GD210: ISO 13485:2003 Quality Management System Audits Performed by Health Canada Recognized Registrars

February 8, 2007

Notice

Our File Number: 07-103218-349

Re: GD210: ISO 13485:2003 Quality Management System Audits Performed by Health Canada Recognized Registrars

Health Canada is pleased to announce the release of the revised guidance document GD210: ISO 13485:2003 Quality Management System Audits Performed by Health Canada Recognized Registrars. This guidance document supersedes the December 16, 2002 version of the same document.

GD210 provides guidance to registrars recognized by Health Canada on how to perform ISO 13485:2003 quality management system (QMS) audits under the Canadian Medical Devices Conformity Assessment System (CMDCAS). This guidance document has been revised to reflect CAN/CSA-ISO 13485:03, Medical devices - Quality management systems - Requirements for regulatory purposes, and other new international standards. Specifically, the most significant changes that have been made to the document:

  • References to ISO 13485:2003 have been added and references to 13485:1996/8 have been removed.
  • Under the document's Purpose, a paragraph has been added to describe how medical device manufacturers can use the document.
  • The text, "Control over Audits performed by CMDCAS recognized registrars" has been removed.
  • The terms "Exclusion" & "Non-applicability" have been reinforced.
  • An explanation has been added as to how an applicable Medical Devices Regulations (MDR) requirement can be incorporated into the quality management system (QMS) documentation.
  • The distinction between an inspection and a QMS audit has been explained.
  • The information to gather prior to an on-site audit has been listed.
  • The role of the Regulatory Correspondent has been explained.
  • The need for the manufacturer to inform the registrar of QMS changes has been reiterated.
  • Licence Amendment and Obligation to Inform have been reinforced.
  • The auditing of virtual manufacturers and regulatory correspondents has been clarified.
  • Annex A has been revised to show linkages between MDR and ISO 13485:2003.
  • The table in Annex B describes which section of the MDR is applicable to what party.
  • A new Annex lists MDR amendments.

Please direct any questions or comments regarding the content of this guidance document to the following:

Quality Systems Section
Medical Devices Bureau
150 Tunney's Pasture Driveway
Main Statistics Canada Building, Room 1605
Address Locator: 0301H1
Ottawa, Ontario K1A 0K9

Phone: (613) 948-4370
Fax: (613) 946-6758
E-mail: ISO13485_CMDCAS_SCECIM@hc-sc.gc.ca

Guidance Document

GD210: ISO 13485:2003 Quality Management System Audits Performed by Health Canada Recognized Registrars

Date Adopted 2002/12/16
Effective Date 2007/01/31

Foreword

Guidance documents are meant to provide assistance to industry and health care professionals on how to comply with governing statutes and regulations. Guidance documents also provide assistance to staff on how Health Canada mandates and objectives should be implemented in a manner that is fair, consistent and effective.

Guidance documents are administrative instruments not having force of law and, as such, allow for flexibility in approach. Alternate approaches to the principles and practices described in this document may be acceptable provided they are supported by adequate justification. Alternate approaches should be discussed in advance with the relevant program area to avoid the possible finding that applicable statutory or regulatory requirements have not been met.

As a corollary to the above, it is equally important to note that Health Canada reserves the right to request information or material, or define conditions not specifically described in this document, in order to allow the Department to adequately assess the safety, efficacy or quality of a therapeutic product. Health Canada is committed to ensuring that such requests are justifiable and that decisions are clearly documented.

This document should be read in conjunction with the accompanying notice and the relevant sections of other applicable guidance documents.

Document Number: GD210/Rev0-MDB

Replaces: GD210/RevDR-MDB

File name: cmdcas_scecim _audit13485_2 _e.wpd

Replaces: cmdcas_scecim _audit13485 _e.wpd

Version: 0

Replaces: Draft

Date: 2007-01-31

Date: 2002-12-16

Document Change Log
Change Location (section, paragraph) Nature of and/or Reason for Change
1 Overall document "quality system" replaced with "quality management system" (QMS)
2 Overall document References to ISO 13485:2003 added. References to 13485:1996/8 remove.
3 Overall document CMDCAS recognized/qualified changed to Health Canada recognized/qualified.
4 Overall document Annexes renamed.
5 1.1 Purpose Paragraph added to describe how manufacturers can use the document. Informs Manufacturers where to find this document.
6 1.3 Supporting documents Section renamed.
7 1.4 Background "Control over Audits performed by CMDCAS recognized registrars" removed.
8 1.4 Background Exclusion and Non-applicability reinforced.
9 1.5 Definitions Some definitions added.
10 2.1.1 Inclusion of regulatory requirements in management system documents Explains how an applicable MDR requirement can be incorporated into the QMS documentation and explains how to obtain the latest consolidated copy of the MDR.
11 2.1.2 Compliance inspection versus conformity audit Distinguishes an inspection from an audit.
12 2.2.2 Essential information about a Manufacturer Describes the information to gather prior to an on-site audit.
13 2.2.3 Regulatory Correspondent Describes the role of the Regulatory Correspondent.
14 2.2.4 Changes to a Manufacturer's QMS Reiterates the need for the manufacturer to inform the registrar of QMS changes.
15 2.2.5 Changes to a medical device or Manufacturer as described in Section 34 and 43 of the MDR Reinforces Licence Amendment and Obligation to Inform.
16 2.3.2.4 Auditing of suppliers or outsourced processes Clarifies auditing of virtual manufacturers and regulatory correspondents.
17 3.0 Requirements Tables Describes the purposes of the Annexes.
18 Annex A Lists linkages between MDR and ISO 13485:2003.
19 Annex B Describes which clause is applicable to what party.
20 Annex E Lists MDR amendments
21 Annex F A few acronyms added.

Table of Contents

1.0 Introduction

1.1 Purpose

The purpose of this document is to provide registrars that have been recognized by Health Canada under section 32.1 of the Medical Devices Regulations (MDR) guidance on how to perform ISO 13485:2003 quality management system (QMS) audits under the Canadian Medical Devices Conformity Assessment System (CMDCAS).

While CMDCAS does not place any direct requirements on medical device Manufacturers, nonetheless they may refer to this guidance to: a) understand the links between the MDR and ISO 13485:2003 and thus gain an understanding of how to incorporate the former into their documented QMS; and b) learn what can be expected in an audit performed by a Health Canada Recognized Registrar.

1.2 Scope

The scope of this guidance document is limited to ISO 13485:2003 QMS audits of medical device Manufacturers that sell, or intend to sell a Class II, III or IV medical device in Canada. These audits are performed by registrars that have been recognized by Health Canada through CMDCAS or some other recognition process developed by Health Canada.

Organizations that design, manufacture and sell only Class I medical devices in Canada are not permitted to be audited or registered under the CMDCAS program. However, Manufacturers of Class I devices that also design, manufacture and sell Class II, III or IV devices in Canada are eligible for registration under CMDCAS and may voluntarily include the Class I device and other medical devices not sold in Canada in the audit process and include them in their QMS certificate scope of registration.

1.3 Supporting Documents

This guidance document contains undated references. In these cases, the following documents apply:

Medical Devices Regulations SOR/98-282 (Promulgated 1998. Latest consolidated version.)

ISO 13485:2003 (ISO 13485-03-CAN/CSA) Medical Devices -- Quality management systems -- Requirements for regulatory purposes

ISO/TR 14969:2004 Medical devices -- Quality management systems -- Guidance on the application of ISO 13485:2003

ISO 19011:2002 - Guidelines for quality and/or environmental management systems auditing

CAN-P-10B (ISO/IEC Guide 62:1996) - Criteria for Accreditation of Organizations Registering Quality Systems

IAF GD2:2005 IAF Guidance on the Application of ISO/IEC Guide 62:1996, General Requirements for Bodies Operating Assessment and Certification/registration of Quality Systems, Issue 4

GHTF/SG4/N28: Guidelines for Regulatory Auditing of Quality Systems of Medical Device Manufacturers - General Requirements : 1999 Final Document

ISO 9000:2005 - Quality management systems - Fundamentals and vocabulary

ISO 14971:2000/Amd 1:2003 - Medical devices - Application of risk management to medical devices

1.4 Background

1.4.1 Quality Management System Standards

The MDR require Class II medical devices to be manufactured under CAN/CSA-ISO 13485:03 and Class III and IV devices to be designed and manufactured under CAN/CSA-ISO 13485:03. There are no regulatory QMS requirements for Class I medical devices.

