A07-W81XWH-18-R-0058_Attch-6-ISO_13485_Checklist_for_TCR_7Dec2017_LA.RTF

ISO 13485/21CFR820 Compliance Checklist Page 10 of 10

ISO 13485 Compliance Checklist FDA-ISO QMS Audit Checklist

Item Subsystem / Assessment Detail FDA / ISO reference Compliant?

If no, provide explanation The Quality Manual defines scope of QMS, procedures (or reference to) within QMS, and description of the interaction of processes within QMS

ISO 13485:2012: 4.1, 4.2.2

There are criteria and methods in place to monitor and control processes for effectiveness ISO 13485:2012: 4.1(c), 4.2.1(d), 8.4

Management Reviews are established and conducted at least annually ISO 13485:2012: 5.1(d), 5.6;

21 CFR 820.5, 820.20(c)

Management reviews examine suitability and effectiveness of quality systems, improvements needed because of customer requirements, and resource needs ISO 13485:2012: 4.1(f), 5.6.1, 5.6.3, 6.1, 8.4;

21 CFR 820.20(c)

Management reviews and addresses audit results, customer feedback, process performance, CAPAs, previous management reviews, changes to QMS, recommendations for improvement, and new or revised regulatory requirements.

ISO 13485:2012: 5.6.2

There is an established Quality Manual and Quality System Procedures and Instructions that are appropriate ISO 13485:2012: 4.1(a), 4.2.1(b), (c)

21 CFR 820.5, 820.20(c), (e), 820.22 (d)

There is an established Quality Plan ISO 13485:2012: 4.2.1(d), 5.4 21 CFR 820.20(d)

Quality Planning addresses QMS needs and Quality Objectives

ISO 13485:2012: 5.4.2;

21 CFR 820.20(a), (d)

There is a Quality Policy and Quality Objectives ISO 13485:2012: 4.2.1(a), 5.1(b), (c), 5.3, 5.4.1;

21 CFR 820.20(a), (d)

There are established Quality Audit procedures and audits are conducted

ISO 13485:2012: 4.2, 8.2.2;

21 CFR 820.20(c), 820.22

The quality audits examine compliance and effectiveness ISO 13485:2012: 4.1(f), 4.2.1(d), 8.2.2;

21 CFR 820.22

The auditors are trained

ISO 13485:2012 8.2.2

The audits are conducted by objective parties

ISO 13485:2012: 8.2.2

The quality audits are linked to CAPA

ISO 13485:2012: 8.2.2;

21 CFR 820.22, 820.100

There is an organizational structure of the company and resources are available to support QMS processes ISO 13485:2012: 4.1(d), 5.1(e), 5.5.1, 5.5.2, 6.1, 6.2;

21 CFR 820.20(b), 820.25

There is a defined a management representative with executive responsibility for implementing and reporting quality management system

ISO 13485:2012: 5.1, 5.5.1, 5.5.2, 6.1, 6.2;

21 CFR 820.20(b)(3), 820.25

Appropriate responsibilities, authority, and resources are in place for quality system activities ISO 13485:2012: 5.1(e), 5.5.1, 5.5.2, 6.1, 6.2 21 CFR 820.5(b)(1)-(2), 820.20(b), 820.25

There are established procedures for identifying training needs;

ensure personnel are trained to perform assigned responsibilities

ISO 13485:2012: 6.2

21 CFR 820.25(b)

Executive management ensures adequate and effective quality system is implemented. Management is committed to and communicates importance of meeting customer requirements, regulatory requirements, and QMS.

ISO 13485:2012: 5.1(a), 5.2, 5.5.3

Design & Development / Design Controls (main subsystem) Compliant?

If no, provide explanation Products are subject to design controls

ISO 13485:2012: 7.1, 7.3

21 CFR 820.30(a)

There are established and applied design control and risk management procedures

ISO 13485:2012: 7.3

21 CFR 820.30(a) -(j)

Design and development stages are identified; there are documented review, verification, validation, and design transfer activities at each stage; The responsibilities for design and development are defined

ISO 13485:2012: 7.3.1

21 CFR 820.30

There are procedures for updating the design & development plan and it is reviewed and approved

21 CFR 820.30(b)

There are established design input requirements, that are reviewed, and approved; customer requirements are captured; inputs include functional, performance, safety, and statutory and regulatory requirements

