White Papers & Articles

​Are you ready to electrify your QMS system?
 
If you’re at a point where you’re finally ready to consider bringing in an electronic Quality Management System (eQMS) tool, or perhaps you’re looking to re-evaluate better options on the market, there’s naturally a litany of things to do and consider BEFORE you decide which tool to move forward with.
 
This article covers most of the steps and considerations you’ll need to think through as you evaluate different electronic Quality Management System (eQMS) for your medical device company.  I’ve had the good fortune to help dozens of clients select eQMS tools and scale them to operational status.  Here’s what I’ve seen from a decision-making perspective, and of course some learned lessons along the way.
 
WHAT IS AN EQMS:
The folks at Praxie did a superb job defining what an eQMS is, so we’ll borrow their definition: “An eQMS is a technology-driven solution designed to manage and monitor quality standards across an organization’s manufacturing processes. It replaces traditional paper-based systems, offering a centralized platform where all quality-related data and processes are stored and managed digitally. The primary role of an EQMS is to ensure consistent quality by automating and standardizing processes such as document control, audit management, and training management.
 
KNOW YOUR WHY:
As you look to bring in a QMS, including eQMS, one of the biggest considerations is to know your why – what’s driving the need.  What’s the reason you’re thinking of bringing in a tool in the first place?  Do you really need the tool or is it nice to have? 
 
PRO-TIP – if you’re a pre-clinical startup there’s a good chance you might not need an eQMS just yet.  The old-fashioned traditional paper-based approach, while simple and cost effective, can be a realistic option.  That said, the manual paper-based QMS isn’t a long-term solution as it can bring about complications with time-consuming processes, human error and traceability.    
 
Most startups typically think about bringing in a QMS once they reach the design phase of the product development lifecycle as at that point implementing design controls becomes critical. (image credit: Medical Device Quality Management System (QMS) - SimplerQMS)

From there, the next thing your WHY will help you understand is how robust a system you need.  Read section ‘System Functionalities’ for further insights.
 
REGULATORY REQUIREMENTS:
A good QMS ensures compliance with standards such as ISO 13485, FDA 21 CFR Part 820, and EU MDR, and helps maintain product quality and safety.  Is your company seeking to go outside the US (OUS) or remain domestic?  While you can certainly pick a QMS without knowing 100% what your regulatory strategy will be, it’s advisable to know that ahead of time as different tools offer different modules and layouts which may work more efficiently with a domestic strategy vs an OUS one.  The reality is you must still be compliant to FDA regulations if operating in the US due to site registration requirements.
 
Secondarily, I’m of the opinion if I’m looking for a tool to support medical device QMS related needs I’m only going to look for tools which are largely, if not exclusively, designed for this purpose.  Trying to appropriate a tool which was initially designed for another industry, even pharma, into your medtech space is more of a band aide than a real solution.  Buy the right tool for the right purpose.
 
ORGANIZATIONAL NEEDS:
Inevitably we may be splitting hairs here as some of this information will be similar in thought and approach to ‘Know Your Why’.  Picking the best QMS tool relies on you also knowing what you need out of it.  Things to consider are your company size (# employees and product lines), growth plans (scaling strategy and how a tool would need to grow in parallel with you), budget (what can you afford now, while taking into account setup costs, maintenance fees, licensing fees, etc.).  You’ll also want to think through the complexity of your technology as the more complex a product is the more advanced your QMS functionality needs to be in order to appropriately address areas like risk management and product/ process traceability.
 
SYSTEM FUNCTIONALITIES:
QMS tools, like any other software tool, offer a variety of different features and user experiences.  No two tools are the same, or so they say.  When we’re considering a software tools functionality, we first need to be able to answer our WHY (why we need the tool) and what we’re hoping to do with it.  This will then help you determine if the functionality of a tool you are evaluating is appropriate.  For example, a popular QMS tool in the medical device industry is Greenlight Guru.  It does it all, and has a modern user interface experience, but it isn’t cheap and could be overkill for a pre-clinical startup.  Think about it like this – if you’re buying a car just to get you to the office 15 miles away, strictly for commuting, do you really need a car that has every bell and whistle on it?  Think about QMS tools this same way.  If you only need the basics you might want to stay away from the flash and glitz that comes with the bigger tools.  To further complicate things, and to play both side of the fence, robust tools like Greenlight Guru offer starter packages that allow you to add on modules as your company scales.  Is a starter package the right route?  You’ll need to read on to decide.
 
