ISO 13485:2016 Audit Checklist

Title Page

Conducted on
Completed By
Location

Quality Management System

4.1 General Requirements

Does your organisation have a documented Quality Management System in place which defines the scope of the roles undertaken by the organisation?
Does the organisation determine the processes needed for the quality management system and the application of these processes throughout the organisation taking into account the roles undertaken by the organisation?
Is there a risk based approach applied to the control of the appropriate processes needed for the quality management system and has the organisation determined the sequence and interaction of these processes.
For each quality management system process, does your organisation determine criteria and methods needed to ensure that both the operation and control of these processes are effective? Do they ensure the availability of resources and information necessary to support the operation and monitoring of these processes?
Does your organisation implement actions necessary to achieve planned results and maintain the effectiveness of each QMS processes? Are the quality management system processes monitored, measured as appropriate and analysed?
Does the organisation establish and maintain records needed to demonstrate conformance to this International Standard and compliance with applicable regulatory requirements (see 4.2.5).
When changes are to be made to these processes are they: a) evaluated for their impact on the quality management system; b) evaluated for their impact on the medical devices produced under this quality management system; c) controlled in accordance with the requirements of this International Standard and applicable regulatory requirements.
When the organisation chooses to outsource any process that affects product conformity to requirements, do they monitor and ensure control over such processes?
Are the controls proportionate to the risk involved and the ability of the external party to meet the requirements in accordance with 7.4. Do the controls include written quality agreements?
Does the organisation document procedures for the validation of the application of computer software used in the quality management system. Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application.
Are the specific approach and activities associated with software validation and revalidation proportionate to the risk associated with the use of the software and are records of such activities maintained? (see 4.2.5)

4.2 Documentation Requirements

Does the quality management system documentation (see 4.2.4) include: a) documented statements of a quality policy and quality objectives; b) a quality manual; c) documented procedures and records required by this International Standard; d) documents, including records, determined by the organisation to be necessary to ensure the effective planning, operation, and control of its processes; e) other documentation specified by applicable regulatory requirements.
Does the organisation document a quality manual that includes: a) the scope of the quality management system, including details of and justification for any exclusion or non-application; b) the documented procedures for the quality management system, or reference to them; c) a description of the interaction between the processes of the quality management system.
Does the quality manual outline the structure of the documentation used in the quality management system?
For each medical device type or medical device family, does the organisation establish and maintain one or more files either containing or referencing documents generated to demonstrate conformity to the requirement of this International Standard and compliance with applicable regulatory requirements. The content of the file(s) shall include, but is not limited to: a) general description of the medical device, intended use/purpose, and labelling, including any instructions for use; b) specifications for product; c) specifications or procedures for manufacturing, packaging, storage, handling and distribution; d) procedures for measuring and monitoring; e) as appropriate, requirements for installation; f) as appropriate, procedures for servicing.
Are documents required by the quality management system controlled according to the requirements given in 4.2.5.
Is there a documented procedure in place which defines the controls needed to: a) review and approve documents for adequacy prior to issue; b) review, update as necessary and re-approve documents; c) ensure that the current revision status of and changes to documents are identified; d) ensure that relevant versions of applicable documents are available at points of use; e) ensure that documents remain legible and readily identifiable; f) ensure that documents of external origin, determined by the organisation to be necessary for the planning and operation of the quality management system, are identified and their distribution controlled; g) prevent deterioration or loss of documents; h) prevent the unintended use of obsolete documents and apply suitable identification to them.
Does the organisation ensure that changes to documents are reviewed and approved either by the original approving function or another designated function that has access to pertinent background information upon which to base its decisions?
Does the organisation define the period for which at least one copy of obsolete documents shall be retained? (This period shall ensure that documents to which medical devices have been manufactured and tested are available for at least the lifetime of the medical device as defined by the organisation, but not less than the retention period of any resulting record (see 4.2.5), or as specified by applicable regulatory requirements.)
Are records maintained to provide evidence of conformity to requirements and of the effective operation of the quality management system?
Does the organisation document procedures to define the controls needed for the identification, storage, security and integrity, retrieval, retention time and disposition of records?
Is there defined and implemented methods for protecting confidential health information contained in records in accordance with the applicable regulatory requirements?
Does the organisation ensure that records remain legible, readily identifiable and retrievable. Are changes to a record remain identifiable. Does the organisation retain the records for at least the lifetime of the medical device as defined by the organisation, or as specified by applicable regulatory requirements, but not less than two years from the medical device release by the organisation?

