1---2name: quality-manager-qms-iso134853description: ISO 13485 Quality Management System implementation and maintenance for medical device organizations. Provides QMS design, documentation control, internal auditing, CAPA management, and certification support.4---5
6# Quality Manager - QMS ISO 13485 Specialist
7
8ISO 13485:2016 Quality Management System implementation, maintenance, and certification support for medical device organizations.
9
10---
11
12## Table of Contents
13
14- [QMS Implementation Workflow](#qms-implementation-workflow)
15- [Document Control Workflow](#document-control-workflow)
16- [Internal Audit Workflow](#internal-audit-workflow)
17- [Process Validation Workflow](#process-validation-workflow)
18- [Supplier Qualification Workflow](#supplier-qualification-workflow)
19- [QMS Process Reference](#qms-process-reference)
20- [Decision Frameworks](#decision-frameworks)
21- [Tools and References](#tools-and-references)
22
23---
24
25## QMS Implementation Workflow
26
27Implement ISO 13485:2016 compliant quality management system from gap analysis through certification.
28
29### Workflow: Initial QMS Implementation
30
311. Conduct gap analysis against ISO 13485:2016 requirements
322. Document current state vs. required state for each clause
333. Prioritize gaps by:
34 - Regulatory criticality
35 - Risk to product safety
36 - Resource requirements
374. Develop implementation roadmap with milestones
385. Establish Quality Manual per Clause 4.2.2:
39 - QMS scope with justified exclusions
40 - Process interactions
41 - Procedure references
426. Create required documented procedures:
43 - Document control (4.2.3)
44 - Record control (4.2.4)
45 - Internal audit (8.2.4)
46 - Nonconforming product (8.3)
47 - Corrective action (8.5.2)
48 - Preventive action (8.5.3)
497. Deploy processes with training
508. **Validation:** Gap analysis complete; Quality Manual approved; all required procedures documented and trained
51
52### Gap Analysis Matrix
53
54| Clause | Requirement | Current State | Gap | Priority | Action |
55|--------|-------------|---------------|-----|----------|--------|
56| 4.2.2 | Quality Manual | Not documented | Major | High | Create QM |
57| 4.2.3 | Document control | Informal | Moderate | High | Formalize SOP |
58| 5.6 | Management review | Ad hoc | Major | High | Establish schedule |
59| 7.3 | Design control | Partial | Moderate | Medium | Complete procedures |
60| 8.2.4 | Internal audit | None | Major | High | Create program |
61
62### QMS Structure
63
64| Level | Document Type | Purpose | Example |
65|-------|---------------|---------|---------|
66| 1 | Quality Manual | QMS overview, policy | QM-001 |
67| 2 | Procedures | How processes work | SOP-02-001 |
68| 3 | Work Instructions | Task-level detail | WI-06-012 |
69| 4 | Records | Evidence of conformity | Training records |
70
71### Required Procedure List
72
73| Clause | Procedure | Minimum Content |
74|--------|-----------|-----------------|
75| 4.2.3 | Document Control | Approval, review, distribution, obsolete control |
76| 4.2.4 | Record Control | Identification, storage, retention, disposal |
77| 8.2.4 | Internal Audit | Program, auditor qualification, reporting |
78| 8.3 | Nonconforming Product | Identification, segregation, disposition |
79| 8.5.2 | Corrective Action | Investigation, root cause, effectiveness |
80| 8.5.3 | Preventive Action | Risk identification, implementation, verification |
81
82---
83
84## Document Control Workflow
85
86Establish and maintain document control per ISO 13485 Clause 4.2.3.
87
88### Workflow: Document Creation and Approval
89
901. Identify need for new document or revision
912. Assign document number per numbering convention:
92 - Format: `[TYPE]-[AREA]-[SEQUENCE]-[REV]`
93 - Example: `SOP-02-001-01`
943. Draft document using approved template
954. Route for review to subject matter experts
965. Collect and address review comments
976. Obtain required approvals based on document type
987. Update Document Master List
998. **Validation:** Document numbered correctly; all reviewers signed; Master List updated
100
101### Document Numbering Convention
102
103| Prefix | Document Type | Approval Authority |
104|--------|---------------|-------------------|
105| QM | Quality Manual | Management Rep + CEO |
106| POL | Policy | Department Head + QA |
107| SOP | Procedure | Process Owner + QA |
108| WI | Work Instruction | Supervisor + QA |
109| TF | Template/Form | Process Owner |
110| SPEC | Specification | Engineering + QA |
111
112### Area Codes
113
114| Code | Area | Examples |
115|------|------|----------|
116| 01 | Quality Management | Quality Manual, policy |
117| 02 | Document Control | This procedure |
118| 03 | Training | Competency procedures |
119| 04 | Design | Design control |
120| 05 | Purchasing | Supplier management |
121| 06 | Production | Manufacturing |
122| 07 | Quality Control | Inspection, testing |
123| 08 | CAPA | Corrective actions |
124
125### Document Change Control
126
127| Change Type | Approval Level | Examples |
128|-------------|----------------|----------|
129| Administrative | Document Control | Typos, formatting |
130| Minor | Process Owner + QA | Clarifications |
131| Major | Full review cycle | Process changes |
132| Emergency | Expedited + retrospective | Safety issues |
133
134### Document Review Schedule
135
136| Document Type | Review Period | Trigger for Unscheduled Review |
137|---------------|---------------|-------------------------------|
138| Quality Manual | Annual | Organizational change |
139| Procedures | Annual | Audit finding, regulation change |
140| Work Instructions | 2 years | Process change |
141| Forms | 2 years | User feedback |
142
143---
144
145## Internal Audit Workflow
146
147Plan and execute internal audits per ISO 13485 Clause 8.2.4.
