Medical Device Link.

Originally Published IVD Technology May 2003

IVD Directive

When documenting quality assurance systems, IVD manufacturers must describe every aspect of a device’s production. 

Jens Butenandt

Preparing for quality assurance assessments is one of the most arduous tasks required by the European Commission (EC) for attaining the CE mark. The scope of necessary review, documentation, and analysis is enormous, ranging from the design of device manufacturing methods to company managerial structure and function. Not only must manufacturers completely analyze and describe all IVD device-related manufacturing processes, but they must also present the structure and function of all company personnel that have an impact on the product. 

Taking a forward-thinking step-by-step approach to preparing for quality assurance assessments will allow IVD manufacturers to present a thorough and effective quality assurance system, and allow for a favorable review by a notified body. A careful analysis of manufacturing processes may even lead to substantial refinement and improvement of the processes, leading to a lower cost or length of time required for production.

This article examines the structure, scope, and requirements for creating a quality assurance system that meets the requirements outlined in the European Union’s IVD Directive. 

Quality Assurance System Evaluation

The directive for in vitro diagnostic medical devices (Directive 98/79/EC) is one of the most recent new-approach directives created by the EC. This directive uses a risk-based principle to regulate the conformity assessments of all IVDs sold in the member states of the European Union. 

Notified bodies are certified third parties that are required to be involved in the conformity assessment of all IVDs that pose a high risk to practitioners, laboratorians, or patients. High-risk IVDs include all devices used for self-testing as well as those listed in Annex II List A and List B of the directive. However, conformity assessments for the majority of IVDs do not require the involvement of a notified body. 

Manufacturers of Annex II IVDs must demonstrate that every device meets the essential requirements listed in Annex I. These manufacturers must also produce a technical file for every product, as required by Annex III. In addition, they must follow the principles of quality assurance outlined in Annex III section 4. These principles were established to ensure that all batches or series of a product fulfill the essential requirements of the directive.

Even if a manufacturer of Annex II List B or self-testing devices chooses to take a conformity assessment route, as directed in Annex V (“EC Type Testing”) along with the route described in Annex VI (“EC Verification”), it must follow the basic principles of quality assurance when designing its quality management system (QMS).

Basic Requirements

General topics that must be addressed by a quality assurance system are described in Annex III of the directive. According to the directive, a quality assurance system should cover:

• The structure and responsibilities of all parts within the manufacturing organization.
• The manufacturing processes and systematic quality control of production.
• The means used to monitor the performance of the quality system.

Several integral components of a quality assurance system are described in Annex III section 5. These include a manufacturer’s responsibility for establishing: 

• A process for long-term postmarketing surveillance.
• A process for initiating corrective action. 
• A process for notifying competent authorities of any incident or potential incident.

Standards for Quality Management Systems

Table I. A comparison of the quality system components required by ISO 13485:1996 (the first version of the standard) and those required by the newest draft version, which is expected to be approved later this year. Quality system components are listed along with their location in the corresponding standard. For a complete comparison, see Table A.2 in the newest draft version of ISO 13485 (Click to Enlarge).

Standards have been developed to aid in the fulfillment of the IVD Directive requirements. The European Committee for Standardization (CEN; Brussels) and the European Committee for Electrotechnical Standardization (CENELEC; Brussels) are international committees that develop and approve these standards.

To facilitate the interpretation of QMS requirements, the standards EN ISO 13485:2000 and EN ISO 13488:2000 have been harmonized under all medical device directives by CEN and CENELEC. These standards add medical device–specific requirements to the 20 quality management elements listed in EN ISO 9001:1994 and EN ISO 9002:1994.

In the future, ISO/DIS 13485:2002 will be updated to serve as a standard that is independent of ISO 9001:2000. The new standard will follow the same process-oriented structure as ISO 9001:2000, and both versions will stipulate what a QMS should cover, in accordance with the directive.

Currently, only EN ISO 13485:2000 and EN ISO 13488:2000 are harmonized, thus device manufacturers must attain conformity with these standards. Additionally, it is important for manufacturers to use the comparison table in ISO/DIS 13485:2002 along with the current standard EN ISO 13485:2000 to prepare for meeting all requirements of the future standard (see Table I).

Guidance in standard EN 928:1995 presents the requirements of the EN 46001 series and the EN 29001 series for IVD manufacturers. This standard does not refer to EN ISO 13485:2000. However, it is constructed in the same manner of listing 20 quality elements, and it provides guidance for how to meet the requirements of the 20 quality elements.

IVD manufacturers should be aware that the transition period of the IVD Directive does not correlate with the transition periods of standards. The transition period for the directive ends on December 7, 2003, for placing devices on the market, and on December 7, 2005, for putting devices into service. These are legally binding dates. However, the transition period for quality management standards is usually three years after the publication of the newest version of a standard.

Proper Documentation

According to the harmonized standard EN ISO 13485:2000, a quality management handbook is a necessary top-level document describing the central aspects of a company’s quality management system. Every employee should completely understand the handbook. Additionally, the handbook may be given to authorities or customers on request.

