Trusting ISO 13485 Certification of a Supplier... A Sad Story

gramaley said:

International Accreditation requires full use of the ISO 17011 by Accreditation Bodies that apply the IAF Mandatory Documents for operating Accreditation activities (accrediting testing labs to ISO 17025, accrediting CABs to ISO 17021 and accrediting organizations that certify personnel ISO 17024). Now that the IAF is adding special ?subscopes? for Medical Device QMS ISO 13485, Food Safety QMS ISO 22000 and Information Security ISO 27001, IAF has added special IAF Mandatory Documents (e.g. IAF MD8, MD9) etc to detail the additional requirements for ABs and CABs to support these certifications.

Click to expand...

I think it is commendable for the Medical Device Industry to attempt innovative approaches in increasing confidence of the suppliers in it's chain web while not exaggerating the burden of oversight applied to vendors.

It is important, however, to realize the limitations of the accreditation layer. From time to time, I read the pointed words from one of the biggest insiders in the accredited certification sector, Mr. Simon Feary, who stated, several years ago:

Simon Feary said:

Free markets, an over-abundance of providers and the voluntary nature of certification have allowed short-term commercial interests to exploit opportunities offered by naive markets and complicit or disinterested governments. But put another way, simply and bluntly, accreditation has failed to do its job adequately and the certification product has leaked credibility.​

Click to expand...

A few highly regulated sectors have created augmented accreditation programs or abandoned the accreditation layer, after attempting it for a while, namely:

1. The Automotive Industry, which, after attempting an expanded accreditation program with QS-9000, dropped the involvement of AB's and perform oversight of CB's directly via the IATF for the ISO/TS-16949 certification program

2. The Aviation, Space & Defense Industry rely on an augmented accreditation program to control the CB's involved with the IAQG ICOP Scheme. The Industry oversight has been responsible for the suspension and/or withdrawal of many CB's from the program, since 2004.

3. The Telecommunications Industry via the TL-9000 Accreditation Program.

So, it is important to remember that, while the Industry Specific IAF Mandatory Documents are a good way to identify the loopholes to be avoided, only RELIABLE oversight can ensure these loopholes are not being exercised.

It is also important to remember that, in the same way an ISO 13485 certificate is not a guarantee of supplier performance, an accreditation to ISO 17021 is no guarantee that a CB will follow the rules all of the time. Anyone who's been in this business for more than a decade knows very well that some (fully accredited) CB's still subtly offer paths of low resistance to certification.

gramaley said:

MDSAP, like the IAF program, will remain voluntary worldwide, because they are expensive. Regulators that make them mandatory may find a terrible loss of access to medical devices, much the same way Canada has suffered under CMDCAS (as many smaller companies bailed on Canada). That is why they have 3000 firms registered compared to 32,000 US firms.

Click to expand...

My feelings of CMDCAS aside, I'd be hesitant to draw any conclusion about CMDCAS from these figures.

Afterall, the US does have 10-times the population of Canada.
...so on a per capita basis, the number of firms is not too different...

Canada has the same population and economic GDP as Italy. Italy has the CE mark, and therefore access to all medical device manufacturers that have sought a CE mark. It is not the size of the country that determines the number of manufacturers that provide products to that country (with the exception of the USA ), but the openness of the economy to overseas manufacturers seeking to sell there.

In his regard, Saudi Arabia, Australia, and many other countries allow for accepting a wider range of approaches to demonstrating safety and effectiveness. They need medical devices, badly (like all nations), and because smaller nations are seriously handicapped in one significant way (they do not have the ability to make all the devices they need), 98% to 99% of devices are imported from overseas (Australia and smaller size economies), so they must aggressively look at sensible, broadly used programs to regulate medical devices.

Thank you for this detailed history Sidney; I was questioned somewhat severely by someone at an IAF meeting in Rio, after some organization had a problem with a medical device, and the company was ISO 13485 certified. As you point out, and as we all know, Quality Managements Systems are an important part of product quality, but they cannot be fully relied on, alone, to address all aspects of medical device safety and effectiveness.