Core functionalities to look for may include:

• Document Control: Automated version control, electronic signatures, and easy document retrieval.
• CAPA (Corrective and Preventive Action) Management: A robust CAPA system to identify, investigate, and prevent quality issues.
• Risk Management: Integration with ISO 14971 (Risk Management for Medical Devices) for proactive risk identification and mitigation.
• Audit Management: Tools to schedule, track, and document internal and external audits.
• Training Management: Managing and tracking employee training, which is crucial for regulatory compliance.
• Supplier Management: Evaluate supplier performance and ensure the quality of supplied components.
• Complaint Management: Streamlined processes to track, evaluate, and resolve customer complaints.
• Change Control: A well-structured process for managing changes to products, processes, or documents.
• Validation Capabilities: Ensure the QMS software itself is compliant and validated for FDA or ISO regulations.

 
Tool Ownership/ Storage:
Many, if not most, QMS software tools today are offered as an online cloud-based tool.  For smaller companies this may be advantageous as the tool supplier owns, manages and maintains the tool on your behalf.  This of course comes with a cost, but it’s minimal in comparison especially when considering the cost of buy, install and maintain a data center of any size.
 
If cloud storage and access isn’t right for your business most of the prominent tools offer an on-premise option which can offer more control over data. OEMs typically choose this option if data security is a high priority, and the company prefers to keep control in-house.
 
UX AND SUPPORT / TRAINING:
While not everyone is going to care about the user experience (UX) of the tool, I’ll candidly admit I fall in the camp of ‘caring’, and consider this to be a big deal for me.  I was recently evaluating several business operations tools, like an ERP, and outright declined one of the options that had all the functionality we needed, at a price that was good, yet the actual experience using it was stale and 20 years old. If I’m going to pay a healthy subscription fee for a tool, like a QMS, I want it to be modern and easy to use, intuitive, as if it was built by people in the industry.
 
When considering support and training for the tool, this may not be an issue with the larger tools like MasterControl or Arena, it may however be an issue with some of the smaller tools like QCBD. (right, you’ve probably never even heard of that one).  My comment here in reality has nothing to do with QCBD as its quite a good tool, however you need to consider the size of the company who makes the tool and how easy or difficult it will be to get support when you need it, not when they can get to you.
 
Take the added step to do some preliminary research on the tools you’re evaluating to see what user forums are saying, how are the tool developers rated, etc.  You can learn volumes of information in short order by doing this.
 
INTEGRATION:
Even if you don’t need it now, it’s advisable to pick a tool that can eventually integrate with other tools your company already has in use this way when the time comes you can increase efficiencies with your operation.  Ideally, your QMS should integrate seamlessly with your existing systems such as ERP (Enterprise Resource Planning), PLM (Product Lifecycle Management), CRM (Customer Relationship Management), and MES (Manufacturing Execution Systems).
 
According to Allan Murphy Bruun with Simpler QMS, “It typically takes 3 to 9 months to fully establish a medical device QMS. Still, medical device consultants suggest starting preparations at least 18-24 months before commercialization.”
 
CUSTOMIZATION:
This may fall into the same camp as the UX comments above, however I would caution you against selecting a tool that has little to no customization ability.  Every medical device company is different as their technology, people and processes all have their own flavor to contend with. Choosing a QMS tool that allows customization based on your company's specific workflows is key. The more adaptable the tool, the better it can cater to your unique processes without requiring excessive manual work. 

​PRO-TIP – while a tool may offer customization many times it can come with at a price.  Ask about this during the evaluation phase so you can manage your own expectations accordingly on the backend as the tool is being integrated into your operations.
 
Regulatory and Quality (RAQA) expert Robert Lahaderne further shares, “Being able to customize your eQMS is a big deal since your QMS must be aligned with the tools and therefore becomes your QMS.  Not being able to adjust things like titles or work flows leads back to the UX considerations within this article.”
 