1.4.2 Exclusion and non-applicability of clauses from ISO 13485:2003

Clause 1.2 - Application of ISO 13485:2003 permits Manufacturers of Class II medical devices to exclude clause 7.3 - Design and development from the QMS, with justification(s). ISO 13485:2003 recognizes that some requirements in Clause 7 may be "not applicable" due to the nature of the medical device. For example, when a medical device does not require installation or post-market servicing by the Manufacturer (clauses 7.5.1.2.2 and 7.5.1.2.3 respectively) then these clauses are to be omitted from the Manufacturer's quality manual but supported with details of the justification.

In cases where a process (for example [e.g.], designing, manufacturing, sterilizing, assembling, processing, labelling, packaging, refurbishing or modifying the device, or for assigning to it a purpose, etc.) is applicable to the medical device but the Manufacturer has outsourced it to another organization, the MDR and ISO 13485:2003 state that the Manufacturer is nonetheless responsible for the process. Clause 4.1- General requirements, of ISO 13485:2003 requires that the Manufacturer ensures control over all outsourced processes and the control shall be identified within the Manufacturer's QMS.

1.4.3 Importers and Distributors

The MDR do not require importers or distributors of medical devices to have a registered QMS. However, any importer or distributor of a Class II, III or IV medical device that chooses to become the legal Manufacturer of the medical device by labelling and selling it with their own name, or under a trade-mark, design, trade name or other name or mark owned or controlled by them (see section 1.5 below for the definition of Manufacturer) shall comply with the applicable QMS requirement plus any other applicable requirements of the MDR.

1.5 Definitions

Audit:
Systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled (ISO 19011:2002 and ISO 9000:2005).

Audit Conclusion:
Outcome of an audit provided by the audit team after consideration of the audit objectives and all audit findings. (ISO 19011:2002 and ISO 9000:2005)

Audit Criteria:
Set of policies, procedures or requirements (ISO 19011:2002 and ISO 9000:2005). Health Canada recognized registrars will use "ISO 13485:2003 under CMDCAS" as the audit criteria.

Audit Objectives
The audit objectives define what is to be accomplished by the audit... (ISO 19011:2002) See 2.3.1 and 2.4 below.

Audit Plan:
Description of the activities and arrangements of an audit. (ISO 19011:2002 and ISO 9000:2005)

Audit Scope:
Extent and boundaries of an audit. (ISO 19011:2002 and ISO 9000:2005) The audit scope generally includes a description of the physical locations, organizational units, activities and processes, as well as the time period covered (ISO 19011:2002). NB: not to be confused with the scope of registration.

Competence:
(Audit) Demonstrated personal attributes and demonstrated ability to apply knowledge and skills. (ISO 19011:2002 and ISO 9000:2005)

Compliance
The state of conformity of a regulated party (including a corporation, institution, individual or other legal entity) or a product with a legislative or regulatory requirement or a recognized standard. (Health Products and Food Branch Inspectorate, Guidance on the Medical Device Inspection Programme, February 6, 2004)

Conformity:
Fulfilment of a requirement (ISO 9000:2005)

Correction:
Action to eliminate a detected nonconformity.

Distributor:
Means any person, partnership, corporation, association, or other legal relationship which stands between the Manufacturer and the retail seller in purchases, consignments, or contracts for sale of consumer goods.

Health Canada Recognized Registrar:
A registrar recognized by Health Canada per section 32.1 of the MDR. "The Minister shall recognize a person as a registrar for the purpose of issuing quality system certificates if the person (a) has sufficient training, experience and technical knowledge in the design and manufacture of medical devices and in the effective implementation of quality systems to determine whether a quality system satisfies a standard referred to in paragraph 32(2)(f), (3)(j) or (4)(p); and (b) conducts quality system audits in accordance with the applicable guidelines and practices established by the International Organization for Standardization." (SOR/2003-173, s. 3.)

Importer:
For the purposes of this document, an importer is a person, other than the Manufacturer of a medical device, who causes the medical device to be brought into Canada for sale.

Manufacturer:
A person who sells a medical device under their own name, or under a trade-mark, design, trade name or other name or mark owned or controlled by the person, and who is responsible for designing, manufacturing, assembling, processing, labelling, packaging, refurbishing or modifying the medical device, or for assigning to it a purpose, whether those tasks are performed by that person or on their behalf. (SOR/98-282, May 1998)

Noncompliance:
A state of nonconformity with a specific requirement of the Act or Regulations. (Health Products and Food Branch Inspectorate, Guidance on the Medical Device Inspection Programme, February 6, 2004)

Nonconformity:
Non-fulfilment of a requirement (ISO 9000:2000)

Person:
Includes a partnership and an association. (SOR/98-282, May 1998)

Quality Management System:
Management system to direct and control an organization with regard to quality. (ISO 9000:2005).

Registrar:
Organization that assesses and registers or certifies the quality management systems of Manufacturers with respect to published standards.

Note 1: CERTIFICATION/REGISTRATION BODY: A third party that assesses and certifies/registers the quality system of suppliers with respect to published quality system standards and any supplementary documentation required under the system. (CAN-P-10B).

Note 2: A registrar may be called certification body (CB), registration body (RB), assessment and registration body, or certification/registration body (CRB).

Note 3: In Europe, QMS assessment and registration can also be performed by Notified Bodies that have been found competent to do so by an accreditation body.

Significant Change:
Means a change that could reasonably be expected to affect the safety or effectiveness of a medical device. It includes a change to any of the following: (a) the manufacturing process, facility or equipment; (b) the manufacturing quality control procedures, including the methods, tests or procedures used to control the quality, purity and sterility of the device or of the materials used in its manufacture; (c) the design of the device, including its performance characteristics, principles of operation and specifications of materials, energy source, software or accessories; and (d) the intended use of the device, including any new or extended use, any addition or deletion of a contra-indication for the device and any change to the period used to establish its expiry date. (SOR/98-282)

Regulatory Correspondent:
A person that is officially authorized by the Manufacturer to be its contact with Health Canada with respect to its licenced device(s). See 2.2.3 below.

Technical expert (Audit)
Person who provides specific knowledge or expertise to the audit team. (ISO 19011:2002 and ISO 9000:2005)

Valid Certificate:
Means a certificate that :

  • has been issued by a Registrar that has been recognized by Health Canada under section 32.1 of the Medical Devices Regulations;
  • contains the information described in guidance document "GD207/Rev0-MDB Guidance on the content of ISO 13485 and ISO 13488 quality system certificates issued by CMDCAS recognized registrars"; and
  • is valid for the period, not exceeding three years, specified in it. (SOR/2003-173, s. 2. May 2003)

2.0 ISO 13485 Audit Process

2.1 General

QMS audits performed by Health Canada Recognized Registrars shall follow the general auditing process described in ISO 19011. Health Canada Recognized Registrars shall use the guidance herewith, amongst other requirements,

  • to determine the extent of conformity of a Manufacturer's management system to the requirements of ISO 13485; and
  • to confirm that a Manufacturer has documented and effectively implemented all applicable provisions of Part 1of the MDR into their ISO 13485 QMS.

2.1.1 Inclusion of Regulatory Requirements in Management System Documents

A MDR requirement can be included in QMS documents in a number of ways. For example, regulatory text or a summary of the text could be inserted into a procedure, work instruction or some other relevant document. A MDR requirement could be listed in an annex to a general procedure, or the section number of the requirement could simply be referenced. However, if referencing is used, the Manufacturer must have a current electronic or paper version of the MDR available at all times. Vague or unsubstantiated statements of compliance with the MDR are unacceptable as they are not supported by objective evidence.

Paper or electronic versions of the current consolidated version of the MDR, or an initial version of the MDR with attached subsequent amendments, could be used as objective evidence.

Health Canada publishes announcements of future regulatory amendments as well as requests for public comment on draft regulatory amendments

Note 1 : See Annex B for a summary of MDR requirements and their applicability to Manufacturers of Class II, III and IV medical devices, importers, and distributors.

Note 2 : See Annex E for a summary of regulatory amendments from 1998 to 2005.

2.1.2 Compliance inspection versus conformity audit

The conformity audit of a QMS by a Health Canada Recognized Registrar and a compliance inspection performed by a Health Canada inspector are two completely different and independent activities.p

Specific Health Canada personnel have been designated by the Minister of Health to enforce the Food and Drugs Act and the MDR. They have been given specific regulatory powers that are defined in the Food and Drugs Act, Chapter F-27, Part II, sections 22(1), (2) and 23(1) to perform compliance inspections of an organization located in Canada.

