Correspondence Between ISO 13485:2003 and the

US Quality System Regulation (21CFR820)

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
1. Scope 820.1 Scope The Scope sections of each
1.1 General (a) Applicability. document set out their objectives. For
This International Standard specifies (1) Current good manufacturing the Standard the objective is to
requirements for a quality practice (CGMP) requirements are harmonize regulation around the
management system where an set forth in this quality system world. As a result an attempt was
organization needs to demonstrate its regulation. The requirements in this made by FDA during the revision of
ability to provide medical devices and part govern the methods used in, and the GMPs, while the 1996 version of
related services that consistently the facilities and controls used for, the ISO 13485 was being developed, to
meet customer requirements and design, manufacture, packaging, incorporate the requirements that
regulatory requirements applicable to labeling, storage, installation, and were included in that version of the
medical devices and related services. servicing of all finished devices Standard. While the agency could not
intended for human use. The revise the format of the regulation to
The primary objective of this requirements in this part are intended follow that of the Standard, many of
International Standard is to facilitate to ensure that finished devices will be the requirements were included.
harmonized medical device safe and effective and otherwise in
regulatory requirements for quality compliance with the Federal Food, This section of the regulation contains
management systems. As a result, it Drug, and Cosmetic Act (the act). some additional regulatory issues that
includes some particular This part establishes basic are not appropriate for the Standard.
requirements for medical devices and requirements applicable to
excludes some of the requirements of manufacturers of finished medical
ISO 9001 that are not appropriate as devices....
regulatory requirements. Because of
these exclusions, organizations (c) Authority. Part 820 is established
whose quality management systems and issued under authority of
conform to this International Standard sections 501, 502, 510, 513, 514,
cannot claim conformity to ISO 9001 515, 518, 519, 520, 522, 701, 801,
unless their quality management 803 of the act (21 U.S.C. 351, 352,
systems conform to all the 360, 360c, 360d, 360e, 360h, 360i,
requirements of ISO 9001 (Annex B). 360j, 360l, 371, 374, 381, 383). The
failure to comply with any applicable
provision in this part renders a device
adulterated under section 501(h) of
the act. Such a device, as well as any
person responsible for the failure to
comply, is subject to regulatory
action.

(d) Foreign manufacturers. If a

manufacturer who offers devices for
import into the United States refuses
to permit or allow the completion of a
Food and Drug Administration (FDA)
inspection of the foreign facility for the
purpose of determining compliance
with this part, it shall appear for
purposes of section 801(a) of the act,
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 2

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
that the methods used in, and the
facilities and controls used for, the
design, manufacture, packaging,
labeling, storage, installation, or
servicing of any devices produced at
such facility that are offered for import
into the United States do not conform
to the requirements of section 502(f)
of the act and this part and that the
devices manufactured at that facility
are adulterated under section 501(h)
of the act.

(e) Exemptions or variances.

(1) Any person who wishes to petition
for an exemption or variance from
any device quality system
requirement is subject to the
requirements of section 520(f)(2) of
the act.

Petitions for an exemption or variance

shall be submitted according to the
procedures set forth in Sec. 10.30 of
this chapter, the FDA’s administrative
procedures. Guidance is available
from the Center for Devices and
Radiological Health, Division of Small
Manufacturers Assistance, (HFZ-
220), 1350 Piccard Dr., Rockville, MD
20850, U.S.A., telephone 1-800-
6382041 or 1-301-443-6597, FAX
301-443-8818.

(2) FDA may initiate and grant a

variance from any device quality
system requirement when the agency
determines that such variance is in
the best interest of the public health.
Such variance will remain in effect
only so long as there remains a public
health need for the device and the
device would not likely be made
sufficiently available without the
variance.

1.2 Application 820.1 Scope Basically, the applicability guidance

All requirements of this International (a) Applicability. for the two documents is the same in
Standard are specific to organizations (1) Current good manufacturing both documents. In essence, they
providing medical devices, regardless practice (CGMP) requirements are allow for the exclusion from the QMS
of the type or size if the organization. set forth in this quality system requirements associated with
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 3

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
requirement. The requirements in this activities not performed by the
If regulatory requirements permit part govern the methods used in, and organization. The standard explicitly
exclusions of design and the facilities and controls used for, the limits those exclusions associated
development controls (see 7.3), this design, manufacture, packaging, with product realization.
can be used as a justification for their labeling, storage, installation, and
exclusion from the quality servicing of all finished devices
management system. These intended for human use. The Because of this approach, it will be
regulations can provide alternative requirements in this part are intended necessary for registrars to explain in
arrangements that are to be to ensure that finished devices will be detail the scope of any certificates of
addressed in the quality management safe and effective and otherwise in compliance with ISO 13485:23003.
system. It is the responsibility of the compliance with the Federal Food, They will have to spell out clearly any
organization to ensure that claims of Drug, and Cosmetic Act (the act). exclusions.
conformity with this International This part establishes basic
Standard reflect exclusion of design requirements applicable to
and development controls [see 4.2.2 manufacturers of finished medical
a) and 7.3]. devices.

If any requirement(s) in Clause 7 of If a manufacturer engages in only

this International Standard is (are) not some operations subject to the
applicable due to the nature of the requirements in this part, and not in
medical device(s) for which the others, that manufacturer need only
quality management system is comply with those requirements
applied, the organization does not applicable to the operations in which
need to include such a requirement(s) it is engaged. With respect to class I
in its quality management system devices, design controls apply only to
[see 4.2.2 a)]. those devices listed in Sec.
820.30(a)(2). This regulation does not
The processes required by this apply to manufacturers of
International Standard, which are components or parts of finished
applicable to the medical device(s), devices, but such manufacturers are
but which are not performed by the encouraged to use appropriate
organization, are the responsibility of provisions of this regulation as
the organization and are accounted guidance. Manufacturers of human
for in the organization’s quality blood and blood components are not
management system [see 4.1 a)]. subject to this part, but are subject to
part 606 of this chapter.

(2) The provisions of this part shall be

applicable to any finished device as
defined in this part, intended for
human use, that is manufactured,
imported, or offered for sale in any
State or Territory of the United
States, the District of Columbia, or
the Commonwealth of Puerto Rico.

In this International Standard the (3) In this regulation the term “where
terms “if appropriate” and “where appropriate” is used several times.
appropriate” are used several times. When a requirement is qualified by
When a requirement is qualified by “where appropriate,” it is deemed to
either of these phrases, it is deemed be “appropriate” unless the
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 4

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
to be the appropriate unless the manufacturer can document
organization can document a justification otherwise. A requirement
justification otherwise. A requirement is “appropriate” if nonimplementation
is considered appropriate if it is could reasonably be expected to
necessary in order for
x the product to meet specified result in the product not meeting its
requirements, and/or specified requirements or the
x the organization to carry out manufacturer not being able to carry
corrective action. out any necessary corrective action.

(b) Limitations. The quality system

regulation in this part supplements
regulations in other parts of this
chapter except where explicitly stated
otherwise. In the event that it is
impossible to comply with all
applicable regulations, both in this
part and in other parts of this chapter,
the regulations specifically applicable
to the device in question shall
supersede any other generally
applicable requirements.

2 Normative reference
The following reference documents
are indispensable for the application
of this document. For dated
references, only the edition cited
applies. For undated references, the
latest edition of the reference
document (including any
amendments) applies.

ISO 9000:2000, Quality management

systems — fundamentals and
vocabulary

3 Terms and definitions 820.3 Definitions. The Standard spells out clearly the
For the purposes of this document, (a) Act means the Federal Food, new meanings of the words “supplier"
the terms and definitions given in ISO Drug, and Cosmetic Act, as amended and “organization."
9000 apply, together with the (secs. 201-903, 52 Stat. 1040 et seq.,
following. as amended (21 U.S.C. 321-394)). All
definitions in section 201 of the act
The following terms, used in this shall apply to the regulations in this
edition of ISO 13485 to describe the part.
supply chain, have been changed to
reflect the vocabulary currently used:
supplier Æ organization Æ
customer

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 5

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
The term “organization” replaces the
term “supplier” used in ISO 13485:
1996, and refers to the unit to which
this International Standard applies.
Also, the term “supplier” now replaces
the term “subcontractor”.