5.0 Management Responsibility

5.1 Management Commitment

Does top management provide evidence of its commitment to the development and implementation of the quality management system and maintenance of its effectiveness by: a) communicating to the organisation the importance of meeting customer as well as applicable regulatory requirements; b) establishing the quality policy; c) ensuring that quality objectives are established; d) conducting management reviews; e) ensuring the availability of resources

5.2 Customer Focus

Do top management ensure that customer requirements and applicable regulatory requirements are determined and met?

5.3 Quality Policy

Do top management ensure that the quality policy: a) is applicable to the purpose of the organisation; b) includes a commitment to comply with requirements and to maintain the effectiveness of the quality management system; c) provides a framework for establishing and reviewing quality objectives; d) is communicated and understood within the organisation; e) is reviewed for continuing suitability.

5.4 Planning

Does top management ensure that quality objectives, including those needed to meet applicable regulatory requirements and requirements for product, are established at relevant functions and levels within the organisation?
Are the quality objectives measurable and consistent with the quality policy?
Does top management ensure that: a) the planning of the quality management system is carried out in order to meet the requirements given in 4.1, as well as the quality objectives; b) the integrity of the quality management system is maintained when changes to the quality management system are planned and implemented.

5.5 Responsibility, authority and communication

Does top management ensure that responsibilities and authorities are defined, documented and communicated within the organisation?
Are the interrelation of all personnel who manage, perform and verify work affecting quality and the independence and authority necessary to perform these tasks documented by top management?
Have top management appointed a member of management who, irrespective of other responsibilities, has responsibility and authority that includes: a) ensuring that processes needed for the quality management system are documented; b) reporting to top management on the effectiveness of the quality management system and any need for improvement; c) ensuring the promotion of awareness of applicable regulatory requirements and quality management system requirements throughout the organisation.
Does top management ensure that appropriate communication processes are established within the organisation and that communication takes place regarding the effectiveness of the quality management system?

5.6 Management review

Does the organisation have documented procedures for management review. Top management shall review the organisation's quality management system at documented planned intervals to ensure its continuing suitability, adequacy and effectiveness. The review shall include assessing opportunities for improvement and the need for changes to the quality management system, including the quality policy and quality objectives.
Are records for management reviews maintained? (see 4.2.5)
Does the input to management review include, but not limited to, information arising from: a) feedback; b) complaint handling; c) reporting to regulatory authorities; d) audits; e) monitoring and measurement of processes; f) monitoring and measurement of product; g) corrective action; h) preventive action; i) follow-up actions from previous management reviews; j) changes that could affect the quality management system; k) recommendations for improvement; l) applicable new or revised regulatory requirements.
Is the output from management review recorded (see 4.2.5) and include the input reviewed at the meeting and any decisions and actions related to: a) improvement needed to maintain the suitability, adequacy, and effectiveness of the quality management system and its processes; b) improvement of product related to customer requirements; c) changes needed to respond to applicable new or revised regulatory requirements; d) resource needs.

6.0 Resource Management

6.1 Provision of resources

Has the organisation determined and provided the resources needed to: a) implement the quality management system and to maintain its effectiveness; b) meet applicable regulatory and customer requirements.

6.2 Human resources

Personnel performing work affecting product quality shall be competent on the basis of appropriate education, training, skills and experience. Does the organisation document the process(es) for establishing competence, providing needed training, and ensuring awareness of personnel. The organisation shall: a) determine the necessary competence for personnel performing work affecting product quality; b) provide training or take other actions to achieve or maintain the necessary competence; c) evaluate the effectiveness of the actions taken; d) ensure that its personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives; e) maintain appropriate records of education, training, skills and experience (see 4.2.5).