TOOL DEMO:
Never, ever buy a software tool without first going through an in depth demonstration, to do so otherwise if foolhardy. Request a demo and ask for a pilot test period to evaluate the tool in your actual working environment. During this time, test the core functionalities that align with your company’s key regulatory and operational needs.
 
COST & ONGOING FEES:
A large portion of software tools, including medical device QMS tools, operate on the subscription model from a pricing standpoint.  Like it or love it, this pricing model will probably be around for a while.  When looking at the cost associated with a software tool purchase make sure you get the following information upfront of your decision:

• Upfront Cost: Licensing fees and implementation costs. (can licenses be shared?)
• Maintenance Fees: Ongoing costs related to support, upgrades, or additional features.
• Hidden Costs: Consider training, downtime during implementation, and future scalability costs. If you already have a QMS tool and you’re looking to replace it with a new one just know that you may have to run both tools, the new and the old, for several months in parallel while the new tool gets fully integrated and tested.  Running two tools simultaneously naturally adds cost into the grand scheme of things.

 
COMPLIANCE AND VALIATION
In the medical device industry one can’t just buy or use any tool without risks on to your operation on the backend.  If you’re going to consider a formal QMS tool, you’ll want to take it a step further and ensure the tool is compliant with electronic records and signatures requirements. (ie 21 CFR Part 11 Compliance)
 
When selecting a tool, you’ll also want to choose a QMS tool which can be easily validated and offers validation templates or support.  This way if you’re using a simplified tool you can get it up and running and do so with limited additional costs.
 
SECURITY
Since medical device companies deal with sensitive information, the QMS should include data encryption, access control, audit trails, and secure backups.  While not all devices and tools require it, you’ll want to talk with your prospective tool developer, and regulatory folks, about the potential need for Secure Product Development Framework (SPDF) and Quality System Regulations (QSR) as outlined by the Federal Drug Administration (FDA).  It’s always better to be in the know, then have to plead ignorance down the road should regulatory action come about.
 
WHICH TOOL SHOULD YOU PICK:
By now you’ve probably concluded there is a lot to keep in mind when bringing in a QMS tool to your operation.  There is a good chance many different tools can solve your problems while also meeting your business needs.  Below is a quick rundown of QMS tools we often come across in our clients’ operations (note – we are not advocating for one tool vs the other, please make sure you do your own research before you make the commitment):
 
Larger Company Tools:

• MasterControl
• Greenlight Guru
• Arena QMS
• ETQ Reliance
• Qualio

 
Small Company Tools:

• Quality Collaboration by Design (QCBD)
• Veeva Vault QMS
• Intellectt QMS
• QT9 QMS
• QAD eQMS

 
PAST LESSONS LEARNED
If you’ve been in business for any length of time you’ve inevitably made some mistakes along the way, hopefully you learned from them and got better as a result.  When it comes to eQMS, we’ve seen many mistakes made which have translated into lessons learned for future projects and advisory needs.  RAQA expert Robert Lahaderne further shares his PRO-TIPS and lessons learned when evaluating and integrating eQMS:

• Be prepared that success will be tied to resources that are dedicated to the project. Consider what experience the current/future team members have with these tools,
• Don’t be afraid to adopt different facets of the QMS into an eQMS system instead of doing it all at once,
• An eQMS does not eliminate paper from your company, it changes, but an eQMS is the first step in reducing papers,
• It is a big decision; it is hard to change after you have started down one path. As you grow, plan on assessing whether the eQMS can grow with you.

 
 
IN THE END
When selecting an eQMS tool for your medical device company, it is my opinion one must prioritize regulatory compliance, ease of use, scalability, integration capabilities, and robust vendor support as the primary decision factors when evaluating an eQMS.  Opt for a solution that can grow with your company while ensuring compliance with critical medical device regulations.  Remember, no tool is perfect, so if you get most of what you need at a price you can live with then the next step is making sure the tool is used as intended and maintained after implementation.  That’s another article and another read for next time.

​GET PROJECT HELP TODAY!
The quickest way to overcome a business challenge is to get help from those who are experienced in besting your beast!  The team at Square-1 Engineering is comprised of a variety of technical and project management professionals who are subject matter experts in the areas of NPD, Quality, Compliance and Manufacturing Engineering.  Learn more about how we can solve your work and project problems today to get you back on track!

