How an Automated Quality Management System Eases Compliance with ISO 13485:2016

Change is good, but nobody said it was easy. Clichés aside, adjusting to a change in standards may be a challenge, although it is ultimately worth the time and effort put in. ISO 13485:2016, the newest ISO revision for medical devices, contains revisions and additions that may require changes in an organization’s processes.

Equipped with the right tools, this transition can be tackled smoothly and with minimal issues. An automated quality management system (QMS) eases the transition period, helping smooth compliance with ISO 13485:2016 standards. By answering the following four simple questions, organizations will realize how an automated QMS helps to understand, implement, and maintain the new standards of ISO 13485:2016.

What’s New in ISO 13485:2016?
Although it’s not feasible to review every single change and update, there are several major themes in the new standards that are important to understand. Most of the recent ISO updates urge everyone to adopt a different mindset when it comes to quality, making quality everyone’s responsibility. When everyone adopts the following major values, quality will become a company-wide commitment:

Harmonization of regulatory requirements: By including external parties (suppliers and stakeholders) in quality requirements, one can ensure that everyone involved is in compliance at all points of production. When everyone is operating by the same set of standards, there’s no need to worry that tasks won’t be accomplished the way companies want—or need—them to be done. Under these standards, collaboration is more efficient because all parties have the same guiding principles.

Emphasis on risk: A major emphasis is now placed on incorporating risk and risk management throughout all processes. The new standards promote gathering of risk-related data and statistics and using them to drive decisions. That way, there is solid evidence that the decisions are designed to reduce risk and promote improvement.

Clarification of Validation and Verification: There are now additional regulations for monitoring and controlling validation and verification processes after implementation, rather than just in the planning stages. Following up with compliance periodically ensures that an organization is staying within compliance for the foreseeable future. That way, the likelihood of a nonconformance or another adverse event is drastically reduced.

Increased focus on improvement mechanisms: Organizations should now have a set procedure for gathering and acting on customer feedback, whether positive or negative. Additionally, more emphasis is placed on using data and statistics gathered from customer feedback to drive CAPAs and other improvement methods. Since customers are ultimately the driving force behind all of an organization’s operations, it is important to include them in the decision-making and improvement processes.
Shift in mindset: Arguably the biggest difference in the new set of standards is the shift in the way quality is viewed. It’s no longer about regulations and requirements, but more about adopting a quality-centric mindset. The standards suggest leaders work to create a company-wide commitment to quality. Rather than quality being the business of a select few, it should be a priority for everyone.

Where Does Automation Meet ISO?
In order to accomplish a company-wide commitment to quality under the new ISO standards, an organization needs to adopt processes that promote that goal. Having common, standard processes is the first step in changing a company’s overall culture. When everyone is an active participant in quality management, it becomes second nature for everyone to make quality a priority. The result is a visible, traceable loop from start to finish. That loop is the center of a company’s quality process, which flows through all of its operations.

Automated quality software provides the workflow tools needed for collaboration, data analysis, and risk management by centralizing processes and supplying a common place to work together toward quality goals. Adopting an automated QMS gives an organization that common hub where all quality-related activities take place. It standardizes the way people go about quality processes as well as making sure everyone is taking part in it. An automated QMS promotes long-term quality success, because it lays the foundation necessary for successful implementation and maintenance of quality standards.

How Does an Automated Solution Help Compliance?
The features of an automated QMS can help ease into compliance with ISO 13485:2016 by centralizing and connecting all processes while keeping in line with the priorities set by the new standards. Incorporating automation into quality management habits will lead to long-term improvement in the following areas:

Mapping quality objectives: An automated QMS helps to set quality goals that are visible to everyone involved. That way, one can collaborate with external parties (such as suppliers) and stakeholders in the same way one would with the rest of a team. When including external parties in the same quality process as an internal team, they are held to the same quality standards. Now everyone can be held accountable for complying with the latest regulations and producing products with similar goals in mind.

Document control: Document control can create, store, and share necessary and supplementary files for training, production, supplier agreements, and more. This allows better control of a business’ communication and dissemination of information. The result is a team—internal and external—of people who are more accountable for their actions. The necessary documentation is never out of reach, so there is no excuse for team members to veer off their procedural paths.