6.3 Infrastructure

Does the organisation document the requirements for the infrastructure needed to achieve conformity to product requirements, prevent product mix-up and ensure orderly handling of product. Infrastructure includes, as appropriate: a) buildings, workspace and associated utilities; b) process equipment (both hardware and software); c) supporting services (such as transport, communication, or information systems).
Does the organisation document requirements for the maintenance activities, including the interval of performing the maintenance activities, when such maintenance activities, or lack thereof, can affect product quality. As appropriate, the requirements shall apply to equipment used in production, the control of the work environment and monitoring and measurement.
Are records of such maintenance maintained (see 4.2.5)?

6.4 Work environment and contamination control

Do the organisation document the requirements for the work environment needed to achieve conformity to product requirements?
If the conditions for the work environment can have an adverse effect on product quality, do the organisation document the requirements for the work environment and the procedures to monitor and control the work environment? The organisation shall: a) document requirements for health, cleanliness and clothing of personnel if contact between such personnel and the product or work environment could affect medical device safety or performance; b) ensure that all personnel who are required to work temporarily under special environmental conditions within the work environment are competent or supervised by a competent person.
As appropriate, the organisation shall plan and document arrangements for the control of contaminated or potentially contaminated product in order to prevent contamination of the work environment, personnel, or product?
For sterile medical devices, do the organisation document requirements for control of contamination with microorganisms or particulate matter and maintain the required cleanliness during assembly or packaging processes?

7.0 Product Realization

7.1 Planning of product realization

Does the organisation plan and develop the processes needed for product realization? Planning of product realization shall be consistent with the requirements of the other processes of the quality management.
Do the organisation document one or more processes for risk management in product realization? Records of risk management activities shall be maintained (see 4.2.5).
In planning product realization, does the organisation determine the following, as appropriate: a) quality objectives and requirements for the product; b) the need to establish processes and documents (see 4.2.4) and to provide resources specific to the product, including infrastructure and work environment; c) required verification, validation, monitoring, measurement, inspection and test, handling, storage, distribution and traceability activities specific to the product together with the criteria for product acceptance; d) records needed to provide evidence that the realization processes and resulting product meet requirements (see 4.2.5).
Is the output of this planning documented in a form suitable for the organisation's method of operations?

7.2 Customer-related processes

Does your organisation determine: a) requirements specified by the customer, including the requirements for delivery and post-delivery activities; b) requirements not stated by the customer but necessary for specified or intended use, as known; c) applicable regulatory requirements related to the product; d) any user training needed to ensure specified performance and safe use of the medical device; e) any additional requirements determined by the organisation
Does the organisation review the requirements related to product. The review shall be conducted prior to the organisation's commitment to supply product to the customer (e.g. submission of tenders, acceptance of contracts or orders, acceptance of changes to contracts or orders) and shall ensure that: a) product requirements are defined and documented; b) contract or order requirements differing from those previously expressed are resolved; c) applicable regulatory requirements are met; d) any user training identified in accordance with 7.2.1 is available or planned to be available; e) the organisation has the ability to meet the defined requirements.
Are records of the results of the review and actions arising from the review maintained (see 4.2.5)?
When the customer provides no documented statement of requirement, is the customer requirements confirmed by the organisation before acceptance? When product requirements are changed, does the organisation ensure that relevant documents are amended and that relevant personnel are made aware of the changed requirements?
Does the organisation plan and document arrangements for communicating with customers in relation to: a) product information; b) enquiries, contracts or order handling, including amendments; c) customer feedback, including complaints; d) advisory notices.
Does the organisation communicate with regulatory authorities in accordance with applicable regulatory requirements?