In this 2-part series of Medtech Snapshot we're joined by Square-1 Engineering Director of Delivery & Operations Trisha Aure as she walks us through the highlights of our article 'FDA Announcement: 21 CFR 820 and ISO 13485 Guidance'
 
Hear the areas where 21 CFR 820 differs most from ISO 13485 and what this means for medical device OEMs.
 
Part-2 of this series will cover the process to transition and key considerations when doing so.
 
#iso13485 #regulation #compliance #fda #21CFR #riskmanagement #medicaldevice #medtech #news #podcast #snapshot #regulatoryaffairs

On February 2nd, 2024 the U.S. Food and Drug Administration (FDA) made its formal announcement and ruling providing guidance on 21 CFR Part 820 which up to that point was the standard overseeing medical device quality system regulation and current good manufacturing practices (cGMP) in the United States of America. 
 
The big news – 21 CFR 820 will be heavily amended to incorporate ISO 13485 as the leading guidance for Quality Management System Regulation (QMSR) and cGMP.  While the news wasn’t a surprise, it does put a final note on the direction the agency intends to take for medical device practices moving forward, especially as it relates to risk management.  While many device OEMs already utilize ISO as their leading regulation standard, those who don’t will have two years to adjust to these changes to be in compliance effective February 2nd, 2026.
​
Here’s what you need to know as it relates to the differences between 21 CFR 820 and ISO 13485, as well as considerations OEMs should take into account in order to meet the 2026 deadline.
 
Big Picture:

• 21 CFR 820 (Code of Federal Regulations Title 21, Part 820), also known as the Quality System Regulation (QSR), is a set of regulations established by the U.S. Food and Drug Administration (FDA) for medical device manufacturers selling products in the United States.
• ISO 13485:2016 is an international standard that specifies requirements for a quality management system (QMS) for medical devices.

 
Key Differences:

​Transitioning to ISO 13485
Transitioning from CFR 820 to ISO 13485 involves several steps to ensure compliance with the ISO standard. A general outline of the steps an OEM should take to transition may include:
 
1. Understand the Requirements of ISO 13485: Familiarize yourself with the requirements of ISO 13485. This includes understanding the structure of the standard, its key clauses, and any specific requirements which may differ from CFR 820. (see above table for highlights)
 
2. Gap Analysis: Conduct a thorough gap analysis to identify the differences between your current quality management system under CFR 820 and the requirements of ISO 13485. This will help you determine what changes, if any, need to be made to your existing processes, procedures, and documentation.  This is also a great time to do a review of your QMS tool to determine if it is an appropriate tool for future use.
 
3. Document Review and Update: Review your existing documentation, including quality manuals, procedures, work instructions, and forms, to ensure they align with the requirements of ISO 13485. Update or create new documents as necessary to meet the standard's requirements.
 
4. Training and Awareness: Provide training to relevant personnel to ensure they understand the requirements of ISO 13485 and their roles in implementing and maintaining the QMS. This may include training on new procedures, processes, and documentation.
 
5. Implementation of New Processes: Implement any new processes or procedures required by ISO 13485. This may include processes related to risk management, design and development, purchasing, production, and service provisions.
 
6. Internal Audits: Conduct internal audits of your QMS to verify compliance with ISO 13485 requirements. Identify any non-conformities and take corrective actions to address them.
 
7. Management Review: Hold management reviews to evaluate the effectiveness of the QMS and identify opportunities for improvement. Ensure top management is actively involved in the transition process and committed to maintaining the QMS.
 
8. Certification Audit: BEFORE you consider this step be sure to speak with a regulatory affairs subject matter expert to ensure it is necessary.  Once you believe your QMS is fully compliant with ISO 13485, engage a certification body to conduct a certification audit. The audit will assess your organization's compliance with the standard and determine if you are eligible for certification. 
 
9. Address Non-conformities: If any non-conformities are identified during the certification audit, take corrective actions to address them. The certification body will typically require verification that corrective actions have been implemented before issuing the ISO 13485 certificate.
 
10. Continual Improvement: Continuously monitor and improve your QMS to ensure ongoing compliance with ISO 13485 and to enhance the efficiency and effectiveness of your processes.
 
