GD210: ISO 13485:2003 Quality Management System Audits Performed by Health Canada Recognized Registrars

February 8, 2007

Notice

Our File Number: 07-103218-349

Re: GD210: ISO 13485:2003 Quality Management System Audits Performed by Health Canada Recognized Registrars

Health Canada is pleased to announce the release of the revised guidance document GD210: ISO 13485:2003 Quality Management System Audits Performed by Health Canada Recognized Registrars. This guidance document supersedes the December 16, 2002 version of the same document.

GD210 provides guidance to registrars recognized by Health Canada on how to perform ISO 13485:2003 quality management system (QMS) audits under the Canadian Medical Devices Conformity Assessment System (CMDCAS). This guidance document has been revised to reflect CAN/CSA-ISO 13485:03, Medical devices - Quality management systems - Requirements for regulatory purposes, and other new international standards. Specifically, the most significant changes that have been made to the document:

• References to ISO 13485:2003 have been added and references to 13485:1996/8 have been removed.
• Under the document's Purpose, a paragraph has been added to describe how medical device manufacturers can use the document.
• The text, "Control over Audits performed by CMDCAS recognized registrars" has been removed.
• The terms "Exclusion" & "Non-applicability" have been reinforced.
• An explanation has been added as to how an applicable Medical Devices Regulations (MDR) requirement can be incorporated into the quality management system (QMS) documentation.
• The distinction between an inspection and a QMS audit has been explained.
• The information to gather prior to an on-site audit has been listed.
• The role of the Regulatory Correspondent has been explained.
• The need for the manufacturer to inform the registrar of QMS changes has been reiterated.
• Licence Amendment and Obligation to Inform have been reinforced.
• The auditing of virtual manufacturers and regulatory correspondents has been clarified.
• Annex A has been revised to show linkages between MDR and ISO 13485:2003.
• The table in Annex B describes which section of the MDR is applicable to what party.
• A new Annex lists MDR amendments.

Please direct any questions or comments regarding the content of this guidance document to the following:

Quality Systems Section
Medical Devices Bureau
150 Tunney's Pasture Driveway
Main Statistics Canada Building, Room 1605
Address Locator: 0301H1
Ottawa, Ontario K1A 0K9

Phone: (613) 948-4370
Fax: (613) 946-6758
E-mail: ISO13485_CMDCAS_SCECIM@hc-sc.gc.ca

Guidance Document

GD210: ISO 13485:2003 Quality Management System Audits Performed by Health Canada Recognized Registrars

Date Adopted 2002/12/16
Effective Date 2007/01/31

Foreword

Guidance documents are meant to provide assistance to industry and health care professionals on how to comply with governing statutes and regulations. Guidance documents also provide assistance to staff on how Health Canada mandates and objectives should be implemented in a manner that is fair, consistent and effective.

Guidance documents are administrative instruments not having force of law and, as such, allow for flexibility in approach. Alternate approaches to the principles and practices described in this document may be acceptable provided they are supported by adequate justification. Alternate approaches should be discussed in advance with the relevant program area to avoid the possible finding that applicable statutory or regulatory requirements have not been met.

As a corollary to the above, it is equally important to note that Health Canada reserves the right to request information or material, or define conditions not specifically described in this document, in order to allow the Department to adequately assess the safety, efficacy or quality of a therapeutic product. Health Canada is committed to ensuring that such requests are justifiable and that decisions are clearly documented.

This document should be read in conjunction with the accompanying notice and the relevant sections of other applicable guidance documents.

Document Number: GD210/Rev0-MDB

Replaces: GD210/RevDR-MDB

File name: cmdcas_scecim _audit13485_2 _e.wpd

Replaces: cmdcas_scecim _audit13485 _e.wpd

Version: 0

Replaces: Draft

Date: 2007-01-31

Date: 2002-12-16

Table of Contents

• 1.0 Introduction
  • 1.1 Purpose
  • 1.2 Scope
  • 1.3 Supporting Documents
  • 1.4 Background
    • 1.4.1 Quality Management System Standards
    • 1.4.2 Exclusion and non-applicability of clauses from ISO 13485:2003
    • 1.4.3 Importers and Distributors
  • 1.5 Definitions
• 2.0 ISO 13485 Audit Process
  • 2.1 General
    • 2.1.1 Inclusion of regulatory requirements in management system documents
    • 2.1.2 Compliance inspection versus conformity audit
  • 2.2 Audit Preparation
    • 2.2.1 General
    • 2.2.2 Essential information about a Manufacturer
    • 2.2.3 Regulatory Correspondent
    • 2.2.4 Changes to a Manufacturer's Quality Management System
    • 2.2.5 Changes to a medical device or Manufacturer as described in Section 34 and 43 of the Medical Devices Regulations
  • 2.3 Performing the Audit
    • 2.3.1 Opening Meeting
    • 2.3.2 Collecting Information
      • 2.3.2.1 Audit time
      • 2.3.2.2 Sampling for objective evidence
      • 2.3.2.3 Multi-site organizations
      • 2.3.2.4 Auditing of suppliers or outsourced processes
      • 2.3.3 Nonconformities
      • 2.3.3.1 Major nonconformity
      • 2.3.3.2 Minor nonconformity
      • 2.3.3.3 Closure of nonconformites
  • 2.4 Audit Reports
• 3.0 Requirements Tables
• Annex A - Links Between ISO 13485:2003 and Medicial Devices Regulations
• Annex B - MDR Requirements and Applicability to Manufacturers of Class II, III and IV Medical Devices, Importers and Distributors
• Annex C - Multi-Site Medical Device Manufacturers
• Annex D - Guidance on Potential Audit Situations
• Annex E - Date of Initial Promulgation of Medical Devices Regulations and Amendments
• Annex F - Acronyms

