Quality Grind Podcast

Impact of Adopting ISO13485 in New QMSR for Medical Devices, Part 2

• MEDVACON Life Sciences • Episode 16

Share episode

Send us a text

In this episode of the Quality Grind Podcast, host Mike Kent continues his discussion with Medvacon consultant Armin Beck about the newly amended 21 CFR 820, Quality Management System Regulation for medical devices. The duo explores the implications of new FDA inspection techniques, the importance of thorough gap analyses for readiness, and the increased responsibility of executive management in quality oversight. The lens widens to discuss the potential impact on not just medical device firms but also the broader Life Sciences industry. The episode also offers practical guidance and resources to help organizations align with the new requirements and avoid regulatory pitfalls.

Contact MEDVACON:

  • Message us at @MedvaconLifeSciences on LinkedIn
  • Visit our website at www.medvacon.com/contact
  • Email us at qualitygrind@medvacon.com

Thanks for listening! Don't forget to follow us @medvacon on all platforms for updates on blogs and podcasts!

Ep 16 Impact of Adopting ISO13485 in New QMSR for Medical Devices, Part 2

Jessica Taylor: [00:00:00] This is the Quality Grind Podcast presented by Medvacon. Conversations that go beyond compliance. Sharing insights geared toward helping you navigate the everyday grind of regulated life science industries. Here are your hosts, Joe Toscano and Mike Kent.

Mike Kent: Welcome back to The Grind, everyone! Today we continue our visit with Medvacon consultant Armin Beck.

 To recap our discussion to this point, 21 CFR 820, the US Medical Device Quality System Regulation, has been amended. The Quality Management System Regulation takes effect on February 2nd, 2026. One of the major updates is FDA's adoption of ISO 13485, which on the surface is not a major change, but there are some important and impactful changes that medical device [00:01:00] firms should be evaluating right away.

Under ISO 13485, FDA will have access to your internal and external audit reports, as well as your Quality Management Review records. And ISO 13485 focuses heavily on Risk Management.

Part two of our chat with Armin will describe the impact of the amended regulation on FDA inspection and oversight practices, as well as the need for more active and direct participation from executive management in both the assessment process and ongoing oversight of their firm's compliance gaps and mitigation activities. Let's jump back into the discussion now.

With that, a couple other potential impacts to organizations as FDA adopts this final rule in February of 2026. FDA has said they will develop a new inspection process to align with the [00:02:00] requirements of the new QMSR, and that's going to be implemented when the new rule takes place. Is this, in your opinion, akin to what happened back when the Quality System Inspection Technique came on board? And what else do you see happening now with this new inspection process? Where do you think the FDA is going to take this?

Armin Beck: Well, I mean, the FDA has recognized it will be a challenge for them to get away from the QSIT and try to develop a training for their auditors to adopt a new inspection technique. In general, I think the FDA is overthinking this a little bit. You have still the older generation, but I also be included of this one. They liked the QSIT technology. I never liked it. And they doing this now since 30 years, and now they have to actually learn something different. 

I believe auditing the 13485 is sometimes more an individual [00:03:00] inspiration. You're going in a company and you can actually jump around. You start with something, you see something else, you're going back and forth and back and forth and come actually to the real problems of the company. So you have much more flexibility. And I believe the FDA need to accept that there is flexibility about this.

That is, not all companies can be audited to a structure, and I think that's a good thing. I think it's also a good thing for the FDA to understand that we have much more flexibility. The FDA understands with the 13485, there is more flexibility, but they also need to try to implement. 

This is the problem what they're having. One of the difference between the 13485 and the adoption of the 13485 is that in Europe or the rest of the world, the 13485 is a standard. In the United States, this will become the law. So if you don't have a certain general technique, people can take a lawyer and complain, well, you [00:04:00] inspected me in a different way. That will be a challenge for the FDA to figure out this, because they have to. 

You know, obviously the United States, everything is about lawyers. Everything is about making a mistake. So if they don't have a certain technique, it might be some legal issues. So I wish the best for the FDA that they find some really perfect way, but the FDA have clearly already admitted this will be a challenge.