148
149### Workflow: Annual Audit Program
150
1511. Identify processes and areas requiring audit coverage
1522. Assess risk factors for audit frequency:
153 - Previous audit findings
154 - Regulatory changes
155 - Process changes
156 - Complaint trends
1573. Assign qualified auditors (independent of area audited)
1584. Develop annual audit schedule
1595. Obtain management approval
1606. Communicate schedule to process owners
1617. Track completion and reschedule as needed
1628. **Validation:** All processes covered; auditors qualified and independent; schedule approved
163
164### Workflow: Individual Audit Execution
165
1661. Prepare audit plan with scope, criteria, and schedule
1672. Notify auditee minimum 1 week prior
1683. Review procedures and previous audit results
1694. Prepare audit checklist
1705. Conduct opening meeting
1716. Collect evidence through:
172 - Document review
173 - Record sampling
174 - Process observation
175 - Personnel interviews
1767. Classify findings:
177 - Major NC: Absence or breakdown of system
178 - Minor NC: Single lapse or deviation
179 - Observation: Risk of future NC
1808. Conduct closing meeting
1819. Issue audit report within 5 business days
18210. **Validation:** All checklist items addressed; findings supported by evidence; report distributed
183
184### Audit Program Template
185
186| Audit # | Process | Clauses | Q1 | Q2 | Q3 | Q4 | Auditor |
187|---------|---------|---------|----|----|----|----|---------|
188| IA-001 | Document Control | 4.2.3, 4.2.4 | X | | | | [Name] |
189| IA-002 | Management Review | 5.6 | | X | | | [Name] |
190| IA-003 | Design Control | 7.3 | | X | | | [Name] |
191| IA-004 | Production | 7.5 | | | X | | [Name] |
192| IA-005 | CAPA | 8.5.2, 8.5.3 | | | | X | [Name] |
193
194### Auditor Qualification Requirements
195
196| Criterion | Requirement |
197|-----------|-------------|
198| Training | ISO 13485 awareness + auditor training |
199| Experience | Minimum 1 audit as observer |
200| Independence | Not auditing own work area |
201| Competence | Understanding of audited process |
202
203### Finding Classification Guide
204
205| Classification | Criteria | Response Time |
206|----------------|----------|---------------|
207| Major NC | System absence, total breakdown, regulatory violation | 30 days for CAPA |
208| Minor NC | Single instance, partial compliance | 60 days for CAPA |
209| Observation | Potential risk, improvement opportunity | Track in next audit |
210
211---
212
213## Process Validation Workflow
214
215Validate special processes per ISO 13485 Clause 7.5.6.
216
217### Workflow: Process Validation Protocol
218
2191. Identify processes requiring validation:
220 - Output cannot be verified by inspection
221 - Deficiencies appear only in use
222 - Sterilization, welding, sealing, software
2232. Form validation team with subject matter experts
2243. Write validation protocol including:
225 - Process description and parameters
226 - Equipment and materials
227 - Acceptance criteria
228 - Statistical approach
2294. Execute Installation Qualification (IQ):
230 - Verify equipment installed correctly
231 - Document equipment specifications
2325. Execute Operational Qualification (OQ):
233 - Test parameter ranges
234 - Verify process control
2356. Execute Performance Qualification (PQ):
236 - Run production conditions
237 - Verify output meets requirements
2387. Write validation report with conclusions
2398. **Validation:** IQ/OQ/PQ complete; acceptance criteria met; validation report approved
240
241### Validation Documentation Requirements
242
243| Phase | Content | Evidence |
244|-------|---------|----------|
245| Protocol | Objectives, methods, criteria | Approved protocol |
246| IQ | Equipment verification | Installation records |
247| OQ | Parameter verification | Test results |
248| PQ | Performance verification | Production data |
249| Report | Summary, conclusions | Approval signatures |
250
251### Revalidation Triggers
252
253| Trigger | Action Required |
254|---------|-----------------|
255| Equipment change | Assess impact, revalidate affected phases |
256| Parameter change | OQ and PQ minimum |
257| Material change | Assess impact, PQ minimum |
258| Process failure | Full revalidation |
259| Periodic | Per validation schedule (typically 3 years) |
260
261### Special Process Examples
262
263| Process | Validation Standard | Critical Parameters |
264|---------|--------------------|--------------------|
265| EO Sterilization | ISO 11135 | Temperature, humidity, EO concentration, time |
266| Steam Sterilization | ISO 17665 | Temperature, pressure, time |
267| Radiation Sterilization | ISO 11137 | Dose, dose uniformity |
268| Sealing | Internal | Temperature, pressure, dwell time |
269| Welding | ISO 11607 | Heat, pressure, speed |
270
271---
272
273## Supplier Qualification Workflow
274
275Evaluate and approve suppliers per ISO 13485 Clause 7.4.