Throughout the text of this

International Standard, wherever the
term “product” occurs, it can also
mean “service”.

Wherever requirements are specified

as applying to “medical devices”, the
requirements apply equally to related
services supplied by the organization.

The following definitions should be

regarded as generic, as definitions
provided in national regulations can
differ slightly and take precedence.

3.1
active implantable medical device
active medical device which is
intended to be totally or partially
introduced, surgically or medically,
into the human body or by medical
intervention into a natural orifice, and
which is intended to remain after the
procedure

3.2
active medical device
medical device relying for its
functioning on a source of electrical
energy or any source of power other
than that directly generated by the
human body or gravity

3.3
advisory notice
notice issued by the organization,
subsequent to delivery of the medical
device, to provide supplementary
information and/or to advise what
action should be taken in
– the use of a medical device,
– the modification of a medical
device,

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 6

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
– the return of the medical device to
the organization that supplied it, or
– the destruction of a medical
device

NOTE Issue of an advisory notice

might be required to comply with
national or regional regulations.

3.4 (b) Complaint means any written, The regulatory definition is a bit
customer complaint electronic, or oral communication that broader, as it covers products that
written, electronic or oral alleges deficiencies related to the have not, as yet, been placed on the
communication that alleges identity, quality, durability, reliability, market, but have been released for
deficiencies related to the identity, safety, effectiveness, or performance distribution. This would mean that a
quality, durability, reliability, safety or of a device after it is released for lot of product that has been released
performance of a medical device that distribution. for distribution could be included in
has been placed on the market the activities associated with a
customer complaint, even though no
part of the lot has reached the
customer.

3.5 21 CFR §812.3(d) Implant means a The definition in the Standard

implantable medical device device that is placed into a surgically explicitly includes eye implants.
medical device intended or naturally formed cavity of the
x to be totally or partially human body if it is intended to remain
introduced into the human there for a period of 30 days or more.
body or a natural orifice, or FDA may, in order to protect public
x to replace an epithelial health, determine that devices placed
surface or the surface of the in subjects for shorter periods are
eye, also" implants" for purposes of this
by surgical intervention, and which is part.
intended to remain after the
procedure for at least 30 days, and
which can be removed only by
medical or surgical intervention

NOTE This definition applies to

implantable medical devices other
than active implantable medical
devices.

(c) Component means any raw

material, substance, piece, part,
software, firmware, labeling, or
assembly which is intended to be
included as part of the finished,
packaged, and labeled device.

(d) Control number means any

distinctive symbols, such as a
distinctive combination of letters or
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 7

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
numbers, or both, from which the
history of the manufacturing,
packaging, labeling, and distribution
of a unit, lot, or batch of finished
devices can be determined.

(e) Design history file (DHF) means a

compilation of records which
describes the design history of a
finished device.
3.6 Federal Food, Drug, and Cosmetic The definition in the regulation is a bit
labelling Act, Section 201: more detailed, but the definition in the
written, printed or graphic matter (m) The term “labeling” means all Standard should cover all that is
– affixed to a medical device or any labels and other written, printed, or covered in the definitions of “label”
of its containers or wrappers, or graphic matter (1) upon any article or and “labeling” in the regulation.
– accompanying a medical device, any of its containers or wrappers or
related to identification, technical (2) accompanying such article.
description, and use of the medical
device, but excluding shipping (k) The “label” means a display of
documents. written, printed, or graphic matter
upon the immediate container of any
NOTE Some regional and national article; and a requirement made by or
regulations refer to “labelling” as under authority of this Act that any
“information supplied by the word, statement, or other information
manufacturer.” appear on the label shall not be
considered to be complied with
unless such word, statement, or other
information also appears on the
outside container or wrapper, if any
there be, of the retail package or such
article, or is easily legible through the
outside container or wrapper.

ISO 13485:2003, 7.3.2 Design and (f) Design input means the physical The definition of “design and
development inputs and performance requirements of a development inputs” in the Standard
Inputs related to product device that are used as the basis for is actually incorporated into the
requirements shall be determined and device design. requirements section. It is also a bit
records maintained (see 4.2.4). more explicit.
These inputs shall include
a) functional, performance and
safety requirements,
according to the intended
use,
b) applicable statutory and
regulatory requirements,
c) where applicable, information
derived from previous similar
designs,
d) other requirements essential
for design and development,
and
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 8

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
e) output(s) of risk management
(see 7.1).
These inputs shall be reviewed
for adequacy and approved.
Requirements shall be complete,
unambiguous and not in conflict with
each other.

ISO 13485:2003, 7.3.3 Design and (g) Design output means the results The definition of “design and
development outputs of a design effort at each design development outputs” in the Standard
The outputs of design and phase and at the end of the total is actually incorporated into the
development shall be provided in a design effort. The finished design requirements section. It is also a bit
form that enables verification against output is the basis for the device more explicit.
the design and development input master record. The total finished
and shall be approved prior to design output consists of the device, While the regulation doesn’t explicitly
release. its packaging and labeling, and the include examples of design output, it
device master record. is clear that FDA considers items like
Design and development outputs the product and component
shall specifications, manufacturing
a) meet the input requirements procedures, engineering drawings,
for design and development, and logbooks are part of the design
b) provide appropriate output.
information for purchasing,
production and for service
provision,
c) contain or reference product
acceptance criteria, and
d) specify the characteristics of
the product that are essential
for its safe and proper use.

Records of the design and

development outputs shall be
maintained (see 4.2.4).

NOTE Records of the design and

development outputs can include
specifications, manufacturing
procedures, engineering drawings,
and engineering or research
logbooks.

3.7 Federal Food, Drug, and Cosmetic

medical device Act, Section 201:
any instrument, apparatus, (h) The term “device” (...) means an
implement, machine, appliance, instrument, apparatus, implement,
implant, in vitro reagent or calibrator, machine, contrivance, implant, in vitro
software, material or other similar or reagent, or similar or related article,
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 9

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
related article, intended by the including any component, part, or
manufacturer to be used, alone or in accessory, which is
combination, for human beings for 1) recognized in the official
one or more of the specific National Formulary, or the
purpose(s) of United States Pharmacopeia,
– diagnosis, prevention, monitoring, or any supplement to them,
treatment or alleviation of disease, 2) intended for use in the
– diagnosis, monitoring, treatment, diagnosis of disease or other
alleviation of or compensation for conditions, or in the cure,
an injury, mitigation, treatment, or
– investigation, replacement, prevention of disease, in man
modification, or support of the or other animals, or
anatomy or of a physiological 3) intended to affect the
process, structure or any function of
– supporting or sustaining life, the body of man or other
– control of conception, animals, and
– disinfection of medical devices, which does not achieve its primary
– providing information for medical intended purposes through chemical
purposes by means of in vitro action within or on the body of man or
examination of specimens derived other animals and which is not
from the human body, dependent upon being metabolized
and which does not achieve its for the achievement of its primary
primary intended action in or on the intended purposes.
human body by pharmacological,
immunological or metabolic means,
but which may be assisted in its
function by such means.

NOTE This definition has been

developed by the Global
Harmonization Task Force (GHTF).
See bibliographic reference [15].

ISO 13485:2003, 7.3.4 Design and (h) Design review means a The definition of “design and
development review documented, comprehensive, development review” in the Standard
At suitable stages, systematic systematic examination of a design to is actually incorporated into the
reviews of design and development evaluate the adequacy of the design requirements section. Otherwise
shall be performed in accordance requirements, to evaluate the there is no significant difference.
with planned arrangements (see capability of the design to meet these
7.3.1) requirements, and to identify
a) to evaluate the ability of the problems.
results of design and
development to meet
requirements, and
b) to identify any problems and
propose necessary actions.