1.0 Introduction

1.1 Purpose

The purpose of this document is to provide registrars that have been recognized by Health Canada under section 32.1 of the Medical Devices Regulations (MDR) guidance on how to perform ISO 13485:2003 quality management system (QMS) audits under the Canadian Medical Devices Conformity Assessment System (CMDCAS).

While CMDCAS does not place any direct requirements on medical device Manufacturers, nonetheless they may refer to this guidance to: a) understand the links between the MDR and ISO 13485:2003 and thus gain an understanding of how to incorporate the former into their documented QMS; and b) learn what can be expected in an audit performed by a Health Canada Recognized Registrar.

1.2 Scope

The scope of this guidance document is limited to ISO 13485:2003 QMS audits of medical device Manufacturers that sell, or intend to sell a Class II, III or IV medical device in Canada. These audits are performed by registrars that have been recognized by Health Canada through CMDCAS or some other recognition process developed by Health Canada.

Organizations that design, manufacture and sell only Class I medical devices in Canada are not permitted to be audited or registered under the CMDCAS program. However, Manufacturers of Class I devices that also design, manufacture and sell Class II, III or IV devices in Canada are eligible for registration under CMDCAS and may voluntarily include the Class I device and other medical devices not sold in Canada in the audit process and include them in their QMS certificate scope of registration.

1.3 Supporting Documents

This guidance document contains undated references. In these cases, the following documents apply:

Medical Devices Regulations SOR/98-282 (Promulgated 1998. Latest consolidated version.)

ISO 13485:2003 (ISO 13485-03-CAN/CSA) Medical Devices -- Quality management systems -- Requirements for regulatory purposes

ISO/TR 14969:2004 Medical devices -- Quality management systems -- Guidance on the application of ISO 13485:2003

ISO 19011:2002 - Guidelines for quality and/or environmental management systems auditing

CAN-P-10B (ISO/IEC Guide 62:1996) - Criteria for Accreditation of Organizations Registering Quality Systems

IAF GD2:2005 IAF Guidance on the Application of ISO/IEC Guide 62:1996, General Requirements for Bodies Operating Assessment and Certification/registration of Quality Systems, Issue 4

GHTF/SG4/N28: Guidelines for Regulatory Auditing of Quality Systems of Medical Device Manufacturers - General Requirements : 1999 Final Document

ISO 9000:2005 - Quality management systems - Fundamentals and vocabulary

ISO 14971:2000/Amd 1:2003 - Medical devices - Application of risk management to medical devices

1.4 Background

1.4.1 Quality Management System Standards

The MDR require Class II medical devices to be manufactured under CAN/CSA-ISO 13485:03 and Class III and IV devices to be designed and manufactured under CAN/CSA-ISO 13485:03. There are no regulatory QMS requirements for Class I medical devices.

1.4.2 Exclusion and non-applicability of clauses from ISO 13485:2003

Clause 1.2 - Application of ISO 13485:2003 permits Manufacturers of Class II medical devices to exclude clause 7.3 - Design and development from the QMS, with justification(s). ISO 13485:2003 recognizes that some requirements in Clause 7 may be "not applicable" due to the nature of the medical device. For example, when a medical device does not require installation or post-market servicing by the Manufacturer (clauses 7.5.1.2.2 and 7.5.1.2.3 respectively) then these clauses are to be omitted from the Manufacturer's quality manual but supported with details of the justification.

In cases where a process (for example [e.g.], designing, manufacturing, sterilizing, assembling, processing, labelling, packaging, refurbishing or modifying the device, or for assigning to it a purpose, etc.) is applicable to the medical device but the Manufacturer has outsourced it to another organization, the MDR and ISO 13485:2003 state that the Manufacturer is nonetheless responsible for the process. Clause 4.1- General requirements, of ISO 13485:2003 requires that the Manufacturer ensures control over all outsourced processes and the control shall be identified within the Manufacturer's QMS.

1.4.3 Importers and Distributors

The MDR do not require importers or distributors of medical devices to have a registered QMS. However, any importer or distributor of a Class II, III or IV medical device that chooses to become the legal Manufacturer of the medical device by labelling and selling it with their own name, or under a trade-mark, design, trade name or other name or mark owned or controlled by them (see section 1.5 below for the definition of Manufacturer) shall comply with the applicable QMS requirement plus any other applicable requirements of the MDR.

1.5 Definitions

Audit:
Systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled (ISO 19011:2002 and ISO 9000:2005).

