Is ISO 9001 Obsolete?

Originally Published MDDI October 2001

With the publication of the 2000 revision of the general ISO quality systems standard, the medical device industry has concluded that it must follow a separate course. A pending update to the industry's own ISO standard, 13485, will formalize the split.

Edward R. Kimmelman

Medical device companies are confronted by a variety of relevant quality systems, standards intended to satisfy manufacturing requirements in addition to customer and regulatory agency objectives. These standards are embodied in regulations, such as the U.S. quality system regulation and the Japanese good manufacturing practices regulation, as well as international standards (e.g., ISO 9001 and ISO 13485). International standards may have been incorporated directly into national regulations or adopted voluntarily by medical device manufacturing organizations.

Manufacturers may face a dilemma, however, in adapting to a changing standards environment. ISO 9001:2000 has instituted significant changes and is not viewed by all as an appropriate foundation for a medical device quality system management standard. Thus, companies may find it advantageous to prepare now to adapt their quality management strategies to evolving requirements.

This article outlines medical device quality system issues created by ISO 9001:2000 and recommends courses of action for individual organizations as they review and possibly revise their quality management systems to meet future requirements.

BACKGROUND

The mandate of ISO Technical Committee 210, Working Group 1 (ISO/TC 210, WG 1) is to develop international voluntary quality systems standards for the medical device sector. Thus far it has developed three standards:

The titles of these standards reflect the fact that their content and format are based directly on the 1994 versions of the ISO 9000 series of standards. For example, essentially all of the requirements of ISO 9001:1994 are carried over to ISO 13485:1996, with the addition of particular requirements that are relevant to all medical devices or to some classes of medical devices. Many of these particular requirements come directly from existing regulations. WG 1 continues to review and update these standards, based on the changing needs of the medical device sector.

The Global Harmonization Task Force (GHTF) includes representatives from medical device regulatory agencies in many of the industrialized countries, along with representatives from industry. Study Group 3 (SG3) of the GHTF has succeeded in harmonizing the regulatory quality system requirements in the major markets around the world and is working to extend this achievement to other countries.

ISO 13485:1996 is the basis for the GHTF agreement on quality system requirements. Although the quality system regulations in the individual GHTF countries may not follow the format of ISO 13485:1996, the substance of the requirements is consistent with that found in this standard.

In 2000, ISO Technical Committee 176 published a revised version of the ISO 9000 series of standards. This revision included a number of key elements.

Adopting the "process approach" to quality management resulted in the formatting of ISO 9001:2000 to reflect the key quality system processes (i.e., management, resources, product realization, and measurement). Within these major process areas are subprocesses dealing with quality system management planning, management review, human resources, work environment, design and development, purchasing, production, monitoring and measurement, analysis of data, improvement, and others.

ISO 9002 and ISO 9003 were eliminated through the use of an applications approach (ISO 9001:2000, clause 1.2) that allows an organization to disregard quality system requirements for product realization processes it does not perform (such as design and development).

The refocusing of the objectives of ISO 9001 enabled ISO 9001:2000 to be targeted at a quality management system intended to meet customer requirements. At the same time, ISO 9004:2000 is focused on quality system recommendations for business excellence.

Within ISO 9001:2000, the requirements related to customer satisfaction and continual improvement are stronger than in the previous verison, and requirements related to procedural documentation are weaker. ISO 8402 was eliminated by including relevant quality system definitions in ISO 9000:2000.

Representatives of both ISO/TC 210, WG1 and GHTF, SG3 participated in a number of joint working sessions to consider ISO 9001:2000. They concluded it is no longer an appropriate basis for a medical device quality system standard that is intended to support existing international harmonization of quality system regulation and to be a model for countries developing such regulations.