ISO 13485:2012: 7.2.1, 7.3.2

21 CFR 820.30(c)

Incomplete, ambiguous, and/or conflicting design requirements are addressed

ISO 13485:2012: 7.3.2

21 CFR 820.30(c)

Design & development outputs are established, verifiable, reviewed, and approved ISO 13485:2012: 7.3.3(a), (c) 21 CFR 820.30(d)

Design & development outputs are appropriate for purchasing, production, and servicing ISO 13485:2012: 7.3.3(b)

Essential design & development outputs are identified ISO 13485:2012: 7.3.3(d);

Acceptance criteria is referenced by design & development outputs and was defined prior to design verification and design validation activities ISO 13485:2012: 7.3.3(c), 7.3.5 21 CFR 820.30(d) & (f)

Design verification confirm design outputs meet design input requirements

ISO 13485:2012: 7.3.5

21 CFR 820.30(f)

Design validation results prove device meets predetermined user needs and intended uses

ISO 13485:2012: 7.3.6

21 CFR 820.30(g)

Design validation does not leave unresolved discrepancies

If required by national or regional regulations, there should be clinical evaluations and/or evaluation of device performance

If device contains software, the software must be validated

ISO 13485:2012: 7.3.1, 7.3.6

21 CFR 820.30(g), 820.75

Initial production units (or equivalents) are used for design validation

Risk management activities were performed

ISO 13485:2012: 7.1

ISO 14971:2012

Design changes are controlled and validated (or where appropriate, verified)

ISO 13485:2012: 7.3.1, 7.3.5, 7.3.7

21 CFR 820.30(i), 820.70(b), 820.75(c)

Design changes are reviewed for effect on components and product previously made

ISO 13485:2012: 7.3.1, 7.3.5, 7.3.7

21 CFR 820.30(i), 820.70(b)

Design reviews are conducted at appropriate stages of design & development

ISO 13485:2012: 7.2.2, 7.3.1, 7.3.4

21 CFR 820.30(e)

Design review attendees are appropriate for stage and included independent reviewer

ISO 13485:2012: 7.3.1, 7.3.4

21 CFR 820.30(e)

The design must be correctly transferred to production

21 CFR 820.30(h)

The Device History File must contain design control documentation 21 CFR 820.30(b) - (j)

Corrective & Preventive Actions (CAPA) (main subsystem)

If no, provide explanation CAPA procedures comply with regulatory requirements

ISO 13485:2012: 8.5

21 CFR 820.100(a)

Non-conforming product and CAPA procedures determine the need for investigation and notification

ISO 13485:2012: 8.3, 8.5;

21 CFR 820.90(a), 820.100(a)(2)

Non-conforming product and CAPA procedures define responsibilities for review and disposition

ISO 13485:2012: 8.3, 8.5;

21 CFR 820.90(b)(1)

Procedures for rework, retesting, and re- evaluation of nonconforming product exist and are followed

21 CFR 820.90(b)(2)

Appropriate records of quality problems have been created and used

21 CFR 820.100(a)(1)

Trend analysis data indicates quality problems; determine if data used for CAPA decisions.

ISO 13485:2012: 8.1, 8.2.3, 8.4, 8.5

21 CFR 820.100(a)(1), 820.250

CAPA data is complete, accurate, and timely; compare results across multiple data sources to identify quality problems

ISO 13485:2012: 8.4, 8.5

21 CFR 820.100(a)(1)

Appropriate statistical techniques are implemented

ISO 13485:2012: 8.1, 8.2.3, 8.4

21 CFR 820.100(a)(1), 820.250

Device failure investigations determine root cause

21 CFR 820.100(a)(2)

Failure investigations are commensurate with risks

21 CFR 820.100(a)(2), 820.90(b)

Controls exist to prevent non-conforming product from being released

ISO 13485:2012: 8.3

21 CFR 820.90(b)

Appropriate actions are taken for quality problems

ISO 13485:2012: 8.2.3, 8.5.2, 8.5.3

21 CFR 820.100(a)(3), 820.100(a)(5), 820.100(a)(4), 820.100(b)

CAPA actions are effective, verified, validated, documented, and implemented appropriately

ISO 13485:2012: 8.5

21 CFR 820.100(a)(4), 820.100(a)(5), 820.100(b)

CAPAs and nonconformities are disseminated to personnel responsible for ensuring quality and prevention of problems

