Shifting Auditor Competency in the Supply Chain: The Impact of New IAF MD9:2022

Medical device regulators and the medical device industry will benefit from the added confidence

Published: Tuesday, February 15, 2022 - 13:03

The IAF Medical Device Working Group has updated one of the most important documents that supports the medical device quality system ISO 13485. IAF MD9:2022—“Application of ISO/IEC 17021-1 in the field of medical device quality management systems (ISO 13485)” provides the mandatory requirements for auditors to ensure they are competent, impartial, and spending enough time doing their audits, especially where medical devices present a higher risk to patient safety.

New solutions to problems within the supply chain

In 2017, IAF MD9 was published with the aim of supporting manufacturers and other organizations that were not making medical devices, but were supplying “parts and services.” This followed after the ISO 13485:2016 standard was revised, which opened up ISO 13485 for more casual use. Since then, thousands of companies have sought ISO 13485 certificates for what are essentially unregulated products and services.

The main change to IAF MD9 in 2017 was the additional Table A1.7, which introduced a new “main technical area” to support suppliers of parts and services. Unfortunately, a couple of years into the application of IAF MD9:2017, auditors reported concerns that some companies seemed to be taking advantage of this new scope.

The IAF Working Group was asked to address abuses such as the following, which the new IAF MD9:2022 will now correct.
• The organization manufactures “parts” advertised for use in implanted medical devices.
• Some companies advertised they made medical device software under consulting “services.”
• Some companies made near-complete medical devices and called them “parts.”

Although regulators rarely have a legal basis to audit these kinds of organizations, they have become a grave concern. Often, some of the most important work concerning the safety and effectiveness of medical devices is wrapped up in activities beyond the control of the legal manufacturer before a device is placed on the market. The legal manufacturer is the company with legal authority to design, manufacture, package, and label a product or device, and may do little more than register the device under their own name.

Some of these activities are important and support the safety and effectiveness of our medical devices. Some regulators refer to these as “critical suppliers.” In Europe, notified bodies can be expected to consider doing an additional audit of these critical suppliers, and can even make the legal manufacturer pay extra to cover the additional audit of that supplier’s quality management system (QMS).

Improving allocation of auditors and their competencies

Under IAF MD9:2022, these critical suppliers may continue as they have, but the conformity assessment bodies (CABs)—aka auditing organizations—are now expected to check a company’s website and send in auditors who are competent enough to examine that QMS, especially when they see claims by the company’s website that indicate the part or service is supporting certain kinds of medical devices.

For example, if a company is advertising that they make screws for implanted medical devices, the ISO 13485 audit must be handled differently than for a company advertising fasteners used for general purposes. In the case where a company seeking ISO 13485 certification advertises itself as providing consulting services and indicates they are creators of medical device software, CABs will be expected to send auditors with competencies sufficient to assess the QMS in light of some expected practices that are unique to developing medical device software.

How does this help the medical device industry?

Some regulators are now demanding that the legal manufacturers pay much closer attention to critical suppliers. IAF MD9:2022 improves audits of critical suppliers by using audit teams that carry technical expertise, when appropriate, related to the types of medical devices in the other “main technical areas” (e.g., A.1.1 thru A.1.6). It requires that auditors who have experience with medical devices be involved in auditing notably medical-device-like parts and services.

After a critical supplier has earned their certificate under these conditions, these critical suppliers may be excused from further auditing by their customer’s CAB, which should reduce costs for everyone.

IAF-backed ISO 13485 certificates issued under their multilateral recognition arrangement are now recognized by the European cooperation for Accreditation (EA). The improved audits could actually save a company thousands of dollars in additional auditing fees. These more credible ISO 13485 certs provide a reason for notified bodies to excuse additional audits of certain critical suppliers.

Companies that are critical suppliers of parts and service will likely find that having a more seasoned and experienced medical-device auditor reviewing their quality systems is a good thing. Despite the usual fears that “they will know better where to look,” experienced auditors also know what can be ignored as inconsequential and have a better grasp of what is within reason while pressing hardest on the important areas of concern to patient safety and regulatory compliance.

Capacity building: Adding more ISO 13485 auditors is important

Roughly 30,000 organizations worldwide hold ISO 13485 certificates issued under the IAF Accreditation Program. That number continues to grow each year. To meet demand for the future, more auditors are needed. Since less expertise is required for auditors who support generic parts and services, the IAF has provided the right amount of room for new auditors to get started in supporting ISO 13485. IAF MD9:2022 simply aims more experienced auditors where they are needed most.

Medical device regulators and the medical device industry will benefit from the added confidence provided by the IAF’s new IAF MD9:2022. The goal of the IAF accreditation system is to provide confidence in medical devices made where the ISO 13485 QMS is expected to be applied. No longer is just one certificate good enough. Medical device supply chains are complex, and ISO 13485 is needed deep within them. It’s not merely the credibility of ISO 13485 certificates that is supported here, but also the well-being of billions of patients, who are undergoing every imaginable treatment supported by medical devices manufactured by companies that are certified to ISO 13485.

About The Author

Grant Ramaley

Grant Ramaley is the director of regulatory affairs for Aseptico Inc., a manufacturer and marketer of dental support equipment in the United States and Canada since 1975.  Ramaley also is co-chairman of the Regulatory Affairs and Standards Committee for the Dental Trade Alliance, Convener for the ISO 13485 Medical Device Working Group at the International Accreditation Forum, and Technical Committee Advisor to the Global Harmonization Working Party.