Mike Kent: At the same time, really we characterize 13485 and the existing 21 CFR 820 as not having a ton of major differences, philosophically or structurally in that sense. I put those two things together with now the access to internal and external audit reports, quality management reports, is there adequate oversight? Is that oversight active and from the right people? And is there evidence to [00:05:00] suggest that what the management has dictated must happen is actually happening and actually having an impact?

For me, what that means is potentially, could the agency then come in and say, all ,right you have these issues. These issues have been reported upwards. But I don't see a lot of evidence that things have been addressed or addressed sufficiently, or the things that have been tried aren't working. And I don't see an awful lot of other things underway. At that point, it would seem to me that I could say your system is out of control. Your oversight is not present or being implemented accordingly. Therefore, I have even less faith in the general quality program at the site. I'm going to issue a pretty significant [00:06:00] 483 observation, and I'm going to go on to my next site. Am I connecting dots that are connectable or am I off base? 

Armin Beck: I 100 percent agree. the access to the management review, internal audits, external audit, make it for the FDA very easy, effective and efficient. And that's the point. And that's, it's a good thing. It is a good thing for any government agency to work effective and efficient, and everything what we can do, we should do this.

 The overall responsibility for a quality management system and for the risk management lies with the executive management or a top management or a CEO. 

So if I'm FDA auditor, now I go in, I don't have to review 10 CAPA reports with the Quality Manager. I look at your Management Review meeting and I see while your system is out of control and the management did not do what it should to be responsible for your quality management system. I don't have to look [00:07:00] at 50 CAPA records because I already know it doesn't matter for me.

Mike Kent: Exactly.

Armin Beck: I don't care.

Mike Kent: Right.

Armin Beck: You wrong. I caught you. You need to change. I write you up and I come back with 20 other auditors in three months, make it super easy. 

Mike Kent: We've gone into organizations where management is not really strong and not really active in this process. And the "blame" for the 483 or the warning letter trickles down into the organization, either the Director of Quality or the Director of Operations or people like that, who may have been trying, may not have been. Regardless, my point is now the people responsible for changing their behavior and changing their ways, it's not your Quality department. It's not your Operations department. It's not your site. It's the C suite executives that are named in the [00:08:00] 483 that says your oversight was inadequate and lead to this and who knows how many other issues.

Armin Beck: Exactly.

Mike Kent: Now the onus is directly on the senior executives of the firm to do something. And they're the ones that are going to be in front of the investigator next time they come in to say, "Okay, last time I was here, I pegged you four people as responsible. You all sit in the C suite. Tell me about what you specifically have done. Not what your Quality department has done, not what your Operations department has done, but how your behavior has changed. Am I on track? 

Armin Beck: That's absolutely right. And I love this actually. I mean, this is the thing with the FDA. Just an example, smaller startup companies funded by VC, the VC brought some guy in as a CEO, has no idea about medical devices, has no idea about anything, and now he is [00:09:00] responsible.

Mike Kent: Yeah, they always have been. But what happens is, and we know this from going into organizations all the time and being in organizations all the time, is they pass the buck down and say, here, go fix this. 

Armin Beck: Right. 

Mike Kent: Yeah, I can't help but smirk a little bit. I know that one of the intentions behind the QSIT all those years ago was to put the target a little higher in the organization. If that's what happens and oversight improves through active engagement, I'm really excited.

Armin Beck: And this is a good thing. I do this quality since so many years. And it is really, if a company is not committed to this one, if you're just hearing, we don't have to do this. Nothing has changed. As a Quality manager, you cannot change the organization. There's nothing what you can do. 

And that's just why I think right now with US companies, with a structure in the United States, with finance, with money it's a good thing to really make certain people responsible. And I think the [00:10:00] industry needs to change it. I think the medical device industry in the United States needs to understand who is responsible. We have to change the culture. And this is not just like talking, oh, we need to change the culture. No, we actually have to do something. We don't want to sell any medical device what is it's not right, we don't want to do this.