Auditors who work for a Health Canada Recognized Registrar do not have any regulatory powers. Specifically a QMS auditor does not :

  • determine compliance of a Manufacturer to the requirements of the Food and Drugs Act or the MDR;
  • extend the scope of an audit to include the MDR requirements that are not applicable to the Manufacturer of a Class II, III or IV medical device, unless the Manufacturer has indicated otherwise;
  • provide advice, consulting services or interpretations of the MDR;
  • classify medical devices on behalf of a Manufacturer;
  • assess technical or clinical data related to a medical device so as to make a determination of its safety and effectiveness;
  • review and interpret any information sent to the Manufacturer by Health Canada for the purpose of regulatory compliance with the MDR;
  • act as a Health Canada inspector or perform related duties.

2.2 Audit Preparation

2.2.1 General

When preparing for an audit, a Health Canada Recognized Registrar shall ensure that:

  • at least one member of the assigned audit team has passed the Health Canada CMDCAS training course and has been qualified by Health Canada to perform these types of audits. Auditing of large Manufacturers will require one or more Health Canada qualified auditors;
  • the competency of the audit team as a whole meets the competency criteria found in clauses 10.2.1 and 10.2.3 of the Global Harmonization Task Force (GHTF) guidance document GHTF/SG4(99)28: "Guidelines for Regulatory Auditing of Quality Systems of Medical Device Manufacturers - General Requirements : 1999 Final Document";
  • technical experts who are not qualified as auditors, shall assess just the processes related to their specialized knowledge and shall be under the supervision of an auditor;
  • the Audit Plan covers "the Audit Scope, including identification of the organizational and functional units and processes to be audited" (ISO 19011:2002 6.4.1c), particularly the entities that are associated with the design and manufacture of medical devices that are presently sold, or will be sold, in Canada. (See Annex C for possible organizational scenarios that will influence the audit planning process and the collection of evidence);
  • the audit team is aware of the type and Class of medical devices the Manufacturer sells or intends to sell in Canada;
  • the audit team has been made aware of any changes to a medical device or its manufacturing process or QMS that may affect the safety and effectiveness or licence status of a medical device;
  • at least one member of the audit team has a copy of the latest consolidated MDR with them when performing an audit.

2.2.2 Essential Information about a Manufacturer

When preparing for an initial audit (or a registration transfer) of a medical device Manufacturer, the Health Canada Recognized Registrar shall gather "essential information" about the Manufacturer and the medical devices they intend to sell in Canada. This information is provided to and used by the audit team to plan and execute the audit.

The "essential information" to gather or verify includes (where applicable and feasible):

  • the name and address of the Manufacturer and related sites and activities performed at each site;
  • the name and address of suppliers (subcontractors) and activities performed by them;
  • the scope and structure of the QMS to determine if it is corporate or site specific or if it is linked with other QMSs of the same or related companies (e.g., internal supplier arrangement), and the relationship between licensed medical devices and the QMS;
  • other country or regional regulatory QMS requirements with which the Manufacturer complies;
  • the location of all records specified by the QMS and/or ISO 13485:2003 and the MDR;
  • a complete list of current Class II, III or IV medical device licences. Note that a paper record of a medical device licence is issued only once to a Manufacturer. Revised paper copies of medical device licences are provided to the Manufacturer only if the existing medical device licence has been amended (section 34 of the MDR). A current and searchable list of licensed medical devices is maintained on a publically accessible website, Medical Device Active Licence Listing (MDALL), www.mdall.ca. MDALL shall be used to verify what medical devices are currently licensed for sale in Canada.
  • a list of medical devices that the Manufacturer intends to sell in Canada;
  • the name, location, contractual arrangement and type of activities assigned to a Regulatory Correspondent (see below).

When preparing for a surveillance or reassessment audit the Health Canada Recognized Registrar shall update the "essential information" and communicate it to the audit team. This activity will be performed in advance and will not be carried out on-site of the audit.

2.2.3 Regulatory Correspondent

The MDR do not require foreign Manufacturers to have an "authorized contact" in Canada. However, Canadian and foreign Manufacturers have the option of assigning some activities like regulatory communication and record keeping to a Regulatory Correspondent located in or out of Canada. The Regulatory Correspondent can be a person or an organization such as a Canadian branch office, distributor, importer or representative. Some of the activities that can be assigned to the Regulatory Correspondent include, but are not limited to:

  • licence renewal and voluntary withdrawal;
  • responses to requests for additional information from Health Canada, including submission of QMS documents and records related to post-market actions (mandatory problem reporting, complaints, recalls);
  • maintenance of documentation and records related to the Manufacturer's QMS (including design history file, manufacturing specifications); or
  • maintaining records and/or copies of licences (including information submitted to support a licence application or amendment).

2.2.4 Changes to a Manufacturer's Quality Management System

Section 2.1.5.1 of CAN-P-10B requires Registrars to have an arrangement with their clients to be promptly notified of any intended changes to the client's QMS or other changes that may affect conformity with requirements. When a Health Canada Recognized Registrar is made aware of these intended changes, they will, as a minimum, note the change in the Manufacturer's file and determine the need for immediate follow-up. Section 2.1.5.3 c) of CAN-P-10B requires Registrars to have procedures and conduct a reassessment of their client's QMS in the "event of changes significantly affecting the activity and operation of the supplier" (Manufacturer).

2.2.5 Changes to a Medical Device or Manufacturer as Described in Section 34 and 43 of the Medical Devices Regulations

Section 34 of the MDR, Application for a Medical Device Licence Amendment, describes the types of changes that a Manufacturer intends to make to a licenced medical device and the action the Manufacturer must take in order to continue selling the medical device in Canada if the changes were to occur. Note that a Significant Change applies under this Section of the MDR and includes changes to the manufacturing process, facility or equipment, quality control procedures, design, intended use, etc. for Class III and IV devices.

Section 43 of the MDR, Obligation to Inform, describes what the Manufacturer shall do following any changes to the information and documents related to a medical device other than those already covered by section 34.

The Health Canada qualified auditor will collect objective evidence to verify if the Manufacturer has procedures and processes that address sections 34 and 43 of the MDR.

2.3 Performing the Audit

Health Canada Recognized Registrars are expected to provide their auditors with appropriate information and time that will allow them to plan and perform their audits effectively. This information shall include the "essential information" described in section 2.2.2 and perhaps a checklist that is based on the applicable MDR requirements (see Annex A).

2.3.1 Opening Meeting

During the opening meeting between the audit team and the Manufacturer's representatives, the lead auditor shall restate that two of the overall audit objectives are to:

  1. Assess the organization's conformity to ISO 13485:2003; and
  2. Assess the capability of the management system to ensure compliance with the appropriate requirements of the most recent version of Part 1, Canadian MDR (SOR/98-282, May 1998). Specifically, the Health Canada qualified auditor will determine whether the Manufacturer has documented and effectively implemented all applicable sections of Part 1 of the MDR in their QMS.

2.3.2 Collecting Information

2.3.2.1 Audit Time

Because of the great variability in the type, size and complexity of medical device Manufacturers, Health Canada does not specify the amount of time a Health Canada qualified auditor shall spend performing a document review or on-site audit. Health Canada recommends that any audit time estimates be based on the durations defined in Annex 2 - Auditor Time, IAF Guidance on the Application of ISO/IEC Guide 62:1996. Any addition or reduction of auditor time per Annex 2 shall be justified and documented.

2.3.2.2 Sampling for Objective Evidence

Health Canada Recognized Registrars will use their existing procedures for collecting objective evidence. Records, procedures and processes that are used in the design and manufacture of medical devices sold in Canada will be sampled. If more than one site or geographic location is involved in the design and manufacturing processes, these sites or locations will also be visited for the purpose of collecting objective evidence. In a situation where there are multiple medical devices, greater confidence might be placed in the lead auditor's recommendation(s) and report(s) if the sampling is focussed on evidence associated with the medical devices in the higher risk Class (that is [i.e.], III and IV).

2.3.2.3 Multi-site Organizations

Manufacturers are considered to be a multi-site organization if they typically have an identified central (or corporate) office or location at which certain activities are planned, controlled or managed and a network of local offices or branches at which such activities are fully or partially carried out.

Multi-site organizations may be audited, and documents sampled, following established guidance given in Annex 3 of IAF guidance on the Application of ISO/IEC Guide 62 (IAF GD2:2005, see www.iaf.nu) if clause 2.0.1 has been satisfied, "The products/services provided by all the sites have to be substantially of the same kind and have to be produced fundamentally according to the same methods and procedures." Note that few Manufacturers meet this criteria.

See Annex C for guidance on auditing multi-site organizations that have a Canadian location that has been delegated all or partial responsibility for processes like medical device licence application, medical device licence amendment, regulatory correspondence, packaging, warehousing, and distribution.

2.3.2.4 Auditing of Suppliers or Outsourced Processes

Manufacturers are responsible for their finished medical devices meeting regulatory safety, effectiveness and QMS requirements regardless of whether the Manufacturer has, in whole or in part, outsourced the supply of parts, material, services or finished medical devices.