7.3 Design and development

Does the organisation document procedures for design and development?
Does the organisation plan and control the design and development of product? As appropriate, design and development planning documents shall be maintained and updated as the design and development progresses.
During design and development planning, does the organisation document: a) the design and development stages; b) the review(s) needed at each design and development stage; c) the verification, validation, and design transfer activities that are appropriate at each design and development stage; d) the responsibilities and authorities for design and development; e) the methods to ensure traceability of design and development outputs to design and development inputs; f) the resources needed, including necessary competence of personnel.
Are the inputs relating to product requirements determined and records maintained (see 4.2.5). These inputs shall include: a) functional, performance, usability and safety requirements, according to the intended use; b) applicable regulatory requirements and standards; c) applicable output(s) of risk management; d) as appropriate, information derived from previous similar designs; e) other requirements essential for design and development of the product and processes. These inputs shall be reviewed for adequacy and approved. Requirements shall be complete, unambiguous, able to be verified or validated, and not in conflict with each other.
Design and development outputs shall: a) meet the input requirements for design and development; b) provide appropriate information for purchasing, production and service provision; c) contain or reference product acceptance criteria; d) specify the characteristics of the product that are essential for its safe and proper use.
Are the outputs of design and development in a form suitable for verification against the design and development inputs and approved prior to release. Are records of the design and development outputs maintained (see 4.2.5)?
At suitable stages, systematic reviews of design and development shall be performed in accordance with planned and documented arrangements to: a) evaluate the ability of the results of design and development to meet requirements; b) identify and propose necessary actions.
Does the participants in such reviews include representatives of functions concerned with the design and development stage being reviewed, as well as other specialist personnel?
Are records of the results of the reviews and any necessary actions maintained and include the identification of the design under review, the participants involved and the date of the review (see 4.2.5)?
Is design and development verification performed in accordance with planned and documented arrangements to ensure that the design and development outputs have met the design and development input requirements?
Does the organisation document verification plans that include methods, acceptance criteria and, as appropriate, statistical techniques with rationale for sample size? If the intended use requires that the medical device be connected to, or have an interface with, other medical device(s), verification shall include confirmation that the design outputs meet design inputs when so connected or interfaced.
Are records of the results and conclusions of the verification and necessary actions maintained (see 4.2.4 and 4.2.5)?
Is the design and development validation performed in accordance with planned and documented arrangements to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use? Does the organisation document validation plans that include methods, acceptance criteria and, as appropriate, statistical techniques with rationale for sample size?
Are design validations conducted on representative product? (Representative product includes initial production units, batches or their equivalents.)
As part of design and development validation, does the organisation perform clinical evaluations or performance evaluations of the medical device in accordance with applicable regulatory requirements? (A medical device used for clinical evaluation or performance evaluation is not considered to be released for use to the customer.) If the intended use requires that the medical device be connected to, or have an interface with, other medical device(s), validation shall include confirmation that the requirements for the specified application or intended use have been met when so connected or interfaced. Validation shall be completed prior to release for use of the product to the customer.
Are records for the rationale for the choice of product used for validation and the results and conclusion of validation and necessary actions maintained (see 4.2.4 and 4.2.5)?
Does the organisation document procedures for transfer of design and development outputs to manufacturing? These procedures shall ensure that design and development outputs are verified as suitable for manufacturing before becoming final production specifications and that production capability can meet product requirements. Are results and conclusions of the transfer recorded (see 4.2.5)?
Does the organisation document procedures to control design and development changes? The organisation shall determine the significance of the change to function, performance, usability, safety and applicable regulatory requirements for the medical device and its intended use. Design and development changes shall be identified. Before implementation, the changes shall be: a) reviewed; b) verified; c) validated, as appropriate; d) approved.
Does the review of design and development changes include evaluation of the effect of the changes on constituent parts and product in process or already delivered, inputs or outputs of risk management and product realization processes? Are records of changes, their review and any necessary actions maintained (see 4.2.5)?
Do the organisation maintain a design and development file for each medical device type or medical device family.? This file shall include or reference records generated to demonstrate conformity to the requirements for design and development and records for design and development changes.

