1---2name: quality-manager-qms-iso13485-33description: ISO 13485 Quality Management System implementation and maintenance for medical device organizations. Provides QMS design, documentation control, internal auditing, CAPA management, and certification support. Use when this capability is needed.4---56# Quality Manager - QMS ISO 13485 Specialist78ISO 13485:2016 Quality Management System implementation, maintenance, and certification support for medical device organizations.910---1112## Table of Contents1314- [QMS Implementation Workflow](#qms-implementation-workflow)15- [Document Control Workflow](#document-control-workflow)16- [Internal Audit Workflow](#internal-audit-workflow)17- [Process Validation Workflow](#process-validation-workflow)18- [Supplier Qualification Workflow](#supplier-qualification-workflow)19- [QMS Process Reference](#qms-process-reference)20- [Decision Frameworks](#decision-frameworks)21- [Tools and References](#tools-and-references)2223---2425## QMS Implementation Workflow2627Implement ISO 13485:2016 compliant quality management system from gap analysis through certification.2829### Workflow: Initial QMS Implementation30311. Conduct gap analysis against ISO 13485:2016 requirements322. Document current state vs. required state for each clause333. Prioritize gaps by:34 - Regulatory criticality35 - Risk to product safety36 - Resource requirements374. Develop implementation roadmap with milestones385. Establish Quality Manual per Clause 4.2.2:39 - QMS scope with justified exclusions40 - Process interactions41 - Procedure references426. Create required documented procedures:43 - Document control (4.2.3)44 - Record control (4.2.4)45 - Internal audit (8.2.4)46 - Nonconforming product (8.3)47 - Corrective action (8.5.2)48 - Preventive action (8.5.3)497. Deploy processes with training508. **Validation:** Gap analysis complete; Quality Manual approved; all required procedures documented and trained5152### Gap Analysis Matrix5354| Clause | Requirement | Current State | Gap | Priority | Action |55|--------|-------------|---------------|-----|----------|--------|56| 4.2.2 | Quality Manual | Not documented | Major | High | Create QM |57| 4.2.3 | Document control | Informal | Moderate | High | Formalize SOP |58| 5.6 | Management review | Ad hoc | Major | High | Establish schedule |59| 7.3 | Design control | Partial | Moderate | Medium | Complete procedures |60| 8.2.4 | Internal audit | None | Major | High | Create program |6162### QMS Structure6364| Level | Document Type | Purpose | Example |65|-------|---------------|---------|---------|66| 1 | Quality Manual | QMS overview, policy | QM-001 |67| 2 | Procedures | How processes work | SOP-02-001 |68| 3 | Work Instructions | Task-level detail | WI-06-012 |69| 4 | Records | Evidence of conformity | Training records |7071### Required Procedure List7273| Clause | Procedure | Minimum Content |74|--------|-----------|-----------------|75| 4.2.3 | Document Control | Approval, review, distribution, obsolete control |76| 4.2.4 | Record Control | Identification, storage, retention, disposal |77| 8.2.4 | Internal Audit | Program, auditor qualification, reporting |78| 8.3 | Nonconforming Product | Identification, segregation, disposition |79| 8.5.2 | Corrective Action | Investigation, root cause, effectiveness |80| 8.5.3 | Preventive Action | Risk identification, implementation, verification |8182---8384## Document Control Workflow8586Establish and maintain document control per ISO 13485 Clause 4.2.3.8788### Workflow: Document Creation and Approval89901. Identify need for new document or revision912. Assign document number per numbering convention:92 - Format: `[TYPE]-[AREA]-[SEQUENCE]-[REV]`93 - Example: `SOP-02-001-01`943. Draft document using approved template954. Route for review to subject matter experts965. Collect and address review comments976. Obtain required approvals based on document type987. Update Document Master List998. **Validation:** Document numbered correctly; all reviewers signed; Master List updated100101### Document Numbering Convention102103| Prefix | Document Type | Approval Authority |104|--------|---------------|-------------------|105| QM | Quality Manual | Management Rep + CEO |106| POL | Policy | Department Head + QA |107| SOP | Procedure | Process Owner + QA |108| WI | Work Instruction | Supervisor + QA |109| TF | Template/Form | Process Owner |110| SPEC | Specification | Engineering + QA |111112### Area Codes113114| Code | Area | Examples |115|------|------|----------|116| 01 | Quality Management | Quality Manual, policy |117| 02 | Document Control | This procedure |118| 03 | Training | Competency procedures |119| 04 | Design | Design control |120| 05 | Purchasing | Supplier management |121| 06 | Production | Manufacturing |122| 07 | Quality Control | Inspection, testing |123| 08 | CAPA | Corrective actions |124125### Document Change Control126127| Change Type | Approval Level | Examples |128|-------------|----------------|----------|129| Administrative | Document Control | Typos, formatting |130| Minor | Process Owner + QA | Clarifications |131| Major | Full review cycle | Process changes |132| Emergency | Expedited + retrospective | Safety issues |133134### Document Review Schedule135136| Document Type | Review Period | Trigger for Unscheduled Review |137|---------------|---------------|-------------------------------|138| Quality Manual | Annual | Organizational change |139| Procedures | Annual | Audit finding, regulation change |140| Work Instructions | 2 years | Process change |141| Forms | 2 years | User feedback |142143---144145## Internal Audit Workflow146147Plan and execute internal audits per ISO 13485 Clause 8.2.4.148149### Workflow: Annual Audit Program1501511. Identify processes and areas requiring audit coverage1522. Assess risk factors for audit frequency:153 - Previous audit findings154 - Regulatory changes155 - Process changes156 - Complaint trends1573. Assign qualified auditors (independent of area audited)1584. Develop annual audit schedule1595. Obtain management approval1606. Communicate schedule to process owners1617. Track completion and reschedule as needed1628. **Validation:** All processes covered; auditors qualified and independent; schedule approved163164### Workflow: Individual Audit Execution1651661. Prepare audit plan with scope, criteria, and schedule1672. Notify auditee minimum 1 week prior1683. Review procedures and previous audit results1694. Prepare audit checklist1705. Conduct opening meeting1716. Collect evidence through:172 - Document review173 - Record sampling174 - Process observation175 - Personnel interviews1767. Classify findings:177 - Major NC: Absence or breakdown of system178 - Minor NC: Single lapse or deviation179 - Observation: Risk of future NC1808. Conduct closing meeting1819. Issue audit report within 5 business days18210. **Validation:** All checklist items addressed; findings supported by evidence; report distributed183184### Audit Program Template185186| Audit # | Process | Clauses | Q1 | Q2 | Q3 | Q4 | Auditor |187|---------|---------|---------|----|----|----|----|---------|188| IA-001 | Document Control | 4.2.3, 4.2.4 | X | | | | [Name] |189| IA-002 | Management Review | 5.6 | | X | | | [Name] |190| IA-003 | Design Control | 7.3 | | X | | | [Name] |191| IA-004 | Production | 7.5 | | | X | | [Name] |192| IA-005 | CAPA | 8.5.2, 8.5.3 | | | | X | [Name] |193194### Auditor Qualification Requirements195196| Criterion | Requirement |197|-----------|-------------|198| Training | ISO 13485 awareness + auditor training |199| Experience | Minimum 1 audit as observer |200| Independence | Not auditing own work area |201| Competence | Understanding of audited process |202203### Finding Classification Guide204205| Classification | Criteria | Response Time |206|----------------|----------|---------------|207| Major NC | System absence, total breakdown, regulatory violation | 30 days for CAPA |208| Minor NC | Single instance, partial compliance | 60 days for CAPA |209| Observation | Potential risk, improvement opportunity | Track in next audit |210211---212213## Process Validation Workflow214215Validate special processes per ISO 13485 Clause 7.5.6.216217### Workflow: Process Validation Protocol2182191. Identify processes requiring validation:220 - Output cannot be verified by inspection221 - Deficiencies appear only in use222 - Sterilization, welding, sealing, software2232. Form validation team with subject matter experts2243. Write validation protocol including:225 - Process description and parameters226 - Equipment and materials227 - Acceptance criteria228 - Statistical approach2294. Execute Installation Qualification (IQ):230 - Verify equipment installed correctly231 - Document equipment specifications2325. Execute Operational Qualification (OQ):233 - Test parameter ranges234 - Verify process control2356. Execute Performance Qualification (PQ):236 - Run production conditions237 - Verify output meets requirements2387. Write validation report with conclusions2398. **Validation:** IQ/OQ/PQ complete; acceptance criteria met; validation report approved240241### Validation Documentation Requirements242243| Phase | Content | Evidence |244|-------|---------|----------|245| Protocol | Objectives, methods, criteria | Approved protocol |246| IQ | Equipment verification | Installation