Mike Kent: So now what this does also, and this is the trainer in me, this now puts a much more significant onus on the executive management of any organization having a much better, more robust, not necessarily detailed, but a more robust understanding of quality, GMP, regulated environment. What does oversight really mean?

Because these are influential people that want to do the right thing. There's a phrase that I'm coming to know a lot better, and that's "assume positive intent". I have to assume that [00:11:00] individuals in these organizations want their companies to grow and be successful, want to do the right thing. That just, for me, that's a basic premise. 

So now there's additional focus on understanding, okay, what are those right things? What's your role in the process? You need to now be much more active in that process and provide greater, more detailed, more robust oversight. There, I think, is an opportunity for us to help coach those individuals and how they can become more an active part of the process, rather than more figure heads in that process. 

Question for you, Armin, as we go back to a topic that we started the discussion with. And we always tend to go to pharma because it's a big, huge part of the life science landscape, right?

But there's cell and gene therapy, there's biotech, there's diagnostics, there's all the different genres, if you [00:12:00] will, of life sciences. With the FDA heading down this road, should those other genres be on notice that this may be coming down the pike sooner than later for them?

Armin Beck: I think the answer is yes. I think the entire world tries to be better. And I think it's a matter of time when they start also going in a pharma industry and have the same requirements.

 I think the pharma industry or combination product industry should actually not wait. And a quality management system helps the company to be better. Why wait until somebody mandate to do this? I work for pharma companies, for combination product company, and I know the issues. And I think I running into walls trying to explain why quality management system is great. Because it's the same thing. "Oh, we do this design ideas. We're making tablets. Everything is fine." 

But I think we also need to try to educate the pharma industry that a quality management system to 13485, it's a [00:13:00] great thing. This will help you and we can help you to adjust. We can help you to build one. We can actually help you being a better company, making more profit. And sometimes it's out of my control. I don't know how, I'm not a sales and marketing guy. So I probably approach the wrong people.

Mike Kent: No I think you're spot on. I do think there's an opportunity for those of us who've had these experiences in the medical device world and really been systems focused.

I love the point that you made around us having a real opportunity to help coach and educate into the value of this, and also to that end, help people understand that it's not as arduous as they may think. It doesn't have to be extremely difficult. Organizations have systems in place already. They have processes in place already. It's about how we look at things and [00:14:00] shifting the lenses that we see things through to accommodate this perspective a bit more. And what could be learned, what could be gleaned, what could be adopted? A design-focused quality system, some of the unit operations don't necessarily support it. But what are the ones that do? What are the ones that could apply? What improvements could be made? It sounds like we've got the premise for another tremendous podcast in terms of what are the elements of design-based thinking that could help non-design-based organizations do their things better.

Armin Beck: I mean, I love this whole combination product. This is the whole thing. When we're talking about design, if you're designing a medical device and you sell this, the quantity is very small.

Now you're going in a pharma industry, you have a combination program, like a pre-filled syringe. You're [00:15:00] selling out millions or billions pre-filled syringe. Now you figured out you have a design problem. You have to recall billions of pre-filled syringes. You're losing so much. 

And this is this whole thing. Why not implement good design practices? Why can we not take something from the 13485 also if it's not required? Why not implement this? Why not making a right to avoid these recalls? But the problem, and I've seen this so many times, it's the cost of quality, what nobody sees. So long as there is no issue, why should I invest money? It's this whole rethinking, this education about the C level people who can adjust the budget to say, look, if this has happened, it might not happen, but if not, this is a problem. And, I don't know how we can get into this one, but I think we have to.

Mike Kent: Yeah. I'm with you. What could go wrong? You could have to, as you [00:16:00] said, recall 10 million pre-filled syringes for a critical life saving drug. 

Armin Beck: Right. 

Mike Kent: Now you've just created a drug shortage because one of your suppliers of your plunger for your syringe, there was an issue with. Should we have known about this? Could we have predicted that as a problem? And what was our fail safe for getting out in front of it? 

If we ask all of those questions up front, yeah, it may take us a few months to figure that out with resources allocated towards that. But if you can help prevent a drug shortage, which could cost patient lives, your company's reputation? I think eventually where this is headed is with all of this efficiency and effectiveness, global harmonization and we are still having problems with drug shortages in the pharma industry.