Although the 21 CFR 820 and ISO 13485 vary in their structure, and at times use different terminology to describe similar concepts, 21 CFR 820 and ISO 13485 are substantially similar in that both prioritize principles such as risk management, design controls, and continual process improvement.  It’s possible as organizations begin to look at their current standards and systems, they will find the transition process is not as cumbersome as initially thought.  While this is an obvious assumption, it’s important to note regulatory affairs professionals should be counseled throughout this entire process to ensure appropriateness of adoption and change management.

Medical device companies play a critical role in advancing healthcare as their ability to diagnose, monitor, and treat medical conditions allow patients like you and I the opportunity to recover and live longer.  Device companies carry a heavy burden on our behalf and that burden starts with product risk.
 
One of the biggest challenges an OEM medical device organization will be faced with is managing risk, especially during the early stages of product development.
 
The integration of risk management into design control (ISO 14971) is essential for identifying, assessing, and mitigating potential risks associated with the design and development of a medical device. Given risk management is a part of nearly every development process, and is a primary focus of all regulatory agencies like the U.S. Food and Drug Administration (FDA) and the European Medicines Agency (EMA), why is it then so many medical device companies struggle with sound risk management strategies?
 
The failure to address risks adequately can lead to a whole host of problems ranging from regulatory non-compliance, compromised patient safety, financial setbacks, and in severe situations criminal prosecution of executives.  Needless to say, understanding why medical device companies come up short with their risk management strategy and how you can avoid that for yourself is key to your future success. In this article, we will explore some of the key reasons behind risk management failure.
 
Most Common Risk Failure Factor - Inadequate Understanding of Regulatory Requirements:
One of the primary reasons for failure in risk management is an insufficient understanding of the complex and evolving regulatory landscape. Medical device companies must navigate a web of regulations, standards, and guidelines to ensure compliance. Failing to keep abreast of these requirements can result in flawed risk assessments, inadequate risk mitigation measures, and ultimately, regulatory sanctions.
 
Poor Integration of Risk Management into Product Development:
Successful risk management should be an integral part of the product development lifecycle. However, some companies make the mistake of treating it as a standalone process rather than integrating it seamlessly into every stage of development. When risk management is an afterthought, essential risks may be overlooked, leading to suboptimal product designs, increased failure rates, and compromised patient outcomes.
 
Lack of Cross-Functional Collaboration:
Effective risk management requires collaboration across various departments, including research and development, regulatory affairs, quality assurance, and manufacturing. Failure to establish clear communication channels and encourage cross-functional collaboration can result in siloed decision-making. This lack of coordination can lead to critical risks being underestimated or missed entirely.
 
Insufficient Resources and Expertise:
Some medical device companies fail in risk management due to resource constraints and a shortage of expertise. This can manifest in inadequate training for personnel responsible for risk management, insufficient allocation of time and budget, and a lack of access to external expertise. Without the necessary resources, companies may struggle to conduct comprehensive risk assessments and implement effective risk mitigation strategies.
 
Overemphasis on Short-Term Goals:
Pressure to meet short-term financial goals can sometimes lead companies to prioritize speed to market over thorough risk analysis. This can result in hasty decision-making and inadequate risk identification and mitigation. Companies need to strike a balance between meeting market demands and ensuring the safety and efficacy of their medical devices in the long run.
 
Failure to Learn from Industry Incidents:
The medical device industry has witnessed several high-profile incidents related to product failures and patient harm. Failure to learn from these incidents and implement lessons learned into future risk management strategies can perpetuate the same mistakes. Companies must actively analyze industry incidents, update risk management processes accordingly, and continuously improve their practices.
 
Ineffective Communication with Stakeholders:
Communication is crucial in risk management, both internally and externally. Companies that fail to communicate effectively with their stakeholders, including regulatory bodies, healthcare professionals, and patients, may face increased scrutiny and regulatory challenges. Transparency and open communication are essential for building trust and demonstrating commitment to patient safety.
 
In the highly regulated and dynamic field of medical devices, effective risk management is not just a regulatory requirement - it is a fundamental aspect of ensuring patient safety and the success of a company. Understanding the pitfalls that lead to failures in risk management can help medical device companies proactively address these challenges. By prioritizing compliance, integrating risk management into every stage of product development, fostering cross-functional collaboration, and learning from industry incidents, companies can enhance their risk management strategies and contribute to the advancement of healthcare with safe and reliable medical devices.

