ISO 13485 QMS Scope: Common Audit Risks

Imagine the auditor opens the Quality Manual and sees that the organisation performs sterilisation, installation and servicing.

Except… your organisation doesn't perform any of those activities.

Understanding ISO 13485 QMS Scope #

This part is not about making your organization sound more impressive. It is clearly stating what your organization does. It is about identifying which activities are included in your quality system. The scope must be precise. It must reflect the work your organization does. This is the foundation. A clear scope means a quality system. A strong quality system means compliance. Better compliance means patient safety. That is the goal.

The scope of a Quality Management System is more than a paragraph that is added to the Quality Manual to finish a document. The scope of a Quality Management System draws the borders of your Quality Management System. It tells you which activities, products, services and processes your organisation must manage. And getting it wrong can create confusion during audits, especially when the activities mentioned in your Quality Manual do not match what your organisation does.

What should the QMS scope include? #

Depending on the organisation's activities, the scope may cover:

• Design and Development
• Manufacturing
• Assembly
• Storage and Distribution
• Sterilization
• Installation
• Servicing

But here is an important aspect: not every organisation necessitates to cover every process. #

For example, a medical device manufacturer that develops, fabricates, assembles, retains, and dispatches its products may not perform sterilizing, installation, or service activities itself.

In that circumstance, these processes should not inherently be included in its defined area. The scope should capture the organisation's existing responsibilities and activities, while pertinent externally performed activities must be adequately regulated.

How should you define the scope in your Quality Manual? #

1. The products covered: Which medical devices does the QMS apply to?
2. The activities covered: Does the organisation design, manufacture, assemble, or distribute the devices?
3. The applicable requirements: Are any requirements considered not applicable? For example, a manufacturer might define its scope as:

Design and development, manufacturing, assembly, storage, and distribution of medical devices.

If applicable regulatory requirements allow the exclusion of design and development controls, these requirements may be used to justify their exclusion from the Quality Management System (QMS). In such cases, any alternative approaches specified by the regulations must be incorporated into the QMS. The organization is responsible for ensuring that any claim of conformity to this International Standard clearly reflects the exclusion of design and development controls, where applicable.

If any requirement under Clauses 6, 7, or 8 of this International Standard is not applicable based on the organization's activities or the nature of the medical devices covered by the QMS, the organization may exclude that requirement from its Quality Management System. The justification for each requirement identified as not applicable shall be documented in accordance with Clause 4.

Can an organisation exclude activities or requirements? #

Yes, but there is an important distinction.

An organisation should define its QMS scope based on its actual activities.

Just because a company outsources a task it doesn't mean they no longer have to be in charge of how that task is done.

Take sterilization for example. If the company outsources sterilization, they still need to make sure the service provider follows the controls and standards when needed.

The point isn't to make the scope look big or impressive. It's to get it right. To make sure it's reasonable and matches how the company works.

Key Takeaway #

Your QMS scope defines the boundaries of your quality system. It should accurately reflect your organisation's actual activities, products, and applicable requirements rather than claiming to cover everything.

V Reg Solutions help medical device companies define and strengthen their QMS scope, align quality practices with applicable ISO 13485 requirements, and prepare for audits with greater confidence.

Because in a QMS, clarity starts with knowing exactly where your quality system begins and where its boundaries lie.