Participants in such reviews shall

include representatives of functions
concerned with the design and
development stage(s) being
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 10

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
reviewed, as well as other specialist
personnel (see 5.5.1 and 6.2.1).

Records of the results of the reviews

and any necessary actions shall be
maintained (see 4.2.4).

3.8
sterile medical device
category of medical device intended
to meet the requirements for sterility

NOTE The requirements for sterility

of a medical device might be subject
to national or regional regulations or
standards.

(i) Device history record (DHR)

means a compilation of records
containing the production history of a
finished device.

(j) Device master record (DMR)

means a compilation of records
containing the procedures and
specifications for a finished device.

(k) Establish means define, document

(in writing or electronically), and
implement.

(l) Finished device means any device

or accessory to any device that is
suitable for use or capable of
functioning, whether or not it is
packaged, labeled, or sterilized.

(m) Lot or batch means one or more

components or finished devices that
consist of a single type, model, class,
size, composition, or software version
that are manufactured under
essentially the same conditions and
that are intended to have uniform
characteristics and quality within
specified limits.

ISO 9000:2000, 3.2.7 top (n) Management with executive The intent of both definitions is the
management responsibility means those senior same.
– person or group of people who employees of a manufacturer who
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 11

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
directs and controls an have the authority to establish or
organization (3.3.1) at the highest make changes to the manufacturer’s
level. quality policy and quality system.

(o) Manufacturer means any person

who designs, manufactures,
fabricates, assembles, or processes a
finished device. Manufacturer
includes but is not limited to those
who perform the functions of contract
sterilization, installation, relabeling,
remanufacturing, repacking, or
specification development, and initial
distributors of foreign entities
performing these functions.
(p) Manufacturing material means
any material or substance used in or
used to facilitate the manufacturing
process, a concomitant constituent,
or a byproduct constituent produced
during the manufacturing process,
which is present in or on the finished
device as a residue or impurity not by
design or intent of the manufacturer.

ISO 9000:2000, 3.6.2 (q) Nonconformity means the

nonconformity nonfulfillment of a specified
– non-fulfillment of a requirement requirement.
(3.1.2)]
ISO 9000:2000, 3.4.2 product (r) Product means components, The definition in the Standard more
– the result of a process (3.4.1) manufacturing materials, in-process clearly reflects the process approach
NOTE 1 There are four generic devices, finished devices, and of this document.
product categories, as follows: returned devices.
x Services (e.g., transport); The definition in the Standard is a bit
x Software (e.g., computer more detailed.
program, dictionary);
x Hardware (e.g., engine
mechanical part);
x Processed materials (e.g.,
lubricant).

Many products comprise elements

belonging to different generic product
categories. Whether the product is
then called service, software,
hardware or processed material
depends on the dominant element.
For example, the offered product
"automobile" consists of hardware
(e.g., tires), processed material (e.g.,
fuel, cooling system liquid), software
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 12

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(e. g., engine control software,
driver’s manual), and service (e.g.,
operating explanations given by the
salesman). ...

ISO 9000:2000, 3.1.1 quality (s) Quality means the totality of the No significant difference. The
– degree to which a set of inherent features and characteristics that bear definition in the regulation reflects the
characteristics (3.5.1) fulfills on the ability of a device to satisfy objective of the regulation, that is the
requirements (3.1.2) fitness-for-use, including safety and assurance of product safety and
performance. effectiveness.

ISO 9000:2000, 3.9.1 audit (t) Quality audit means a systematic, The definition in the regulation
– systematic, independent and independent examination of a imposes the requirement related to
documented process (3.4.1) for manufacturer's quality system that is defined intervals, and includes
obtaining audit evidence (3.9.4) performed at defined intervals and at activities that occur after the audit is
and evaluating it objectively to sufficient frequency to determine actually performed.
determine the extent to which whether both quality system activities
audit criteria (3.9.3) are fulfilled.... and the results of such activities
comply with quality system
procedures, that these procedures
are implemented effectively, and that
these procedures are suitable to
achieve quality system objectives.

ISO 9000:2000, 3.2.4 quality policy (u) Quality policy means overall
– overall intentions and direction of intentions and direction of an
an organization (3.2.1) related to organization with respect to quality,
quality (3.1.1) as formally as established by management with
expressed by top management executive responsibility.
(3.2.7)

ISO 9000:2000, 3.2.2 system (v) Quality system means the The definition in the regulation is
– set of interrelated or interacting organizational structure, more instructive, but is consistent
elements responsibilities, procedures, with the intent of the standard.
processes, and resources for
implementing quality management.

(w) Remanufacturer means any

person who processes, conditions,
renovates, repackages, restores, or
does any other act to a finished
device that significantly changes the
finished device's performance or
safety specifications, or intended use.

ISO 9000:2000, 3.6.7 rework (x) Rework means action taken on a

– action on a nonconforming nonconforming product so that it will
product (3.4.2) to make it conform fulfill the specified DMR requirements
to the requirements (3.1.2) before it is released or distribution.

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 13

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
NOTE Unlike rework, repair (3.6.9)
can affect or change parts of the
nonconforming product.

ISO 9000:2000, 3.7.3 specification (y) Specification means any The regulation requires
– document (3.7.2) stating requirement with which a product, documentation of specifications.
requirements (3.1.2) process, service, or other activity
must conform.
NOTE A specification can be related
to activities (e.g., procedure
document, process specification and
test specification), or products (3.4.2)
(e.g., product specification,
performance specification and
drawing).

ISO 9000:2000, 3.8.5 validation (z) Validation means confirmation by No significant difference, but neither
– confirmation, through the provision examination and provision of definition is very informative.
of objective evidence (3.8.1), that objective evidence that the particular
the requirements (3.2.1) for a requirements for a specific intended The regulatory definition is more
specific intended use or use can be consistently fulfilled. detailed and that it breaks out and
application have been fulfilled defines “process validation” and
(1) Process validation means “design validation.”
NOTE 1 The term “validated” is used establishing by objective evidence
to designate the corresponding that the process consistently Normally, validation is performed on
status. produces the results or product the final product or process for
meeting its predetermined manufacturing, monitoring, testing,
NOTE 2 The use conditions for specifications. and supporting the product.
validation can be real or simulated.
(2) Design validation means
establishing by objective evidence
that device specifications conform
with user needs and intended use(s).

ISO 9000:2000, 3.8.4 verification (aa) Verification means confirmation No significant difference.
– confirmation, through the provision by examination and provision of
of objective evidence (3.8.1) that objective evidence that specified The Standard is more detailed.
specified requirements (3.1.2) requirements have been fulfilled.
have been fulfilled

NOTE 1 The term “verified” is used to

designate the corresponding status.

NOTE 2 Confirmation can comprise

activities such as
– Performing alternative
calculations,

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 14

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
– Comparing a new design
specification (3.7.3) with these
similar proven design
specification,
– Undertaking tests (3.8.3) and
demonstrations, and
– Reviewing documents prior to
issue.

4 Quality management system 820.5 Quality system. No significant differences in intent

4.1 General requirements Each manufacturer shall establish between the two documents.
The organization shall establish, and maintain a quality system that is
document, implement and maintain a appropriate for the specific medical
quality management system and device(s) designed or manufactured,
maintain its effectiveness in and that meets the requirements of
accordance with the requirements of this part.
this International Standard.

The organization shall 820.186 Quality system record.

a) identify the processes Each manufacturer shall maintain a
needed for the quality quality system record (QSR). The
management system and QSR shall include, or refer to the
their application and location of, procedures and the
throughout the organization documentation of activities required
(see 1.2). by this part that are not specific to a
b) determine the sequence and particular type of device(s), including,
interaction of these but not limited to, the records
processes. required by Sec. 820.20. Each
c) determine criteria and manufacturer shall ensure that the
methods needed to ensure QSR is prepared and approved in
that both the operation and accordance with Sec. 820.40.
control of these processes
are active.
d) ensure the availability of
resources and information
necessary to support the
operation and monitoring of
these processes.
e) monitor, measure and
analyse these processes,
and
f) implement actions necessary
to achieve planned the
results and maintain the
effectiveness of these
processes.