According to ISO Central Secretariat (ISO/CS) policy, ISO/TC 176 has the overall responsibility to manage the development of quality system standards. The ISO/CS, however, has recognized that the medical device sector, owing to its heavy regulation worldwide, may require the establishment of standards that are targeted specifically at the sector. As a result, the ISO/CS approved the creation of ISO/TC 210 to manage the development of medical device sector–specific documents, with the understanding that ISO/TC 176 would still maintain primacy related to quality system standards in general. One of the key overall objectives of ISO/TC 176 is to avoid the proliferation of sector-specific quality system standards.

Over the last six years there has been direct interaction between the two committees as each has developed its own standards. There is now general agreement that the needs of the medical device sector would be best served by a separate quality system standard based generally on ISO 9001:2000. Some of the ISO 9001:2000 requirements would be removed, however, and a number of requirements would be added. This separate standard will clearly reflect the differences required by the fact that the medical device sector is highly regulated. As a result, the new ISO 13485:200X will bear the title, "Quality management systems—Medical devices—System requirements for regulatory purposes."

DIFFERENCES BETWEEN ISO 9001:2000 AND ISO 13485:200X

The substantive differences between ISO 9001:2000 and ISO 13485:200X will result from the divergence of the objectives of the two standards. ISO/TC 210 seeks to maintain ISO 13485 as an easily understood, baseline standard targeted at meeting customer requirements and maximizing the probability that compliant organizations will produce safe and effective products. Although ISO/TC 176 professes to share that objective, it is obvious from the requirements that have been added that TC 176 intends to move the ISO 9000 standards closer to the business excellence standards epitomized by quality award systems like the Deming and Baldrige models. TC 176 also seeks to simplify ISO 9001:2000 compliance for smaller organizations by reducing the procedural documentation requirements.

It is important to point out that there will be a great measure of agreement between ISO 9001:2000 and ISO 13485:200X. In the current draft, as much as 80% of the actual requirements text of ISO 13485:200X is quoted directly from ISO 9001:2000. In addition, the format of ISO13485:200X is the same. Specifically, it is based on the process model. This model does not significantly change the actual requirements; however, ISO/TC 210 found it to be very useful in explaining the relevance of the requirements because most organizational operations are based on a compilation of processes.

The major substantive differences between ISO 9001:2000 and the committee draft (CD) of ISO 13485:200X relate to continual improvement, customer satisfaction, and procedural documentation level. The key issue related to continual improvement is that ISO 9001:2000 requires actual objective evidence of continual improvement of the quality management system, not just objective evidence of the exercise of quality management processes targeted at determining needed continual improvement and the effective actions based on such determinations.

Clause 8.5.1 of ISO 9001:2000 states that "the organization shall continually improve the effectiveness of the quality management system through the use of the quality policy, quality objectives, audit results, analysis of data, corrective and preventive actions, and management review" (emphasis added). Clause 8.5.1 of ISO/CD13485:200X begins as follows: "The organization shall identify and implement any changes necessary to ensure and maintain the continued suitability and effectiveness of the quality management system through the use of the quality policy. . . ."

It is important to note that the processes anticipated by both documents to be used to achieve continual improvement are processes that are familiar to medical device organizations because they are required by most quality system regulations. These examples were included in response to comments made by ISO/TC210 during the drafting of ISO 9001:2000.

In early drafts of ISO 9001:2000, clause 8.5.1 also targeted a requirement for improvement of quality system efficiency, but the requirement was removed at the urging of ISO/TC210, because efficiency is more related to organizational excellence than it is to meeting customer requirements.

The requirements in ISO 9001:2000 present a number of issues for medical device organizations. One key issue is that ISO 9001:2000 requires objective evidence that there are active processes for determining whether customers are, in fact, satisfied. During the development of ISO 9001:2000, representatives of ISO/TC 210 convinced ISO/TC 176 to narrow the definition of customer satisfaction to focus it on whether or not an organization is meeting customer requirements. Unfortunately, even this narrowing of the definition does not overcome the concern that there are widely divergent interpretations among professionals assessing quality management systems as to what customer satisfaction really means. In addition, the representatives from ISO/TC210 were not able to get ISO/TC176 to eliminate the use of the term customer perception in clause 8.2.1.