Health Canada Recognized Registrars shall determine if a medical device was manufactured or designed and manufactured under a specific QMS through the review of objective evidence collected at the legal Manufacturer's facility or at the supplier's (subcontractor's) facility that provides the part, material, service or finished medical device.

In deciding whether to visit a supplier's (subcontractor's) facility, a Health Canada Recognized Registrar will first determine:

  1. Whether the supplier has a substantial involvement with the manufacture or design and manufacture of the medical device;
  2. Whether the supplier is undertaking the supply of a part, material or service, which may affect the conformity of the medical device with the Safety and Effectiveness requirements of the MDR;

If the answer to both questions i) and ii) above is No, then no further action is required by the Health Canada Recognized Registrar.

However, if the answer to either i) or ii) above is Yes, then the Health Canada Recognized Registrar must evaluate whether there is sufficient objective evidence at the legal Manufacturer's location that shows the competence of the supplier (subcontractor) to undertake supply of the part, material or service in relation to the medical devices that are manufactured, or designed and manufactured, under the registered QMS. The evaluation will consider various activities, particularly the control and risk mitigation exercised by the Manufacturer over the supplier (subcontractor) and their products/services. Examples include:

  • specifying design and product requirements;
  • specifying personnel qualifications;
  • verifying that subcontracted products meet specified requirements;
  • specifying a QMS under which the subcontracted products are designed and manufactured;
  • performing on-site inspections;
  • validating processes; and,
  • specifying a QMS certificate with which the Health Canada recognized registrar has confidence.

Health Canada Recognized Registrars could decide not to visit the supplier's (subcontractor) site if the supplier can demonstrate that all the following have been met:

  • they have an effective QMS that has been audited and registered by another Health Canada Recognized Registrar;
  • their accredited QMS certificate is valid and has not expired;
  • the certificate covers the parts, material, service or finished medical devices used by the Manufacturer.

or where the Manufacturer has clearly demonstrated adequate controls and/or risk management of the outsourced product and/or service. If the Health Canada Recognized Registrar is not satisfied with the evidence available from the Manufacturer, they will undertake an audit of the supplier (subcontractor) or require the Manufacturer to undertake a re-evaluation of the supplier (subcontractor). (Note that the intent of an on-site visit of the supplier (subcontractor), by the Health Canada Recognized Registrar is not to conduct a second party audit on behalf of the Manufacturer).

Organizations that act as a "virtual Manufacturer" (e.g., own brand labellers, distributors or retailers acting as manufacturers) present more of a challenge to the auditor in terms of audit planning and audit execution because of the potential need for the Health Canada qualified auditor to visit the virtual Manufacturer's suppliers to collect objective evidence that they meet the applicable QMS requirements. Virtual Manufacturers have the same legal responsibility for meeting the safety, effectiveness and QMS requirements as a "real" Manufacturer.

Organizations that act as a Regulatory Correspondent and have been assigned specific regulatory activities by the Manufacturer must be audited by the Health Canada Recognized Registrar. However, the audit might be conducted through a documentation review, phone calls, or interviews, thus avoiding an actual on-site visit.

In any case, a Health Canada Recognized Registrar's final decision and justification for visiting or not visiting a supplier, an original equipment Manufacturer or a Regulatory Correspondent shall be documented and made available for review.

2.3.3 Nonconformities

All nonconformities shall be reported directly against a requirement of ISO 13485:2003 and never directly against a section of the MDR. In the case of a nonconformity where the Manufacturer has not adequately addressed one or more applicable requirements of the MDR, the Health Canada qualified auditor shall determine which requirement of ISO 13485:2003 has not been met, then cite the missing section of the MDR as objective evidence to support the nonconformity. If a suitable requirement or clause of ISO 13485:2003 cannot be found, then a nonconformity could be reported against clause 4.2.1. Terminology from ISO 13485:2003 should be used in citing the nonconformity (i.e., not the terminology in the MDR).

2.3.3.1 Major Nonconformity

The following observations made by the Health Canada qualified auditor, supported by objective evidence, constitute a "major" nonconformity:

  1. any unjustifiable exclusion of a Part 1,Canadian MDR requirement (including sections 26 and 27) from the Manufacturer's QMS;
  2. the failure of the Manufacturer to address one or more applicable clause or process of the QMS standard;
  3. a number of minor nonconformities against a clause or process of the QMS standard that indicates a trend or absence of control;
  4. failure to implement effective corrective action and/or effective preventive action when an investigation of the feedback system indicates a pattern of product defects;
  5. the existence of products which clearly do not comply with the Manufacturer's specifications and/or the regulatory requirements due to defective elements in the QMS;
  6. repeated nonconformities from previous audits.

These observations do not constitute a definition. Other observations made by the auditor may be called "major" depending on how the Health Canada Recognized Registrar categorizes them.

The Manufacturer addresses major nonconformities by submitting a documented corrective action plan, supported with cause analysis (8.5.2b ISO 13485:2003), to the Health Canada Recognized Registrar within 30 days of the nonconformity being issued. If a Manufacturer is unable to meet the 30 day target, the Health Canada Recognized Registrar shall notify Health Canada in writing of the delay and explain why the Manufacturer is unable to comply. The Health Canada Recognized Registrar closes out the nonconformity according to their established nonconformity resolution procedure.

2.3.3.2 Minor Nonconformity

Health Canada Recognized Registrars may describe other forms of nonconformities as "minor" only if they do not raise significant doubt as to the ability of a medical device, or a manufacturing process, to satisfy the Manufacturer's specified requirements.

Note 1: The International Accreditation Forum (IAF) defines a nonconformity as "The absence of, or the failure to implement and maintain, one or more QMS requirements, or a situation which would, on the basis of available objective evidence, raise significant doubt as to the quality of what the organization is supplying." (Section 1.3, IAF guidance on the Application of ISO/IEC Guide 62)

Note 2: GHTF /SG4 defines a nonconformity as "The non-fulfilment of specified requirements within the planned arrangements. Other terms may be used to mean the same as nonconformity (e.g. 'non-compliance', 'deficiency')." (Section 4.7,Guidelines for regulatory auditing of quality systems of medical device manufacturers: General requirements: 1999, Final document SG4(99)28.)

2.3.3.3 Closure of Nonconformites

There is no special process or requirement for the closure of a major nonconformity related to a MDR requirement other than the 30 day requirement for a Manufacturer to submit an action plan to their Health Canada Recognized Registrar. Health Canada can be consulted in complex cases or if the Health Canada Recognized Registrar is unsure as to whether the Manufacturer has addressed the nonconformity adequately. In these cases, it is the responsibility of the Manufacturer or Health Canada Recognized Registrar to initiate the consultation process. Any consultation of this kind would involve the Manufacturer, the Health Canada Recognized Registrar and Health Canada working together to clarify and resolve the nonconformity.

If an on-site visit or documentation review is required to close a nonconformity related to the MDR then the closure of it shall be done by a Health Canada qualified auditor. In all other cases, the Health Canada Recognized Registrar can assign any auditor they deem trained and qualified to perform this task.

2.4 Audit Reports

Health Canada does not currently specify a format for audit reports. However, audit reports will clearly indicate that one objective of the audit was to assess the capability of the QMS to ensure compliance with the appropriate requirements of the most recent version of Part 1, Canadian MDR, SOR/98-282 May, 1998. Reports shall also clearly state that a second objective of the audit was to assess conformity to ISO 13485:2003. Health Canada expects audit reports to contain statements of conformity with respect to these objectives.

The auditor's observations and hand written notes can be located either in the final audit report or in the auditor's supporting notes that are placed in the Manufacturer's file.

All auditor's notes must be complete, legible, non-fading and tamper resistant over the time that the records are retained.

Note 1: Refer to ISO 19011:2002, 6.6.1 Preparing the audit report.

Note 2: IAF GD2:2005 G.3.4.7 states, "In an audit which combines audits of more than one management system, the report shall clearly identify all requirements important to each management system standard."

3.0 Requirements Tables

The Introduction of ISO 13485:2003 states,

"This International Standard specifies requirements for a quality management system that can be used by an organization for the design and development, production, installation and servicing of medical devices, and the design, development, and provision of related services.

It can also be used by internal and external parties, including certification bodies, to assess the organization's ability to meet customer and regulatory requirements."