These processes shall be managed

by the organization in accordance
with the requirements of this
International Standard.
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 15

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
Where an organization chooses to 820.50 Purchasing controls.
outsource any process that affects Each manufacturer shall establish
product conformity with the and maintain procedures to ensure
requirements, the organization shall that all purchased or otherwise
ensure control over such process. received product and services
Control of such outsource processes conform to specified requirements.
shall be identified within the quality
management system (see 8.5.1). (a) Evaluation of suppliers,
contractors, and consultants. Each
manufacturer shall establish and
maintain the requirements, including
quality requirements, that must be
met by suppliers, contractors, and
consultants. Each manufacturer shall:

(1) Evaluate and select potential

suppliers, contractors, and
consultants on the basis of their
ability to meet specified requirements,
including quality requirements. The
evaluation shall be documented.
(2) Define the type and extent of
control to be exercised over the
product, services, supplies,
contractors, and consultants, based
on the evaluation results.

(3) Establish and maintain records of

acceptable suppliers, contractors,
and consultants.

NOTE Processes needed for the

quality management system referred
to above should include processes for
management activities, provision of
resources, product realization and
measurement.

4.2 Documentation requirements 820.20 Management responsibility. The Standard lists the required
4.2.1 General (e) Quality system procedures. quality management system
The quality management system Each manufacturer shall establish documentation in this clause, while
documentation shall include quality system procedures and the QSReg indicates the
a) documented statements of a instructions. An outline of the documentation requirements in the
quality policy and quality structure of the documentation used various sections throughout the
objectives, in the quality system shall be regulation. There is no significant
b) a quality manual, established where appropriate. difference in the documentation
c) documented procedures requirements for the two documents,
required by this International except as indicated below.
Standard,
d) documents needed by the
organization to ensure the
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 16

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
effective planning, operation
and control of its processes,
e) records required by this
International Standard (see
4.2.4), and
f) any other documentation
specified by national or
regional regulations.

Where this International Standard This text is included in ISO

specifies that a requirement, 13485:2003 in order to accommodate
procedure, activity or special the definition of “establish” in the
arrangement shall be “documented”, QSReg.
it shall, in addition, be implemented
and maintained.

For each type or model of medical

device the organization shall
establish and maintain a file either
containing or identifying documents
defining product specifications and
quality management system
requirements (see 4.2.3). These
documents shall define the complete
manufacturing process and, if
applicable, installation and servicing.

NOTE 1 The extent of the quality The QSReg implicitly recognizes that
management system documentation the extent of quality management
can differ from one organization to system documentation will reflect the
another due to: size and complexity of the
a) the size of the organization organization. It also implicitly
and type of activities, recognizes that some documentation
b) the complexity of processes may not be needed due to the
and their interactions, and expertise (either through training,
c) the competence of personnel. education, or experience) of the
personnel.
NOTE 2 The documentation can be in
any form or type of medium.

4.2.2 Quality manual 820.20 Management responsibility. The QSReg has no requirements for
The organization shall establish and (e) Quality system procedures. a Quality Manual. Such a manual
maintain a quality manual that Each manufacturer shall establish would still be helpful in explaining the
includes quality system procedures and nature and extent of the quality
a) the scope of the quality instructions. An outline of the management system to an FDA
management system, structure of the documentation used investigator during an inspection. It
including details of and in the quality system shall be would also be useful in the training of
justification for any exclusion established where appropriate. personnel with regard to the quality
and/or non-application (see management system of the
1.2), organization and their place within
that system.
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 17

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
b) the documented procedures
established for the quality The Quality Manual could be used as
management system, or the repository of some of the
reference to them, and individual quality management
c) a description of the system documentation required by
interaction between the the QSReg (e.g., the organizational
processes of the quality structure and interrelationships, the
management system. highest-level procedures in a small
organization dealing with items like
The quality manual shall outline the document control, records-keeping,
structure of the documentation used training).
in the quality management system.

4.2.3 Control of documents 820.40 Document controls. The requirements are essentially the
Documents required by the quality Each manufacturer shall establish same, except that the QSReg has the
management system shall be and maintain procedures to control all specific requirement to communicate
controlled. Records are a special type documents that are required by this changes to documents to the affected
of document and shall be controlled part. The procedures shall provide for personnel.
according to the requirements given the following:
in 4.2.4.
(a) Document approval and
A documented procedure shall be distribution. Each manufacturer shall
established to define the controls designate an individual(s) to review
needed for adequacy and approve prior to
a) to review and approve issuance all documents established
documents for adequacy to meet the requirements of this part.
prior to issue, The approval, including the date and
b) to review and update as signature of the individual(s)
necessary and re-approve approving the document, shall be
documents, documented. Documents established
c) to ensure that changes and to meet the requirements of this part
the current revision status of shall be available at all locations for
documents are identified, which they are designated, used, or
d) to ensure that relevant otherwise necessary, and all obsolete
versions of applicable documents shall be promptly
documents are available at removed from all points of use or
points of use, otherwise prevented from unintended
e) to ensure that documents use.
remain legible and readily
identifiable,
f) to ensure that documents of
external origin are identified
and their distribution
controlled, and
g) to prevent the unintended
use of obsolete documents,
and to apply suitable
identification to them if they
are retained for any purpose.

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 18

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
The organization shall ensure that (b) Document changes. Changes to
changes to documents are reviewed documents shall be reviewed and
and approved either by the approving approved by an individual(s) in the
function or another designated same function or organization that
function which has access to performed the original review and
pertinent background information approval, unless specifically
upon which to base its decisions. designated otherwise. Approved
changes shall be communicated to
the appropriate personnel in a timely
manner. Each manufacturer shall
maintain records of changes to
documents. Change records shall
include a description of the change,
identification of the affected
documents, the signature of the
approving individual(s), the approval
date, and when the change becomes
effective.

The organization shall define the The Standard requires the

period for which at least one copy of organization to define a retention
obsolete controlled documents shall period for obsolete documents.
be retained. This period shall ensure
that documents to which medical
devices have been manufactured and
tested are available for at least the
lifetime of the medical device as
defined by the organization, but not
less than the retention period of any
resulting record (see 4.2.4), or as
specified by relevant regulatory
requirements.

4.2.4 Control of records 820.180 General requirements. No significant differences in the

Records shall be established and All records required by this part shall general requirements associated with
maintained to provide evidence of be maintained at the manufacturing control of records, except that the
conformity to requirements and of the establishment or other location that is QSReg contains requirements for
effective operation of the quality reasonably accessible to responsible communications with FDA.
management system. Records shall officials of the manufacturer and to
remain legible, readily identifiable and employees of FDA designated to
retrievable. A documented procedure perform inspections. Such records,
shall be established to define the including those not stored at the
controls needed for the identification, inspected establishment, shall be
storage, protection, retrieval, made readily available for review and
retention time and disposition of copying by FDA employee(s). Such
records. records shall be legible and shall be
stored to minimize deterioration and
to prevent loss. Those records stored
in automated data processing
systems shall be backed up.

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 19

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(a) Confidentiality. Records deemed
confidential by the manufacturer may
be marked to aid FDA in determining
whether information may be disclosed
under the public information
regulation in part 20 of this chapter.

The organization shall retain the (b) Record retention period. All
records for a period of time at least records required by this part shall be
equivalent to the lifetime of the retained for a period of time
medical device as defined by the equivalent to the design and
organization, but not less than two expected life of the device, but in no
years from the date of product case less than 2 years from the date
release by the organization or as of release for commercial distribution
specified by relevant regulatory by the manufacturer.
requirements.
(c) Exceptions. This section does not
apply to the reports required by
820.20(c) Management review,
820.22 Quality audits, and supplier
audit reports used to meet the
requirements of 820.50(a) Evaluation
of suppliers, contractors, and
consultants, but does apply to
procedures established under these
provisions. Upon request of a
designated employee of FDA, an
employee in management with
executive responsibility shall certify in
writing that the management reviews
and quality audits required under this
part, and supplier audits where
applicable, have been performed and
documented, the dates on which they
were performed, and that any
required corrective action has been
undertaken.

