Organizing quality and product management in companies

As product management affects the fulfilment of the product-specific regulatory require-ments and the QMS is directly subject to regulation, their design and organization are primarily important to companies manufacturing medical devices. Even though there are numerous and very detailed requirements for both, there is no one specific way they should be organized. Instead, it is up to the manufacturer to design and to construct the systems so that they are functional just in their organization, support the long-term busi-ness plans and objectives and are suitable for the products that the company markets while fulfilling the regulatory requirements set for them. The factors that are essential to take into account in the design include the size of the company and the number of sites, the target markets and the product or products that the company manufactures (White, 2018). It is also noteworthy that the quality and product management systems are not isolated but should be reviewed in the context of the other systems and overall objectives of the company.

For small companies operating at only one location, a natural choice is a single system that covers the whole organization. This applies for both quality and product manage-ment: in small organizations, it is often easiest to construct one QMS and one product management system that are utilized throughout organization. (White, 2018) Of course,

if the company manufactures more than one product, the product management system is usually applied to each product individually – however, the documented system is usually the same for all products and only the subject product is different. In addition, as demonstrating conformity is largely based on showcasing documentation, White (2018) suggests that small companies should rely on a QMS based on the classical pyramid structure of QMS documentation, presented in Figure 4. In the documentation pyramid, the most fundamental and widely applicable policy statements are on the top of the pyr-amid, followed by increasingly detailed and specific statements on the lower levels. Level 2 includes key procedure descriptions and the personnel responsible for them, level 3 details on how the procedures should be executed and level 4 evidence such as records and other documents that the requirements of the other levels have been met. (White, 2018) A similar documentation approach can also be used in the design of the product management system.

Figure 4 The classical pyramid of QMS documentation in which the level of detail of the documentation increases towards the bottom of the pyramid (White, 2018).

For larger companies operating at several locations or comprising several divisions at one location, there are many options for organizing the quality and product management systems. The choice of QMS design depends often on the organization culture: if the company relies on decentralization and autonomous sites or divisions, each of the sites or divisions may establish their own QMSs with the only central requirement of complying with established corporate guidelines. If a higher level of central control is pursued, for example a joint corporate quality policy and quality manual applicable to all sites or divi-sions can be established, which corresponds to an organization-wide level 1 documen-tation in Figure 4. If the goal is even more unified policies and processes, also level 2

documentation can be shared by all sites or divisions: all of them must in that case follow the common QMS processes and strategies. If also level 3 documentation is applied to all sites, the individual sites or divisions are practically only responsible for demonstrating that they fulfil the requirements set in the corporate-wide documentation, all of which are designed centrally. (White, 2018) According to White (2018), an organization-wide QMS is generally beneficial for most companies, but how much detailed guidance should be designed centrally and how much at each site or division varies per case. For the product management system, a congruent approach with different levels of central control can be utilized. However, the choice is also affected by the number of products and how their development, manufacture and other functions are spread across the organization.

The target markets of the company affect the quality and product management systems design directly, as the requirements for both QMS and the products themselves are dif-ferent in difdif-ferent jurisdictions. As the focus of this study is on EU and USA, the QMS and product management systems applicable to those markets are discussed here – however, if a company is primarily aiming at another market, they should design the systems to comply with that market’s requirements. For the design of product manage-ment systems, there are no specific models that are recommended for manufacturers to follow in either EU or USA. Instead, the system should be built so that it considers the requirements for the device in all stages of its lifecycle in that specific jurisdiction. If the product or products will be marketed in many target markets, naturally all of the different jurisdictions’ requirements must be fulfilled. Therefore it is often beneficial to determine the target markets already in the beginning of the product management system design, or make the system easily modifiable.

According to White (2018), manufacturers aiming primarily to EU and also other interna-tional markets benefit the most from establishing an ISO 13485 compliant QMS, while manufacturers aiming primarily to the US market should establish a QMS based on the FDA Quality System Inspection Technique (QSIT) framework, an audit technique devel-oped by FDA. If both markets are relevant for the manufacturer, either system design approach works, but the system should comply with the requirements of the other juris-diction as well. Especially in small companies, it may sometimes be useful to create a custom QMS that serves the overall needs and objectives of the company. A QMS built on the ISO 13485 framework is naturally a system that fulfils the requirements of the ISO 13485 standard and usually also follows its structure. The ISO 13485 structure is dis-cussed in detail in Section 2.2.1. (White 2018) A model of such a process based QMS as an ISO 13485 compliant QMS is shown in Figure 5. The model is based on the ISO 13485:2003 edition, but it includes essentially the same processes as ISO 13485:2016