I was talking with a former FDA official last week about the FDA "Certificate to Foreign Government" (CTFG)and how they state:

"The manufacturing plan(s) in which the product(s) s produced is subject to periodic inspections. The last such inspection showed that the plant(s), at that time, appeared to be in substantial compliance with current good manufacturing practice requirements for the product(s) listed above".

I explained that the (CTFGs) have been viewed as FDA Quality System Certificates, because the GMP referred to infers that the FDA Quality System was operating "substantially in compliance" at the time of the inspection.

The CABs, like FDA, really cannot be there every day, and anything can happen after they leave, which could throw a wrench in the system, but a good QMS will catch problems that will inevitably arise and resolve them through a good feedback and CAPA system. I usually tell people, at the very least, I like to know a company has a QMS, so I can talk about CAPA with them, if something goes bad, and we can dig down to the root cause. Quality Managers know CAPA well. Production managers, sales and even engineers, do not always go far enough.

It has been my experience with FDA, they are very focused on the "attitude" of the Quality Department and Management toward the common goal of providing safe products, and reporting problems quickly. "Attitude" energizes reactions when problems occurs, and so bad attitudes will certainly present a serious concern to FDA. Genuinely good attitudes realize we are on the same team.


So feel it is wrong to characterize the CABs and Accreditation system as a failure, because it cannot succeed 100% of the time from eliminating problems occurring in the market. FDA doesn't claim their own inspections should be trusted so much. What we do know, is that proper vigilance from within and from outside CABs, and up the entire accreditation chain, is ideal.

I have mentioned in this or other posts, how shocked I was to hear so many reports from the field, after the IAF program went into effect Fall 2012, of the other regulatory audits from CABs and Canadian CMDCAS being improved. We had no intention on affecting these other regulatory audits. It happened because CE and CMDCAS auditors were required to meet the IAF requirements during the very same combined audits.

Before the IAF program went into effect, the softer (vague competency “requirements” for CE and CMDCAS CABs) created a wider range of variability in the competency of the audit teams. I learned that some CMDCAS and CE audits had to be entirely re-planned after fall 2012, since the audit teams for CMDCAS and CE didn’t have competent enough auditors to meet the newer, and more specific requirements of IAF MD9.

The requirements were not meant to be more difficult, but they eliminated use of auditors that lacked sufficient ISO 13485 auditor competency and experience, which most would have expected to exist under ISO 13485 CMDCAS and CE (Annex II and Annex V) type audits. This was not necessarily a widespread problem, but it did happen.

It happened this way; Since the Accreditation Assessors were going to be checking on these new IAF competency requirements, ANNUALLY, the CABs, wanting to maintain their international accreditation, had to adapt to the IAF requirements quickly for their upcoming combined audits, or risk losing their international accreditation for ISO 13485.

The new IAF Accreditation requirements were designed to be effective conformity assessment tools, with improved clarity of the specified requirements. The more loosely stated competency requirements that had been enforced by Notifying Authorities couldn't be used to excuse CABs from such variability as existed in their competency requirements, which I noted in their "designated authority handbook"; You cannot assess things that are not specific enough to assess. You cannot have "soft" requirements, and then expect to issue nonconformities. I have seen these things appearing now in MDSAP requirements for competency of Regulator assessors, and this creates inconsistency among those that use "soft requirements". It is also what has been identified as creating the variability among regulators performing notification activities in Europe. In fact the German regulators in 2008 propose the regulators consider using IAF created standard ISO 17021, to help align the "Notification" activities. But what about the ISO 17011 requirements for the Notifying Authorities themselves???

So we merely interpreted the intents, based on standard practices of 4 major notified bodies, who also provided ISO and CMDCAS audits. I would compare this to tightening a tolerance by providing a tolerance level. Yes, tolerance does provide variability, but we understand that risks of devices are afforded tolerances as well, even in the regulated QMS (e.g. Design Controls are exempt for lower risk devices for FDA, Health Canada and EU Directives).