276
277### Workflow: New Supplier Qualification
278
2791. Identify supplier category:
280 - Category A: Critical (affects safety/performance)
281 - Category B: Major (affects quality)
282 - Category C: Minor (indirect impact)
2832. Request supplier information:
284 - Quality certifications
285 - Product specifications
286 - Quality history
2873. Evaluate supplier based on:
288 - Quality system (ISO certification)
289 - Technical capability
290 - Quality history
291 - Financial stability
2924. For Category A suppliers:
293 - Conduct on-site audit
294 - Require quality agreement
2955. Calculate qualification score
2966. Make approval decision:
297 - >80: Approved
298 - 60-80: Conditional approval
299 - <60: Not approved
3007. Add to Approved Supplier List
3018. **Validation:** Evaluation criteria scored; qualification records complete; supplier categorized
302
303### Supplier Evaluation Criteria
304
305| Criterion | Weight | Scoring |
306|-----------|--------|---------|
307| Quality System | 30% | ISO 13485=30, ISO 9001=20, Documented=10, None=0 |
308| Quality History | 25% | Reject rate: <1%=25, 1-3%=15, >3%=0 |
309| Delivery | 20% | On-time: >95%=20, 90-95%=10, <90%=0 |
310| Technical Capability | 15% | Exceeds=15, Meets=10, Marginal=5 |
311| Financial Stability | 10% | Strong=10, Adequate=5, Questionable=0 |
312
313### Supplier Category Requirements
314
315| Category | Qualification | Monitoring | Agreement |
316|----------|---------------|------------|-----------|
317| A - Critical | On-site audit | Annual review | Quality agreement |
318| B - Major | Questionnaire | Semi-annual review | Quality requirements |
319| C - Minor | Assessment | Issue-based | Standard terms |
320
321### Supplier Performance Metrics
322
323| Metric | Target | Calculation |
324|--------|--------|-------------|
325| Accept Rate | >98% | (Accepted lots / Total lots) × 100 |
326| On-Time Delivery | >95% | (On-time / Total orders) × 100 |
327| Response Time | <5 days | Average days to resolve issues |
328| Documentation | 100% | (Complete CoCs / Required CoCs) × 100 |
329
330---
331
332## QMS Process Reference
333
334### ISO 13485 Clause Structure
335
336| Clause | Title | Key Requirements |
337|--------|-------|-----------------|
338| 4.1 | General Requirements | Process identification, interaction, outsourcing |
339| 4.2 | Documentation | Quality Manual, procedures, records |
340| 5.1-5.5 | Management Responsibility | Commitment, policy, objectives, organization |
341| 5.6 | Management Review | Inputs, outputs, records |
342| 6.1-6.4 | Resource Management | Personnel, infrastructure, environment |
343| 7.1 | Product Realization Planning | Quality plan, risk management |
344| 7.2 | Customer Requirements | Determination, review, communication |
345| 7.3 | Design and Development | Planning, inputs, outputs, review, V&V, transfer, changes |
346| 7.4 | Purchasing | Supplier control, purchasing info, verification |
347| 7.5 | Production | Control, cleanliness, validation, identification, traceability |
348| 7.6 | Monitoring Equipment | Calibration, control |
349| 8.1 | Measurement Planning | Monitoring and analysis planning |
350| 8.2 | Monitoring | Feedback, complaints, reporting, audits, process, product |
351| 8.3 | Nonconforming Product | Control, disposition |
352| 8.4 | Data Analysis | Trend analysis |
353| 8.5 | Improvement | CAPA |
354
355### Management Review Required Inputs (Clause 5.6.2)
356
357| Input | Source | Prepared By |
358|-------|--------|-------------|
359| Audit results | Internal and external audits | QA Manager |
360| Customer feedback | Complaints, surveys | Customer Quality |
361| Process performance | Process metrics | Process Owners |
362| Product conformity | Inspection data, NCs | QC Manager |
363| CAPA status | CAPA system | CAPA Officer |
364| Previous actions | Prior review records | QMR |
365| Changes affecting QMS | Regulatory, organizational | RA Manager |
366| Recommendations | All sources | All Managers |
367
368### Record Retention Requirements
369
370| Record Type | Minimum Retention | Regulatory Basis |
371|-------------|-------------------|------------------|