7.4 Purchasing

Is there documented procedures (see 4.2.4) to ensure that purchased product conforms to specified purchasing information? The organisation shall establish criteria for the evaluation and selection of suppliers. The criteria shall be: a) based on the supplier’s ability to provide product that meets the organisation's requirements; b) based on the performance of the supplier; c) based on the effect of the purchased product on the quality of the medical device; d) proportionate to the risk associated with the medical device.
Does the organisation plan the monitoring and re-evaluation of suppliers? Supplier performance in meeting requirements for the purchased product shall be monitored. The results of the monitoring shall provide an input into the supplier re-evaluation process. Are non-fulfilment of purchasing requirements addressed with the supplier proportionate to the risk associated with the purchased product and compliance with applicable regulatory requirements?
Are records of the results of evaluation, selection, monitoring and re-evaluation of supplier capability or performance and any necessary actions arising from these activities maintained (see 4.2.5)?
Does purchasing information describe or reference the product to be purchased, including as appropriate: a) product specifications; b) requirements for product acceptance, procedures, processes and equipment; c) requirements for qualification of supplier personnel; d) quality management system requirements.
Does the organisation ensure the adequacy of specified purchasing requirements prior to their communication to the supplier? Does purchasing information include, as applicable, a written agreement that the supplier notify the organisation of changes in the purchased product prior to implementation of any changes that affect the ability of the purchased product to meet specified purchase requirements?
To the extent required for traceability given in 7.5.9, does the organisation maintain relevant purchasing information in the form of documents (see 4.2.4) and records (see 4.2.5)?
Has the organisation established and implemented the inspection or other activities necessary for ensuring that purchased product meets specified purchasing requirements? The extent of verification activities shall be based on the supplier evaluation results and proportionate to the risks associated with the purchased product.
When the organisation becomes aware of any changes to the purchased product, does the organisation determine whether these changes affect the product realization process or the medical device?
When the organisation or its customer intends to perform verification at the supplier’s premises, does the organisation state the intended verification activities and method of product release in the purchasing information? Are records of the verification maintained (see 4.2.5)?