What we know to be true is root cause analysis (RCA) plays a vital role in the development, manufacturing, and use of medical devices. When we are able to successfully identify and address the underlying causes of failures or errors, using RCA as a tool in your operation helps to improve the safety, reliability, and effectiveness of medical devices. 

When done correctly, RCA has a significant impact on medical devices by enhancing patient safety, improving design and manufacturing processes, ensuring regulatory compliance, driving product improvement and iteration, mitigating risks, and supporting post-market surveillance efforts.  While all of this may sound common sense, what's most important is when RCA is used and done correctly.  

​In this episode of Medtech Snapshot we're joined by Quality Executive Robert Lahaderne to talk Root Cause Analysis (RCA)!  Hear how Robert shares his perspective on the impact Root Cause makes to a medical device organization when it is done correct versus when it is done incorrectly and how rushing through FMEAs and hazard analysis creating unnecessary challenges down the road.

#rootcauseanalysis #rootcause #medicaldevice #medtech #fmea #hazardanalysis #patientsafety #riskmanagement

​​The quickest way to overcome a business challenge is to get help from those who are experienced in besting your beast!  The team at Square-1 Engineering is comprised of a variety of technical and project management professionals who are subject matter experts in the areas of NPD, Quality, Compliance and Manufacturing Engineering.  Learn more about how we can solve your work and project problems today to get you back on track!

​Recently our company published a poll online offering up the following question for the medical device community:

​“What is the most important factor to consider when developing a medical device product?”

At the close of the poll dozens of people had cast their votes for what they believed to be the factors affecting product development the most.  The poll options included:

• Regulations
• Marketplace Analysis (competitive landscape, problem to solve, needs, etc.)
• Having the Right Team in Place
• Risk Management

If you have been in industry for any length of time you know there are dozens of factors which can and often have a direct impact on the product development process.  While there are dozens to consider, such as PRS (Product Requirement Specification), planning, user experience, DFM, etc. what we know to be true is each of these factors carry varying weights of impact.  They are not all equal in measure or influence.

As our poll launched and picked up steam one of the four factors listed as an option began to take a commanding lead.  The respondents, who are largely made up of medical device professionals and executives, had identified a common factor which stood above the rest in its ability to impact positively or negatively the product development process.

What was this most important factor?

Would you have guessed ‘Having the Right Team in Place’ is the number one factor which determines success when developing a medical device product?
‘Having the Right Team in Place’ was identified by 51% of the respondents as being the most important factor which directly contributes to the success of medical device product development.  The other options broke down as follows:

​Simply put – having the right team in place covers all of the other areas that potentially could produce challenges during the product development cycle.  Whereas the inverse is certainly all too true.  When we have the wrong team in place, or teammates lacking the capabilities to facilitate their job as needed by the company, inevitably problems go arise which hold back otherwise good opportunities and technology offerings.

Jim Collins, celebrated author (books like ‘Good to Great’ & ‘Built to Last’) and business management guru, is quoted as saying “Leaders of great companies start by getting the right people on the bus, the wrong people off the bus, and the right people in the right seats.”

What this means is it’s more about the people than it is the technology or problem you’re solving.  This is an important lesson, especially for first time entrepreneurs and startup executives.  You can have the best product idea in the world, one that is in high demand, but if you don’t have the right team in place you’ll most likely spin your wheels while blowing out copious amounts of money in the process.

We’ve also seen this reality in person dozens of times.  As a medical device consulting firm we work with a lot of companies, both start up and conglomerate alike.  One of the consistent characteristics we see within the companies which are able to drive success, often times repeated success, is their management team is comprised of experts in their particular field who know how to both lead and operate in the weeds.  They both strategic and tactical, able to plan for the long term while addressing todays shorter term needs.  As a result, they know how the job is done and therefore can either lead or delegate those tasks helping to guide their department or team to successful completion. 

When you have the right people on the team (your bus) you will then find opportunities (the medical problem you’ll solve) to move forward with.  Following this process you’ll also have a far better chance of facilitating that opportunity through the development process and into commercialization, or acquisition.