Audit Conclusion:
Outcome of an audit provided by the audit team after consideration of the audit objectives and all audit findings. (ISO 19011:2002 and ISO 9000:2005)

Audit Criteria:
Set of policies, procedures or requirements (ISO 19011:2002 and ISO 9000:2005). Health Canada recognized registrars will use "ISO 13485:2003 under CMDCAS" as the audit criteria.

Audit Objectives
The audit objectives define what is to be accomplished by the audit... (ISO 19011:2002) See 2.3.1 and 2.4 below.

Audit Plan:
Description of the activities and arrangements of an audit. (ISO 19011:2002 and ISO 9000:2005)

Audit Scope:
Extent and boundaries of an audit. (ISO 19011:2002 and ISO 9000:2005) The audit scope generally includes a description of the physical locations, organizational units, activities and processes, as well as the time period covered (ISO 19011:2002). NB: not to be confused with the scope of registration.

Competence:
(Audit) Demonstrated personal attributes and demonstrated ability to apply knowledge and skills. (ISO 19011:2002 and ISO 9000:2005)

Compliance
The state of conformity of a regulated party (including a corporation, institution, individual or other legal entity) or a product with a legislative or regulatory requirement or a recognized standard. (Health Products and Food Branch Inspectorate, Guidance on the Medical Device Inspection Programme, February 6, 2004)

Conformity:
Fulfilment of a requirement (ISO 9000:2005)

Correction:
Action to eliminate a detected nonconformity.

Distributor:
Means any person, partnership, corporation, association, or other legal relationship which stands between the Manufacturer and the retail seller in purchases, consignments, or contracts for sale of consumer goods.

Health Canada Recognized Registrar:
A registrar recognized by Health Canada per section 32.1 of the MDR. "The Minister shall recognize a person as a registrar for the purpose of issuing quality system certificates if the person (a) has sufficient training, experience and technical knowledge in the design and manufacture of medical devices and in the effective implementation of quality systems to determine whether a quality system satisfies a standard referred to in paragraph 32(2)(f), (3)(j) or (4)(p); and (b) conducts quality system audits in accordance with the applicable guidelines and practices established by the International Organization for Standardization." (SOR/2003-173, s. 3.)

Importer:
For the purposes of this document, an importer is a person, other than the Manufacturer of a medical device, who causes the medical device to be brought into Canada for sale.

Manufacturer:
A person who sells a medical device under their own name, or under a trade-mark, design, trade name or other name or mark owned or controlled by the person, and who is responsible for designing, manufacturing, assembling, processing, labelling, packaging, refurbishing or modifying the medical device, or for assigning to it a purpose, whether those tasks are performed by that person or on their behalf. (SOR/98-282, May 1998)

Noncompliance:
A state of nonconformity with a specific requirement of the Act or Regulations. (Health Products and Food Branch Inspectorate, Guidance on the Medical Device Inspection Programme, February 6, 2004)

Nonconformity:
Non-fulfilment of a requirement (ISO 9000:2000)

Person:
Includes a partnership and an association. (SOR/98-282, May 1998)

Quality Management System:
Management system to direct and control an organization with regard to quality. (ISO 9000:2005).

Registrar:
Organization that assesses and registers or certifies the quality management systems of Manufacturers with respect to published standards.

Note 1: CERTIFICATION/REGISTRATION BODY: A third party that assesses and certifies/registers the quality system of suppliers with respect to published quality system standards and any supplementary documentation required under the system. (CAN-P-10B).

Note 2: A registrar may be called certification body (CB), registration body (RB), assessment and registration body, or certification/registration body (CRB).

Note 3: In Europe, QMS assessment and registration can also be performed by Notified Bodies that have been found competent to do so by an accreditation body.

Significant Change:
Means a change that could reasonably be expected to affect the safety or effectiveness of a medical device. It includes a change to any of the following: (a) the manufacturing process, facility or equipment; (b) the manufacturing quality control procedures, including the methods, tests or procedures used to control the quality, purity and sterility of the device or of the materials used in its manufacture; (c) the design of the device, including its performance characteristics, principles of operation and specifications of materials, energy source, software or accessories; and (d) the intended use of the device, including any new or extended use, any addition or deletion of a contra-indication for the device and any change to the period used to establish its expiry date. (SOR/98-282)

Regulatory Correspondent:
A person that is officially authorized by the Manufacturer to be its contact with Health Canada with respect to its licenced device(s). See 2.2.3 below.

Technical expert (Audit)
Person who provides specific knowledge or expertise to the audit team. (ISO 19011:2002 and ISO 9000:2005)

Valid Certificate:
Means a certificate that :

• has been issued by a Registrar that has been recognized by Health Canada under section 32.1 of the Medical Devices Regulations;
• contains the information described in guidance document "GD207/Rev0-MDB Guidance on the content of ISO 13485 and ISO 13488 quality system certificates issued by CMDCAS recognized registrars"; and
• is valid for the period, not exceeding three years, specified in it. (SOR/2003-173, s. 2. May 2003)

2.0 ISO 13485 Audit Process

2.1 General

QMS audits performed by Health Canada Recognized Registrars shall follow the general auditing process described in ISO 19011. Health Canada Recognized Registrars shall use the guidance herewith, amongst other requirements,

• to determine the extent of conformity of a Manufacturer's management system to the requirements of ISO 13485; and
• to confirm that a Manufacturer has documented and effectively implemented all applicable provisions of Part 1of the MDR into their ISO 13485 QMS.