820.181 Device master record. The QSReg requires the

Each manufacturer shall maintain establishment of a Device Master
device master records (DMR's). Each Record (DMR). The DMR may be a
manufacturer shall ensure that each separate file of documents and
DMR is prepared and approved in records, or it may be documents
accordance with 820.40. The DMR containing references to the various
for each type of device shall include, elements of the DMR. ISO/DIS
or refer to the location of, the 13485:2003 has no requirements for
following information: such a file even though it requires the
individual documents and records
(a) Device specifications including that would be contained within that
appropriate drawings, composition, file.
formulation, component
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 20

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
specifications, and software
specifications;

(b) Production process specifications

including the appropriate equipment
specifications, production methods,
production procedures, and
production environment
specifications;

(c) Quality assurance procedures and

specifications including acceptance
criteria and the quality assurance
equipment to be used;

(d) Packaging and labeling

specifications, including methods and
processes used; and

(e) Installation, maintenance, and

servicing procedures and methods.

7.5.1 Control of production and 820.184 Device history record. The QSReg requires the
service provision Each manufacturer shall maintain establishment of a Device History
7.5.1.1 General requirements ... device history records (DHR's). Each Record (DHR) for each lot of devices
The organization shall establish and manufacturer shall establish and or unit manufactured. The DHR may
maintain a record (see 4.2.4) for each maintain procedures to ensure that be a separate file containing the
batch of medical devices that DHR's for each batch, lot, or unit are records, or it may be a document that
provides traceability to the extent maintained to demonstrate that the references the location of these
specified in 7.5.3 and identifies the device is manufactured in accordance records. The Standard does not
amount manufactured and amount with the DMR and the requirements require the establishment of such a
approved for distribution. The batch of this part. The DHR shall include, or file, even though it requires the
record shall be verified and approved. refer to the location of, the following individual records that would be
information: contained with that file.
NOTE A batch can be a single
medical device. (a) The dates of manufacture;

(b) The quantity manufactured;

(c) The quantity released for

distribution;

(d) The acceptance records which

demonstrate the device is
manufactured in accordance with the
DMR;

(e) The primary identification label

and labeling used for each production
unit; and

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 21

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(f) Any device identification(s) and
control number(s) used.

820.186 Quality system record. The QSReg requires the

Each manufacturer shall maintain a establishment of a Quality System
quality system record (QSR). The Record, which may be a separate file
QSR shall include, or refer to the containing the required documents or
location of, procedures and the a document referencing the required
documentation of activities required contents. The Standard does not
by this part that are not specific to a require the establishment of such a
particular type of device(s), including, file, even though it does require the
but not limited to, the records establishment of the various
required by Sec. 820.20. Each documents that would be included in
manufacturer shall ensure that the that file.
QSR is prepared and approved in
accordance with Sec. 820.40.

5 Management responsibility 820.20 Management responsibility. No significant differences in

5.1 Management commitment (a) Quality policy. Management with management responsibilities; the
Top management shall provide executive responsibility shall QSReg spells some of them out in
evidence of its commitment to the establish its policy and objectives for, subsequent sections of the
development and implementation of and commitment to, quality. regulation.
the quality management system and
maintaining its effectiveness by Management with executive
a) communicating to the responsibility shall ensure that the
organization the importance quality policy is understood,
of meeting customer as well implemented, and maintained at all
as statutory and regulatory levels of the organization.
requirements,
b) establishing the quality
policy,
c) ensuring that quality
objectives are established,
d) conducting management
reviews, and
e) ensuring the availability of
resources.

NOTE For the purposes of this

International Standard, statutory
requirements are limited to the safety
and performance of the medical
device only.

5.2 Customer focus The Standard has a distinct focus on

Top management shall ensure that meeting customer requirements in
customer requirements are addition to meeting regulatory
determined and are met with the aim requirements. The QSReg is entirely
of enhancing customer satisfaction focused on meeting those
(see 7.2.1 and 8.2.1). requirements that have as their
objective the design, manufacture,
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 22

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
distribution, and support of safe and
effective medical devices.

The Standard includes requirements

for determining customer
requirements during the entire
product realization process, while the
QSReg includes requirements that
identify product and process
requirements that are focused on
ensuring safe and effective medical
devices.
5.3 Quality policy 820.20 Management responsibility.
Top management shall ensure that (a) Quality policy. Management with
the quality policy executive responsibility shall
a) is appropriate to the purpose establish its policy and objectives for,
of the organization, and commitment to, quality.
b) includes a commitment to
comply with requirements Management with executive
and to maintain the responsibility shall ensure that the
effectiveness of the quality quality policy is understood,
management system, implemented, and maintained at all
c) provides a framework for levels of the organization.
establishing and reviewing
quality objectives,
d) is communicated and
understood within the
organization, and
e) is reviewed for continuing
suitability.
5.4 Planning 820.20 Management responsibility.
5.4.1 Quality objectives (a) Quality policy. Management with
Top management shall ensure that executive responsibility shall
quality objectives, including those establish its policy and objectives for,
needed to meet requirements for and commitment to, quality.
product [see 7.1 a)], are established
at relevant functions and levels within Management with executive
the organization. The quality responsibility shall ensure that the
objectives shall be measurable and quality policy is understood,
consistent with the quality policy. implemented, and maintained at all
levels of the organization.

5.4.2 Quality management system 820.5 Quality system. The QSReg contains the prescriptive
planning Each manufacturer shall establish requirements for a quality plan and
Top management shall ensure that and maintain a quality system that is quality system procedures.
a) the planning of the quality appropriate for the specific medical
management system is device(s) designed or manufactured,
carried out in order to meet and that meets the requirements of
the requirements given in 4.1, this part.
as well as the quality
objectives, and
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 23

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
b) the integrity of the quality (d) Quality planning. Each It is not clear what the FDA is looking
management system is manufacturer shall establish a quality for when they ask for a quality plan. It
maintained when changes to plan which defines the quality seems to be a combination of a high-
the quality management practices, resources, and activities level quality planning document,
system are planned and relevant to devices that are designed containing policy and key objectives,
implemented. and manufactured. The manufacturer with a mandate to drive those
shall establish how the requirements objectives down into the organization,
for quality will be met. and a set of high-level procedures
that illustrate how that plan will be
met.

(e) Quality system procedures. Both the QSReg and the Standard
Each manufacturer shall establish require the establishment of these
quality system procedures and kinds of procedures; only the QSReg
instructions. An outline of the gives them special standing as quality
structure of the documentation used system procedures.
in the quality system shall be
established where appropriate.

5.5 Responsibility, authority and 820.20 Management responsibility.

communication (b) Organization. Each manufacturer
5.5.1 Responsibility and authority shall establish and maintain an
Top management shall ensure that adequate organizational structure to
responsibilities and authorities are ensure that devices are designed and
defined, documented and produced in accordance with the
communicated within the requirements of this part.
organization.

Top management shall establish the (1) Responsibility and authority.

interrelation of all personnel who Each manufacturer shall establish the
manage, perform and verify work appropriate responsibility, authority,
affecting quality, and shall ensure the and interrelation of all personnel who
independence and authority manage, perform, and assess work
necessary to perform these tasks. affecting quality, and provide the
independence and authority
NOTE National or regional necessary to perform these tasks.
regulations might require the
nomination of specific persons as
responsible for activities related to
monitoring experience from the post-
production stage and reporting
adverse events (see 8.2.1 and 8.5.1).

5.5.2 Management representative 820.20 Management responsibility. No significant differences, except the
Top management shall appoint a (b) Organization. requirements in the Standard reflect
member of management who, (3) Management representative. the focus on meeting customer
irrespective of other responsibilities, Management with executive requirements.
shall have responsibility and authority responsibility shall appoint, and
that includes document such appointment of, a
a) ensuring that processes member of management who,
needed for the quality irrespective of other responsibilities,
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 24

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
management system are shall have established authority over
established, implemented and responsibility for:
and maintained,
b) reporting to top management (i) Ensuring that quality system
on the performance of the requirements are effectively
quality management system established and effectively
and any need for maintained in accordance with this
improvement (see 8.5), and part; and
c) ensuring the promotion of
awareness of regulatory and (ii) Reporting on the performance of
customer requirements the quality system to management
throughout the organization. with executive responsibility for
review.
NOTE The responsibility of a
management representative can
include liaison with external parties
on matters relating to the quality
management system.
5.5.3 Internal communication 820.20 Management responsibility. No significant differences; the QSReg
Top management shall ensure that (b) Organization. Each manufacturer implicitly requires the necessary
appropriate communication shall establish and maintain an communication processes that make
processes are established within the adequate organizational structure to for successful interrelationships.
organization and that communication ensure that devices are designed and
takes place regarding the produced in accordance with the
effectiveness of the quality requirements of this part.
management system.
(1) Responsibility and authority.
Each manufacturer shall establish the
appropriate responsibility, authority,
and interrelation of all personnel who
manage, perform, and assess work
affecting quality, and provide the
independence and authority
necessary to perform these tasks.

5.6 Management review 820.20 Management responsibility.

5.6.1 General (c) Management review.
Top management shall review the Management with executive
organization's quality management responsibility shall review the
system, at planned intervals, to suitability and effectiveness of the
ensure its continuing suitability, quality system at defined intervals
adequacy and effectiveness. This and with sufficient frequency
review shall include assessing according to established procedures
opportunities for improvement and to ensure that the quality system
the need for changes to the quality satisfies the requirements of this part
management system, including the and the manufacturer's established
quality policy and quality objectives. quality policy and objectives. The
dates and results of quality system
Records from management reviews reviews shall be documented.
shall be maintained (see 4.2.4).

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 25

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
5.6.2 Review input The requirements for review input
The input to management review that are spelled out in the Standard
shall include information on are logical and would be expected by
a) results of audits, an FDA investigator during an
b) customer feedback, inspection that focused on
c) process performance and management responsibilities.
product conformity,
d) status of preventive and
corrective actions,
e) follow-up actions from
previous management
reviews,
f) changes that could affect the
quality management system,
and
g) recommendations for
improvement, and
h) new or revised regulatory
requirements.

5.6.3 Review output The requirements for review output

The output from the management that are spelled out in the Standard
review shall include any decisions are logical and would be expected by
and actions related to an FDA investigator during an
a) improvements needed to inspection that focused on
maintain the effectiveness of management responsibilities.
the quality management
system and its processes,
b) improvement of product
related to customer
requirements, and
c) resource needs.

6 Resource management 820.20 Management responsibility. No significant differences, especially

6.1 Provision of resources (b) Organization. since the Standard includes the
The organization shall determine and (2) Resources. Each manufacturer requirement to meet regulatory
provide the resources needed shall provide adequate resources, requirements.
a) to implement (and maintain) including the assignment of trained
the quality management personnel, for management,
system and maintain its performance of work, and
effectiveness, and assessment activities, including
b) to meet regulatory and internal quality audits, to meet the
customer requirements. requirements of this part.

6.2 Human resources 820.20 Management responsibility.

6.2.1 General (b) Organization.
Personnel performing work affecting (2) Resources. Each manufacturer
product quality shall be competent on shall provide adequate resources,
the basis of appropriate education, including the assignment of trained
training, skills and experience. personnel, for management,
performance of work, and
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 26

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
assessment activities, including
internal quality audits, to meet the
requirements of this part.

820.25 Personnel.
(a) General. Each manufacturer shall
have sufficient personnel with the
necessary education, background,
training, and experience to assure
that all activities required by this part
are correctly performed.

(b) Training. Each manufacturer

shall establish procedures for
identifying training needs and ensure
that all personnel are trained to
adequately perform their assigned
responsibilities. Training shall be
documented.
(1) As part of their training, personnel
shall be made aware of device
defects which may occur from the
improper performance of their specific
jobs.
(2) Personnel who perform
verification and validation activities
shall be made aware of defects and
errors that may be encountered as
part of their job functions.

6.2.2 Competence, awareness and 820.20 Management responsibility.

training (b) Organization.
The organization shall (2) Resources. Each manufacturer
a) determine the necessary shall provide adequate resources,
competence for personnel including the assignment of trained
performing work affecting personnel, for management,
product quality, performance of work, and
b) provide training or take other assessment activities, including
actions to satisfy these internal quality audits, to meet the
needs, requirements of this part.
c) evaluate the effectiveness of
the actions taken, 820.25 Personnel.
d) ensure that its personnel are (a) General. Each manufacturer shall
aware of the relevance and have sufficient personnel with the
importance of their activities necessary education, background,
and how they contribute to training, and experience to assure
the achievement of the that all activities required by this part
quality objectives, and are correctly performed.
e) maintain appropriate records (b) Training. Each manufacturer
of education, training, skills shall establish procedures for
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 27

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
and experience (see 4.2.4). identifying training needs and ensure
that all personnel are trained to
NOTE National or regional adequately perform their assigned
regulations might require the responsibilities. Training shall be
organization to establish documented documented.
procedures for identifying training (1) As part of their training, personnel
needs. shall be made aware of device
defects which may occur from the
improper performance of their specific
jobs.
(2) Personnel who perform
verification and validation activities
shall be made aware of defects and
errors that may be encountered as
part of their job functions.

6.3 Infrastructure 820.70 Production and process The intent of the two documents is
The organization shall determine, controls. consistent; the QSReg contains a
provide and maintain the (d) Personnel. Each manufacturer number of specific requirements
infrastructure needed to achieve shall establish and maintain related to the creation of maintenance
conformity to product requirements. requirements for the health, schedules, inspections, and
Infrastructure includes, as applicable cleanliness, personal practices, and adjustment of equipment, and
a) buildings, workspace and clothing of personnel if contact manufacturing materials.
associated utilities, between such personnel and product
b) process equipment (both or environment could reasonably be
hardware and software), and expected to have an adverse effect
c) supporting services (such as on product quality. The manufacturer
transport or communication). shall ensure that maintenance and
other personnel who are required to
The organization shall establish work temporarily under special
documented requirements for environmental conditions are
maintenance activities, including their appropriately trained or supervised by
frequency, when such activities or a trained individual.
lack thereof can affect product
quality. (f) Buildings. Buildings shall be of
suitable design and contain sufficient
Records of such maintenance shall space to perform necessary
be maintained (see 4.2.4). operations, prevent mixups, and
assure orderly handling.

(g) Equipment. Each manufacturer

shall ensure that all equipment used
in the manufacturing process meets
specified requirements and is
appropriately designed, constructed,
placed, and installed to facilitate
maintenance, adjustment, cleaning,
and use.

(1) Maintenance schedule. Each

manufacturer shall establish and
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 28

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
maintain schedules for the
adjustment, cleaning, and other
maintenance of equipment to ensure
that manufacturing specifications are
met. Maintenance activities, including
the date and individual(s) performing
the maintenance activities, shall be
documented.

(2) Inspection. Each manufacturer

shall conduct periodic inspections in
accordance with established
procedures to ensure adherence to
applicable equipment maintenance
schedules. The inspections, including
the date and individual(s) conducting
the inspections, shall be documented.

(3) Adjustment. Each manufacturer

shall ensure that any inherent
limitations or allowable tolerances are
visibly posted on or near equipment
requiring periodic adjustments or are
readily available to personnel
performing these adjustments.

(h) Manufacturing material. Where There is no mention of manufacturing

a manufacturing material could material in the Standard, but the
reasonably be expected to have an Standard does have general
adverse effect on product quality, the requirements related to prevention of
manufacturer shall establish and contamination.
maintain procedures for the use and
removal of such manufacturing
material to ensure that it is removed
or limited to an amount that does not
adversely affect the device's quality.
The removal or reduction of such
manufacturing material shall be
documented.

