QUALITY SYSTEMSGetting Compliant for theGlobal Market

Medical Device & Diagnostic Industry Magazine | MDDI Article Index

Originally published November, 1996

Gunter Frey and Kimberly Hughes

[Related Links]

Although it is still more than a year and a half away, the date of June 15, 1998, is approaching very rapidly for device manufacturers seeking to begin or continue selling in the European Union (EU). That is the day the EU's Medical Devices Directive (MDD) will become fully effective throughout the member states of the union, and when device manufacturers will have to either demonstrate compliance with the directive or cease selling in the EU.

Among the most important terms of the MDD are specific requirements for quality systems that must be observed by manufacturers. The directive does not explicitly mention any of the quality systems standards commonly used in the United States or Europe, but it is clear that the EU expects manufacturers to adopt and comply with such standards as are appropriate to their particular industry.

With the growing importance of overseas markets and the rapid globalization of the device industry, most U.S. manufacturers are faced with the task of developing and implementing a quality system that complies with both international and domestic requirements. As a guide to those who are about to undertake this daunting process, this article describes how our company, Pryon Corp. (Menomonee Falls, WI), successfully accomplished certification to the ISO 9001 and EN 46001 quality systems standards (see Figure 1, below). The article poses many of the same questions we raised during our preparatory work, and provides some resources to help obtain the answers. Although our approach cannot be expected to work for every company, our experience may benefit those who will shortly be guiding their own companies toward a certification audit.

GATHERING RESOURCES

The first step for any company preparing for its initial audit is to become familiar with the relevant standards and available resources. Since standards are revised over time, companies should be sure to obtain the most recent versions. Copies of the EU directives, relevant standards, and guidance documents are available from a number of organizations, including the American Society for Quality Control (ASQC), the Office of European Community Affairs, and the National Institute of Standards and Technology. Numerous books, videos, and software packages are also available to provide either a general overview or answers to detailed questions. Information about these resources can be found in trade publications as well as in the publicity materials issued by their publishers.

Among the most helpful sources of information is the National ISO 9000 Support Group. This group provides an independent arena for discussion, advice, and information exchange. It promotes a better understanding of the standards, the steps involved in implementation, the benefits of certification, and the process of becoming certified. Members of the group represent a great deal of ISO 9000 experience. The support group provides members with general ISO information, ideas on where to go for additional information, tutorials, the Continuous Improvement Newsletter, and discounts on publications. In addition, the support group is accessible via the Internet. The group can be contacted at 616/891-9114.

While the goal in this step is to gather as much information as possible, it's equally important not to become overwhelmed. This phase is comparable to a first semester at college, and it takes roughly the same time--three to four months--to comprehend the unfamiliar terminology and get a general sense of what lies ahead.

WHICH STANDARDS?

The second step is to determine which standards apply to the firm and its products. For device manufacturers, the most widely used quality management and quality assurance standards are those of the ISO 9000 family, compiled by the International Organization for Standardization (ISO). A virtually identical series of standards have been published as European norms under the designation EN 29000, and the requirements of the ISO standards are also reflected in FDA's revised good manufacturing practices (GMP) regulation.

The ISO 9000 series includes five parts, the first and last of which (ISO 9000, "Guide to Selection and Use," and ISO 9004, "Guide to Quality Management Elements") assist manufacturers in determining which of the remaining three standards apply to them. Pryon Corp. conducts research, development, manufacturing, installation, and servicing of CO₂ monitors, so our goal was to become certified to ISO 9001, which covers design, production, and installation. Some companies approach ISO 9001 certification by first attempting certification to ISO 9002 (production, installation, and servicing) and later expanding their quality system to include design and development.

To do business in Europe, most medical device manufacturers will also have to comply with another set of European norms, designated the EN 46000 series, which translate the general requirements of the ISO 9000 series for use specifically by manufacturers of medical products. Compiled by the European Committee for Standardization and the European Committee for Electrotechnical Standardization (CEN and CENELEC), the EN 46000 standards mandate additional requirements for medical products to be sold in the European market. For example, requirements of EN 46001 include or refer to postmarket surveillance activities, customer complaint handling, advisory notices, and recalls.

INVOLVING EXECUTIVE MANAGEMENT

Once the company has determined which of the various types of quality certification will be required, it is important to ensure that executive management is fully involved in the process. Even though company executives may have identified the need for certification and may have recommended creation of an audit team or committee, they may still require some education about the complexities of the certification process.

Some of this education takes place gradually, as managers observe preparations and are given updates on the company's progress. But it is also necessary to conduct meetings with executive management apart from the training classes held for all staff. At Pryon, management was supplied with an outline of the audit and certification process, and was continuously updated on schedules, activities being performed, and tasks still remaining to be done.

At most companies, the individual or committee coordinating the certification process is also responsible for establishing the company's training requirements. But to ensure that executive managers are fully engaged in the process, it is a good idea to involve them in this process and to update them regularly. Executive management can provide valuable assistance in developing the company's training programs, and in supporting travel to training seminars for key employees.

Without executive management's continuing commitment and support, it will be difficult to achieve successful completion of the certification program. But since preparation for the certification audit is complicated and time-consuming, commitment may wane at times. To keep managers motivated, it may be helpful to remind them that registration is intended to ensure that the company's products will have ready access to important markets. At Pryon, management's commitment was evidenced by its support of all activities, and its active participation in the design and conduct of internal audits and employee training.

