With intense focus on getting a medical device to market – and keeping it there – it’s easy to see how some areas of quality management can slip. Fortunately, here at Peercode Regulatory Consultancy, we’ve compiled a list of often overlooked QMS improvements which you can start making today.

1 Maintain Supplier Control

It goes without saying that the safety of medical devices is critical. So for medical device manufacturers, oversight and control over their entire supply chain is essential.

With the MDR, supplier control is part of the scope. That means companies need to maintain visibility over every component in their product. It’s their responsibility to ensure that suppliers are suitably qualified and that this qualification is properly documented. Depending on the product, qualification might include things like the cost of a component, the quality of it, and how it’s made.

To ensure compliance with appropriate safety standards, both the qualification method and the agreement between parties are of key importance. Not least because Notified Bodies can ask to view this documentation together with evidence of what’s been purchased. It’s an MDR expectation that companies maintain full control – especially when there are high risk components inside the product.

For example, if a supplier identifies an error in their component, they must notify the manufacturer as per their agreement. However, it’s also best practice for the manufacturer to maintain regular communication with the supplier to ensure that faulty devices do not enter the market. When it comes to quality management, the bottom line is that companies can outsource manufacturing activities, but they cannot outsource responsibility for the end product.

2 Assign Relevant Roles

Quality management systems rely on an effective organisational structure. Particularly in smaller businesses, where people usually have multiple roles and responsibilities, assigning roles can be challenging. Let’s face it, in any size organisation nobody can be present 24/7, so it’s important that oversight of regulatory compliance is shared – especially for those times when the person responsible is absent or leaves the company.

The MDR sets out two key positions: the Person Responsible for Regulatory Compliance (PRRC), and a Quality Management Representative (QMR). If something goes wrong with a product, the company is held accountable, but the PRRC is the spokesperson and point of contact in terms of any compliance issues. They will also establish the validity of an apparent  noncompliance. The QMR is more widely focused on the quality of the product, and the organisation as a whole. It’s also important for the QMR to be someone independent of commercial decision-making to avoid a conflict of interest between being completely compliant, and taking a product to market faster.

On top of these two roles, it’s good practice for companies to allocate a Process Owner to ensure that quality management is being correctly executed. Of course, it’s up to individual companies as to how they structure their organisation. However, in an ideal world, medical device companies involve at least three roles in their QMS: a regulatory compliance manager, a member of the management team, and a technical expert. This provides a variety of views around quality management.

3 Stay Up To Date

Notified Bodies require medical device companies to be state of the art. Not only do they need to be aware of the latest versions of guidance documents, they need to implement relevant changes within the correct time frames. The onus is on manufacturers to stay up to date with the latest guidance, whether that’s general standards, or specific product requirements.

Maintaining compliance with relevant standards for medical devices requires continuous oversight over multiple moving parts. Process and product standards are reviewed every 5 years, so there is an ongoing cycle of updates. However, in between updates, there can be numerous amendments from both ISO and the IEC to which companies must adhere. Companies can choose to stay up to date however they like – from signing up to a mailing list to joining a relevant group on social media – but responsibility for compliance is firmly at their feet and deviations should be well documented and justified.

4 Report Substantial Changes

For the commercially-minded, when a substantial change is about to occur within your business or product, reporting it to a Notified Body might not be your first thought – but it is a requirement. And that applies to both your QMS and your product.

Substantial changes of any kind must be documented and reported to a Notified Body. A change of material in a medical device, the use of a new factory, and a new CEO all constitute substantial changes. The best way to handle these eventualities is by establishing a clear process for reporting them.

Any substantial change must also be documented ahead of time because a Notified Body will need to carefully examine the change report. That means completing a change report needs to be part of a QMS process because any changes might affect the potential risk of a product. Failure to report substantial changes carries reputational risk and could also result in a device being pulled from the market.

5 Deliver Employee Training

Whenever a medical device company hires someone to execute a role covered by the QMS, that person needs to know what’s expected of them in terms of regulatory compliance. That’s because what they do directly or indirectly impacts the medical device, its reliability, and patient safety.

To ensure both new starters and existing staff understand and operate within the changing requirements of the MDR, they need ongoing and regular training. On one hand, this is totally logical. On the other hand, it’s easy to forget that this process needs to be documented.

In medical device companies, essential knowledge around QMS is needed in a broad range of roles, from a cleaner working in a sterile environment to the QA manager with direct responsibility for quality. Even someone working in finance would need some level of training in case they happen to receive a complaint about a product.

Put simply, the entire organisation needs training – that is, everyone who has a part to play in the safety and performance of a medical device. Companies can verify this through a robust training schedule, certification, or even questionnaire to demonstrate employee knowledge.

Whichever way they go about it, companies need to define the method of verification from a simple test to something more complex – like carrying out a practical procedure on the factory floor. This then makes it more straightforward to satisfy a Notified Body that quality standards are being met.

6 Validate Your QMS Software

Not only do medical device companies need a robust QMS system, they also need to ensure that their software for managing quality is also up to standard. From maintaining training records to updated standard operating procedures (SOPs) software is used to accomplish most activities around medical device manufacturing.

Every software used in the production of medical devices needs to be validated for use. That can be as simple as stating that an off-the-shelf solution, such as Microsoft Word, is used for preparing documentation. Or it could be more complicated, such as when a company has a proprietary support ticket system. In this scenario, the software would need to be validated for its intended use. This can be done internally or externally, but it always starts with how the software is being used.

At the same time, software used in the production and testing of a medical device must also be validated to ensure it is functioning correctly, storing data securely, and protected from cyberattacks. It’s down to individual companies to list the software related to their QMS, from document control to production. With so much focus on the end product, this is another area which is easily overlooked.

7 Reducing Risk Through QMS

Regulations are there for a reason, and when it comes to manufacturing medical devices, product and patient safety are paramount.

If a faulty or noncompliant product reaches the market, it could have devastating consequences for both healthcare providers and their patients. It also leaves the company behind it wide-open to irreparable reputational and financial damage. That’s why risk management is so important, and that’s also where a robust and risk-based QMS can make the difference.

When you think about it, every process involved in the production of a medical device is risk based. From key players in a product’s supply chain to substantial changes to a medical device company (or one of its products) everything covered by a QMS is there because it has an impact on the end product.

The fact is, in any successful medical device company, risk awareness and quality awareness run deep. Whilst it may feel commercially counterintuitive at first, the key for medical device companies looking to improve their QMS is not to focus solely on the end product, but to manage risk within all the processes that help create that product.

Find out how Peercode Regulatory Services can help you stay compliant, competitive, and reduce risk. Talk to a specialist.