ISO/TC 210 believes that the use of the term customer satisfaction is not appropriate for ISO13485:200X, because it is too subjective to use in a standard that will provide the basis for regulation. As a result, ISO 13485:200X will encourage the use of active processes for gathering customer feedback related to whether or not the organization is meeting customer requirements. It will also require the generation of objective evidence that these systems are being used and the feedback acted upon. Examples of such processes given in ISO 13485:200X include complaint handling, order handling, and contract review.

The key documentation issue is that ISO 9001:2000 has reduced the number of processes that require documented procedures. It specifically spells out a limited number of processes that require documented procedures, and it has left it up to the individual device manufacturer to determine whether procedures are needed for all other quality management processes.

In the regulated world of medical devices, documented procedures are used as objective evidence of control of key quality management system processes. It is inappropriate to allow the flexibility embodied in ISO 9001:2000, especially for processes that could significantly affect the safety and effectiveness of products. As a result, ISO 13485:200X will retain the same documented procedure requirements as in the 1996 version of this standard.

HOW AND WHEN ISO 13485:200X WILL APPEAR

ISO 13485:200X will be a stand-alone standard; it will not make direct references on a section-by-section basis to ISO 9001 as the current version of ISO 13485 does. This approach will go a long way toward disconnecting the two standards and make ISO 13485 less susceptible to future changes in the ISO 9001 standard.

As mentioned above, ISO 13485:200X will quote extensively from ISO 9001:2000. As required by ISO policy, these quoted sections will be designated by a distinctive font or font treatment. For particularly important additions or deletions a note will be added to the ISO 13485:200X clause text, pointing out the difference. If the change requires explanation, that information will be provided in an annex to the standard.

ISO 13488:1996 is the medical device equivalent of the ISO 9002 standard. ISO 9002 was intended to provide quality management system requirements for organizations that performed all activities except design and development of products and the processes for providing them. As indicated above, ISO/TC176 has decided to eliminate ISO 9002.

ISO/TC 210 is left with the decision as to whether or not to extend the viability of ISO 13488, or to follow the lead of ISO/TC 176 and eliminate it. At the present time, there are still plans to publish ISO 13488:200X because a number of medical device regulatory schemes in Europe and North America rely on the existence of separate standards.

The European Community has developed an approach for applying the new version of ISO 9001 to compliance with the conformity assessment requirements of the various new approach directives. They have documented that approach in the foreword of EN/ISO 9001:2000.

WG1 has issued a briefing paper to all participating members of ISO/TC 210, explaining the situation and soliciting guidance as to the appropriate path forward. That decision will be made at the upcoming meeting of WG 1 this month.

ISO 14969:1999 is a standard that provides guidance on the application of ISO 13485. It is based on and refers directly to ISO 9000-2, a guidance document published by ISO/TC 176. Because ISO/TC 176 has decided to eliminate ISO 9000-2, ISO 14969 will be republished as a stand-alone technical specification following the same organizational structure as ISO13485:200X.

Technical specifications are a new kind of ISO document that require significantly less consensus review and can be published more quickly. ISO 14969:200X will contain much of the same guidance language as in the 1999 version of this document, and it also will contain more detailed guidance related to quality planning, design and development, and process validation.

Figure 1 provides a simple time line that points out the quality system transition. ISO 9001:2000 was published in December 2000 (A),with the guidance that the 1994 version of the standard would remain viable until December 2003 (B). Because ISO 13485:1996 refers directly to ISO 9001:1994, WG 1 of ISO/TC 210 is under time pressure to publish the approved new version of ISO 13485 by the end of 2002 or the first quarter of 2003. WG 1 published the CD version of ISO 13485:200X in June 2001 (C) and will consider comments on this draft at its meeting in October 2001 (D). It is anticipated that the draft international standard (DIS) version of ISO 13485:200X will be published during the first quarter of 2002 (E).