The table in Annex A summarizes the links between ISO 13485:2003 and the applicable Part 1, MDR regulatory requirements that the Manufacturer must meet. These regulatory requirements will be integrated into a Manufacturer's processes that are intended for :

  • providing confidence to Health Canada that Class II, III and IV medical devices sold or distributed in Canada consistently meet the safety and effectiveness requirements;
  • applying to Health Canada for a licence to sell or distribute a medical device in Canada;
  • maintaining objective evidence that demonstrate that the medical device is safe and effective;
  • retaining distribution records for traceability purposes;
  • documenting specified procedures;
  • notifying Health Canada of defined changes to its manufacturing process or QMS certificate; and
  • notifying users and Health Canada of medical device problems or recalls.

3.1 Annex A - ISO 13485:2003

The table in Annex A is a summary of the QMS requirements found in ISO 13485:2003. For each requirement, the applicable section of the Canadian Medical Devices Regulations and auditor considerations are provided. The table in Annex A can also be used for Class II medical devices by excluding clause 7.3 Design and development.

Annex A - Links Between ISO 13485:2003 and the Medicial Devices Regulations

The Health Canada Recognized Registrar will use existing ISO 13485:2003 audit questions and the considerations listed in the right-hand column.

Links Between ISO 13485:2003 and MDR
Element of ISO 13485:2003 QMS requirement ISO 13485:2003 MDR requirement SOR/98 -282 Feb 26, 2006, consolidated Auditor Considerations
1 Scope
1.1 General
This International Standard specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer requirements and regulatory requirements applicable to medical devices and related services.
Most recent consolidated version of Part 1, Medical Devices Regulations (MDR) It says that ISO 13485:2003 shall be used by a Manufacturer to demonstrate that it can provide medical devices that meet customer as well as regulatory requirements.
1.2 Application
If regulatory requirements permit exclusions of design and development controls (see 7.3), this can be used as a justification for their exclusion from the quality management system. These regulations can provide alternative arrangements that are to be addressed in the quality management system. It is the responsibility of the organization to ensure that claims of conformity with this International Standard reflect exclusion of design and development controls [see 4.2.2 a) and 7.3].
32(2)(f) permits exclusion of Design and development controls (element 7.3) from the QMS for Class II medical devices. The manufacturer cannot exclude Design and development controls if their intention is to obtain a class III or IV device licence.
3 Terms and definitions
Existing ISO 9000:2005 and ISO 13485:2003 definitions.
  This is not a requirement clause of ISO 13485:2003 but is meant to inform the reader. Where this a conflict of definitions, the MDR definitions take precedence.
...definitions should be regarded as generic, as definitions provided in national regulations can differ slightly and take precedence. Part 1, Section 1 Interpretations
In the MDR "Manufacturer" means a person who sells a medical device under their own name, or under a trade-mark, design, trade name or other name or mark owned or controlled by the person, and who is responsible for designing, manufacturing, assembling, processing, labelling, packaging, refurbishing or modifying the device, or for assigning to it a purpose, whether those tasks are performed by that person or on their behalf.

The MDR holds the "Manufacturer" responsible for the safety and effectiveness of the medical device. The Manufacturer shall be certified to ISO 13485:2003 by a Health Canada Recognized Registrar.

QMS certificates must be issued to the organization that meets the MDR definition of the Manufacturer.

3.3

Advisory notice
notice issued by the organization, subsequent to delivery of the medical device, to provide supplementary information and/or to advise what action should be taken in

  • the use of a medical device,
  • the modification of a medical device,
  • the return of the medical device to the organization that supplied it, or
  • the destruction of a medical device

Note: Issue of an advisory notice might be required to comply with national or regional regulations.

Part 1, Section 1 Interpretations
"recall", in respect of a medical device that has been sold, means any action taken by the manufacturer, importer or distributor of the device to recall or correct the device, or to notify its owners and users of its defectiveness or potential defectiveness, after becoming aware that the device

  1. may be hazardous to health;
  2. may fail to conform to any claim made by the manufacturer or importer relating to its effectiveness, benefits, performance characteristics or safety; or
  3. may not meet the requirements of the Act or these Regulations.
The intent of a regulatory "recall" is consistent with the ISO "advisory notice".
4 Quality management system
4.1 General requirements
The organization shall...identify the processes needed for the quality management system and their application throughout the organization (see 1.2)...
2, 3, 5 Application
6, 7 (including Schedule 1) Classification
26 Prohibition
28 to 31 Devices deemed licensed
32, 33 Application for a device licence
34 Amendment to a device licence
43 Obligation to inform
43.1 Obligation to submit certificate
If some of the MDR requirements have been delegated by the legal Manufacturer to another area of the organization, has the delegation of responsibility been clearly defined and documented?
Where an organization chooses to outsource any process that affects product conformity with requirements, the organization shall ensure control over such processes. Control of such outsourced processes shall be identified within the quality management system (see 8.5.1).  

Does the Manufacturer have control over all outsourced processes and are these control mechanisms identified within the QMS?

The MDR hold the "Manufacturer" responsible for the safety and effectiveness of the medical device including the design, fabrication, assembly, sterilization, shipping etc. The Manufacturer must demonstrate control over these processes.

Note: Refer to section 2.3 Performing the Audit for additional guidance on auditing suppliers.

4.2 Documentation requirements
4.2.1

General
The quality management system documentation shall include...f) any other documentation specified by national or regional regulations.

Where this International Standard specifies that a requirement, procedure, activity or special arrangement be "documented", it shall, in addition, be implemented and maintained.

For each type or model of medical device, the organization shall establish and maintain a file either containing or identifying documents defining product specifications and quality management system requirements (see 4.2.3). These documents shall define the complete manufacturing process and, if applicable, installation and servicing.

9(2) A manufacturer shall keep objective evidence to establish that the medical device meets those requirements. [safety and effectiveness]

10 to 20 Safety and Effectiveness Requirements

32 Application for a Medical device Licence

For Class II devices refer to 32(1) and (2) for minimum requirements.

For Class III devices refer to 32(1) and (3) for minimum requirements.

For Class IV devices refer to 32(1) and (4) for minimum requirements.

Does the Manufacturer have files (often called the Technical File or Device Master File) that contain, or refers to the location of the evidence of safety and effectiveness required in Sections 10 to 20?

These files, or parts of them, can be used to satisfy the :

Class II licence application requirements of Sections 32(1) and (2);

Class III licence application requirements of Sections 32(1) and (3); or

Class IV licence application requirements of Sections 32(1) and (4).

Have these regulatory requirements been documented in the Quality Manual?

4.2.2 Quality manual
  The organization shall establish and maintain a quality manual that includes...a) the scope of the quality management system, including details of and justification for any exclusion and/or non-application (see 1.2)... 32(2) f) Application for a Class II device licence - QMS requirement

Applicable only to Class II medical device Manufacturers

If the Manufacturer excludes element 7.3 Design and development from the scope of the QMS, does the quality manual contain a detailed justification of its exclusion?

Is the justification based on the Section 32(2)(f)?

4.2.3 Control of documents
Existing ISO 13485:2003 QMS requirements.
No specific requirement in MDR. Does the Manufacturer have the most recent consolidated version of the MDR including any amendments published in Canada Gazette Part II?
http://laws.justice.gc.ca
http://canadagazette.gc.ca/
4.2.4 Control of records
The organization shall retain the records for a period of time at least equivalent to the lifetime of the medical device as defined by the organization, but not less than two years from the date of product release by the organization or as specified by the relevant regulatory requirement.
55, 56 Distribution records
66 to 68 Implant registration

Has the Manufacturer identified the lifetime of the medical devices?

Has the Manufacturer defined the record retention period for distribution records in respect of a medical device for the longer of (a) the projected useful life of the device, or (b) two years after the date the device is shipped?

5 Management responsibility
5.1 Management commitment
Top management shall provide evidence of its commitment to the development and implementation of the quality management system and maintaining its effectiveness by...communicating to the organization the importance of meeting customer as well as statutory and regulatory requirements....
No specific requirement in MDR. Does objective evidence exist of top management's commitment to meeting the requirements of the Canadian MDR? ( e.g. Device Licensing, Mandatory Problem Reports, Recalls etc.)
5.2 Customer focus No specific requirement in MDR.  
5.3 Quality policy No specific requirement in MDR.  
5.4 Planning
5.4.1 Quality objectives No specific requirement in MDR.  
5.4.2 Quality management system planning No specific requirement in MDR.  
5.5 Responsibility, authority and communication
5.5.1 Responsibility and authority No specific requirement in MDR.  
5.5.2 Management representative No specific requirement in MDR.  
5.5.3 Internal communication No specific requirement in MDR.  
5.6 Management review
5.6.1 General No specific requirement in MDR.  
5.6.2 Review input No specific requirement in MDR. Is a review of new or revised MDR part of the input to management review?
5.6.3 Review output No specific requirement in MDR.  
6 Resource management
6.1 Provision of resources No specific requirement in MDR.  
6.2 Human resources No specific requirement in MDR.  
6.2.1 General No specific requirement in MDR.  
6.2.2 Competence, awareness and training No specific requirement in MDR. Have the people who perform regulatory activities been trained in the understanding of the MDR?
6.3

Infrastructure
The organization shall determine, provide and maintain the infrastructure needed to achieve conformity to product requirements. Infrastructure includes, as applicable

  1. buildings, workspace and associated utilities,
  2. process equipment (both hardware and software), and
  3. supporting services (such as transport or communication).
14 Transport and storage Does the Manufacturer have and maintain the necessary infrastructure to ensure that the characteristics and performance of their medical device(s) is(are) not adversely affected by transport or conditions of storage?
6.4 Work environment No specific requirement in MDR.  
7 Product realization
7.1

Planning of product realization
The organization shall plan and develop the processes needed for product realization.