7.5 Production and service provision

Is the production and service provision planned, carried out, monitored and controlled to ensure that product conforms to specification? As appropriate, production controls shall include but are not limited to: a) documentation of procedures and methods for the control of production (see 4.2.4); b) qualification of infrastructure; c) implementation of monitoring and measurement of process parameters and product characteristics; d) availability and use of monitoring and measuring equipment; e) implementation of defined operations for labelling and packaging; f) implementation of product release, delivery and post-delivery activities.
Does the organisation establish and maintain a record (see 4.2.5) for each medical device or batch of medical devices that provides traceability to the extent specified in 7.5.9 and identifies the amount manufactured and amount approved for distribution. The record shall be verified and approved.
Does the organisation document requirements for cleanliness of product or contamination control of product if: a) product is cleaned by the organisation prior to sterilization or its use; b) product is supplied non-sterile and is to be subjected to a cleaning process prior to sterilization or its use; c) product cannot be cleaned prior to sterilization or its use, and its cleanliness is of significance in use; d) product is supplied to be used non-sterile, and its cleanliness is of significance in use; e) process agents are to be removed from product during manufacture.
Does the organisation document requirements for medical device installation and acceptance criteria for verification of installation, as appropriate?
If the agreed customer requirements allow installation of the medical device to be performed by an external party other than the organisation or its supplier, does the organisation provide documented requirements for medical device installation and verification of installation? Are records of medical device installation and verification of installation performed by the organisation or its supplier maintained (see 4.2.5)?
If servicing of the medical device is a specified requirement, does the organisation document servicing procedures, reference materials, and reference measurements, as necessary, for performing servicing activities and verifying that product requirements are met?
Does the organisation analyse records of servicing activities carried out by the organisation or its supplier: a) to determine if the information is to be handled as a complaint; b) as appropriate, for input to the improvement process.
Are records of servicing activities carried out by the organisation or its supplier maintained (see 4.2.5)?
Does the organisation maintain records of the sterilization process parameters used for each sterilization batch (see 4.2.5)? Sterilization records shall be traceable to each production batch of medical devices.
Does the organisation validate any processes for production and service provision where the resulting output cannot be or is not verified by subsequent monitoring or measurement and, as a consequence, deficiencies become apparent only after the product is in use or the service has been delivered?
The validation demonstrate the ability of these processes to achieve planned results consistently. Does the organisation document procedures for validation of processes, including: a) defined criteria for review and approval of the processes; b) equipment qualification and qualification of personnel; c) use of specific methods, procedures and acceptance criteria; d) as appropriate, statistical techniques with rationale for sample sizes; e) requirements for records (see 4.2.5); f) revalidation, including criteria for revalidation; g) approval of changes to the processes.
Does the organisation document procedures for the validation of the application of computer software used in production and service provision? Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application. The specific approach and activities associated with software validation and revalidation shall be proportionate to the risk associated with the use of the software, including the effect on the ability of the product to conform to specifications.
Are records of the results and conclusion of validation and necessary actions from the validation maintained (see 4.2.4 and 4.2.5)?
Does the organisation document procedures (see 4.2.4) for the validation of processes for sterilization and sterile barrier systems?
Are processes for sterilization and sterile barrier systems validated prior to implementation and following product or process changes, as appropriate?
Are records of the results and, conclusion of validation and necessary actions from the validation maintained (see 4.2.4 and 4.2.5)?
Does the organisation document procedures for product identification and identify product by suitable means throughout product realization?
Does the organisation identify product status with respect to monitoring and measurement requirements throughout product realization?
Is identification of product status maintained throughout production, storage, installation and servicing of product to ensure that only product that has passed the required inspections and tests or released under an authorized concession is dispatched, used or installed?
If required by applicable regulatory requirements, does the organisation document a system to assign unique device identification to the medical device? Does the organisation document procedures to ensure that medical devices returned to the organisation are identified and distinguished from conforming product?
Is there documented procedures for traceability? These procedures shall define the extent of traceability in accordance with applicable regulatory requirements and the records to be maintained (see 4.2.5).
Does the records required for traceability include records of components, materials, and conditions for the work environment used, if these could cause the medical device not to satisfy its specified safety and performance requirements?
Does the organisation require that suppliers of distribution services or distributors maintain records of the distribution of medical devices to allow traceability and that these records are available for inspection? Are records of the name and address of the shipping package consignee maintained (see 4.2.5)?
Does the organisation identify, verify, protect, and safeguard customer property provided for use or incorporation into the product while it is under the organisation's control or being used by the organisation? If any customer property is lost, damaged or otherwise found to be unsuitable for use, the organisation shall report this to the customer and maintain records (see 4.2.5).
Is there documented procedures for preserving the conformity of product to requirements during processing, storage, handling, and distribution? Preservation shall apply to the constituent parts of a medical device.
Does the organisation protect product from alteration, contamination or damage when exposed to expected conditions and hazards during processing, storage, handling, and distribution by: a) designing and constructing suitable packaging and shipping containers; b) documenting requirements for special conditions needed if packaging alone cannot provide preservation. If special conditions are required, they shall be controlled and recorded (see 4.2.5).
Does the organisation determine the monitoring and measurement to be undertaken and the monitoring and measuring equipment needed to provide evidence of conformity of product to determined requirement?
Is there documented procedures to ensure that monitoring and measurement can be carried out and are carried out in a manner that is consistent with the monitoring and measurement requirements?
As necessary to ensure valid results, is the measuring equipment: a) calibrated or verified, or both, at specified intervals, or prior to use, against measurement standards traceable to international or national measurement standards: when no such standards exist, the basis used for calibration or verification shall be recorded (see 4.2.5); b) be adjusted or re-adjusted as necessary: such adjustments or re-adjustments shall be recorded (see 4.2.5); c) have identification in order to determine its calibration status; d) be safeguarded from adjustments that would invalidate the measurement result; e) be protected from damage and deterioration during handling, maintenance and storage. The organisation shall perform calibration or verification in accordance with documented procedures.
In addition, does the organisation assess and record the validity of the previous measuring results when the equipment is found not to conform to requirements. Does the organisation take appropriate action in regard to the equipment and any product affected?
Are records of the results of calibration and verification maintained (see 4.2.5)?
Does the organisation document procedures for the validation of the application of computer software used for the monitoring and measurement of requirements? Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application. The specific approach and activities associated with software validation and revalidation shall be proportionate to the risk associated with the use of the software, including the effect on the ability of the product to conform to specifications.
Are records of the results and conclusion of validation and necessary actions from the validation maintained (see 4.2.4 and 4.2.5)?

