to proudly present their QM system (QM manual) to the outside world. If this QM system contains in-house know-how, this is not possible. This problem does not occur if there are separate standard operating procedures.
2. Interchangeability of standard operating procedures
   Development service providers, in particular, are often forced to develop according to their customers' specifications. This is easier for them if they use the customer's SOPs rather than their own. Not having their SOPS in their QM manual means that the QM manual is not affected by this.
3. Quicker approval
   It is easier to make changes to standard operating procedures because not every change requires a new release of the QM system / QM manual, which can be time-consuming, especially for large companies. Component separation sometimes also sometimes makes sense in the document landscape.

But separating the QM manual and SOPs is not always the best solution. Small companies with only one or only a few products are sometimes better served by an integrated document set.

Are you unsure which option is better for you? Please feel free to contact us. We're happy to help.

Contact us now