The handbook should contain the company’s quality policy, an overview of all manufacturing-related processes within the company, references to the company’s regulatory requirements, e.g., fulfilling the requirements of the IVD Directive, and all standards on which the company’s quality system is based. Work instructions and quality records should also be documented. 

Company Structure and Employee Responsibilities

A quality management handbook may also contain an organizational chart and short descriptions of the key responsibilities of employees. If such a chart is not included in a handbook, it should be available as a second-level document.

Separate documentation of job descriptions is necessary. In large organizations where quality control, quality management, and regulatory affairs are separate managerial functions, the role each employee plays in meeting the requirements of the IVD Directive must be well described. 
Even in small organizations, it is important to describe these responsibilities in detail to avoid any misunderstanding.

For example, in Article X, the directive requires that IVD manufacturers register their companies and their devices with the competent authorities. This responsibility should be assigned to one member of the company’s management team, along with the responsibility for notifying the competent authorities of any incident, near-incident, or systematic recall. National laws implementing the directive may specify additional responsibilities that must be assigned to managerial employees. 

Not only managerial and regulatory job responsibilities, but also, and more importantly, responsibilities that affect product quality must be described. Therefore, job descriptions must be available for every employee whose work has an impact on product quality. 

Manufacturing Processes

IVD companies often describe their manufacturing processes by creating detailed manufacturing protocols, or process operating instructions. These protocols may also be used as manufacturing records, if all variable parameters, including amounts of certain ingredients, stirring times, temperatures, etc., are documented. This is a standard practice in the manufacture of bulk reagents, and it is usually used to ensure that all batches pass their final quality control step. Even small companies create manufacturing protocols that serve as manufacturing records for many processes.
Although bulk manufacturing is usually one of the most important processes for most companies, special care must be taken to ensure that secondary processes like qualifying incoming material, reagent filling, labeling, kit packaging, and the final release of a product are also well regulated. 

The ISO 13485 series requires that, for every revision to a manufacturing process, a new work instruction must be documented, released, and available for review. Additionally, an assessment must be made of any effect on product quality caused by the revision before the manufacturing process is changed.

Systematic Quality

Control of Production

The most efficient way to demonstrate systematic quality control is through the creation of a manufacturing flowchart that lists all of the quality control and production steps that have been taken.

Usually manufacturing flowcharts present information on all components of the manufacturing process that may affect product quality, but that cannot be fully controlled by using quality controls. Some common process steps are the coating of strips, beads, or microplates; freeze-drying; filling of reagents; virus inactivation; and sterilization. These steps must be validated; otherwise there is no proof that the actions taken to control them ensure consistent product quality. 

A quality control system should include process support factors such as regular maintenance of equipment and monitoring of hygienic areas in production. Any validation or maintenance record is a quality record and must be as well documented as any test result obtained.
IVD manufacturers should be sure their quality records prove that, when each device leaves the company, it meets the specifications defined for it in the technical file. Traceability of a batch, not only to its corresponding records but also to the corresponding revision of product specifications, must be ensured. In manufacturing records, traceability should also be established for all batches of ingredients used. 

A systematic quality control of production also requires that a third party reviews all manufacturing and test records before a product is released to the market.

Figure 1. The plan-do-check-act cycle, as applied to the creation, maintenance, and continuous improvement of a quality management system (Click to Enlarge).

Monitoring Quality System Performance

The IVD Directive requires that the quality system itself is monitored, with a focus on all factors affecting product quality that cannot be ensured by validation or by testing. These factors include employee training, proper maintenance of instruments and equipment, and regular calibration of test equipment, as well as the regular reassessment of system efficacy along with the addition of improvements wherever necessary.

Several measures may be taken to monitor quality system performance. Surveillance and investigation of complaints is one monitoring method, albeit an indirect and retrospective one. Other measures can indicate quality trends at an earlier stage.

One effective method of monitoring is the tallying and investigation of nonconformity reports completed within the company. This is a very efficient monitoring method, as not only are product defects counted and investigated, but so are other nonconformities such as missing records, missing evidence of training, missing training, missing calibration records, and the use of unmaintained equipment.

An alternative method of monitoring quality system performance is monitoring the trends of quality indicators like microbial counts in hygienic areas and monitoring the values obtained with various quality control samples. 

Internal quality audits are a central factor in assessing quality system performance. It is important to audit all departments and functions. In every audit, the specific requirements of the IVD Directive and of the chosen quality system standards must be addressed. 

The quality system standards require that the management perform regular quality system reviews. Usually these reviews are performed semiannually or annually. They should completely examine the quality system by reviewing the numbers of and reasons for complaints and nonconformities, and trends and results of internal audits. 

At the end of every review, the management should assess whether the quality system fulfills the legal requirements of the directive, all other applicable regulations, and the requirements of the chosen QMS standard. The management should also watch for any negative trends and decide in which area corrective actions should be taken. 

The yearly management review should focus on defining any long-term actions that are needed or should be considered in the manufacturing planning phase, but the management should also implement regular quality meetings. In these meetings, problems that require a short-term action should be discussed and corresponding corrective action should be initiated. One method of monitoring the performance of quality management systems is the application of the plan-do-check-act cycle (see Figure 1).