Furthermore, the document control system lets everyone become part of the document creation process. People can access and edit the parts of the documents they are responsible for and immediately send them where they need to go. The information in the system is never out of date and can easily be distributed to its correct location. Having instant access to the most updated versions of documents is important when transitioning and adjusting to meeting new standards.

Risk management: As prescribed by the new standards, an organization’s processes should be driven by risk. This is more than just measuring risk, but also learning how to manage and mitigate it. Actions and decisions should be prioritized based on risk, aimed at reducing or preventing the highest risk events. That way, each decision made in an organization is productive and drives improvement while reducing the likelihood of a detrimental or dangerous incident.

Although the standards do not give a specific method for measuring and mitigating risk, they do stress the importance of having a systematic method for computing and analyzing risk. An automated QMS can provide different risk management tools that each work a little differently to meet specific needs. The most common risk management tools are:

Risk Matrix: This tool permits assignment of a numerical value to the frequency and severity of an event, and then graphs the event in a matrix. Defining an acceptable risk range gives statistical footing for decisions as well as providing ground for prioritizing actions. This tool is great for organizations that are adjusting to the emphasis ISO 13485:2016 places on risk, because it is a simple way to visualize the potential impact an event will have on operations.

Decision Tree: This tool maps out the possible outcomes associated with a given event. By knowing the possible outcome with the highest risk, one can implement specific preventive measures to safeguard products and operations. Using a decision tree in combination with a risk matrix will help to adopt the new risk-driven approach.

Risk Reporting: The data gathered from risk tools is not valuable until it is transformed into meaningful information that drives decisions and improvements within an organization. The reporting tools of an automated QMS help to gather, organize, and translate the raw data into statements of strengths, weaknesses, opportunities, and threats.

Risk tools work together to determine what risk level is acceptable for a business, determine the path of lowest risk, and turn risk data into meaningful information.

Audits: Audits are a great opportunity to not only make sure organizations maintain compliance, but also adjust to the new standards. Doing so with an automated system is even more valuable to a business; automatically scheduled audits help maintain compliance and can be set up in advance. Also, many automated systems have audit templates for easy execution. Users won’t have to worry about forgetting important items, since the template will prompt them.

CAPAs: Things happen—sometimes they’re good; sometimes they’re not. What sets a great organization apart is not the absence of adverse events, but the way they are handled. The CAPA feature of an automated QMS helps to stay within compliance and get back on track quickly if something undesirable were to happen. The CAPA assists in discovering the root cause of the issue and developing prevention plans so it doesn’t happen again, all while keeping interested parties updated. When there is a set procedure to handle these types of events, one can have more confidence that the situation is being handled quickly, efficiently, and correctly.

Customer Feedback: An automated QMS can also serve as a way to collect and organize customer feedback. What better way to find out the customer experience than from the customers themselves? They are a great source of candid, honest information that can help to see how products are working in action, rather than just on paper. This is especially important in the medical device industry because it’s very difficult to predict issues that will arise with products after their use, such as side effects or disposal issues.

How Do Companies Transition Smoothly?
The new standards must be implemented by March 1, 2019, which means organizations now have less than three years to transition. It is important to make this transition as simple and efficient as possible to avoid last-minute scrambling or being overwhelmed. There are a few things that can be done in the beginning stages that smooth the path for the rest of the transition. The first step is not really a step, but preparing for the first step of implementation. By thoroughly reviewing the new standards and making sure top management is aware of the changes, organizations can be prepared to allocate the time and resources necessary for the changes.

Also, performing a Gap Analysis illustrates the major differences between current processes and the new standards, so companies know exactly what needs to change and to what extent. This is also a good time to start incorporating risk management into decisions and processes, especially if that’s new to an organization.

Once implementation has begun, take a phased approach. Rather than trying to change everything at once, spread it out and tackle a little bit at a time. Breaking the transition down into manageable chunks prevents resources from being exhausted and a company from being overwhelmed.

Finally, take advantage of an automated QMS. It not only helps with the transition, but also with maintaining compliance in the future. All of the features discussed previously work together to help achieve and maintain compliance, throughout this set of revisions and those that will follow.