Planning of product realization shall be consistent with the requirements of the other processes of the quality management system (see 4.1).

The organization shall establish documented requirements for risk management throughout product realization. Records arising from risk management shall be maintained (see 4.2.4).

32(4)(e) submit a quality plan with a Class IV device application

9 Manufacturer's Obligations

32(4)(d) submit risk assessment with Class IV device application

10 Manufacturer to perform risk analysis

Does the Manufacturer have a quality plan (which is also submitted to Health Canada with Class IV medical device applications) that specifies the processes and resources for specific medical devices?

Have risk assessment and control measures been performed throughout the product realization process for all classes of medical devices?

Note 1: See ISO 14971:2000 for guidance related to risk management.

Note 2: See Global Harmonization Task Force (GHTF) SG3 guidance document "Risk Management as an Integral Part of the Quality Management System" for additional guidance.
www.ghtf.org

7.2 Customer-related processes
7.2.1 Determination of requirements related to the product    
  The organization shall determine ...c) statutory and regulated requirements related to the product

2 to 5 Application
6 to 7 Classification
8 to 9 Application and Manufacturer's Obligations

10 to 20 Safety and Effectiveness
21 to 23 Labelling
24 Contraceptive Devices Advertising
26 to 27 Prohibition
28 to 31 Medical Devices Deemed Licensed
32 Application for a Medical device Licence
34 Application for licence amendment
43 Obligation to inform
52 to 56 Distribution records
57, 58 Complaint handling
59 to 62 Mandatory problem reporting
63, 64 Recall
66 to 68 Implant registration
Schedule 1 Classification rules for medical devices
Schedule 2 list of Implants that must comply with the implant registration requirements of section 66

Has the Manufacturer determined the applicable statutory and regulatory requirements that apply to the medical device?

Did the Manufacturer use the Classification rules in Schedule 1 to classify any new medical devices?

Does the Manufacturer track changes to the information and documents that had been supplied earlier to Health Canada but did not lead to a licence amendment? Are these changes reported during the annual licence renewal process required in section 43(1) (b)?

Is the Manufacturer only selling licensed medical devices in Canada (see www.mdall.ca)?

(Note: Objective evidence to satisfy this requirement will be found either at the legal Manufacturers location or at another location that is part of the Manufacturer's organization like a Canadian subsidiary that is controlled through the organization's QMS. See Annex C for auditing simple and complex multi-site organizations)

7.2.2 Review of requirements related to the product No specific requirement in MDR.  
7.2.3 Customer communication No specific requirement in MDR.  
7.3 Design and development
7.3.1 Design and development planning No specific requirement in MDR  
7.3.2 Design and development inputs
Inputs relating to product requirements shall be determined and records maintained (see 4.2.4). These inputs shall include
a) functional, performance and safety requirements, according to the intended use,
b) applicable statutory and regulatory requirements...
e) output(s) of risk management (see 7.1).
10 Manufacturer to perform risk analysis
11 Device must not adversely affect the health or safety of a patient
13 Characteristics and performance of device must not deteriorate under normal use
14 The characteristics and performance of a medical device shall not be adversely affected by transport or conditions of storage
15 Compatibility - Materials used the manufacture of the device
16 Minimum risks to a patient and other person from foreseeable hazards
18 Compatibility between parts and components
19 Measuring function to perform within tolerance limits
32 Application for a medical device licence requirements

Has the Manufacturer determined the design and development inputs related to the regulatory safety and effectiveness requirements?

Has the Manufacturer determined the medical device licensing requirements for Class II, III or IV medical devices?

7.3.3 Design and development outputs No specific requirement in MDR.  
7.3.4 Design and development review No specific requirement in MDR.  
7.3.5 Design and development verification No specific requirement in MDR  
7.3.6 Design and development validation
As part of design and development validation, the organization shall perform clinical evaluations and/or evaluation of performance of the medical device, as required by national or regional regulations

12 device shall perform as intended

32(3)(f) and 32 (4)(i) : studies on Class III and IV devices to ensure safety and effectiveness

20 validation of software used in a device

Has design and development validation been carried out and does the medical device perform as intended ?

Has design and development validation been performed on initial production medical devices or their equivalents?

Has the performance of any software used in the medical device been validated?

7.3.7 Control of design and development changes

1 MDR definition of a "significant change"

34 Application for a medical device licence amendment for Class III or IV device in the event of a "significant change"

43(1)(b) Obligation to inform minister at time of annual licence renewal of any change to information or documents that do not meet Section 34 requirements.

Does the Manufacturer have a process or procedure for identifying a "significant change" to a Class III or IV medical device?

Does the Manufacturer have a procedure for amending a Class III or IV medical device licence in the event of a significant change to a medical device?

Does the Manufacturer track changes to the information and documents that had been supplied earlier to Health Canada but did not lead to a licence amendment? Are these changes reported during the annual licence renewal process required in section 43(1)(b)?

Following any design and development changes, is the device master file (technical file) updated ?

7.4 Purchasing
7.4.1 Purchasing process
The organization shall establish documented procedures to ensure that purchased product conforms to specified purchase requirements. The type and extent of control applied to the supplier and the purchased product shall be dependent upon the effect of the purchased product on subsequent product realization or the final product.
No specific requirement in MDR.

Do Manufacturers who use suppliers to provide finished medical devices have documented procedures in place to ensure that the finished medical device is safe and effective?

Do Manufacturers who use suppliers to provide parts, components or services that could affect the safety and effectiveness of the finished medical device have documented procedures in place to ensure that the finished medical device is safe and effective?

7.4.2 Purchasing information
Purchasing information shall describe the product to be purchased, including where appropriate .... quality management system requirements.
No specific requirement in MDR.  
7.4.3 Verification of purchased product No specific requirement in MDR.  
7.5 Production and service provision
7.5.1 Control of production and service provision
7.5.1.1 General requirements
The organization shall plan and carry out production and service provision under controlled conditions.
17 Validation and control of sterilization process If the medical device is to be sold in a sterile condition, is it manufactured and sterilized under appropriately controlled conditions, and is the sterilization method used validated?
7.5.1.2 Control of production and service provision - Specific requirements
7.5.1.2.1 Cleanliness of product and contamination control No specific requirement in MDR.  
7.5.1.2.2 Installation activities No specific requirement in MDR.  
7.5.1.2.3 Servicing activities No specific requirement in MDR.  
7.5.1.3 Particular requirements for sterile medical devices 17 Validation and control of sterilization process  
7.5.2 Validation of processes for production and service provision
7.5.2.1 General requirements No specific requirement in MDR.  
7.5.2.2 Particular requirements for sterile medical devices
The organization shall establish documented procedures for the validation of sterilization processes. Sterilization processes shall be validated prior to initial use. Records of validation of each sterilization process shall be maintained (see 4.2.4).
17 Validation and control of sterilization process

Does the Manufacturer have documented procedures for the validation of sterilizations processes?

Was the sterilization process validated prior to initial use?

Does the Manufacturer have and maintain records of validation of each sterilization process?

7.5.3 Identification and traceability
7.5.3.1 Identification No specific requirement in MDR.  
7.5.3.2 Traceability
7.5.3.2.1 General
The organization shall establish documented procedures for traceability. Such procedures shall define the extent of product traceability and the records required (see 4.2.4, 8.3 and 8.5). Where traceability is a requirement, the organization shall control and record the unique identification of the product (see 4.2.4).
21 c) and d) Labelling
52 and 54 Distribution records
Do medical devices labels contain: a) the name of the medical device; b) the name and address of the Manufacturer; c) the identifier of the medical device, including the identifier of any medical device that is part of a system, test kit, medical device group, medical device family or medical device group family; d) in the case of a Class III or IV medical device, the control number?
The organization shall establish documented procedures for traceability. Such procedures shall define the extent of product traceability and the records required (see 4.2.4, 8.3 and 8.5). Where traceability is a requirement, the organization shall control and record the unique identification of the product 52 to 56 Distribution Records

Do the Manufacturer's distributors have records of distribution of medical devices and are these records kept for the longer of, the projected useful life of the medical device as defined by the Manufacturer, or two years after the medical device was shipped?