and is applicable to the QMSs designed according to the 2016 version as well. It shows that the QMS processes discussed in the standard – management responsibility, re-source management, product realization and measurement, analysis and improvement – get their input from customers and regulatory authorities for example in the form of requirements and feedback. The processes are interlinked and information is transferred between them and the external stakeholders. The effectiveness of the QMS is main-tained through a specific process as well. (ISO/TR 14969:2004, Ch. 0.2)

Figure 5 The model of a process based, for example ISO 13485 compliant, QMS.

Information and value are transferred between the central QMS processes and external stakeholders. The effectiveness of the QMS is maintained through a specific process.

Adapted from Figure 1 of ISO/TR 14969:2004 (2004).

An FDA QSIT compliant QMS, in turn, is divided into seven subsystems: Management, Material controls, Design controls, Corrective and preventive actions, Production and process controls, Equipment and facility controls and Records, documents, and change controls. The framework has been originally introduced in FDA guidance as an example on how a QSR compliant QMS could be constructed so that it facilitates the examination of regulatory requirements during inspections. It is presented in Figure 6, in which the management system is positioned in the middle of the framework due to its central role in quality systems and processes. (White 2018) It is worth noting that nowadays in many FDA audits, the QSIT framework has been replaced by the Medical Device Single Audit Program (MDSAP), an audit program developed by IMDRF – however, QSIT is still the basis of the QMSs of many manufacturers operating in the US market (FDA 2020e). In

addition to the framework, White (2018) suggests that also a subsystem on sales and marketing should be added, as they are separately regulated outside of the QSR. Even though the ISO 13485 and QSIT frameworks are different, they share the objective of ensuring the safety and effectiveness of the products and require that the manufacturer identifies key processes important just in their organization related to the chapters or subsystems of the frameworks. These processes may include for example internal and external audits, software and process validation, customer feedback management and supplier quality management. (White 2018)

Figure 6 The FDA QSIT framework including seven subsystems. The management system is located in the middle as it has a remarkable impact on all the subsystems.

(White 2018)

Finally, the product or products that the manufacturer produces influence the choice of quality and product management systems design. In regard to product management, the requirements set for the device and thus the means to fulfil them vary based on the features of the product. (Ståhlberg 2015) The amount of resources and detail of design that each function of the product management system requires depends on the product features as well. For example, while plenty of thought has to be put to the distribution of physical products, such as imaging equipment or surgical knives, especially if they are sterile, the distribution of for example cloud-based software is often remarkably less re-source-intensive and may even require less complex plans in the design of the product management system. In addition, if the manufacturer produces multiple products, it is usually most practical that at least some parts of the product management system are separate and designed individually for each product. On the other hand, some functions, such as marketing, may be conducted commonly for all the products. In any case, it is

common for all kinds of products and product mixes that the product management sys-tem should be well documented and thoroughly implemented, in which ever way it is constructed.

Also the quality system design depends to some extent on the features of the product.

Some of the requirements introduced in ISO 13485 and FDA QSR are not applicable to all kinds of devices. For example, FDA QSR poses some requirements specifically for products with features or quality that deteriorates over time. They do naturally not apply to all devices, but it is the responsibility of the manufacturer to determine which QMS requirements should be fulfilled just in their QMS design, and potentially to provide au-thorities with a rationale on why some requirements are not relevant to their organization.

(Ståhlberg 2015) Again, if the manufacturer produces more than one product and espe-cially if their risk class and thus the regulatory classification are not the same, it is im-portant to ensure that the QMS covers all if the products and fulfils the QMS requirements governed by the classification of the device. On the other hand, according to White (2018), in case there are several products with very different features, it may be reason-able to establish separate QMSs, especially if the products are manufactured at different sites.

In conclusion, the organization of product and quality management systems depends strongly on the company and its objectives. While various different decisions have to be made on the number and centralization of the systems as well as the framework that they are based on and processes and other contents they include, it is common for all systems that the more carefully they are designed with the operating environment and long-term objectives of the company in mind, the more successful they probably are. The systems are not only established in order to meet regulatory requirements, but to support and facilitate the business and everyday operations of the company.