What you leave out of your QMS can matter just as much as what you include.
ISO 13485 isn’t designed to be a one-size-fits-all solution to medical device quality assurance. When your organization doesn’t design or service medical devices, you aren’t forced into pretending you do.
These cases of the dos and don’ts of your company are where exclusions enter.
Clause 1 of ISO 13485:2016 gives organizations the ability to circumvent requirements only when they do not apply to the nature of their product or service. While it sounds simple enough, it’s a common occurrence for companies to get tripped up. Not by what they exclude, but by how they explain it.
Before you cut anything from your QMS, here’s what you want to know.
Step One: Knowing What to Exclude
The first and most important rule of clause exclusion is the following: only clauses from Section 7 (Product Realization) can be excluded. The second most important rule is that you’re only eligible for exclusion when they don’t apply to your operations.
Some examples of the most common valid exclusions are as follows:
- 7.3: Design and Development – filed by contract manufacturers or OEMs with no design responsibility.
- 7.5.4: Servicing Activities – filed when your device doesn’t require servicing and your business doesn’t offer it.
- 7.5.5: Installation Activities – filed specifically for non-installable devices or components.
Any organization that attempts to exclude anything outside Section 7 (such as document control or management review) will almost always result in a nonconformance.
Step Two: How You Say It
When exclusions are filed, the reasoning needs to be written down, explained in plain terms, and backed by how your business functions. If you’re leaving something out of your quality system, like design and development, you need to explain why that part doesn’t apply to your specific system.
As an example, imagine you’re a contract manufacturer and your clients handle all the design work. When you are petitioning for an exclusion, you need to say exactly that. The explanation itself should be straightforward and specific. The scribbled sentence “We don’t do design” won’t be enough and will definitely raise questions during an audit.
Consistency Across Documentation
This is the unfortunate pitfall for lots of organizations. Excluding a clause in your Quality Manual, but still having procedures and records related to that clause doesn’t do your cause a lot of help.
When you say design controls are excluded, committing to that exclusion is necessary. You shouldn’t have a legacy design review form hanging around in your training binder. Auditors will notice.
Before your next audit, take the time and special precautions to ensure:
- Your procedures and forms are aligned with potential exclusions
- Outdated content has been removed or archived from the documentation
- Confirm your team is capable of explaining what and why something is out of scope
Not Loopholes, Risk Points
Exclusions don’t exist as a free pass for lazy organizations. They’re flags for auditors to look closely at. When reviewing your exclusions, they’ll want to confirm:
- The exclusion is justified by the scope of activities
- A company isn’t unknowingly performing excluded tasks (something like offering minor design input to a client)
- The QMS meets all other regulatory requirements
If your actual activities creep into the territory of a clause you’ve excluded, you’re now out of compliance without realizing it.
Not Sure What To Exclude or How To Phrase It?
At APEX QA, we’ve helped medical device companies all over the country tailor their quality systems to match their actual operations. Consultationscan include reviewing the scope of your company, identifying justified exclusions, and ensuring your Quality Manual passes scrutiny during audits.
Whether you’re just getting certified or tightening up for a recertification audit, our professionals make sure your exclusions are compliant, consistent, and clearly documented.
Final Thoughts
While ISO 13485 gives you room to tailor your QMS, it doesn’t do so at the cost of clarity or compliance. Exclusions must be created and documented with precision. A principle to hold close while contemplating exclusions is that what you exclude says just as much about your business as what you include.
If you’re unsure whether a clause truly applies to your operations, or how to document your justification, our ISO 13485 training or gap assessment service can leave you with the peace of mind you’ve been yearning for.