What [00:17:00] happens if now FDA turns around and say, well, you should have been able to predict that these failures would lead to a drug shortage. It happened. You didn't have anything in place. And I know that because I've looked at your Quality Management Review records and your internal audit reports and none of this was ever considered, but it should have been. Now you're financially liable for every one of those patients and their health and their medical costs and everything else. You think that a CEO wouldn't take notice and say, "We got to get out in front of this!"? 

Armin Beck: This is the thing in the medical devices with the 13485 in their risk management where you evaluate a device for the entire lifetime. You would consider, do I have the components to actually supply my device? What has happened? So the whole stuff about medical devices is much more robust. And I think [00:18:00] the pharmaceutical industry would benefit from this thinking about medical devices. 

This is part of what I say with the design and development, the risk management is part of design and development. And you need to think about the lifetime of the device. What is when my company is going bankrupt? How can I actually still support physicians? All this stuff needs to be addressed. 

And the FDA will hunt you down in the medical device industry, and it will come to the pharma industry, too. And I think it's a good way, because in the end effect, we want to save life. We want to support life. We all have families. I mean, I always think, what happen if my father is this? What then? 

Mike Kent: That patient focus, is absolutely critical.

 One thing I do want to get to, Armin, is what can and should companies start doing to really ready themselves for these changes? 

Armin Beck: I think the main important thing for a company is to [00:19:00] do a gap analysis. I'm not saying about an internal audit, but really a gap analysis to compare the internal audit reports, external audit reports, supplier audit reports to the Management Review and really analyzes where are my gaps here? Where is my problem? How can the FDA actually see on this documentation how bad my system is? And feeding this back into the CAPA system and complaints management system to get together. 

They can try to do it internally. I have my doubts about doing this internally. I would recommend to the companies find a couple of good people who understand really what's going in, let them do a gap analysis, look at the report and then start actually to do some kind of remediation. It's still enough time for companies and they can, they need to allocate the resources to this one. But I think, companies needs to understand they need a gap analysis. 

And as we said in the beginning, from a C level, the Quality manager, you can do this, you can make this, try to hide it. It's not [00:20:00] time to hide something. It's actually now time to put it on a paper. What is our problem? 

Mike Kent: Okay. So if I'm hearing you correctly, organizations should be really on notice at this point that this does pose a fairly significant risk to them from a regulatory oversight perspective, if they don't get on top of it. Understanding that with the records that are now going to be accessible by the agency, they're going to be able to connect the dots. 

So going through an exercise, "Do we have all of the dots connected? Are things that are showing up in our internal and external audit reports showing up in the Quality Management Reviews? Are there actions that are either planned or underway, hopefully underway at this point, for each one of those items? What evidence can we show that [00:21:00] suggests that we are making appropriate headway on addressing these issues and all of the right people, including the executive management, are aware of our progress? Do they show up on subsequent Quality Management Reviews to say, all right, what's the progress of this?" Doing the gap analysis between those quality systems that feed into and connect all of those systems, your audit program, your CAPA program, your Nonconformity program, your Quality Management Reviews. 

I would add a couple of more in there. How do you include Change Control into that process? Are you looking at the impact of changes and seeing evidence of where you've made changes? How are those tracked? 

So making sure that you have the right information in your Quality Management Review, as well. If you've got a bunch of [00:22:00] dashboards with percent complete and percent on time, that's only going to go so far. You're going to want to be identifying, what are your top risks? How does your Risk Management program drop into this? 

So what we'll do in the show notes is we'll provide some additional resources for you in terms of ICH Q9 for Quality Risk Management, the actual ISO 13485, some additional resources that FDA has actually published that are practical guides, including one that I want to highlight here. The International Medical Device Regulators Forum, IMDRF, published in April of 2024, the second edition of 'Essential Principles of Safety and Performance of Medical Devices and IVD Medical Devices'. As well as 'ISO [00:23:00] 13485:2016, A Practical Guide', published by AAMI and ISO that is identified as a step by step guidance applicable to all the stages of a medical device's lifecycle from gathering customer requirements to design and through to post-market surveillance of devices. 

Those are the types of things that we know are available to folks, we'll provide links in the show notes so that you can get access to that information. 

Hopefully this is not a surprise to medical device companies. If this is a surprise or if you're hearing this for the first time, where did this come from? I had no idea. I want to encourage you to ask questions about how regulatory intelligence is being gathered, communicated, collated, and used to inform your regulatory and compliance strategies at your organization. [00:24:00] Because back in January of 2024, this was announced. We're halfway through the two year time period before it becomes effective on February 2nd, 2026. And this is another opportunity for the C suite really to drive things home in terms of how are we gathering this information about what's coming down the pike? What should we know about? 

What other resources or what other strategies, Armin, would you suggest organizations look at in terms of gathering and utilizing regulatory intelligence?

Armin Beck: I think it comes down back to the, to the C-level people. On a lower level or the operational level, we can gather information. You nailed it down. 

The question here is how can we actually communicate this information to the C-level people. And it's not just about a communication, to really make them aware what's coming down.

This is where I [00:25:00] have some doubts on the C-level people that they really understand what's coming down. And I have seen this. Everybody is aware, everybody has the same information, and C level always said, "Well, we have so much time, don't worry until products will taking off the market."

 The issue is simple, it's basically you're responsible for your system, and you need to demonstrate this. I also know the C level people have other things to do. We have to figure out how do we change our mindset, and this will be difficult.

Mike Kent: Well, the good news / bad news is that we have regulatory agencies like the FDA that are piggybacking on global models to really push the agenda and force organizations to start looking at those types of questions much more seriously, which can only help.

Armin Beck: Right. But I think with the FDA, it's all the same. I mean, during COVID, the FDA slowed down with [00:26:00] audits, now picking up. I think companies or the industry got in some kind of sleepy mode. Well, we are fine. We don't have to do anything until it's really hitting this. I mean, for me, it's important. We need to prevent actually the 483, we need to prevent warning letters. We need to prevent that the FDA is shutting down a company. 

And this is what I try to communicate. How can we help you or what can we do for you that you don't get in this situation? Well, yeah, it's cost money. We need resources right now, but we able right now to help you. We have one, not even one and a half years time and we can do something. 

Mike Kent: Yeah and the outcome and the impact we continue to see ultimately impacts patients, impacts consumers and impacts our quality of life. 

So I think we've hit on a number of great points here today really in illustrating what the impact of FDA's adoption [00:27:00] of ISO 13485 into the new Quality Management System Regulation that takes effect in about 14 months time from the date of this recording. We've identified some strategies that companies can begin to implement, some things that they can begin to think about a bit more robustly. Getting the executive management engaged in that process is going to be key. It's not going to be easy, per se, but it is absolutely essential to the success. 

Armin Beck, I really appreciate all the time. This has been a tremendous conversation. Thanks so much for joining us here on the Quality Grind Podcast!

Armin Beck: Thank you for having me, Mike. It was my pleasure and I like to continue different podcasts, especially about the combination products, design control, risk management, more than happy to do that.

Mike Kent: Oh it's always seeming that when we talk about one particular [00:28:00] topic, we end up with three more that we should talk about. That's the case here. And I can't wait to have our next conversation. Thanks so much! 

Armin Beck: Thank you so much and enjoy the rest of the weekend.

Joe Toscano: If Medvacon can help you and your organization, we're happy to do so. We specialize in the following areas: Quality and Compliance, Validation and Qualification Services, Project Management, Tech Transfers, General and Specialized Training Programs, Engineering Services, and Talent Acquisition. If you have general questions as well, feel free to give us a call at any time.

We can easily be reached at 833 633 8226, or via our website at www. medvacon. com. Thanks so much, and we look forward to speaking with you! 

Jessica Taylor: Thank you for listening to the Quality Grind Podcast presented by Medvacon. To learn more or to hear additional episodes, visit us at www. medvacon. com.