Such a publication schedule will enable organizations claiming compliance with ISO 13485 to understand the requirements of the new version in time to inform their employees and make any necessary modifications to their quality management systems before the 1994 version of ISO 9001 disappears. This timing will also allow third-party registrars and notified bodies to adjust their assessment procedures, and to arrange assessment schedules to avoid lapses in registrations and ensure an orderly transition.

RECOMMENDED COURSES OF ACTION

It will be important for individual organizations to use their management review processes to discuss and determine their quality management system standards compliance objectives. Should they work for compliance with ISO 9001:2000, ISO 13485:200X, or both (F)?

In the absence of any customer or regulatory requirements to comply with ISO 9001, medical device organizations should seek registration to ISO 13485:200X only. Such registration will provide objective evidence of compliance with quality management system requirements consistent with meeting customer requirements and those of the major regulatory agencies around the world. An organization may choose to adopt some of the customer satisfaction and continual improvement requirements of ISO 9001 because it believes that to be a good business decision. If there are no customer or regulatory reasons for registration to this standard, however, it seems unwise to subject the organization to the trauma of third-party assessment against these requirements.

It is true that some customers and a number of regulatory agencies in smaller countries are not aware of ISO 13485 and may require or request compliance with ISO 9001:2000. Although the GHTF is doing its best to publicize the value of ISO 13485 to regulatory agencies around the world, it might be necessary for individual organizations to educate their customers and the regulatory agencies with which they interact. These organizations should avail themselves of materials that are available from the GHTF and the Association for the Advancement of Medical Instrumentation, which administers the ISO Secretariat for ISO/TC 210 (see below).

It will be important for each organization to negotiate with its current registrar or notified body and with others that may offer programs that are more consistent with the organization's objectives (G). The transition from the 1994 to the 2000 versions of ISO 9001 will likely cause increased demand for quality management system assessments and may lengthen each of these assessments. Getting on a registrar's schedule may be difficult if an organization delays this action.

If an organization seeks registration to ISO 13485:200X alone, it will be necessary to determine if the registrar is or plans to be qualified for ISO 13485:200X for the relevant medical devices. It may be necessary to help the registrar gather the information it requires to plan for assessments and, if necessary, to educate its assessors.

If an organization seeks registration to both ISO 9001:2000 and ISO 13485:200X, it will also be necessary to negotiate with the registrar about the process of assessing for both standards and the costs associated with this process. It will be necessary to determine if dual registration will require more than one assessment or other significant additional costs.

One of the things an individual organization can do immediately is to internalize the process approach by reviewing it with top management, developing training programs for affected personnel, and beginning to modify its high-level documentation to reflect this approach (H). Because both ISO 9001:2000 and ISO 13485:200X have adopted the process approach, there is little chance that such efforts will be wasted.

Once the ISO/CS has published the DIS version of ISO 13485:200X, it is unlikely that significant substantive changes will be made to this standard. At that point, the DIS should be satisfactory to use as the basis for an analysis of an individual organization's current quality management system against the revised requirements (I). One of the objectives of ISO 13485:200X is to maintain the status quo with regard to requirements. It is, therefore, not likely that an analysis of a compliant quality management system will reveal many gaps. In any case, starting this process during the second quarter of 2002 should provide sufficient time for corrective and preventive actions to be taken before the end of 2003.

If an individual organization seeks compliance with ISO 9001:2000, it should start its gap analysis immediately. Such an analysis may uncover deficiencies related to customer satisfaction and continual improvement processes.

The key is for medical device manufacturers to start their quality systems strategy efforts right away, keeping in mind what they learn as they follow the development process for ISO 13485:200X. That should leave enough time for each organization to effect an orderly and timely quality management system transition.

HELPFUL WEB SITES AND CONTACTS

Global Harmonization Task Force: http://www.GHTF.org.

Association for the Advancement of Medical Instrumentation (AAMI): http://www.aami.org; Hillary Woehrle, Secretary ISO/TC 210; e-mail, [email protected].

Copyright ©2001 Medical Device & Diagnostic Industry