Do distribution records contain sufficient information to permit a complete and rapid withdrawal of a Class II, III or IV medical device from the market?

 

66 Implant registration (Applicable to devices listed in Schedule 2 of the MDR that are :

  1. Heart valves
  2. Annuloplasty rings
  3. Active implantable device systems
    1. all models of implantable pacemakers and leads;
    2. all models of implantable defibrillators and leads;
    3. artificial heart;
    4. implantable ventricular support system; and
    5. implantable drug infusion system
  4. Devices of human origin
    1. human dura mater; and
    2. wound covering
If the Manufacturer sells a medical device in Canada that is listed in Schedule 2 of the MDR, does the Manufacturer have procedures and records that satisfy the traceability requirements of section 66?
7.5.3.2.2 Particular requirements for active implantable medical devices and implantable medical devices
The organization shall require that its agents or distributors maintain records of the distribution of medical devices to allow traceability and that such records are available for inspection.... Records of the name and address of the shipping package consignee shall be maintained (see 4.2.4).
67(1) Implant registration
54(1),(2) Distribution records for implants.
Do the Manufacturer's agents or distributors of active implantable and implantable (as defined in section 3 of ISO 13485:2003) maintain distribution records of these medical devices?
7.5.3.3 Status identification No specific requirement in MDR.  
7.5.4 Customer property
The organization shall exercise care with customer property while it is under the organization's control or being used by the organization. The organization shall identify, verify, protect and safeguard customer property provided for use or incorporation into the product. If any customer property is lost, damaged or otherwise found to be unsuitable for use, this shall be reported to the customer and records maintained (see 4.2.4).
67(3) Implant registration How does the Manufacturer safeguard the name and address of the patient, unless disclosure is required by law?
7.5.5 Preservation of product
The organization shall establish documented procedures or documented work instructions for preserving the conformity of product during internal processing and delivery to the intended destination.
14 Conditions of storage and transport Are the characteristics and performance of the medical device protected during transport or storage, taking into account the Manufacturer's instructions and information for transport and storage?
7.6 Control of monitoring and measuring devices No specific requirement in MDR.  
8 Measurement, analysis and improvement
8.1 General No specific requirement in MDR.  
8.2 Monitoring and measurement
8.2.1 Feedback
The organization shall establish a documented procedure for a feedback system [see 7.2.3 c)] to provide early warning of quality problems and for input into the corrective and preventive action processes (see 8.5.2 and 8.5.3).
57 (1)(a) Complaint Handling

Does the Manufacturer and its Canadian importer and distributor(s) maintain records of reported problems or consumer complaints relating to the performance characteristics or safety of the medical device?

Are these problem reports or consumer complaints used as input into the corrective action system?

Note 1 : for guidance on complaint handling and recall see http://www.hc-sc.gc.ca/dhp-mps/compli-conform/index-eng.php

8.2.2 Internal audit No specific requirement in MDR. Has the manufacturer conducted a full system internal audit indicating coverage of the MDR?
8.2.3 Monitoring and measurement of processes No specific requirement in MDR  
8.2.4 Monitoring and measurement of product
8.2.4.1 General requirements No specific requirement in MDR.  
8.2.4.2 Particular requirement for active implantable medical devices and implantable medical devices No specific requirement in MDR.  
8.3 Control of nonconforming product No specific requirement in MDR.  
8.4 Analysis of data No specific requirement in MDR.  
8.5 Improvement    
8.5.1 General
The organization shall establish documented procedures for the issue and implementation of advisory notices. These procedures shall be capable of being implemented at any time.

64 & 65 Recall
(note the MDR definition of Recall includes the actions of physically removing a device from the market or notifying its owners and users of its defectiveness or potential defectiveness. See Section 1 of the MDR for official definition)

58 a) Complaint Handling

59-62 Mandatory Problem Reporting

Do the Manufacturer and his Canadian importer have documented procedures for them to:

  1. carry out an effective and timely recall of the medical device following a consumer complaint or reported problem related to medical device performance or safety;
  2. recall or correct a medical device, or to notify its owners and users in Canada of its defectiveness or potential defectiveness after becoming aware that the medical device : (a) may be hazardous to health; (b) may fail to conform to any claim made by the Manufacturer or importer relating to its effectiveness, benefits, performance characteristics or safety; or (c) may not meet the requirements of the Food and Drugs Act (R.S., c. F-27, s.1) or the MDR (SOR/DORS/98-282)

Note 3 : for guidance on Product recall procedures see http://www.hc-sc.gc.ca/dhp-mps/compli-conform/index-eng.php

Records of all customer complaint investigations shall be maintained (see 4.2.4). If investigation determines that the activities outside the organization contributed to the customer complaint, relevant information shall be exchanged between the organizations involved (see 4.1).

If any customer complaint is not followed by corrective and/or preventive action, the reason shall be authorized (see 5.5.1) and recorded (see 4.2.4).

57(1)(b) Maintain records of actions taken following reported problems and customer complaint.

Does the Manufacturer and its Canadian importer and distributors maintain records of reported problems or consumer complaints relating to the performance characteristics or safety of the medical device ?

Are these problem reports or consumer complaints used as input into the corrective and preventive action system?

Note 1 : for guidance on complaint handling and recall see http://www.hc-sc.gc.ca/dhp-mps/compli-conform/index-eng.php

If national or regional regulations require notification of adverse events that meet specified reporting criteria, the organization shall establish documented procedures to notify the regulatory authorities. Section 59 to 62: Mandatory Problem Reporting

Does the Manufacturer and its Canadian importer have documented procedures to inform Health Canada of incidents that meet the mandatory reporting criteria found in Sections 59 to 62.

Note 2 : For guidance on mandatory problem reporting see http://www.hc-sc.gc.ca/dhp-mps/compli-conform/index-eng.php

8.5.2 Corrective action 58 a), b) Complaint Handling  
8.5.3 Preventive action No specific requirement in MDR.  

Annex B - Medical Devices Regulations Requirements and Applicability to Manufacturers of Class II, III and IV Medical Devices, Importers and Distributors

Medical Devices Regulations Requirements and Applicability to Manufacturers of Class II, III and IV Medical Devices, Importers and Distributors
Requirement Canadian MDR Section Applicability of requirement
    Manufacturer of Class I Manufacturer of Class II, III & IV Distributor Importer Audits by Health Canada Recognized Registrar
Part 1, General
Interpretations
(Definitions)
1 X X X X X
Application

2 to 5

X X X X X
Classification of medical devices 6 to 7 X X     X
Application 8 General information
Manufacturer's obligation 9 X X     X
Safety and effectiveness requirements 10 to 20 X X     X
Labelling requirements 21 to 23 X X X X X
Contraceptive devices- Advertising 24   X X X  
Class I - Medical devices 25 X        
Class II, III and IV Devices
Prohibition (sale and importation) 26 to 27   X X X X
Medical devices deemed licensed 28 to 31   X     X
Application for a medical device licence 32   X     X
Quality Management Certificate 32.1 to 32.5          
Foreign manufacturer (Mutual recognition agreements - (MRAs)) 33   X
(not in effect at this time)
     
Licence amendment 34   X     X
Renseignements complémentaires et échantillons 35   X      
Issuance 36   X      
Lot of in Vitro Diagnostic devices 37   X      
Refusal to issue 38   X      
Additional information 39   X      
Suspension 40 to 42
  X      
Obligation to inform 43   X     X
Obligation to Submit Certificate 43.1   X     X
Medical Devices to Be Sold for the Purposes of Implementing the General Council Decision 43.2 to 43.6 X X      
Establishment Licences
Prohibition (sale and importation) 44 X   X X  
Application 45 X   X X  
Issuance 46 X   X X  
Refusal 47 X   X X  
Notification 48 X   X X  
Suspension 49 to 51 X   X X  
Post-market and Other Requirements
Distribution records 52 to 56 X X X X X
Complaint handling 57 to 58 X X X X X
Mandatory problem reporting 59 to 62 X X X X X
Recall 63 to 65.1 X X X X X
Implant registration 66 to 68   X     X
Part 2, Custom-Made Devices and Medical Devices to be Imported or Sold for Special Access
Application 69 General information
General 70 X X X X  
Authorization 71 to 72 X X X    
Additional information 73 to 74 X X X    
Labelling 75 X X X X  
Distribution records 76     X    
Reporting incident 77 Reporting requirements apply to healthcare professional
Implant registration 78   X      
Part 3, Medical Devices Sold for Investigational Testing Involving Human Subjects
Application 79 General information
General 80 (1) - Sale or importation 80(1) X X X X  
General 80 (2) - Class II, III IV authorization 80(2) X X X    
General 80 (1) - Class I 80(3) X   X    
Records 81 X X X X  
Authorization 82 à 83 X   X X  
Additional information 84 à 85 X X X    
Labelling 86 X X X X  
Advertising 87 X X X X  
Other requirements (distribution, record, complain handling, mandatory problem reporting, recall and implant registration) 88 X X X X  
Part 4, Export Certificates
Export certificates 89 to 92 X X X X  
Part 5 - Transitional Provisions, Repeal and coming into Force
Transitional provisions 93 to 95   X      
Repeal 96          
Coming into force 97 X X X X  
Schedules
Classification rules for medical devices Schedule 1 X X     X
Implants Schedule 2   X     X
Export certificates for medical devices Schedule 3 X X X X  