records |247| OQ | Parameter verification | Test results |248| PQ | Performance verification | Production data |249| Report | Summary, conclusions | Approval signatures |250251### Revalidation Triggers252253| Trigger | Action Required |254|---------|-----------------|255| Equipment change | Assess impact, revalidate affected phases |256| Parameter change | OQ and PQ minimum |257| Material change | Assess impact, PQ minimum |258| Process failure | Full revalidation |259| Periodic | Per validation schedule (typically 3 years) |260261### Special Process Examples262263| Process | Validation Standard | Critical Parameters |264|---------|--------------------|--------------------|265| EO Sterilization | ISO 11135 | Temperature, humidity, EO concentration, time |266| Steam Sterilization | ISO 17665 | Temperature, pressure, time |267| Radiation Sterilization | ISO 11137 | Dose, dose uniformity |268| Sealing | Internal | Temperature, pressure, dwell time |269| Welding | ISO 11607 | Heat, pressure, speed |270271---272273## Supplier Qualification Workflow274275Evaluate and approve suppliers per ISO 13485 Clause 7.4.276277### Workflow: New Supplier Qualification2782791. Identify supplier category:280 - Category A: Critical (affects safety/performance)281 - Category B: Major (affects quality)282 - Category C: Minor (indirect impact)2832. Request supplier information:284 - Quality certifications285 - Product specifications286 - Quality history2873. Evaluate supplier based on:288 - Quality system (ISO certification)289 - Technical capability290 - Quality history291 - Financial stability2924. For Category A suppliers:293 - Conduct on-site audit294 - Require quality agreement2955. Calculate qualification score2966. Make approval decision:297 - >80: Approved298 - 60-80: Conditional approval299 - <60: Not approved3007. Add to Approved Supplier List3018. **Validation:** Evaluation criteria scored; qualification records complete; supplier categorized302303### Supplier Evaluation Criteria304305| Criterion | Weight | Scoring |306|-----------|--------|---------|307| Quality System | 30% | ISO 13485=30, ISO 9001=20, Documented=10, None=0 |308| Quality History | 25% | Reject rate: <1%=25, 1-3%=15, >3%=0 |309| Delivery | 20% | On-time: >95%=20, 90-95%=10, <90%=0 |310| Technical Capability | 15% | Exceeds=15, Meets=10, Marginal=5 |311| Financial Stability | 10% | Strong=10, Adequate=5, Questionable=0 |312313### Supplier Category Requirements314315| Category | Qualification | Monitoring | Agreement |316|----------|---------------|------------|-----------|317| A - Critical | On-site audit | Annual review | Quality agreement |318| B - Major | Questionnaire | Semi-annual review | Quality requirements |319| C - Minor | Assessment | Issue-based | Standard terms |320321### Supplier Performance Metrics322323| Metric | Target | Calculation |324|--------|--------|-------------|325| Accept Rate | >98% | (Accepted lots / Total lots) × 100 |326| On-Time Delivery | >95% | (On-time / Total orders) × 100 |327| Response Time | <5 days | Average days to resolve issues |328| Documentation | 100% | (Complete CoCs / Required CoCs) × 100 |329330---331332## QMS Process Reference333334### ISO 13485 Clause Structure335336| Clause | Title | Key Requirements |337|--------|-------|-----------------|338| 4.1 | General Requirements | Process identification, interaction, outsourcing |339| 4.2 | Documentation | Quality Manual, procedures, records |340| 5.1-5.5 | Management Responsibility | Commitment, policy, objectives, organization |341| 5.6 | Management Review | Inputs, outputs, records |342| 6.1-6.4 | Resource Management | Personnel, infrastructure, environment |343| 7.1 | Product Realization Planning | Quality plan, risk management |344| 7.2 | Customer Requirements | Determination, review, communication |345| 7.3 | Design and Development | Planning, inputs, outputs, review, V&V, transfer, changes |346| 7.4 | Purchasing | Supplier control, purchasing info, verification |347| 7.5 | Production | Control, cleanliness, validation, identification, traceability |348| 7.6 | Monitoring Equipment | Calibration, control |349| 8.1 | Measurement Planning | Monitoring and analysis planning |350| 8.2 | Monitoring | Feedback, complaints, reporting, audits, process, product |351| 8.3 | Nonconforming Product | Control, disposition |352| 8.4 | Data Analysis | Trend analysis |353| 8.5 | Improvement | CAPA |354355### Management Review Required Inputs (Clause 5.6.2)356357| Input | Source | Prepared By |358|-------|--------|-------------|359| Audit results | Internal and external audits | QA Manager |360| Customer feedback | Complaints, surveys | Customer Quality |361| Process