Cultural Shift of ISO 13485: 2016 Implementation for the FDA

On January 31, 2024, the United States FDA issued a final rule amending the medical device current good manufacturing practice (CGMP) requirements for the Quality System Regulation (QSR) under 21 CFR 820. This Regulation has now become known as the Quality Management System Regulation (QMSR). The QMSR aligns more closely with the international consensus standard for Quality Management Systems for medical devices, ISO 13485: 2016.

It is important to note that if your organisation already has ISO 13485:2016 certification this does not mean you will automatically be in compliance with the new QMSR. In addition, you will not be exempt from FDA inspections if you are already ISO 13485-certified. Similarly, an FDA inspection will not grant an organisation with ISO 13485: 2016 certification.

In support for the introduction of this change, the FDA intends to replace its current Quality System Inspection Technique (QSIT) with an inspection approach that will be consistent with the requirements of the QMSR. The “top-down” approach to inspections adopted by QSIT begins with each subsystem being reviewed to determine whether the firm has addressed the basic requirements in that subsystem. This process ensured the organisation has defined and documented appropriate procedures. This was then followed by an analysis of whether the firm has implemented the requirements of that subsystem. Within the QSIT model for the FDA, each subsystem included a number of inspection objectives for the auditors. This approach gave the feel to the auditee of an itemised checklist format for these FDA audits.

By contrast ISO 13485: 2016 audits completed by Conformity Assessment Bodies, such as Notified Bodies in the EU, are governed by ISO 19011: 2018 standard for auditing of QMS. This standard sets the requirements for a process-based audit. This type of audit looks to follow the organisations procedures and check compliance with what has been determined as requirements by the organisation and also by the ISO 13485: 2016 standards. This type of audit established a risk-based approach to the sampling plan, requesting more samples for higher risk areas of the QMS.
If organisations are not familiar with the process approach to auditing, these organisations should prepare for a cultural shift in the approach to their QMS. Following a process from start to finish, taking trails to supporting processes such as competence, resources, purchasing or document and record control can find lacunae in the QMS previously unseen using the QSIT audit type.

Utilising a trained, experienced and objective ISO 13485: 2016 assessor to complete an internal audit, or a mock audit, can add considerable value to the organisation. Value added to an organisation can include:

Training for auditees on the process approach
Gap assessment against the ISO 13485: 2016 standard
Understand the expectations of the auditor

If your organisation requires the expertise necessary to navigate the changes to the Regulation or the change to the model of inspection for the FDA, then please contact ICON where experienced ISO 13485: 2016 Quality Specialists including ex Notified Body Auditors can fulfil your organisations specific needs.

In this section

Connect with us