Annex C - Multi-Site Medical Device Manufacturers

Multi-site structure 1 (simple case - no subcontracting activities)
Description: Manufacturer, located in or out of Canada, performs some activities such as design, manufacture and associated activities but uses another part of the organization based in Canada to perform regulatory activities and possibly packaging, warehousing, distribution, service, and installation. All locations in and out of Canada are under the control of a single QMS.

In this case, the Health Canada Recognized Registrar will visit all sites defined in the scope of the QMS and will expect to find, at a location designated by the Manufacturer, objective evidence that the applicable clauses of the MDR have been addressed.

Multi-site structure 2 (limited subcontracting activities)
Description: Manufacturer, located in or out of Canada, performs regulatory activities and subcontracts some or all other activities like design, manufacture, packaging, warehousing, distribution, service and installation to entities that may or may not be part of the Manufacturer's organization. All activities that are not subcontracted are under the control of the Manufacturer's QMS. Control over the subcontracted products or processes is maintained through a formal, documented process that could use contracts, purchasing agreements, specification verification or second party audits.

In this case, the Health Canada Recognized Registrar will visit all sites defined in the scope of the QMS and will expect to find at the Canadian location, or any other location that has been delegated the responsibility by the Manufacturer, objective evidence that the applicable clauses of the MDR have been addressed.

The Health Canada Recognized Registrar uses the guidance given in section "2.3.2 Collecting Information" above to evaluate the need to visit a subcontractor that provides a product or service that will become part of, or could affect the quality of, the medical device.

Multi-site structure 3 (complex case- extensive subcontracting)
Description : Manufacturer, located in or out of Canada, puts its own name, trademark, trade name or logo on the label of a medical device but subcontracts all design and manufacturing and possibly packaging, warehousing, service and installation activities to component manufacturers, original equipment manufacturers or contract service providers that may or may not be part of the Manufacturer's organization. The Manufacturer also maintains a QMS that controls all subcontracted activities and services through a formal, documented process that could use contracts, purchasing agreements, specification verification or second party audits.

In this case the Health Canada Recognized Registrar will visit all sites covered by the scope of the QMS and will expect to find at the location that has been delegated the responsibility by the Manufacturer, objective evidence that the applicable clauses of the MDR have been addressed.

The Health Canada Recognized Registrar uses the guidance given in section "2.3.2 Collecting Information" above to evaluate the need to visit a subcontractor.

Note: IAF GD2:2005, Annex 3, 2.0.1, states,: "The products / services provided by all the sites have to be substantially of the same kind and have to be produced fundamentally according to the same methods and procedures."

Annex D - Guidance on Potential Audit Situations

Should a Health Canada Recognized Registrar certify a "new" QMS?

It is acknowledged that a Health Canada Recognized Registrar may be reluctant to issue a certificate to a Manufacturer because their QMS could be considered "brand new" thereby making an objective assessment of the effectiveness of the QMS difficult. However, the regulatory requirement is for the Manufacturer to have a valid certificate in order for them to receive a medical device licence.

In this case, Health Canada expects the Health Canada Recognized Registrar to issue the certificate based on their audit of the implemented QMS but has an understanding with the Manufacturer that a second audit will be performed within 12 months that will focus on a review of the effectiveness of the QMS.

Brand new QMSs may have to the audited for start-up companies or when there is a change in manufacturing facilities. The Health Canada Recognized Registrar shall audit the Manufacturer as soon as possible within the next 12 months after the issuance of the QMS certificate to verify full implementation.

What should an auditor do if there is no design file or design history file?

If a medical device was placed on the Canadian market prior to 1998, the year that the MDR came into force, it is possible that the Manufacturer may not have the original design file or design history file. Under such circumstances, Health Canada does not expect the Manufacturer to recreate the design file. Instead, the Manufacturer will be expected to have documented procedures in place that could be implemented for the "design and development" process. The intent of these procedures would be to demonstrate what the Manufacturer would do if they were to introduce any new product or if they were to make a change to an existing medical device.

Where should documents be stored?

To minimize travel time and expense of an auditor, all necessary documents that a Manufacturer needs to demonstrate that they conform to a QMS standard should be kept at the Manufacturer's location. However, in more complex multi-site or virtual Manufacturer organizations, the Manufacturer could refer to the location delegated by them where the documents are kept. However, these documents must be easily accessible by the auditor and if the auditor wishes to review these documents, then they must be made available by bringing the documents to the auditor or having the auditor go to the location where the documents are kept.

Section 9(2) of the MDR requires all Manufacturers to keep objective evidence to establish that the medical device meets the safety and effectiveness requirements of section 10 to 20. The MDR also require the Manufacturer to maintain complaint handling records or procedures, mandatory problem reporting procedures, recall procedures, and distribution records.

All documents shall be made available to the auditor, including internal audits and management reviews.

Annex E - Date of Initial Promulgation of Medical Devices Regulations and Amendments (up to December 2006)

Date of Initial Promulgation of Medical Devices Regulations and Amendments (up to December 2006)
Year of Publication Reference Detail Canada Gazette Part II website
1998 Schedule 1101 SOR/98-282 Medical Devices Regulations http://gazette.gc.ca/archives/p2/1998/1998-05-27/html/sor-dors282-eng.html
2001 Amendment Schedule 1258 SOR/2001-217 Amendment to Section 97 (3) postponing coming into force date of QMS requirements in section 32(2)(f), 32(3)(j), 32(4)(p) from July 1, 2001 to January 1, 2003 http://gazette.gc.ca/archives/p2/2001/2001-07-04/html/sor-dors217-eng.html
2002 Amendment Schedule 1162 SOR/2002-190

Amendments to sections 1, 21, 23, 24, 61, 65, 78, 88 to correct oversights inadvertently introduced in the MDR in 1998 as well as removal of unnecessary requirements and definitions.

Addition of new sections 61.1 and 65.1 relating to mandatory problem reporting and recalls.

http://gazette.gc.ca/archives/p2/2002/2002-05-22/html/sor-dors190-eng.html
2003 Amendment Schedule 1293 SOR/2003-173

Amendments to sections 1, 32(2)(f), 32(3)(j), 32(4)(p), 43(1)(b), to make changes related to the handling of QMS certificates.

Addition of new sections 32.1, 32.2, 32.3, 32.4, 32.5 relating to Health Canada Recognized Registrars.

Addition of new section 43.1 requiring manufacturers to submit a new QMS certificate to Health Canada within 30 days of it being issued.

http://gazette.gc.ca/archives/p2/2003/2003-06-04/html/sor-dors173-eng.html
2005 Amendment Project 1402 SOR/2005-142 Section 1 changed and new sections 43.2 to 43.6 added to allow low-cost versions of patented medical devices to be manufactured solely for exportation to developing countries. http://gazette.gc.ca/archives/p2/2005/2005-06-01/html/sor-dors142-eng.html
2006 Amendment Project 1484 SOR/2006-197

Sections 1, 32(2)(f), 32(3)(j), 32(4)(p), 32.1 to 32.4, 40(1)(f) and 43.1 modified by replacing the terms "quality system certificate" and "quality system" with the terms "quality management system certificate" and "quality management system".

Sections 32(2)(f), 32(3)(j), 32(4)(p) reflect CAN/CSA-ISO 13485:03.

http://gazette.gc.ca/archives/p2/2006/2006-09-20/html/sor-dors197-eng.html

Annex F - Acronyms

CMDCAS
GHTF
 
HPFB
IAF
 
ISO
 
MDB
Medical Devices Bureau
MDR
 
SCC
 
TPD

Page details

Date modified: