Are your suppliers prepared for the revised ISO 13485?

Medical device manufacturers are responsible for ensuring that all components, even those produced externally, comply with all relevant ISO guidelines. To this end, they must check and ensure that the quality management systems of their suppliers fulfil all the necessary requirements. This is all the more urgent now as two crucial standards have recently been revised: suppliers must ensure that their processes conform to the new ISO 9001 by September 2018 and to the revised ISO 13485 by March 2019. If a component manufacturer doesn’t obtain certification in time, the OEM will have to switch suppliers, at least in the short term. If this is not an option, the worst-case scenario means the manufacturer will be unable to market their product in the European Union.

This is why FMI, a Chicago-based specialist for complex silicone parts, has immediately taken the necessary measures: the company carried out a gap analysis in January 2017 and is planning to inspect its compliance to ISO 13485 in April, this year. To satisfy the growing quality demands, the company has, for example, optimised its risk management for product realisation and its CAPA programme.

“For OEMs, it is not always easy to ensure that vendor parts conform to ISO standards,” explains Leo Gelera, Quality Manager at FMI. “In the best-case scenario, the quality management (QM) systems of our suppliers are efficient enough to recognise risks and prevent faults and defects.”

The medical device manufacturer recognises how effective the internal processes are, using factors such as certification as per ISO standards, risk management for product realisation, the use of a Corrective and Preventive Actions (CAPA) programme and the significance of quality as part of the corporate culture.

With ISO 9001, which specifies the minimum requirements on QM systems, and ISO 13485 having both been revised recently, the priority for OEMs at the moment is to ensure that suppliers comply with the deadlines for certifications according to these revised standards.

“The key objective of the new standards is to improve the risk management among suppliers of the medical industry,” says Gelera. “Among other things, this is done by focussing more intensively on the need for controls throughout the entire supply chain process.”

In order to complete the certification process successfully within the deadline, the supplier can engage an external consultant or use internal personnel resources. If the latter approach is chosen, the office responsible for the certification should be contacted. This office will provide advice on the best process and provide the checklists, which are also used for later evaluation.

In addition, the quality manager responsible for the project should attend a training session about the requirements of the new standards and be certified as the lead auditor. If this occurs, the next step is to carry out a gap analysis. In doing so, the requirements of the new guidelines are compared with the current processes at the supplier’s premises and steps for their adjustment are identified.

“The companies should not dawdle. The regulatory bodies are allowing the exact amount of time required for successful certification between the publication of the standard and the end of the deadline,” highlights Gelera. For example, FMI carried out a gap analysis back on January 2017 and identified the areas in which changes are needed. “In my view, the key elements of ISO 13485:2016 are the training and CAPA programme along with more accurate supplier checks,” says Gelera. “We are making major progress in these areas, for example we have redefined our training programme to include a more robust verification check to ensure that FMI’s training plans for our employees are effective.”

FMI has already agreed an evaluation date in April 2018 with the certifying authority. Even if not all the companies in the supply industry are working as quickly, the gap analysis at least needs to have been performed in September 2017 and a precise plan for the upgrade should have been developed.

Gelera adds: “There can be grave consequences for an OEM if it obtains components from a company, whose quality management system is not certified in accordance with ISO 13485:2016.

“This certification is a fundamental prerequisite for being able to market a medical device in the European Union. As a result, it is one of the standard requirements of suppliers for many OEMs.”

If the deadline is not complied with, the medical device manufacturer must not use these components in its production processes until the non-compliance is resolved. As OEMs normally only have one supplier for a specific component, there is the risk that existing orders might not be fulfilled. If the medical device manufacturer has the impression that its supplier is not currently far enough into the certification process, the OEM should at least request the supplier’s action plan and schedule for the adjustments in order to get a more accurate overview and be able to take action in good time.