Postmarket Surveillance

According to the directive, every IVD manufacturer is responsible for postmarket surveillance. The manufacturer must verify that its devices are used and perform as intended. Collecting customer complaints is one method of verification, but is not usually considered sufficient. Visiting customers and participation in external quality assessment schemes are additional activities that can enhance postmarket surveillance.

Initiating Corrective and Preventive Action

When a major problem related to a medical device is observed on the market, the manufacturer of the device will be asked to take corrective action. Depending on the severity of the problem, corrective action may involve an improvement of future products, a customer notification, or a systematic recall. 

Corrective action should be taken not only in response to customer complaints, but also when nonconformities have been observed within the processing line. Often, one correction will be used to rectify both an external and an internal nonconformity. In this case, the corrective action should include a statement that classifies the complaints and nonconformities according to varying levels of severity.

This list should take the form of a chart used to track the reports and document that a proper investigation, decision on immediate containment and correction, corrective action, and possibly a decision on preventive action have been taken. Additionally, notes should be taken on how the actions have been implemented and how their effectiveness has been monitored.

Additionally, quality management standards require that IVD manufacturers design and implement a process for taking preventive action in an effort to catch any problems that could lead to adverse incidents. Such a process should take an active approach to screening for potential problems by regularly conducting a failure mode effects analysis (FMEA). Such an analysis consists of routine quality assessment process analyses and regular risk assessment based on market surveillance.

The quality assessment process should include a system by which potential problems can be classified, the cause for the potential problem can be properly investigated, a decision on preventive action can be made, and the effectiveness of any action taken can be monitored. A company’s procedure for initiating preventive action should differ from its procedure for initiating corrective action only in the addition of a step for identifying potential problems.

Notifying Competent Authorities

The directive requires IVD manufacturers to design a procedure for notifying the competent authorities of any incident or potential incident. The legislation clearly demands what aspects of the incident must be reported, how they must be reported, and the time frame in which they must be reported. In order to ensure that the authorities are notified properly, according to the requirements of the directive, a notification procedure should be drawn up ahead of time.

Internal Audits

A quality system that has been designed according to the quality management system standard can be assessed according to how well it conforms to this standard. This type of certification requires auditors from a registrar to assess the QMS, approve the system, and recommend certification by the certification body of the registrar. 

To prepare for an audit, an auditor will assess a company’s quality management handbook beforehand. Auditors will usually send a company an audit plan ahead of time, describing which department will be audited and at what time the audit will take place. During the audit, the auditors will interview employees of various responsibility levels and ask them for descriptions of the company QMS procedures, their work instructions, and any quality records they have created to collect evidence demonstrating that the QMS described in the company handbook has been implemented and all aspects of the company’s chosen QMS standard have been met.

Working with Notified Bodies

Manufacturers of Annex II or self-testing IVDs must involve a notified body in the conformity assessment. If a manufacturer has selected a full quality system or a quality system production as its conformity assessment route, auditors from the notified body will assess both the quality assurance system and the manufactured products. The auditors will ask to assess the technical files of all List B or self-testing devices. This assessment can be performed either before or during the audit. 

For List A devices, a notified body will usually either assess the design dossier according to Annex IV section 4 or perform a type testing according to Annex V. If any issues could not be resolved via written communication and still remain open, they will usually be discussed during the audit. Design dossier assessment or type examination results might also require the discussion of unresolved issues relating to other product details, such as virus inactivation, during the audit.

Jens Butenandt, PhD, is a lead auditor for in vitro diagnostic medical devices and head of the IVD department at TÜV Product Service GmbH (Munich). He can be contacted at jens.butenandt@ tuev-sued.de.

Notified body auditors will also assess production records and validation records of production processes. These auditors usually expect to find several specific documented processes including procedures for assembling technical files, performing risk management, and translating product information, as well as contracts with an EC representative or OEMs when applicable. 

After a successful audit, a notified body will issue an EC certificate that is valid for five years. At this point, an IVD manufacturer can register all products covered by the certificate with the responsible competent authority. The notified body will regularly perform surveillance audits to ensure conformity after certificates have been issued. 

When selecting a notified body, companies should confirm that it has the required accreditation for the manufacturer’s chosen conformity assessment route as well as for the current and future products in its portfolio. 

It is also important to determine whether a notified body can provide further services such as certification according to ISO 13485/8 by a CMDCAS-recognized registrar for the Canadian market.

Conclusion

Quality assurance is an essential component of the IVD Directive requirements. However, a complete quality management system is not required in all cases. 

The EN ISO 13485 series of standards is harmonized and supports IVD manufacturers in fulfilling most of the requirements of the directive. Each legal requirement of the directive must be addressed individually.

For most conformity assessment routes, a notified body assesses the QMS before an IVD manufacturer receives its corresponding certificate. An overview of all EC directives and current standardization activities can be found on-line at http://www.newapproach.org.  

Copyright ©2003 IVD Technology