2.1.1 Inclusion of Regulatory Requirements in Management System Documents

A MDR requirement can be included in QMS documents in a number of ways. For example, regulatory text or a summary of the text could be inserted into a procedure, work instruction or some other relevant document. A MDR requirement could be listed in an annex to a general procedure, or the section number of the requirement could simply be referenced. However, if referencing is used, the Manufacturer must have a current electronic or paper version of the MDR available at all times. Vague or unsubstantiated statements of compliance with the MDR are unacceptable as they are not supported by objective evidence.

Paper or electronic versions of the current consolidated version of the MDR, or an initial version of the MDR with attached subsequent amendments, could be used as objective evidence.

Health Canada publishes announcements of future regulatory amendments as well as requests for public comment on draft regulatory amendments

Note 1 : See Annex B for a summary of MDR requirements and their applicability to Manufacturers of Class II, III and IV medical devices, importers, and distributors.

Note 2 : See Annex E for a summary of regulatory amendments from 1998 to 2005.

2.1.2 Compliance inspection versus conformity audit

The conformity audit of a QMS by a Health Canada Recognized Registrar and a compliance inspection performed by a Health Canada inspector are two completely different and independent activities.p

Specific Health Canada personnel have been designated by the Minister of Health to enforce the Food and Drugs Act and the MDR. They have been given specific regulatory powers that are defined in the Food and Drugs Act, Chapter F-27, Part II, sections 22(1), (2) and 23(1) to perform compliance inspections of an organization located in Canada.

Auditors who work for a Health Canada Recognized Registrar do not have any regulatory powers. Specifically a QMS auditor does not :

• determine compliance of a Manufacturer to the requirements of the Food and Drugs Act or the MDR;
• extend the scope of an audit to include the MDR requirements that are not applicable to the Manufacturer of a Class II, III or IV medical device, unless the Manufacturer has indicated otherwise;
• provide advice, consulting services or interpretations of the MDR;
• classify medical devices on behalf of a Manufacturer;
• assess technical or clinical data related to a medical device so as to make a determination of its safety and effectiveness;
• review and interpret any information sent to the Manufacturer by Health Canada for the purpose of regulatory compliance with the MDR;
• act as a Health Canada inspector or perform related duties.

2.2 Audit Preparation

2.2.1 General

When preparing for an audit, a Health Canada Recognized Registrar shall ensure that:

• at least one member of the assigned audit team has passed the Health Canada CMDCAS training course and has been qualified by Health Canada to perform these types of audits. Auditing of large Manufacturers will require one or more Health Canada qualified auditors;
• the competency of the audit team as a whole meets the competency criteria found in clauses 10.2.1 and 10.2.3 of the Global Harmonization Task Force (GHTF) guidance document GHTF/SG4(99)28: "Guidelines for Regulatory Auditing of Quality Systems of Medical Device Manufacturers - General Requirements : 1999 Final Document";
• technical experts who are not qualified as auditors, shall assess just the processes related to their specialized knowledge and shall be under the supervision of an auditor;
• the Audit Plan covers "the Audit Scope, including identification of the organizational and functional units and processes to be audited" (ISO 19011:2002 6.4.1c), particularly the entities that are associated with the design and manufacture of medical devices that are presently sold, or will be sold, in Canada. (See Annex C for possible organizational scenarios that will influence the audit planning process and the collection of evidence);
• the audit team is aware of the type and Class of medical devices the Manufacturer sells or intends to sell in Canada;
• the audit team has been made aware of any changes to a medical device or its manufacturing process or QMS that may affect the safety and effectiveness or licence status of a medical device;
• at least one member of the audit team has a copy of the latest consolidated MDR with them when performing an audit.

2.2.2 Essential Information about a Manufacturer

When preparing for an initial audit (or a registration transfer) of a medical device Manufacturer, the Health Canada Recognized Registrar shall gather "essential information" about the Manufacturer and the medical devices they intend to sell in Canada. This information is provided to and used by the audit team to plan and execute the audit.

The "essential information" to gather or verify includes (where applicable and feasible):

• the name and address of the Manufacturer and related sites and activities performed at each site;
• the name and address of suppliers (subcontractors) and activities performed by them;
• the scope and structure of the QMS to determine if it is corporate or site specific or if it is linked with other QMSs of the same or related companies (e.g., internal supplier arrangement), and the relationship between licensed medical devices and the QMS;
• other country or regional regulatory QMS requirements with which the Manufacturer complies;
• the location of all records specified by the QMS and/or ISO 13485:2003 and the MDR;
• a complete list of current Class II, III or IV medical device licences. Note that a paper record of a medical device licence is issued only once to a Manufacturer. Revised paper copies of medical device licences are provided to the Manufacturer only if the existing medical device licence has been amended (section 34 of the MDR). A current and searchable list of licensed medical devices is maintained on a publically accessible website, Medical Device Active Licence Listing (MDALL), www.mdall.ca. MDALL shall be used to verify what medical devices are currently licensed for sale in Canada.
• a list of medical devices that the Manufacturer intends to sell in Canada;
• the name, location, contractual arrangement and type of activities assigned to a Regulatory Correspondent (see below).