What we have now, are more specific requirements for ABs and CABs, that are being enforced through IAF assessments of ABs and their regional group members, improved AB assessments of CABs, which are inculcated into the entire chain ANNUAL assessments and additional assessments when changes to a new Main Technical Area Scope (per IAF MD9 Annex A), so that our ISO 13485 audits are more consistent, across the globe.

As these improved assessments are also frequent (6 to 27 times as frequent as the FDA inspections performed overseas if you belief the 2008 GAO report data is still relevant) this certainly increases the number of audits that show “substantial compliance to the ISO 13485 QMS standard. Is it perfect? Is anything?

Would we dare say we can eliminate crime by having enough police officers? Would we argue that when a murder, rape, or theft occurs, law enforcement has failed us? Keep in mind, the US FDA is indeed a law enforcement agency, and they conduct many “for cause” inspections when things go bad. Had they been in the factory every other year, as mandated by Congress; would we have a whole lot less “for cause” FDA inspections? Are we willing to pay for 5X more FDA investigators and their international travel, hiring of local interpreters, etc? Do we need to suddenly move toward that opposite extreme? Most medical devices really couldn’t cause a safety risk (serious injury or death). Many are safer than the tools you buy at home depot, but certainly provide for billions of meaningful treatments.

MDSAP, like the IAF program, will remain voluntary worldwide, because they are expensive. Regulators that make them mandatory may find a terrible loss of access to medical devices (...)

Click to expand...

In a couple of conversations with Kim Trautman regarding my employer's upcoming participation in MDSAP, I gathered that MDSAP is intended by FDA, or at least the pro-harmonization faction in FDA and among certain Congressional staffers, to be mandatory at FDA. That is, MDSAP would entirely replace FDA's QSIT 1 and 2 inspections, and FDA's own inspectors would do only problem followup, For Cause, PMA and special inspections.

Of course, perhaps I misunderstood.

In any case, I doubt if USA would lose access to very many medical devices of consequence by imposing a quality system requirement that would cost a few thousand dollars a year more than now. The USA market is far too economically important to most substantial medical device companies.

Surely that would have to be the direction FDA would need to push the Cures Act. I can't imagine them making another failed 3rd party program.

I have to add, however belatedly:

Hopefully some posters here have learned in the intervening 8 years that risk management is the alternative to trust. Once you understand the difference, you must pick one and remain doggedly faithful to it, or slowly drown in the perpetual confusion and disappointment that invariably results when you try to mix the two. If you pick trust, I and patients everywhere would be forever grateful if you would not practice it in industries that make products used in healthcare.

As for any and all claims regarding what any regulatory agency wants or doesn't want, is going to do or not do, these are just rumors (aka, "unsubstantiated claims"). As far as I can tell, a lot of them are hopeful rumors, often with an air of "if we say it enough times, maybe it will become true." (One of my all-time favorite comments..having nothing to do with ISO 13485 or MDSAP...on any forum, anywhere, any time: "And what evidence do we have to support this, other than a lot of people saying it over and over again on the internet?")

Regulatory agencies, in particular, are political entities, and their senior-level staff are politicians. You should give what they say as much weight as you would anything said by any politician or political organization. Not only that, but...well, I don't know what to say to people who think that what the executive management of any organization tells its employees is the truth, the whole truth, and nothing but. It is what executive management thinks its employees need to hear in order to do their jobs the way executive management wants them to do them, including what executive management wants them to tell people outside the organization. What you hear from other biased parties, such as parties whose income is tied to ISO 13485 and MDSAP and their adoption by agencies and companies, should be given much the same weight.

This is such an enlightening thread that made me wonder if anyone has some recent updates on the subject of the Medical Device Industry reliance on ISO 13485 certification.