Good day to all and welcome back to another week of MedTech Compliance Chronicles. Last week we spoke about management responsibilities which help ensure that those with decision making authority are actively involved in the maintenance and continued effectiveness of the quality management system (QMS). Management responsibility provides a good transition into this week’s topic, resource management, as providing the necessary resources for the QMS is one of management’s responsibilities.
Resource management plays a crucial role in the medical device industry, it is the vital bridge between a bunch of written requirements and documents to producing a finished, working product. Fundamentally, resource management is broken up into three main categories: human resources, infrastructure and work environment. Today we will go into depth on these three types of resources and how to meet the corresponding requirements for each from ISO 13485:2016.
Human Resources
The primary focus of the human resource requirements is to establish the competence of all employees performing work related to quality. All human resource requirements focus on either determining, establishing or documenting competence. Competence is defined by ISO (in ISO 9000:2015 QMS - Fundamentals and Vocabulary) as the “ability to apply knowledge and skills to achieve intended results.” It is further stated in ISO 13485:2016, that the basis for competence is education, training, skills and experience or any combination thereof. Now that we know what we are talking about when we say a person must be ‘competent’ to perform their duties, we can get into what is required from the organization’s perspective.
The organization's responsibilities in relation to competence of personnel include determining the necessary competencies, ensuring that their organization has these competencies, evaluating the effectiveness of competency determination and acquisition and, of course, documenting all of this. This section of the standard also re-emphasizes the importance of communicating to each employee the relevance and importance of their work and how it impacts quality.
Determination of competence involves knowing your processes and what is required to operate them in-depth. You should determine a minimum level of education for all employees who perform work related to quality, it does not have to be the same for all positions but all positions should have an established minimum education. Training, skills and experience are much harder to establish set levels as these can vary greatly depending on when, where and how the individual was given said training or acquired said skills and experience. In order to objectively determine skills, training and experience necessary, you need to really break down each individual role in your QMS, the tasks an individual in that role must execute and the potential effects of those tasks on product quality. This will help you highlight what types of knowledge is necessary to perform the tasks and give you a means of prioritizing them by their potential effects on quality.
After you have determined the necessary competence required for each role, you must now ensure that each individual in those roles meet the determined level of competence. You have a number of options to do this and the regulatory authorities do not really care how you go about it, just that it's done. You can either hire people who already have these competencies and document how you determined they have them (degrees from accredited universities in a related field, prior related experience, etc.) or develop a training program to give new employees the necessary competencies which could include both in-house and externally provided training. A combination of both approaches is most common in practice.
Finally, you must evaluate the effectiveness of the actions you have taken to determine competency and, of course, maintain records of all of this. Evaluating the effectiveness of your actions basically becomes evaluating the effectiveness of the person in the role and is usually done with performance reviews, practical assessments or by evaluating the impact on the person’s work on the company. You can then use this information to determine if the criteria you have set or new hires or the internal training programs you have developed are adequate.
Infrastructure
Infrastructure requirements focus around the facilities and equipment needed to produce your product, as well as any auxiliary services such as transportation, IT, software, etc. You must have infrastructure that not only achieves conformity to product requirements but also facilitates orderly handling of your product and prevents product mix-up.
Achieving conformity to product requirements is a fancy way of saying you must physically have the ability to make your product. If your product is massive and requires a lot of heavy machinery to make, you should have a fairly large facility, with all of the necessary equipment and clearly identified locations for parts and raw materials, in-process materials or assemblies and finished goods. There should also be clear identification at inspection points of product that have or have not been inspected and product that have or have not passed. Likewise, if your company is more software based, you must be sure that you provide adequate connections to the internet or any other services, computers or other equipment, and any access permissions given out that are necessary to produce your product. Similarly to the physical goods, all files must be properly identified and efforts must be made to prevent mix-up or use of the wrong files/software/documents.
Finally, you must determine any maintenance that any of your infrastructure may require. For mechanical equipment this usually comes in the form of lubrication or changing parts. For computer applications this is usually keeping your software up-to-date. Buildings can have a number of maintenance activities from those related to HVAC to pest control but remember, for regulatory purposes, only maintenance activities that are necessary to ensure product conformity are required to be documented. Calibration is sometimes referred to a maintenance activity on monitoring and measurement equipment but there will be a whole post later specifically on controls of monitoring and measurement equipment.
Work Environment
The final resource requirement the standard puts on organizations is control of the work environment. This is also a point when I really must remind you that only resources that actually have the potential to affect product quality are subject to any of these requirements. Control of the work environment refers to the health and cleanliness of personnel and special conditions of the ambient environment (in most cases referring to cleanrooms).
If your product requires a special work environment to be produced you must document those conditions, the infrastructure requirements of them and the personnel requirements of them. All personnel who work in controlled environments must be trained to work in those environments or, in cases where they only need temporary access, must be supervised by someone who is trained.
Conclusion
I hope you now have a better understanding of resource management as it is required by ISO 13485:2016. Please also remember, even though these requirements are not specifically stated in the US FDA’s part 820, this level of detail is what is expected when they require management to provide ‘adequate resources,’ which is why we spent this week covering solely an ISO clause and did not really touch on FDA regulations.
Thank you all for coming this far, next week will finally get into the fun stuff: Product Realization! Or planning for it at least.
Kommentare