QMS Processes and the Quality Manager Role
ISO 13485 is the international quality management system standard for medical devices. A quality management system describes how an organization consistently meets the requirements that apply to its products, its customers, and its regulated activities. It brings together responsibilities, working methods, resources, and evidence.
In this lesson, we will follow how work moves through that system. Watch for four things: the handoffs between people, the difference between coordinating work and approving a decision, the evidence that a process works, and the responsibilities that remain with the manufacturer when work is outsourced.
A system of connected work
A useful process description answers practical questions. What starts the work? What information is needed? Who is responsible? What controls apply? What result should the process produce, and who uses that result next?
Consider a simple purchasing example. Purchasing sends an approved specification to a supplier. The supplier provides the material. Receiving checks the delivery against the specification, and production uses accepted material.
These activities form a connected process. The documents support the work, but the process also includes the people, decisions, and handoffs that make the work happen.
Handoffs carry the information
Now imagine that purchasing sends revision B of a specification to the supplier, while receiving uses revision C. Both teams may be following the document in front of them, yet they are working from inconsistent information.
The concern is the handoff between the processes. The organization needs a consistent basis for the purchased material and its acceptance. A mistake at one handoff can affect the next activity, even when each individual document looks complete.
When reviewing a process, follow the information across those boundaries. Ask whether the next person receives what they need to do the work correctly.
Control according to risk
Choose process controls by considering the risks to device safety, performance, and regulatory compliance. Ask what could happen if a step fails, and whether the proposed control addresses that consequence.
A missing approval on a safety-related specification deserves more attention than a cosmetic inconsistency in an administrative note. The controls should reflect the work and its risks, and the organization should check whether those controls work.
The practical guide discusses simple questioning as well as more structured analysis. Every process does not need the same elaborate worksheet. A small company can use concise instructions when they reliably communicate the necessary work and cover the applicable requirements and evidence. Brevity is useful when the instructions remain clear and sufficient.
The Quality Manager’s contribution
The Quality Manager helps maintain the process map, identifies gaps, coordinates records, and follows up actions. Those contributions help the organization see how the system is working.
Each activity still needs a clear owner and an appropriately authorized decision-maker. Coordinating a design review does not automatically qualify someone to approve its engineering conclusions. Technical approval needs the competence and authority appropriate to that decision.
In a small company, one person may hold several roles. The organization still needs to address the responsibilities, competence, and any needed independence. The practical question is who is responsible for the activity, and who is qualified and authorized to make the decision.
Evidence that the process works
For each process, identify what successful performance looks like and what record demonstrates it. A signed receiving record may show that an acceptance check was performed. The recorded acceptance results provide evidence about that particular delivery.
Looking across deliveries can reveal a different issue. Recurring supplier failures may show that the wider purchasing process needs attention, even when the receiving checks are being completed.
Useful evidence therefore supports both the individual decision and an assessment of how the process performs over time. Maintaining the records and following up recurring issues help the organization understand whether its controls are effective.
Changes affect connected work
Before changing a process, consider its effects on connected activities and on the devices produced.
For example, a new inspection workflow can affect training, the equipment used, acceptance records, and release decisions. Only one procedure may appear to change, but several parts of the working system may need attention.
Use the process connections to identify those effects. Consider what people will need to know, what resources they will use, and what evidence will support the resulting decisions.
External providers: responsibility remains
Outsourcing work does not transfer the organization’s responsibility for conformity. Define responsibilities in a written quality agreement and maintain controls appropriate to the work and its risk.
For example, a contract tester may perform a test. The manufacturer still confirms the agreed method, reviews the resulting evidence, and controls the product decision.
The agreement helps clarify who does what. The organization also needs to carry out its own responsibilities and maintain the controls that make the outsourced activity fit into the wider quality management system.
Software must suit its intended use
Software that supports quality management activities also needs attention. Evaluate its intended use and risk, with validation before initial use and after relevant changes as appropriate.
A familiar spreadsheet application does not by itself prove that a particular acceptance calculation works correctly. The question is whether the configured tool performs its intended task reliably enough for that use, with validation proportionate to the risk.
Apply the same connected-process thinking: consider the information the software receives, the result it produces, and the decision that depends on that result.
What to take into your work
As you review a quality management system, follow the work from one process to the next. Look for clear responsibilities, competent and authorized decisions, and evidence that the controls work. Consider risk when choosing controls, and examine connected activities when making changes.
These examples explain the lesson concepts. They are not company procedures or authorization to make independent quality decisions. The lesson draws on the AAMI and ISO practical guide to ISO 13485, sections four point one point one through four point one point six, and Annex A. The handbook provides guidance; applicable requirements and the organization’s approved procedures govern actual work.
SOURCE CREDIT AAMI/ISO 13485:2016 — Medical Devices: A Practical Guide (ISO 2017), §§4.1.1–4.1.6 and Annex A; purchased through ANSI. This video presents original educational explanations informed by the guide. It is not an official AAMI, ISO, ANSI, or FDA course. Applicable requirements and company procedures govern actual work.