ISO 13485:2012: 8.3, 8.5

21 CFR 820.100(a)(6)

Quality issues and CAPAs are disseminated for Management Review

ISO 13485:2012: 5.6.3, 8.3, 8.5

21 CFR 820.100(a)(6), 820.100(a)(7)

Firm has procedures for handling complaints and investigation of advisory notices / recalls; ensure provisions exist to feed in CAPA system

ISO 13485:2012: 7.2.3, 8.2.1

21 CFR 820.100, 820.198

Medical Device Reporting (MDR)

If not, provide explanation MDR procedures comply with regulatory requirements

ISO 13485:2012: 8.5.1

21 CFR 803.17

Firm maintains MDR event files that comply with regulatory requirements

21 CFR 803.18

Appropriate MDR information is identified, reviewed, reported, documented, and filed

21 CFR 803, 820.198(d)

Firm is effective in identifying MDR reportable events

21 CFR 803

Firm has established procedures for receiving, reviewing, and evaluating complaints

ISO 13485:2012: 7.2.3, 8.2.1, 8.5.1

21 CFR 820.198(a) - (c) verify firm maintains complaint files and that they are reasonably accessible

21 CFR 820.198(a), (f), (g)

Complaints are evaluated to determine if an event should be a MDR

21 CFR 803, 820.198(a)(3)

Complaint investigations include the device name, date of complaint, device identification number, contact information of complainant, details of complaint, date and results of investigation, any corrective actions, and replies to complainant

21 CFR 820.198(e)

Reports of Corrections & Removals (C&R)

If no, provide explanation C&R procedures comply with regulatory requirements

21 CFR 806

There are records of corrections and/or removals of product

Reporting requirements are implemented

Are there C&R actions not identified or initiated by firm?

There are files of non-reportable corrections and removals

21 CFR 806.20

Production & Process Controls (main subsystem) (P&PC)

If no, provide explanation Product realization processes are planned; risk management occurs throughout product realization

ISO 13485:2012: 7.1

ISO 14971:2000

21 CFR 820.70

Planning of product realization is consistent with requirements of other processes of QMS

ISO 13485:2012: 7.1

21 CFR 820.30, 820.50, 820.80, 820.181

Requirements have been defined for suppliers, contractors, and consultants; ensure suppliers, contractors, and consultants are selected on ability to meet requirements

ISO 13485:2012: 7.1, 7.4.2

21 CFR 820.50(a)

Firm maintains records of acceptable suppliers, contractors, and consultants

ISO 13485:2012: 7.4.1

21 CFR 820.50(a)(3)

There is data supporting supplier requirements is maintained; verify that suppliers, contractors, and consultants agree to notify firm of changes in products and/or services

ISO 13485:2012: 7.4

21 CFR 820.40, 820.50(a)(3),(b)

There are procedures for identifying product during all stages of receipt, production, distribution, and installation are in place

ISO 13485:2012: 7.5.3;

21 CFR 820.60

Firm maintains procedures and records for traceability of each unit, lot, or batch of finished devices and components NOTE: may not be required for all devices

ISO 13485:2012: 7.5.3.2;

21 CFR 820.65

Be able to provide a process for an auditor to review

All processes are controlled and monitored

ISO 13485:2012: 7.5, 7.6, 8.2.3, 8.2.4, 8.4

21 CFR 820.50, 820.70(a), 802.70(e), 820.70(f)-(h), 820.72, 820.75(b), 820.80

The equipment has been adjusted, validated and/or calibrated, and maintained; DQIQOQPQ documentation

ISO 13485:2012: 7.5

21 CFR 820.70(g)(3), 820.72(a), 820.70(g)(1) control and oversight activities must be identified; There must be procedures for control of inspection, measuring , test equipment, and calibration

ISO 13485:2012: 7.6, 8.4

21 CFR 820.50(a)(2), 820.72

There are established procedures for production and process changes; ensure changes are verified or validated, as needed

ISO 13485:2012: 7.3.7, 7.5.2

21 CFR 820.70(b), 820.75(c)

Be able to provide a device history record (DHR) for an auditor to review; DHR must identify rejects and/or non-conformances

21 CFR 820.70

Defects, rejects, non-conformances, and removal of materials must be handled properly