6.4 Work environment 820.70 Production and process The intent of both documents is
The organization shall determine and controls. consistent; the Standard specifically
manage the work environment (c) Environmental control. Where calls for control of used product to
needed to achieve conformity to environmental conditions could prevent contamination of other
product requirements. reasonably be expected to have an product, the manufacturing
adverse effect on product quality, the environment, or personnel.
The following requirements shall manufacturer shall establish and
apply. maintain procedures to adequately
a) The organization shall control these environmental
establish documented conditions. Environmental control
requirements for health, system(s) shall be periodically
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 29

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
cleanliness and clothing of inspected to verify that the system,
personnel if contact between including necessary equipment, is
such personnel and the adequate and functioning properly.
product or work environment These activities shall be documented
could adversely affect the and reviewed.
quality of the product (see
7.5.1.2.1). (d) Personnel. Each manufacturer
b) If work environment shall establish and maintain
conditions can have an requirements for the health,
adverse effect on product cleanliness, personal practices, and
quality, the organization shall clothing of personnel if contact
establish documented between such personnel and product
requirements for the work or environment could reasonably be
environment conditions and expected to have an adverse effect
documented procedures or on product quality. The manufacturer
work instructions to monitor shall ensure that maintenance and
and control these work other personnel who are required to
environment conditions (see work temporarily under special
7.5.1.2.1). environmental conditions are
c) The organization shall ensure appropriately trained or supervised by
that all personnel who are a trained individual.
required to work temporarily
under special environmental (e) Contamination control. Each
conditions within the work manufacturer shall establish and
environment are maintain procedures to prevent
appropriately trained or contamination of equipment or
supervised by a trained product by substances that could
person [see 6.2.2 b)]. reasonably be expected to have an
d) If appropriate, special adverse effect on product quality.
arrangements shall be
established and documented
for the control of
contaminated or potentially
contaminated product in
order to prevent
contamination of other
product, the work
environment or personnel
(see 7.5.3.1).

7 Product realization 820.5 Quality system. The QSReg doesn’t specifically

7.1 Planning of product realization Each manufacturer shall establish recognize the concept of product
The organization shall plan and and maintain a quality system that is realization, even though it includes
develop the processes needed for appropriate for the specific medical requirements related to essentially all
product realization. Planning of device(s) designed or manufactured, of the processes associated with
product realization shall be consistent and that meets the requirements of product realization. The QSReg also
with the requirements of the other this part. requires, either implicitly or explicitly,
processes of the quality management in various sections, planning
system (see 4.1). associated with these requirements.

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 30

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
In planning product realization, the
organization shall determine the
following, as appropriate:
a) quality objectives and
requirements for the product;
b) the need to establish
processes, documents, and
provide resources specific to
the product;
c) required verification,
validation, monitoring,
inspection and test activities
specific to the product and
the criteria for product
acceptance;
d) records needed to provide
evidence that the realization
processes and resulting
product meet requirements
(see 4.2.4).

The output of this planning shall be in

a form suitable for the organization's
method of operations.
(g) Design validation. Each The Standard recognizes the fact that
The organization shall establish manufacturer shall establish and risk management is a process that
documented requirements for risk maintain procedures for validating the shall be conducted throughout the
management throughout product device design. Design validation shall product realization process, while the
realization. Records arising from risk be performed under defined operating QSReg refers to risk management
management shall be maintained conditions on initial production units, only in the section related to design
(see 4.2.4). lots, or batches, or their equivalents. validation. FDA, however, recognizes
Design validation shall ensure that the wisdom of the Standard’s risk
devices conform to defined user management requirements, and will
needs and intended uses and shall seek records associated with risk
include testing of production units management consistent with the
under actual or simulated use requirements set out in the Standard.
conditions. Design validation shall
include software validation and risk
analysis, where appropriate. The
results of the design validation,
including identification of the design,
method(s), the date, and the
individual(s) performing the
validation, shall be documented in the
DHF.

NOTE 1 A document specifying the

processes of the quality management
system (including the product
realization processes) and the
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 31

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
resources to be applied to a specific
product, project or contract, can be
referred to as a quality plan.

NOTE 2 The organization may also

apply the requirements given in 7.3 to
the development of product
realization processes.

NOTE 3 See ISO 14971 for guidance

related to risk management.

7.2 Customer-related processes The closest the QSReg gets to

7.2.1 Determination of determining customer requirements
requirements related to the related to the product is in 820.30(c)
product design inputs. The customer
The organization shall determine requirements referred to in clause 7.2
a) requirements specified by the of the Standard refer to those
customer, including the requirements associated with getting
requirements for delivery and the product to the customer. This
post-delivery activities, includes items associated with order
b) requirements not stated by handling and what were referred to in
the customer but necessary early versions of ISO 9001 as
for specified or intended use, contract review. These are not
where known, focuses of the QSReg.
c) statutory and regulatory
requirements related to the
product, and
d) any additional requirements
determined by the
organization.

7.2.2 Review of requirements

related to the product
The organization shall review the
requirements related to the product.
This review shall be conducted prior
to the organization's commitment to
supply a product to the customer (e.g.
submission of tenders, acceptance of
contracts or orders, acceptance of
changes to contracts or orders) and
shall ensure that
a) product requirements are
defined and documented,
b) contract or order
requirements differing from
those previously expressed
are resolved, and

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 32

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
c) the organization has the
ability to meet the defined
requirements.

Records of the results of the review

and actions arising from the review
shall be maintained (see 4.2.4).

Where the customer provides no

documented statement of
requirement, the customer
requirements shall be confirmed by
the organization before acceptance.

Where product requirements are

changed, the organization shall
ensure that relevant documents are
amended and that relevant personnel
are made aware of the changed
requirements.

NOTE In some situations, such as

internet sales, a formal review is
impractical for each order. Instead the
review can cover relevant product
information such as catalogues or
advertising material.

7.2.3 Customer communication

The organization shall determine and
implement effective arrangements for
communicating with customers in
relation to
a) product information,
b) enquiries, contracts or order
handling, including
amendments,
c) customer feedback, including
customer complaints (see
8.2.1), and
d) advisory notices (see 8.5.1).

7.3 Design and development 820.30 Design controls. The overall objectives of the two
7.3.1 Design and development (a) General. (1) Each manufacturer documents related to design control
planning of any class III or class II device, and planning are consistent. The QSReg
The organization shall establish the class I devices listed in paragraph limits the applicability of design
documented procedures for design (a)(2) of this section, shall establish controls to more high-risk medical
and development. and maintain procedures to control devices, while the Standard applies
the design of the device in order to them to all medical devices.
ensure that specified design
requirements are met.
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 33

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
The organization shall plan and (2) The following class I devices are
control the design and development subject to design controls:
of product. (i) Devices automated with computer
software; and
During the design and development (ii) The devices listed in the following
planning, the organization shall chart.
determine
a) the design and development --------------------------------------------------
stages, Section Device
b) the review, verification, --------------------------------------------------
validation and design transfer 868.6810 Catheter,
activities (see Note) that are Tracheobronchial Suction.
appropriate to each design 878.4460 Glove, Surgeon's.
and development stage, and 880.6760 Restraint, Protective.
c) the responsibilities and 892.5650 System, Applicator,
authorities for design and Radionuclide, Manual.
development. 892.5740 Source, Radionuclide
Teletherapy.
The organization shall manage the --------------------------------------------------
interfaces between different groups
involved in design and development (b) Design and development
to ensure effective communication planning. Each manufacturer shall
and clear assignment of establish and maintain plans that
responsibility. describe or reference the design and
development activities and define
Planning output shall be documented, responsibility for implementation.
and updated as appropriate, as the
design and development progresses The plans shall identify and describe
(see 4.2.3). the interfaces with different groups or
activities that provide, or result in,
NOTE Design transfer activities input to the design and development
during the design and development process. The plans shall be reviewed,
process ensure that design and updated, and approved as design and
development outputs are verified as development evolves.
suitable for manufacturing before
becoming final production (j) Design history file. Each While the Standard requires the
specifications. manufacturer shall establish and creation of design control
maintain a DHF for each type of documentation and records, the
device. The DHF shall contain or QSReg requires the establishment of
reference the records necessary to a Design History File which either
demonstrate that the design was contains or refers to all the
developed in accordance with the documents and records associated
approved design plan and the with the application of the design
requirements of this part. control processes to a particular
product.