8.0 Measurement, analysis and improvement

8.1 General

Does the organisation plan and implement the monitoring, measurement, analysis and improvement processes needed to: a) demonstrate conformity of product; b) ensure conformity of the quality management system; c) maintain the effectiveness of the quality management system. This shall include determination of appropriate methods, including statistical techniques, and the extent of their use.
As one of the measurements of the effectiveness of the quality management system, does the organisation gather and monitor information relating to whether the organisation has met customer requirements? The methods for obtaining and using this information shall be documented.
Is there documented procedures for the feedback process? This feedback process shall include provisions to gather data from production as well as post-production activities.
Does the information gathered in the feedback process serve as potential input into risk management for monitoring and maintaining the product requirements as well as the product realization or improvement processes? If applicable regulatory requirements require the organisation to gain specific experience from postproduction activities, the review of this experience shall form part of the feedback process.
Does the organisation document procedures for timely complaint handling in accordance with applicable regulatory requirements? These procedures shall include at a minimum requirements and responsibilities for: a) receiving and recording information; b) evaluating information to determine if the feedback constitutes a complaint; c) investigating complaints; d) determining the need to report the information to the appropriate regulatory authorities; e) handling of complaint-related product; f) determining the need to initiate corrections or corrective actions.
If any complaint is not investigated, is justification documented? Are corrections or corrective actions resulting from the complaint handling process documented? If an investigation determines activities outside the organisation contributed to the complaint, relevant information shall be exchanged between the organisation and the external party involved. Are complaint handling records maintained (see 4.2.5)?
If applicable regulatory requirements require notification of complaints that meet specified reporting criteria of adverse events or issuance of advisory notices, is there documented procedures for providing notification to the appropriate regulatory authorities? Are records of reporting to regulatory authorities maintained (see 4.2.5)?
Does the organisation conduct internal audits at planned intervals to determine whether the quality management system: a) conforms to planned and documented arrangements, requirements of this International Standard, quality management system requirements established by the organisation, and applicable regulatory requirements; b) is effectively implemented and maintained.
Does the organisation document a procedure to describe the responsibilities and requirements for planning and conducting audits and recording and reporting audit results? Is there an audit program planned, taking into consideration the status and importance of the processes and area to be audited, as well as the results of previous audits?
Is the audit criteria, scope, interval and methods defined and recorded (see 4.2.5)? The selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work.
Are records of the audits and their results, including identification of the processes and areas audited and the conclusions, maintained (see 4.2.5)? The management responsible for the area being audited shall ensure that any necessary corrections and corrective actions are taken without undue delay to eliminate detected nonconformities and their causes. Follow-up activities shall include the verification of the actions taken and the reporting of verification results.
Does the organisation apply suitable methods for monitoring and, as appropriate, measurement of the quality management system processes? These methods shall demonstrate the ability of the processes to achieve planned results. When planned results are not achieved, correction and corrective action shall be taken, as appropriate.
Does the organisation monitor and measure the characteristics of the product to verify that product requirements have been met? This shall be carried out at applicable stages of the product realization process in accordance with the planned and documented arrangements and documented procedures.
Is evidence of conformity to the acceptance criteria maintained? Is the identity of the person authorizing release of product recorded (see 4.2.5)? As appropriate, records shall identify the test equipment used to perform measurement activities.
Does the organisation ensure product release and service delivery shall not proceed until the planned and documented arrangements have been satisfactorily completed? For implantable medical devices, the organisation shall record the identity of personnel performing any inspection or testing.

