ISO 13485 · Basic · 14 min lesson
Clause 4 - QMS requirements, process maps, quality manual and document control
ISO 13485:2016 clauses 4.1 and 4.2.1 to 4.2.4, with links to EU MDR Article 10(9) and 21 CFR part 820
What you will learn
- Explain what clause 4.1 requires of the QMS processes, including risk based control, outsourcing and software validation.
- Build a process map and a quality manual that meet clauses 4.1.3 and 4.2.2, and say what belongs in the medical device file under clause 4.2.3.
- Apply the document control rules of clause 4.2.4 and tell a weak document system from a compliant one.
Key takeaways
- Clause 4.1 asks for a risk based, process based system; outsourced processes stay your responsibility and QMS software is validated.
- A process map with owners, measures and records meets the sequence and interaction requirement of clause 4.1.3.
- The quality manual states scope, justified exclusions, procedures and process interaction (clause 4.2.2).
- The medical device file collects the description, specifications and procedures for each device type or family (clause 4.2.3).
- Document control means approve before issue, identify changes, current version at use, and no unintended use of obsolete copies (clause 4.2.4).
Free practice question
Tavira uses a cloud document system bought off the shelf. It controls approvals and revision status for all procedures. No one has checked that the approval workflow and the obsolete lock work as intended.
What does clause 4.1.6 require?
Validate the application for its intended use before first use and after changes, in proportion to risk.
Correct. Clause 4.1.6 requires documented procedures for validating QMS software before initial use and after changes.
Nothing, because it is a commercial product and the vendor is certified.
Not quite. Clause 4.1.6 puts validation of intended use on the organization, whatever the vendor's certification.
Only a hard copy backup of the database each year.
Not quite. A backup helps record integrity but does not replace validation required by clause 4.1.6.
Validation only if the software is used in production, not in the QMS.
Not quite. Clause 4.1.6 applies to software used in the QMS as well as production and service.
Key terms
- quality manual: Document specifying the QMS scope, justified exclusions, procedures or references and the interaction of processes (ISO 13485:2016 clause 4.2.2).
- medical device file: Collection of documents for a device type or family that shows conformity to the standard and regulatory requirements (clause 4.2.3).
- document control: Defined controls for approval, revision status, availability, legibility, external origin and obsolete documents (clause 4.2.4).
- process map: Diagram of QMS processes showing sequence, interaction, owners, measures and records (clause 4.1.3).
- outsourced process: A process carried out by an external party that affects product conformity; the organization retains control (clause 4.1.5).
- obsolete document: A superseded document kept for a defined period and identified so that it is not used by mistake (clause 4.2.4).
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- Regulation (EU) 2017/745 on medical devices (EUR-Lex), Article 10 and Annexes II and III
- FDA - Quality Management System Regulation (QMSR), 21 CFR part 820
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.