When preparing for a surveillance or reassessment audit the Health Canada Recognized Registrar shall update the "essential information" and communicate it to the audit team. This activity will be performed in advance and will not be carried out on-site of the audit.

2.2.3 Regulatory Correspondent

The MDR do not require foreign Manufacturers to have an "authorized contact" in Canada. However, Canadian and foreign Manufacturers have the option of assigning some activities like regulatory communication and record keeping to a Regulatory Correspondent located in or out of Canada. The Regulatory Correspondent can be a person or an organization such as a Canadian branch office, distributor, importer or representative. Some of the activities that can be assigned to the Regulatory Correspondent include, but are not limited to:

• licence renewal and voluntary withdrawal;
• responses to requests for additional information from Health Canada, including submission of QMS documents and records related to post-market actions (mandatory problem reporting, complaints, recalls);
• maintenance of documentation and records related to the Manufacturer's QMS (including design history file, manufacturing specifications); or
• maintaining records and/or copies of licences (including information submitted to support a licence application or amendment).

2.2.4 Changes to a Manufacturer's Quality Management System

Section 2.1.5.1 of CAN-P-10B requires Registrars to have an arrangement with their clients to be promptly notified of any intended changes to the client's QMS or other changes that may affect conformity with requirements. When a Health Canada Recognized Registrar is made aware of these intended changes, they will, as a minimum, note the change in the Manufacturer's file and determine the need for immediate follow-up. Section 2.1.5.3 c) of CAN-P-10B requires Registrars to have procedures and conduct a reassessment of their client's QMS in the "event of changes significantly affecting the activity and operation of the supplier" (Manufacturer).

2.2.5 Changes to a Medical Device or Manufacturer as Described in Section 34 and 43 of the Medical Devices Regulations

Section 34 of the MDR, Application for a Medical Device Licence Amendment, describes the types of changes that a Manufacturer intends to make to a licenced medical device and the action the Manufacturer must take in order to continue selling the medical device in Canada if the changes were to occur. Note that a Significant Change applies under this Section of the MDR and includes changes to the manufacturing process, facility or equipment, quality control procedures, design, intended use, etc. for Class III and IV devices.

Section 43 of the MDR, Obligation to Inform, describes what the Manufacturer shall do following any changes to the information and documents related to a medical device other than those already covered by section 34.

The Health Canada qualified auditor will collect objective evidence to verify if the Manufacturer has procedures and processes that address sections 34 and 43 of the MDR.

2.3 Performing the Audit

Health Canada Recognized Registrars are expected to provide their auditors with appropriate information and time that will allow them to plan and perform their audits effectively. This information shall include the "essential information" described in section 2.2.2 and perhaps a checklist that is based on the applicable MDR requirements (see Annex A).

2.3.1 Opening Meeting

During the opening meeting between the audit team and the Manufacturer's representatives, the lead auditor shall restate that two of the overall audit objectives are to:

1. Assess the organization's conformity to ISO 13485:2003; and
2. Assess the capability of the management system to ensure compliance with the appropriate requirements of the most recent version of Part 1, Canadian MDR (SOR/98-282, May 1998). Specifically, the Health Canada qualified auditor will determine whether the Manufacturer has documented and effectively implemented all applicable sections of Part 1 of the MDR in their QMS.

2.3.2 Collecting Information

2.3.2.1 Audit Time

Because of the great variability in the type, size and complexity of medical device Manufacturers, Health Canada does not specify the amount of time a Health Canada qualified auditor shall spend performing a document review or on-site audit. Health Canada recommends that any audit time estimates be based on the durations defined in Annex 2 - Auditor Time, IAF Guidance on the Application of ISO/IEC Guide 62:1996. Any addition or reduction of auditor time per Annex 2 shall be justified and documented.

2.3.2.2 Sampling for Objective Evidence

Health Canada Recognized Registrars will use their existing procedures for collecting objective evidence. Records, procedures and processes that are used in the design and manufacture of medical devices sold in Canada will be sampled. If more than one site or geographic location is involved in the design and manufacturing processes, these sites or locations will also be visited for the purpose of collecting objective evidence. In a situation where there are multiple medical devices, greater confidence might be placed in the lead auditor's recommendation(s) and report(s) if the sampling is focussed on evidence associated with the medical devices in the higher risk Class (that is [i.e.], III and IV).

2.3.2.3 Multi-site Organizations

Manufacturers are considered to be a multi-site organization if they typically have an identified central (or corporate) office or location at which certain activities are planned, controlled or managed and a network of local offices or branches at which such activities are fully or partially carried out.

Multi-site organizations may be audited, and documents sampled, following established guidance given in Annex 3 of IAF guidance on the Application of ISO/IEC Guide 62 (IAF GD2:2005, see www.iaf.nu) if clause 2.0.1 has been satisfied, "The products/services provided by all the sites have to be substantially of the same kind and have to be produced fundamentally according to the same methods and procedures." Note that few Manufacturers meet this criteria.