372| Device Master Record | Life of device + 2 years | 21 CFR 820.181 |
373| Device History Record | Life of device + 2 years | 21 CFR 820.184 |
374| Design History File | Life of device + 2 years | 21 CFR 820.30 |
375| Complaint Records | Life of device + 2 years | 21 CFR 820.198 |
376| Training Records | Employment + 3 years | Best practice |
377| Audit Records | 7 years | Best practice |
378| CAPA Records | 7 years | Best practice |
379| Calibration Records | Equipment life + 2 years | Best practice |
380
381---
382
383## Decision Frameworks
384
385### Exclusion Justification (Clause 4.2.2)
386
387| Clause | Permissible Exclusion | Justification Required |
388|--------|----------------------|------------------------|
389| 6.4.2 | Contamination control | Product not affected by contamination |
390| 7.3 | Design and development | Organization does not design products |
391| 7.5.2 | Product cleanliness | No cleanliness requirements |
392| 7.5.3 | Installation | No installation activities |
393| 7.5.4 | Servicing | No servicing activities |
394| 7.5.5 | Sterile products | No sterile products |
395
396### Nonconformity Disposition Decision Tree
397
398```
399Nonconforming Product Identified
400 │
401 ▼
402 Can it be reworked?
403 │
404 Yes──┴──No
405 │ │
406 ▼ ▼
407 Is rework Can it be used
408 procedure as is?
409 available? │
410 │ Yes──┴──No
411 Yes─┴─No │ │
412 │ │ ▼ ▼
413 ▼ ▼ Concession Scrap or
414 Rework Create approval return to
415 per SOP rework needed? supplier
416 procedure │
417 Yes─┴─No
418 │ │
419 ▼ ▼
420 Customer Use as is
421 approval with MRB
422 approval
423```
424
425### CAPA Initiation Criteria
426
427| Source | Automatic CAPA | Evaluate for CAPA |
428|--------|----------------|-------------------|
429| Customer complaint | Safety-related | All others |
430| External audit | Major NC | Minor NC |
431| Internal audit | Major NC | Repeat minor NC |
432| Product NC | Field failure | Trend exceeds threshold |
433| Process deviation | Safety impact | Repeated deviations |
434
435---
436
437## Tools and References
438
439### Scripts
440
441| Tool | Purpose | Usage |
442|------|---------|-------|
443| [qms_audit_checklist.py](scripts/qms_audit_checklist.py) | Generate audit checklists by clause or process | `python qms_audit_checklist.py --help` |
444
445**Audit Checklist Generator Features:**
446- Generate clause-specific checklists (e.g., `--clause 7.3`)
447- Generate process-based checklists (e.g., `--process design-control`)
448- Full system audit checklist (`--audit-type system`)
449- Text or JSON output formats
450- Interactive mode for guided selection
451
452### References
453
454| Document | Content |
455|----------|---------|
456| [iso13485-clause-requirements.md](references/iso13485-clause-requirements.md) | Detailed requirements for each ISO 13485:2016 clause with audit questions |
457| [qms-process-templates.md](references/qms-process-templates.md) | Ready-to-use templates for document control, audit, CAPA, supplier, training |
458
459### Quick Reference: Mandatory Documented Procedures
460
461| Procedure | Clause | Key Elements |
462|-----------|--------|--------------|
463| Document Control | 4.2.3 | Approval, distribution, obsolete control |
464| Record Control | 4.2.4 | Identification, retention, disposal |
465| Internal Audit | 8.2.4 | Program, auditor qualification, reporting |
466| NC Product Control | 8.3 | Identification, segregation, disposition |
467| Corrective Action | 8.5.2 | Root cause, implementation, verification |
468| Preventive Action | 8.5.3 | Risk identification, implementation |
469
470---
471
472## Related Skills
473
474| Skill | Integration Point |
475|-------|-------------------|
476| [quality-manager-qmr](../quality-manager-qmr/) | Management review, quality policy |
477| [capa-officer](../capa-officer/) | CAPA system management |
478| [qms-audit-expert](../qms-audit-expert/) | Advanced audit techniques |
479| [quality-documentation-manager](../quality-documentation-manager/) | DHF, DMR, DHR management |
480| [risk-management-specialist](../risk-management-specialist/) | ISO 14971 integration |