performance | Process metrics | Process Owners |362| Product conformity | Inspection data, NCs | QC Manager |363| CAPA status | CAPA system | CAPA Officer |364| Previous actions | Prior review records | QMR |365| Changes affecting QMS | Regulatory, organizational | RA Manager |366| Recommendations | All sources | All Managers |367368### Record Retention Requirements369370| Record Type | Minimum Retention | Regulatory Basis |371|-------------|-------------------|------------------|372| Device Master Record | Life of device + 2 years | 21 CFR 820.181 |373| Device History Record | Life of device + 2 years | 21 CFR 820.184 |374| Design History File | Life of device + 2 years | 21 CFR 820.30 |375| Complaint Records | Life of device + 2 years | 21 CFR 820.198 |376| Training Records | Employment + 3 years | Best practice |377| Audit Records | 7 years | Best practice |378| CAPA Records | 7 years | Best practice |379| Calibration Records | Equipment life + 2 years | Best practice |380381---382383## Decision Frameworks384385### Exclusion Justification (Clause 4.2.2)386387| Clause | Permissible Exclusion | Justification Required |388|--------|----------------------|------------------------|389| 6.4.2 | Contamination control | Product not affected by contamination |390| 7.3 | Design and development | Organization does not design products |391| 7.5.2 | Product cleanliness | No cleanliness requirements |392| 7.5.3 | Installation | No installation activities |393| 7.5.4 | Servicing | No servicing activities |394| 7.5.5 | Sterile products | No sterile products |395396### Nonconformity Disposition Decision Tree397398```399Nonconforming Product Identified400 │401 ▼402 Can it be reworked?403 │404 Yes──┴──No405 │ │406 ▼ ▼407 Is rework Can it be used408 procedure as is?409 available? │410 │ Yes──┴──No411 Yes─┴─No │ │412 │ │ ▼ ▼413 ▼ ▼ Concession Scrap or414 Rework Create approval return to415 per SOP rework needed? supplier416 procedure │417 Yes─┴─No418 │ │419 ▼ ▼420 Customer Use as is421 approval with MRB422 approval423```424425### CAPA Initiation Criteria426427| Source | Automatic CAPA | Evaluate for CAPA |428|--------|----------------|-------------------|429| Customer complaint | Safety-related | All others |430| External audit | Major NC | Minor NC |431| Internal audit | Major NC | Repeat minor NC |432| Product NC | Field failure | Trend exceeds threshold |433| Process deviation | Safety impact | Repeated deviations |434435---436437## Tools and References438439### Scripts440441| Tool | Purpose | Usage |442|------|---------|-------|443| [qms_audit_checklist.py](scripts/qms_audit_checklist.py) | Generate audit checklists by clause or process | `python qms_audit_checklist.py --help` |444445**Audit Checklist Generator Features:**446- Generate clause-specific checklists (e.g., `--clause 7.3`)447- Generate process-based checklists (e.g., `--process design-control`)448- Full system audit checklist (`--audit-type system`)449- Text or JSON output formats450- Interactive mode for guided selection451452### References453454| Document | Content |455|----------|---------|456| [iso13485-clause-requirements.md](references/iso13485-clause-requirements.md) | Detailed requirements for each ISO 13485:2016 clause with audit questions |457| [qms-process-templates.md](references/qms-process-templates.md) | Ready-to-use templates for document control, audit, CAPA, supplier, training |458459### Quick Reference: Mandatory Documented Procedures460461| Procedure | Clause | Key Elements |462|-----------|--------|--------------|463| Document Control | 4.2.3 | Approval, distribution, obsolete control |464| Record Control | 4.2.4 | Identification, retention, disposal |465| Internal Audit | 8.2.4 | Program, auditor qualification, reporting |466| NC Product Control | 8.3 | Identification, segregation, disposition |467| Corrective Action | 8.5.2 | Root cause, implementation, verification |468| Preventive Action | 8.5.3 | Risk identification, implementation |469470---471472## Related Skills473474| Skill | Integration Point |475|-------|-------------------|476| [quality-manager-qmr](../quality-manager-qmr/) | Management review, quality policy |477| [capa-officer](../capa-officer/) | CAPA system management |478| [qms-audit-expert](../qms-audit-expert/) | Advanced audit techniques |479| [quality-documentation-manager](../quality-documentation-manager/) | DHF, DMR, DHR management |480| [risk-management-specialist](../risk-management-specialist/) | ISO 14971 integration |481482---483> Converted and distributed by [TomeVault](https://tomevault.io/claim/demerzels-lab) — claim your Tome and manage your conversions.484<!-- tomevault:4.0:skill_md:2026-04-13 -->