See Annex C for guidance on auditing multi-site organizations that have a Canadian location that has been delegated all or partial responsibility for processes like medical device licence application, medical device licence amendment, regulatory correspondence, packaging, warehousing, and distribution.

2.3.2.4 Auditing of Suppliers or Outsourced Processes

Manufacturers are responsible for their finished medical devices meeting regulatory safety, effectiveness and QMS requirements regardless of whether the Manufacturer has, in whole or in part, outsourced the supply of parts, material, services or finished medical devices.

Health Canada Recognized Registrars shall determine if a medical device was manufactured or designed and manufactured under a specific QMS through the review of objective evidence collected at the legal Manufacturer's facility or at the supplier's (subcontractor's) facility that provides the part, material, service or finished medical device.

In deciding whether to visit a supplier's (subcontractor's) facility, a Health Canada Recognized Registrar will first determine:

1. Whether the supplier has a substantial involvement with the manufacture or design and manufacture of the medical device;
2. Whether the supplier is undertaking the supply of a part, material or service, which may affect the conformity of the medical device with the Safety and Effectiveness requirements of the MDR;

If the answer to both questions i) and ii) above is No, then no further action is required by the Health Canada Recognized Registrar.

However, if the answer to either i) or ii) above is Yes, then the Health Canada Recognized Registrar must evaluate whether there is sufficient objective evidence at the legal Manufacturer's location that shows the competence of the supplier (subcontractor) to undertake supply of the part, material or service in relation to the medical devices that are manufactured, or designed and manufactured, under the registered QMS. The evaluation will consider various activities, particularly the control and risk mitigation exercised by the Manufacturer over the supplier (subcontractor) and their products/services. Examples include:

• specifying design and product requirements;
• specifying personnel qualifications;
• verifying that subcontracted products meet specified requirements;
• specifying a QMS under which the subcontracted products are designed and manufactured;
• performing on-site inspections;
• validating processes; and,
• specifying a QMS certificate with which the Health Canada recognized registrar has confidence.

Health Canada Recognized Registrars could decide not to visit the supplier's (subcontractor) site if the supplier can demonstrate that all the following have been met:

• they have an effective QMS that has been audited and registered by another Health Canada Recognized Registrar;
• their accredited QMS certificate is valid and has not expired;
• the certificate covers the parts, material, service or finished medical devices used by the Manufacturer.

or where the Manufacturer has clearly demonstrated adequate controls and/or risk management of the outsourced product and/or service. If the Health Canada Recognized Registrar is not satisfied with the evidence available from the Manufacturer, they will undertake an audit of the supplier (subcontractor) or require the Manufacturer to undertake a re-evaluation of the supplier (subcontractor). (Note that the intent of an on-site visit of the supplier (subcontractor), by the Health Canada Recognized Registrar is not to conduct a second party audit on behalf of the Manufacturer).

Organizations that act as a "virtual Manufacturer" (e.g., own brand labellers, distributors or retailers acting as manufacturers) present more of a challenge to the auditor in terms of audit planning and audit execution because of the potential need for the Health Canada qualified auditor to visit the virtual Manufacturer's suppliers to collect objective evidence that they meet the applicable QMS requirements. Virtual Manufacturers have the same legal responsibility for meeting the safety, effectiveness and QMS requirements as a "real" Manufacturer.

Organizations that act as a Regulatory Correspondent and have been assigned specific regulatory activities by the Manufacturer must be audited by the Health Canada Recognized Registrar. However, the audit might be conducted through a documentation review, phone calls, or interviews, thus avoiding an actual on-site visit.

In any case, a Health Canada Recognized Registrar's final decision and justification for visiting or not visiting a supplier, an original equipment Manufacturer or a Regulatory Correspondent shall be documented and made available for review.

2.3.3 Nonconformities

All nonconformities shall be reported directly against a requirement of ISO 13485:2003 and never directly against a section of the MDR. In the case of a nonconformity where the Manufacturer has not adequately addressed one or more applicable requirements of the MDR, the Health Canada qualified auditor shall determine which requirement of ISO 13485:2003 has not been met, then cite the missing section of the MDR as objective evidence to support the nonconformity. If a suitable requirement or clause of ISO 13485:2003 cannot be found, then a nonconformity could be reported against clause 4.2.1. Terminology from ISO 13485:2003 should be used in citing the nonconformity (i.e., not the terminology in the MDR).

2.3.3.1 Major Nonconformity

The following observations made by the Health Canada qualified auditor, supported by objective evidence, constitute a "major" nonconformity:

1. any unjustifiable exclusion of a Part 1,Canadian MDR requirement (including sections 26 and 27) from the Manufacturer's QMS;
2. the failure of the Manufacturer to address one or more applicable clause or process of the QMS standard;
3. a number of minor nonconformities against a clause or process of the QMS standard that indicates a trend or absence of control;
4. failure to implement effective corrective action and/or effective preventive action when an investigation of the feedback system indicates a pattern of product defects;
5. the existence of products which clearly do not comply with the Manufacturer's specifications and/or the regulatory requirements due to defective elements in the QMS;
6. repeated nonconformities from previous audits.