8.3 Control of nonconforming product

Does the organisation ensure that product which does not conform to product requirements is identified and controlled to prevent its unintended use or delivery?
Is there a documented procedure to define the controls and related responsibilities and authorities for the identification, documentation, segregation, evaluation and disposition of nonconforming product? The evaluation of nonconformity shall include a determination of the need for an investigation and notification of any external party responsible for the nonconformity.
Are records of the nature of the nonconformities and any subsequent action taken, including the evaluation, any investigation and the rationale for decisions maintained (see 4.2.5)?
Does the organisation deal with nonconforming product by one or more of the following ways: a) taking action to eliminate the detected nonconformity; b) taking action to preclude its original intended use or application; c) authorizing its use, release or acceptance under concession.
Does the organisation ensure that nonconforming product is accepted by concession only if the justification is provided, approval is obtained and applicable regulatory requirements are met? Are records of the acceptance by concession and the identity of the person authorizing the concession maintained (see 4.2.5)?
When nonconforming product is detected after delivery or use has started, does the organisation take action appropriate to the effects, or potential effects, of the nonconformity? Records of actions taken shall be maintained (see 4.2.5)
Does the organisation document procedures for issuing advisory notices in accordance with applicable regulatory requirements? These procedures shall be capable of being put into effect at any time. Records of actions relating to the issuance of advisory notices shall be maintained (see 4.2.5).
Does the organisation perform rework in accordance with documented procedures that takes into account the potential adverse effect of the rework on the product?
Does the rework procedures undergo the same review and approval as the original procedure? After the completion of rework, product shall be verified to ensure that it meets applicable acceptance criteria and regulatory requirements. Records of rework shall be maintained (see 4.2.5).

8.4 Analysis of data

Does the organisation document procedures to determine, collect and analyse appropriate data to demonstrate the suitability, adequacy and effectiveness of the quality management system? The procedures shall include determination of appropriate methods, including statistical techniques and the extent of their use.
Does the analysis of data include data generated as a result of monitoring and measurement and from other relevant sources and include, at a minimum, input from: a) feedback; b) conformity to product requirements; c) characteristics and trends of processes and product, including opportunities for improvement; d) suppliers; e) audits; f) service reports, as appropriate. If the analysis of data shows that the quality management system is not suitable, adequate or effective, the organisation shall use this analysis as input for improvement as required in 8.5.
Are records of the results of analyses maintained (see 4.2.5)?

8.5 Improvement

Does the organisation identify and implement any changes necessary to ensure and maintain the continued suitability, adequacy and effectiveness of the quality management system as well as medical device safety and performance through the use of the quality policy, quality objectives, audit results, postmarket surveillance, analysis of data, corrective actions, preventive actions and management review?
Does the organisation take action to eliminate the cause of nonconformities in order to prevent recurrence? Any necessary corrective actions shall be taken without undue delay. Corrective actions shall be proportionate to the effects of the nonconformities encountered.
Is there a documented procedure which defines the requirements for: a) reviewing nonconformities (including complaints); b) determining the causes of nonconformities; c) evaluating the need for action to ensure that nonconformities do not recur; d) planning and documenting action needed and implementing such action, including, as appropriate, updating documentation; e) verifying that the corrective action does not adversely affect the ability to meet applicable regulatory requirements or the safety and performance of the medical device; f) reviewing the effectiveness of corrective action taken.
Are records of the results of any investigation and of action taken maintained (see 4.2.5)?
Does the organisation determine action to eliminate the causes of potential nonconformities in order to prevent their occurrence? Preventive actions shall be proportionate to the effects of the potential problems.
Is there a documented procedure in place to describe requirements for: a) determining potential nonconformities and their causes; b) evaluating the need for action to prevent occurrence of nonconformities; c) planning and documenting action needed and implementing such action, including, as appropriate, updating documentation; d) verifying that the action does not adversely affect the ability to meet applicable regulatory requirements or the safety and performance of the medical device; e) reviewing the effectiveness of the preventive action taken, as appropriate.
Are records of the results of any investigations and of action taken maintained (see 4.2.5)?