21 CFR 820.50, 820.70(h), 820.90, 820.100

Processes that cannot be fully verified by an auditor must be fully validated

ISO 13485:2012: 7.5.2

21 CFR 820.75(a)

Automated or software driven processes are validated for intended uses

ISO 13485:2012: 7.5.2.1

21 CFR 820.70(i)

Validations are documented and conducted by qualified personnel 21 CFR 820.75(b)(1)

Personnel records must document personnel are trained per manufacturing processes and aware of potential defects

ISO 13485:2012: 6.2.2

21 CFR 820.20(b)(2), 820.25, 820.70, 820.70(d), 820.75(b)(1) ensure that monitoring and control methods, data, date performed, individuals performing the process, and the major equipment used is documented

ISO 13485:2012: 7.1, 8.4

21 CFR 820.75(b)(2)

Determine linkages to other processes and document

ISO 13485:2012: 4.1, 4.2

21 CFR 820.20, 820.25, 820.30, 820.40, 820.72, 820.90, 820.100, 820.180

The infrastructure and work environment are appropriate and controlled

ISO 13485:2012: 6.3, 6.4

21 CFR 820.70(c), (f), (g)

There are documented maintenance schedules, routine inspections, and adjustments to equipment

ISO 13485:2012: 7.6

21 CFR 820.70(g)

There are procedures in place for contamination control and cleanliness

ISO 13485:2012: 7.5.1.2.1

21 CFR 820.70(e)

There are procedures for verification of purchased products

ISO 13485:2012: 7.4.3, 8.4

21 CFR 820.50(a)(2), 820.80(b)

There are procedures that define receiving, in-process, and final acceptance activities.

ISO 13485:2012: 7.5.5, 8.4

21 CFR 820.80(a) - (d)

Receiving, in-process, and final acceptance activity records must be available for review

ISO 13485:2012: 8.4;

21 CFR 820.80(e)

There are procedures for acceptance status of product

ISO 13485:2012: 7.1, 8.2.4

21 CFR 820.86

Procedures define labeling activities, including integrity, inspection, storage, operations, and control numbers

ISO 13485:2012: 7.5.5;

21 CFR 820.120

Product packaging and shipping containers adequately protect device during processing, storage, handling, shipping, and distribution

ISO 13485:2012: 7.5.5;

21 CFR 820.130

There are procedures to prevent mix-ups, damage, deterioration, contamination, or other adverse effects to product during handling

ISO 13485:2012: 7.5.5

21 CFR 820.140, 820.150

There are procedures for product distribution; confirm distribution records include name and address of consignee, identification and quantity shipped, date of shipment, and identification numbers

21 CFR 820.160

There are installation and inspection procedures (if applicable);installation records are maintained

ISO 13485:2012: 7.5.1.2.2

21 CFR 820.170

There is a servicing procedure (if applicable); verify servicing records are maintained

ISO 13485:2012: 7.5.1.2.3

21 CFR 820.200

Firm identifies, verifies, protects, and safeguards customer property under its care

ISO 13485:2012: 7.5.4

Sterilization Process Controls

If no, provide explanation There are sterilization process procedures and the sterilization process is validated

ISO 13485:2012: 7.5.2.2

21 CFR 820.75(a), (c)

There are sterilization control and monitoring activities; processes, equipment, and calibration are current

ISO 13485:2012: 7.5.1.3

21 CFR 820.50, 820.70(a), (c),(e), (f), (g), (h), 820.72, 820.75(b), 820.80

Documented sterilization failures (DHR) must be integrated with CAPA system 21 CFR 820.75(b)

Sterilization failures must be handled properly 21 CFR 820.70(g)(3), 820.72(a), 820.70(g)(1)

Personnel records must document that personnel are qualified and trained with implemented sterilization activities (on the job training, training assessment test, annual assessment of skills, etc.)