These observations do not constitute a definition. Other observations made by the auditor may be called "major" depending on how the Health Canada Recognized Registrar categorizes them.

The Manufacturer addresses major nonconformities by submitting a documented corrective action plan, supported with cause analysis (8.5.2b ISO 13485:2003), to the Health Canada Recognized Registrar within 30 days of the nonconformity being issued. If a Manufacturer is unable to meet the 30 day target, the Health Canada Recognized Registrar shall notify Health Canada in writing of the delay and explain why the Manufacturer is unable to comply. The Health Canada Recognized Registrar closes out the nonconformity according to their established nonconformity resolution procedure.

2.3.3.2 Minor Nonconformity

Health Canada Recognized Registrars may describe other forms of nonconformities as "minor" only if they do not raise significant doubt as to the ability of a medical device, or a manufacturing process, to satisfy the Manufacturer's specified requirements.

Note 1: The International Accreditation Forum (IAF) defines a nonconformity as "The absence of, or the failure to implement and maintain, one or more QMS requirements, or a situation which would, on the basis of available objective evidence, raise significant doubt as to the quality of what the organization is supplying." (Section 1.3, IAF guidance on the Application of ISO/IEC Guide 62)

Note 2: GHTF /SG4 defines a nonconformity as "The non-fulfilment of specified requirements within the planned arrangements. Other terms may be used to mean the same as nonconformity (e.g. 'non-compliance', 'deficiency')." (Section 4.7,Guidelines for regulatory auditing of quality systems of medical device manufacturers: General requirements: 1999, Final document SG4(99)28.)

2.3.3.3 Closure of Nonconformites

There is no special process or requirement for the closure of a major nonconformity related to a MDR requirement other than the 30 day requirement for a Manufacturer to submit an action plan to their Health Canada Recognized Registrar. Health Canada can be consulted in complex cases or if the Health Canada Recognized Registrar is unsure as to whether the Manufacturer has addressed the nonconformity adequately. In these cases, it is the responsibility of the Manufacturer or Health Canada Recognized Registrar to initiate the consultation process. Any consultation of this kind would involve the Manufacturer, the Health Canada Recognized Registrar and Health Canada working together to clarify and resolve the nonconformity.

If an on-site visit or documentation review is required to close a nonconformity related to the MDR then the closure of it shall be done by a Health Canada qualified auditor. In all other cases, the Health Canada Recognized Registrar can assign any auditor they deem trained and qualified to perform this task.

2.4 Audit Reports

Health Canada does not currently specify a format for audit reports. However, audit reports will clearly indicate that one objective of the audit was to assess the capability of the QMS to ensure compliance with the appropriate requirements of the most recent version of Part 1, Canadian MDR, SOR/98-282 May, 1998. Reports shall also clearly state that a second objective of the audit was to assess conformity to ISO 13485:2003. Health Canada expects audit reports to contain statements of conformity with respect to these objectives.

The auditor's observations and hand written notes can be located either in the final audit report or in the auditor's supporting notes that are placed in the Manufacturer's file.

All auditor's notes must be complete, legible, non-fading and tamper resistant over the time that the records are retained.

Note 1: Refer to ISO 19011:2002, 6.6.1 Preparing the audit report.

Note 2: IAF GD2:2005 G.3.4.7 states, "In an audit which combines audits of more than one management system, the report shall clearly identify all requirements important to each management system standard."

3.0 Requirements Tables

The Introduction of ISO 13485:2003 states,

"This International Standard specifies requirements for a quality management system that can be used by an organization for the design and development, production, installation and servicing of medical devices, and the design, development, and provision of related services.

It can also be used by internal and external parties, including certification bodies, to assess the organization's ability to meet customer and regulatory requirements."

The table in Annex A summarizes the links between ISO 13485:2003 and the applicable Part 1, MDR regulatory requirements that the Manufacturer must meet. These regulatory requirements will be integrated into a Manufacturer's processes that are intended for :

• providing confidence to Health Canada that Class II, III and IV medical devices sold or distributed in Canada consistently meet the safety and effectiveness requirements;
• applying to Health Canada for a licence to sell or distribute a medical device in Canada;
• maintaining objective evidence that demonstrate that the medical device is safe and effective;
• retaining distribution records for traceability purposes;
• documenting specified procedures;
• notifying Health Canada of defined changes to its manufacturing process or QMS certificate; and
• notifying users and Health Canada of medical device problems or recalls.

3.1 Annex A - ISO 13485:2003

The table in Annex A is a summary of the QMS requirements found in ISO 13485:2003. For each requirement, the applicable section of the Canadian Medical Devices Regulations and auditor considerations are provided. The table in Annex A can also be used for Class II medical devices by excluding clause 7.3 Design and development.

Annex A - Links Between ISO 13485:2003 and the Medicial Devices Regulations

The Health Canada Recognized Registrar will use existing ISO 13485:2003 audit questions and the considerations listed in the right-hand column.

