Addressing the “chicken and the egg” conundrum

One of the many challenges start-up medical device companies face when they begin developing a product is realizing that they are in fact a medical device company and that they are, or will soon be, required to have a Quality Management System (QMS). This is often not realized or is overlooked until regulatory submission activities begin, especially when design services have been contracted out. Once the light bulb clicks on, the next question is when and how should this mysterious “system” be implemented? The more interesting of the two questions is the “when”. In many discussions with auditors from various accreditation bodies I have found that it can lead to a “chicken and the egg” type of conundrum.

I can remember my first QMS audit. I was a young Technician fresh into my first job in the medical device industry. I’d never heard of terms like usability engineering, risk management or design history file. In fact, you probably could have told me QMS was short for Quantity Measurement System and I would have believed you. One thing I definitely remember is that cold, gnawing feeling down at the bottom of my stomach as I tried to answer each of the patiently delivered questions from the auditor.

Since 2008 I have participated in dozens of QMS audits, both for StarFish and for its clients. Today I don’t much worry about the yearly surveillance audit as we enter our twelfth year of ISO 13485 certification but the prospect of an initial certification audit for a new client has introduced me to some new challenges. That cold, gnawing feeling has mostly (and I’ll emphasize “mostly”) been replaced by feelings of excitement and curiosity at who is going to walk through that door and what their opinions are going to be of this medical marvel my team and I have helped to create with our client.

The three markets we most often see medical devices launched in are the US, Canada and Europe. All three share a similar regulatory requirement in that they require a manufacturer of a medical device to have a QMS in place before product is placed on the market. The required make-up of the QMS for all three is very similar and is laid out in three respective regulations. In the US the FDA enforces 21 CFR 820, Health Canada has their Medical Device Regulations and the EU requires compliance with the Medical Devices Directive. The general consensus is that ISO 13485 certification with the necessary tweaks is the most effective way to comply with the QMS requirements for the three regulations.

In theory, a medical device is supposed to be developed using design control as described in ISO 13485 and 21 CFR 820. In the US once clearance or approval is granted for a device it can be legally placed on the market and the FDA may inspect the manufacturing facility to ensure the required quality system is in place. During an inspection auditors look for evidence that the QMS is being adhered to and this most often comes in the form of records, or more specifically manufacturing records.

In the case of an ISO 13485 certified QMS, this can be problematic if a device is still in development and manufacturing processes have not yet been set up when the initial registration audit is scheduled. Registrars are reluctant to grant a certificate with a manufacturing scope if a manufacturing infrastructure is not yet in place. But if you don’t have manufacturing in your scope, how are you supposed to do any manufacturing to produce the necessary records to be audited?

Health Canada really exemplifies this question with their requirements for a QMS. In order to obtain a medical device license to sell a device in Canada, proof of an ISO 13485 certification (with a CMDCAS designation which ensures all of the tweaks are in place) is required before a license can be issued. Questions such as these have landed me in more than one friendly debate with an auditor about the timing of a QMS implementation.

Every company is unique and needs will differ depending on a variety of factors. That said, to me it most often seems advantageous to implement a QMS as early as possible, preferably early in the design phase of the product life-cycle. Having the processes and procedures in place helps to ensure that the device is designed in accordance with the various regulations and provides for the best chance of success during a regulatory submission. Actual certification of the system may be postponed until the design transfer phase in order to set up manufacturing activities and produce some initial records for inspection. This can help to control costs by avoiding follow-up inspections. At the end of the day, the more mature a system is, the more comfortable an auditor feels about issuing certification. This leads to less time spent debating the readiness of the system and more time to figure out; where exactly did that chicken come from anyway?