21 CFR 820.25, 820.70(d), 820.75(b)

Automated or software driven sterilization processes are controlled and validated 21 CFR 820.70(i)

Purchasing Controls (main subsystem for virtual manufacturers)

If no, provide explanation There supplier evaluation procedures

21 CFR 820.50

Suppliers are evaluated for ability to meet specified requirements

ISO 13485:2012: 7.4.1;

21 CFR 820.50(a)(1)

There are adequate specifications of materials and/or services provided by supplier and confirmation documentation

ISO 13485:2012: 7.4.2

21 CFR 820.50(b)

Purchasing information identifies requirements for approval of product, procedures, processes, and equipment, requirements for personnel qualification, and QMS requirements

ISO 13485:2012: 7.4.2

Supplier evaluation records are maintained and current

21 CFR 820.50(a)(3)

There are procedures for verification and acceptance of purchased materials and/or services

ISO 13485:2012: 7.4.3

21 CFR 820.50(a)(2), 820.80(a), 820.80(b)

Documentation & Records

If no, provide explanation There are procedures for identification, storage, protection, retrieval, retention time, control, approval, distribution, disposition, and changes of documents and records

ISO 13485:2012: 4.2.3, 4.2.4

21 CFR 820.40, 820.180

Documents and changes are approved prior to use

ISO 13485:2012: 4.2.3

21 CFR 820.40

Documents and records are legible and identifiable; There is a Good Documentation Practices SOP.

ISO 13485:2012: 4.2.3(e), 4.2.4

Documents of external origin are identified with controlled distribution ISO 13485:2012: 4.2.3(f)

Firm maintains a quality system record (QSR) which includes or refers to location of procedures ISO 13485:2012: 4.2.3(f)

21 CFR 820.20, 820.40, 820.186

Documents and records are retained for required length of time (this includes retention of obsolete controlled documents and records)

ISO 13485:2012: 4.2.1, 4.2.3, 4.2.4

21 CFR 820.100(b), 820.180(b), 820.181, 820.184, 820.186, 820.198(a), 820.200(d)

Change control records are reviewed and approved by the same reviewers that performed original review and approval

ISO 13485:2012: 4.2.3, 7.3.7

21 CFR 820.40(b)

Change records include a description of change, justification of change, identification of affected documents, approval signatures, approval date, and effective date

ISO 13485:2012: 7.3.7

21 CFR 820.40(b)

Documents are available at point of use and obsolete document are not in use ISO 13485:2012: 4.2.3(d)(g) 21 CFR 820.40(a)

Firm maintains DMRs for each type of device

ISO 13485:2012: 4.2.1

21 CFR 820.181

DMRs contain or make reference to device specifications, production process specifications, quality assurance procedures and specifications (including acceptance criteria), packaging and labeling specifications (including acceptance criteria), and installation, maintenance, and servicing procedures

ISO 13485:2012: 4.2.1

21 CFR 820.181(a)(e)

DHRs are maintained and devices are manufactured according to DMR; Realization processes and product must meet requirements

ISO 13485:2012: 7.1, 8.2.4

21 CFR 820.184

DHRs contain or make reference to dates of manufacture, quantity manufactured, quantity released for distribution, acceptance records demonstrating the device was manufactured per DMR, primary identification label and labeling used for each unit, and device identification and/or control numbers used.

ISO 13485:2012: 8.2.4

21 CFR 820.184(a)-(f)

Firm maintains records for education, training, skills, and experience of resources ISO 13485:2012: 6.2.2(e)

Firm maintains purchasing and supplier records

ISO 13485:2012 7.4.3

Sterilization process parameters and records are maintained for each batch; sterilization validation records are maintained

ISO 13485:2012: 7.5.1.3, 7.5.2.2

Technical Files (main subsystem)

If no, provide explanation There are technical file procedures ISO 13485:2012: 4.2.1d

21 CFR 820.180, 820.181, 820.184, 820.186

Documents must ensure planning, operation, and control of technical file processes ISO 13485:2012: 4.2.1d

21 CFR 820.180, 820.181, 820.184, 820.186

Documents must be able to be reviewed by an auditor

Documentation addresses a general description of product, intended use(s), contraindications, and any variants, accessories, or other devices used in combination with product

ISO 13485:2012: 7.1, 7.2, 7.3.3

21 CFR 820.30(d), 820.30(g), 820.30(f), 820.181, 820.50, 820.75

Design specifications, standards applied, and results of risk analysis are present in the technical file

There are procedures in place to ensure that all principal requirements have been fulfilled review techniques used to verify design and validate product(s) clinical data

Documentation must define sterilization method and validation

Documentation must include instruction manual(s) and labeling

Major subcontractors have been documented

ISO 13485:2012: 7.1, 7.2, 7.3.3;