Annex B - Medical Devices Regulations Requirements and Applicability to Manufacturers of Class II, III and IV Medical Devices, Importers and Distributors

Annex C - Multi-Site Medical Device Manufacturers

Multi-site structure 1 (simple case - no subcontracting activities)
Description: Manufacturer, located in or out of Canada, performs some activities such as design, manufacture and associated activities but uses another part of the organization based in Canada to perform regulatory activities and possibly packaging, warehousing, distribution, service, and installation. All locations in and out of Canada are under the control of a single QMS.

In this case, the Health Canada Recognized Registrar will visit all sites defined in the scope of the QMS and will expect to find, at a location designated by the Manufacturer, objective evidence that the applicable clauses of the MDR have been addressed.

Multi-site structure 2 (limited subcontracting activities)
Description: Manufacturer, located in or out of Canada, performs regulatory activities and subcontracts some or all other activities like design, manufacture, packaging, warehousing, distribution, service and installation to entities that may or may not be part of the Manufacturer's organization. All activities that are not subcontracted are under the control of the Manufacturer's QMS. Control over the subcontracted products or processes is maintained through a formal, documented process that could use contracts, purchasing agreements, specification verification or second party audits.

In this case, the Health Canada Recognized Registrar will visit all sites defined in the scope of the QMS and will expect to find at the Canadian location, or any other location that has been delegated the responsibility by the Manufacturer, objective evidence that the applicable clauses of the MDR have been addressed.

The Health Canada Recognized Registrar uses the guidance given in section "2.3.2 Collecting Information" above to evaluate the need to visit a subcontractor that provides a product or service that will become part of, or could affect the quality of, the medical device.

Multi-site structure 3 (complex case- extensive subcontracting)
Description : Manufacturer, located in or out of Canada, puts its own name, trademark, trade name or logo on the label of a medical device but subcontracts all design and manufacturing and possibly packaging, warehousing, service and installation activities to component manufacturers, original equipment manufacturers or contract service providers that may or may not be part of the Manufacturer's organization. The Manufacturer also maintains a QMS that controls all subcontracted activities and services through a formal, documented process that could use contracts, purchasing agreements, specification verification or second party audits.

In this case the Health Canada Recognized Registrar will visit all sites covered by the scope of the QMS and will expect to find at the location that has been delegated the responsibility by the Manufacturer, objective evidence that the applicable clauses of the MDR have been addressed.

The Health Canada Recognized Registrar uses the guidance given in section "2.3.2 Collecting Information" above to evaluate the need to visit a subcontractor.

Note: IAF GD2:2005, Annex 3, 2.0.1, states,: "The products / services provided by all the sites have to be substantially of the same kind and have to be produced fundamentally according to the same methods and procedures."

Annex D - Guidance on Potential Audit Situations

Should a Health Canada Recognized Registrar certify a "new" QMS?

It is acknowledged that a Health Canada Recognized Registrar may be reluctant to issue a certificate to a Manufacturer because their QMS could be considered "brand new" thereby making an objective assessment of the effectiveness of the QMS difficult. However, the regulatory requirement is for the Manufacturer to have a valid certificate in order for them to receive a medical device licence.

In this case, Health Canada expects the Health Canada Recognized Registrar to issue the certificate based on their audit of the implemented QMS but has an understanding with the Manufacturer that a second audit will be performed within 12 months that will focus on a review of the effectiveness of the QMS.

Brand new QMSs may have to the audited for start-up companies or when there is a change in manufacturing facilities. The Health Canada Recognized Registrar shall audit the Manufacturer as soon as possible within the next 12 months after the issuance of the QMS certificate to verify full implementation.

What should an auditor do if there is no design file or design history file?

If a medical device was placed on the Canadian market prior to 1998, the year that the MDR came into force, it is possible that the Manufacturer may not have the original design file or design history file. Under such circumstances, Health Canada does not expect the Manufacturer to recreate the design file. Instead, the Manufacturer will be expected to have documented procedures in place that could be implemented for the "design and development" process. The intent of these procedures would be to demonstrate what the Manufacturer would do if they were to introduce any new product or if they were to make a change to an existing medical device.

Where should documents be stored?

To minimize travel time and expense of an auditor, all necessary documents that a Manufacturer needs to demonstrate that they conform to a QMS standard should be kept at the Manufacturer's location. However, in more complex multi-site or virtual Manufacturer organizations, the Manufacturer could refer to the location delegated by them where the documents are kept. However, these documents must be easily accessible by the auditor and if the auditor wishes to review these documents, then they must be made available by bringing the documents to the auditor or having the auditor go to the location where the documents are kept.

Section 9(2) of the MDR requires all Manufacturers to keep objective evidence to establish that the medical device meets the safety and effectiveness requirements of section 10 to 20. The MDR also require the Manufacturer to maintain complaint handling records or procedures, mandatory problem reporting procedures, recall procedures, and distribution records.

All documents shall be made available to the auditor, including internal audits and management reviews.

Annex E - Date of Initial Promulgation of Medical Devices Regulations and Amendments (up to December 2006)

Annex F - Acronyms

CMDCAS

GHTF

HPFB

IAF

ISO

MDB

MDR

SCC

TPD