RESOLVING QUESTIONS

After completing the initial phase of information gathering described above, companies must undertake the more difficult task of understanding and interpreting the materials. Even with many books and videos in hand, company staff will still need help interpreting portions of the standards and answering questions from their fellow employees. A number of resources can help to resolve such difficulties.

One good approach is to ask other firms how they had addressed shortcomings in their quality systems. Peers and business contacts within the medical device industry can be invaluable sources of information. If they have already completed an audit, they speak the language, know the process, and may be willing to share their experiences, problem-solving methods, and advice. When making these contacts it is best to start with friends and then branch out to peer companies, and always ask for recommendations of additional contacts. Also, callers should have ready a list of detailed questions; people are rightfully reluctant to take time from their schedules to answer vague or open-ended questions.

Another resource is FDA's Division of Small Manufacturers Assistance (DSMA), which can supply copies of key agency documents related to quality systems. One such document is the "Working Draft of the Current Good Manufacturing Practices (CGMP) Final Rule," [Now superseded by the October 7, 1996 Final Rule--Ed.] which was released by the agency in July 1995. It includes a preface that summarizes comments from device industry experts about the proposed regulation as well as FDA's position toward those comments. Because it offers insight into the ways the agency has adapted elements of ISO 9001 and EN 46001, the July 1995 draft is still useful even now that the revised GMP regulation has been issued. Experts at DSMA are also available to answer questions regarding the revised GMPs.

Although our company elected not to retain a consultant, there are many such companies and individuals that can answer questions and provide information and assistance. Lists of such service providers are available through many sources, including the National ISO 9000 Support Group and the Internet. Before Pryon decided to conduct its own preparatory work, the company obtained quotes from several consulting services. Our research indicated that the average fee for conducting an ISO 9001 gap analysis for a single-site company of 100 employees was approximately $6000; the average fee for a certification audit was $19,000. Totaling $25,000 (excluding traveling and lodging expenses), these fees did not include certification to EN 46001 or the MDD. Our approach enabled us to limit expenses to about two-thirds of the prices quoted, and also to include certification to EN 46001 and annex II of the MDD.

SELECTING A NOTIFIED BODY

Just as the regulatory regime in the EU differs from that of the United States, so also does the structure of authoritative bodies that administer it. Each member state of the union has a competent authority, usually a governmental agency, which is charged with carrying out the requirements of the EU directives. Competent authorities determine whether a certification organization is qualified to act as a notified body, and they also oversee the auditing of notified bodies to ensure that they remain qualified.

A notified body is a certification organization that has been designated to carry out one or more of the audits described in the annexes of the directives. There may be more than one notified body in any given member state. In many cases, independent European test agencies have achieved qualification to serve as notified bodies. However, an organization's designation as a notified body may be restricted to specified types of devices, so companies must be sure to choose only those that are notified for their products. The EU's Delegation of the European Commission maintains a list of all notified bodies (currently about 34 organizations), which includes their names and addresses; their identification numbers; and the products, procedures/modules, and annexes of the directives for which they are notified.

Notified bodies assume full and final responsibility for the performance of audits, but they may subcontract with a registrar to perform the actual work of the audit. Registrars are organizations that assess and certify companies to the appropriate ISO 9000 and EN 46000 standards. While there are many registrars in North America that can provide ISO 9000 certification, not all are recognized in Europe, and not all can certify companies to the EN 46000 series of standards. In the United States, registrars are accredited by the Registrar Accreditation Board (RAB) using criteria based on internationally recognized standards and guides. The RAB is a private, not-for-profit organization that can provide manufacturers with a list of registrars; it can be contacted at 800/248-1946.

To avoid the possibility of working with a registrar whose accreditation might prove unacceptable in Europe, our company determined to select a notified body that would be responsible for the competence and qualifications of its auditors. We first determined which notified bodies subcontracted with or accepted audits by registrars located in the United States. Then we again contacted our peers to ask them about the notified bodies they were working with. Companies that elect to use this approach should be sure to have a set of short and direct questions that will elicit the information they need, such as the following:

Once the answers to these questions have been digested, the company should then prepare to contact various suitable notified bodies. Not every notified body is a candidate; a company may decide to interview only those located in the country where it does the most business, or only those in a country where it has an office. With the help of feedback from its peers, the company should be able to narrow its list to about 10 notified bodies of interest.

When the manufacturer begins to interview notified bodies, it is important to conduct information gathering according to a well-structured process so that each firm can be compared with the others. There are two reasons for contacting notified bodies. The first is to obtain a detailed quote and related information, including answers to the following questions:

Overall, the manufacturer should try to determine how well the notified body's personnel know and understand the directives and standards that relate to its products. It is also important to ask how backlogged the notified body is with audit requests; the closer we come to June 1998, the greater the likelihood that such firms will be inundated with requests.

The company should request an informational package and an application package from the notified body. The former should provide data regarding the certification process and some background about the notified body; the latter should include forms for the manufacturer to use in supplying general information about itself and its quality systems.

The second reason to contact notified bodies is to enable the manufacturer to get a feel for its potential business relationship with each firm. To determine this, the manufacturer should make careful observations of the body's professionalism in every contact. Some areas that might be worthy of note include the following: