Preparing for ISO® 13485 Certification Success

Benefits of ISO® 13485 Certification

Faster Product Development Cycles

ISO® 13485 certification speeds up processes, shortening the time it takes for a product to go from development to delivery. 

A healthcare equipment manufacturer that wants to introduce a new medical device can use ISO® 13485 guidelines to streamline design, testing, and validation procedures. This not only helps the company bring the device to market faster but also ensures that it meets regulatory standards and customer expectations.

Create a Culture of Continual Improvement

ISO® 13485 promotes continuous improvement by requiring regular assessment and optimization of processes. For example, an IT/SaaS company handling medical data storage and sharing can benefit from ISO® 13485 principles. 

The company can consistently evaluate its information security protocols, identify vulnerabilities, and make improvements to enhance its cybersecurity measures. This helps protect sensitive patient information and adapt to evolving threats.

Evidence-Based Decision-Making

ISO® 13485 certification requires companies to make decisions based on accurate data and evidence. For a healthcare software development company launching a new application, adhering to ISO® 13485 standards means collecting user feedback, conducting thorough testing, and analyzing performance data. 

This data-driven approach allows for informed decisions and the creation of software solutions that meet industry requirements and prioritize users.

Understanding the Cost of ISO® 13485 Certification

The cost of ISO® 13485 certification depends on a range of factors, including:

• Company size

• Number of products

• Complexity of products

• Level of support required

• Certification body used

Generally, the cost of ISO® 13485 is reported over 2–3 years since there are ongoing costs like maintenance and re-certification. While it’s impossible to give accurate estimates, a 3-year range for an SMB might be $10,000 to $25,000+ (depending on the amount of work they do in-house).

There are also additional costs you might incur, including:

Assessment and Gap Analysis

Before certification, companies typically conduct an initial assessment or gap analysis. This involves evaluating existing processes against ISO® 13485 requirements to pinpoint areas for improvement. While this step incurs costs, it's essential for laying the groundwork for certification.

Process Improvement

Aligning your practices with ISO® 13485 standards may necessitate process enhancements or restructuring. This could entail updating documentation, revising workflows, and implementing new procedures. Though costs vary, these changes are crucial for achieving compliance.

Training and Education

ISO® 13485 certification often mandates training employees to understand standard requirements and their application. This might involve workshops, seminars, or hiring experts for in-house training. While upfront costs are involved, this equips your team with vital knowledge.

Documentation and Auditing

Maintaining documentation showcasing adherence to ISO® 13485 includes policies, procedures, records, and reports. Partnering with an accredited certification body for audits incurs fees covering site visits and assessment services.

Certification Body Fees

ISO® 13485 certifications are offered by certification bodies, both accredited and non-accredited. Customers choose certification bodies based on factors such as customer demand, budget, lead time, and implementation level. Accredited certification bodies are considered more reputable and reliable than non-accredited ones.

The certification process involves application scrutiny, document review audit, certification audit, and issuance of the certificate. The costs for small businesses with less than 10 employees range from $2,000 for non-accredited bodies to $5,000 for accredited bodies. Additional fees apply for every additional 10 employees.

How To Prepare for ISO® 13485 Certification

1. Familiarize Yourself with the Guidelines

Before diving into the certification process, it is essential to understand the requirements and guidelines outlined in ISO® 13485. This standard outlines the quality management system (QMS) requirements for the design, development, production, and distribution of medical devices. 

• Example for Healthcare: A medical device manufacturer must ensure that their QMS includes procedures for risk management, design control, and post-market surveillance to meet ISO® 13485 requirements.

• Example for IT/SaaS Companies: An IT/SaaS company must align its QMS with data protection regulations such as the Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR).

You can view a preview and purchase the complete ISO® 13485 documentation from the ISO website. 

For more information and personalized guidance, ISMS Connect offers step-by-step guides and detailed documentation to help you make sense of the standards and ensure compliance. We also offer on-demand expert guidance designed to break down complex ISO® controls[1] [2]  and standards into easy-to-follow steps.

2. Meet Corrective and Preventive Action (CAPA) Standards

Corrective and preventive actions (CAPA) are fundamental aspects of ISO® 13485. 

Corrective actions are actions taken after a problem has arisen designed to fix it. For example, if a newly released model was malfunctioning, the healthcare equipment manufacturer who built it might take corrective action by issuing a recall or a software patch.

Preventative actions are actions taken before a problem arises designed to stop it from happening again. For example, if a medical device’s circuit board overheats, the manufacturer might take preventative action by redesigning the circuit to dissipate heat better.

Companies need to establish processes for identifying and addressing nonconformities and potential issues. This ensures that corrective actions are taken when problems arise and preventive measures are implemented to avoid their recurrence.

• Example for Healthcare: A healthcare company identifies a potential issue in a medical device during production and promptly investigates to determine the root cause. They implement corrective actions, such as process adjustments or staff training, to prevent the issue from reoccurring.

• Example for IT/SaaS Companies: An IT/SaaS company receives a data breach report and immediately launches an investigation to determine the extent of the breach. Following the investigation, they implement measures like encryption protocols, two-factor authentication, and employee cybersecurity training to prevent future breaches.

3. Prepare a Quality Plan

A well-defined quality plan serves as a roadmap for achieving ISO® 13485 compliance. The plan should outline the company's goals, processes, responsibilities, and timelines for certification preparation.

A good quality plan should include the following elements:

• Definition and Scope: Clearly describe the activities and objectives of the plan.

• Quality Plan Inputs and Objectives: Identify the inputs and establish documented objectives.

• Responsibilities and Resources: Clearly define responsibilities and allocate necessary resources for plan implementation.

• Communications: Specify communication responsibilities and establish a methodology for effective communication.

• Design and Development: Reference applicable plans, specifications, and regulatory requirements for design and development processes.

• Manufacturing: Include processes, inputs, and outputs related to production and service provision.

• Identification and Traceability: If necessary, outline requirements for identifying and tracing products.

• Customer Property: Describe how customer properties are identified and verified, and how non-conforming products are controlled.

• Control of Output Deviations: Document how deviations are identified and handled to prevent unintended use of non-conforming products.

• Audits: Define the extent of audits and how audit results will be used to monitor implementation and verify conformity.

4. Implement Complaint Procedures

Determine the types of complaints that are relevant to your organization. These could include issues related to device functionality, safety, labeling, instructions for use, and more.

After which, develop a complaint procedure document that outlines the steps to be followed when a complaint is received. Include details about how complaints will be documented, investigated, and resolved. Make sure the procedure aligns with ISO® 13485 requirements and any applicable regulations.

• Example for Healthcare: A healthcare company establishes a dedicated customer support team to handle complaints and inquiries related to their medical devices. They document each complaint and promptly initiate investigations to resolve the issues.

• Example for IT/SaaS Companies: An IT/SaaS company implements a complaint-handling process through its customer service platform to address user concerns related to its healthcare software. Each complaint is logged, analyzed, and appropriate actions are taken to resolve them.

5. Include Purchasing Controls

Purchasing controls ensure that the materials and services used in the manufacturing or development process meet the necessary quality standards. These controls help prevent defects and non-conformities in the final product.

• Example for Healthcare: A medical device manufacturer establishes strict supplier evaluation criteria and conducts regular audits to ensure their suppliers meet ISO® 13485 standards. They also maintain records of approved suppliers and their evaluation results.

• Example for IT/SaaS Companies: An IT/SaaS company implements purchasing controls by carefully selecting vendors that adhere to information security standards and regularly evaluating their performance.

6. Develop MDR Procedures (Medical Device Reporting)

For healthcare companies dealing with medical devices, implementing Medical Device Reporting (MDR) procedures is critical. MDR helps companies identify and report adverse events and product malfunctions, ensuring continuous improvement and patient safety.

• Example for Healthcare: A medical device manufacturer establishes clear MDR procedures and educates their employees on how to recognize and report adverse events. They maintain records of all reported incidents and analyze the data to identify potential trends.

• Example for IT/SaaS Companies: An IT/SaaS company develops MDR procedures for their healthcare software to track and report any system malfunctions or vulnerabilities discovered by their users.

7. Conduct the First Internal Audit

An internal audit assesses the company's QMS to identify areas of improvement and compliance gaps. Conducting internal audits at regular intervals helps companies identify and address issues before the official ISO® 13485 certification audit.

• Example for Healthcare: A medical device manufacturer conducts an internal audit, involving auditors from different departments, to evaluate their QMS's effectiveness and compliance with ISO® 13485 standards.

• Example for IT/SaaS Companies: An IT/SaaS company performs an internal audit that includes evaluating information security controls, data access permissions, and incident response procedures.

8. Implement Corrective Actions

Following the internal audit, any identified nonconformities or issues must be addressed promptly through corrective actions. This demonstrates the company's commitment to continuous improvement.

• Example for Healthcare: A medical device manufacturer implements corrective actions by revising certain manufacturing processes based on the findings of the internal audit to ensure compliance with ISO® 13485 requirements.

• Example for IT/SaaS Companies: An IT/SaaS company takes corrective actions by updating its information security protocols and conducting additional training for its employees on data protection measures.

9. Organize the First Management Review

A management review is a crucial step to assess the QMS's effectiveness and the progress made toward ISO® 13485 certification. 

The standard defines mandatory inputs and outputs for the management review as follows:

• Inputs: Inputs include assessing the health of the QMS, feedback on compliance handling, reporting to regulatory authorities, audits, monitoring and measurement processes, corrective and preventive actions, and follow-up on previous reviews.

• Outputs: Outputs include records of the management review and queries that demonstrate successful addressing of identified outputs.

Top management must actively participate in these reviews and take corrective actions as necessary.

• Example for Healthcare: The management of a medical device manufacturer holds a review meeting to evaluate the company's progress towards ISO® 13485 certification, discussing any challenges and necessary adjustments to achieve compliance.

• Example for IT/SaaS Companies: The executive team of an IT/SaaS company holds a management review to assess the implementation of information security measures and address any gaps in their QMS.