7.3.2 Design and development 820.30 Design controls.

inputs (c) Design input. Each manufacturer
Inputs relating to product shall establish and maintain
requirements shall be determined and procedures to ensure that the design
records maintained (see 4.2.4). requirements relating to a device are
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 34

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
These inputs shall include appropriate and address the intended
a) functional, performance and use of the device, including the needs
safety requirements, of the user and patient. The
according to the intended procedures shall include a
use, mechanism for addressing
b) applicable statutory and incomplete, ambiguous, or conflicting
regulatory requirements, requirements. The design input
c) where applicable, information requirements shall be documented
derived from previous similar and shall be reviewed and approved
designs, and by a designated individual(s). The
d) other requirements essential approval, including the date and
for design and development, signature of the individual(s)
and approving the requirements, shall be
e) output(s) of risk management documented.
(see 7.1).
These inputs shall be reviewed
for adequacy and approved.

Requirements shall be complete,

unambiguous and not in conflict with
each other.

7.3.3 Design and development 820.30 Design controls. The intent of the two documents is
outputs (d) Design output. Each consistent, with the QSReg
The outputs of design and manufacturer shall establish and containing specific requirements
development shall be provided in a maintain procedures for defining and associated with the approval and
form that enables verification against documenting design output in terms release of design outputs.
the design and development input that allow an adequate evaluation of
and shall be approved prior to conformance to design input
release. requirements. Design output
procedures shall contain or make
Design and development outputs reference to acceptance criteria and
shall shall ensure that those design
a) meet the input requirements outputs that are essential for the
for design and development, proper functioning of the device are
b) provide appropriate identified.
information for purchasing,
production and for service Design output shall be documented,
provision, reviewed, and approved before
c) contain or reference product release. The approval, including the
acceptance criteria, and date and signature of the individual(s)
d) specify the characteristics of approving the output, shall be
the product that are essential documented.
for its safe and proper use.

Records of the design and

development outputs shall be
maintained (see 4.2.4).

NOTE Records of design and

development outputs can include
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 35

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
specifications, manufacturing
procedures, engineering drawings,
and engineering or research
logbooks.

7.3.4 Design and development 820.30 Design controls. The intent of the two documents is
review (e) Design review. Each consistent, with the Standard
At suitable stages, systematic manufacturer shall establish and illustrating in more detail the
reviews of design and development maintain procedures to ensure that objectives of the design review and
shall be performed in accordance formal documented reviews of the the QSReg including prescriptive
with planned arrangements (see design results are planned and design review process requirements
7.3.1) conducted at appropriate stages of not contained in the Standard.
a) to evaluate the ability of the the device's design development. The
results of design and procedures shall ensure that
development to meet participants at each design review
requirements, and include representatives of all
b) to identify any problems and functions concerned with the design
propose necessary actions. stage being reviewed and an
individual(s) who does not have direct
Participants in such reviews shall responsibility for the design stage
include representatives of functions being reviewed, as well as any
concerned with the design and specialists needed. The results of a
development stage(s) being design review, including identification
reviewed, as well as other specialist of the design, the date, and the
personnel (see 5.5.1 and 6.2.1). individual(s) performing the review,
shall be documented in the design
Records of the results of the reviews history file (the DHF).
and any necessary actions shall be
maintained (see 4.2.4).
7.3.5 Design and development 820.30 Design controls. The intent of the two documents is
verification (f) Design verification. Each consistent, with the QSReg including
Verification shall be performed in manufacturer shall establish and prescriptive design verification
accordance with planned maintain procedures for verifying the process requirements not contained
arrangements (see 7.3.1) to ensure device design. Design verification in the Standard.
that the design and development shall confirm that the design output
outputs have met the design and meets the design input requirements.
development input requirements. The results of the design verification,
Records of the results of the including identification of the design,
verification and any necessary method(s), the date, and the
actions shall be maintained (see individual(s) performing the
4.2.4). verification, shall be documented in
the DHF.
7.3.6 Design and development 820.30 Design controls. The intent of the two documents is
validation (g) Design validation. Each consistent. The QSReg seems to
Design and development validation manufacturer shall establish and indicate that risk analysis is a design
shall be performed in accordance maintain procedures for validating the validation process. This is not
with planned arrangements (see device design. Design validation shall consistent with the teachings of ISO
7.3.1) to ensure that the resulting be performed under defined operating 14971:2000, which calls for risk
product is capable of meeting the conditions on initial production units, management activities throughout the
requirements for the specified lots, or batches, or their equivalents. product realization process.
application or intended use. Design validation shall ensure that
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 36

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
Validation shall be completed prior to devices conform to defined user ISO 13485:2003 addresses a
the delivery or implementation of the needs and intended uses and shall scenario not addressed by the
product (see Note 1). include testing of production units QSReg (e.g., where final assembly of
under actual or simulated use the medical device is accomplished
Records of the results of validation conditions. Design validation shall on delivery to the customer).
and any necessary actions shall be include software validation and risk
maintained (see 4.2.4). analysis, where appropriate. The The QSReg contains a number of
results of the design validation, design validation requirements not
As part of design and development including identification of the design, included in the Standard.
validation, the organization shall method(s), the date, and the
perform clinical evaluations and/or individual(s) performing the
evaluation of performance of the validation, shall be documented in the
medical device, as required by DHF.
national or regional regulations (see
Note 2).

NOTE 1 If a medical device can only

be validated following assembly and
installation at point of use, delivery is
not considered to be complete until
the product has been formally
transferred to the customer.

NOTE 2 Provision of the medical

device for purposes of clinical
evaluations and/or evaluation of
performance is not considered to be
delivery.

7.3.7 Control of design and 820.30 Design controls. The Standard contains requirements
development changes (i) Design changes. Each related to the effect of design
Design and development changes manufacturer shall establish and changes on product already delivered
shall be identified and records maintain procedures for the and records of design changes that
maintained. The changes shall be identification, documentation, do not appear in the QSReg.
reviewed, verified and validated, as validation or where appropriate
appropriate, and approved before verification, review, and approval of
implementation. The review of design design changes before their
and development changes shall implementation.
include evaluation of the effect of the
changes on constituent parts and
product already delivered.

Records of the results of the review of

changes and any necessary actions
shall be maintained (see 4.2.4).

7.4 Purchasing 820.50 Purchasing controls.

7.4.1 Purchasing process Each manufacturer shall establish
The organization shall establish and maintain procedures to ensure
documented procedures to ensure that all purchased or otherwise
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 37

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
that purchased product conforms to received product and services
specified purchase requirements. conform to specified requirements.

The type and extent of control applied (a) Evaluation of suppliers,

to the supplier and the purchased contractors, and consultants. Each
product shall be dependent upon the manufacturer shall establish and
effect of the purchased product on maintain the requirements, including
subsequent product realization or the quality requirements, that must be
final product. met by suppliers, contractors, and
consultants. Each manufacturer shall:
The organization shall evaluate and
select suppliers based on their ability (1) Evaluate and select potential
to supply product in accordance with suppliers, contractors, and
the organization's requirements. consultants on the basis of their
Criteria for selection, evaluation and ability to meet specified requirements,
re-evaluation shall be established. including quality requirements. The
evaluation shall be documented.
Records of the results of evaluations
and any necessary actions arising (2) Define the type and extent of
from the evaluation shall be control to be exercised over the
maintained (see 4.2.4). product, services, suppliers,
contractors, and consultants, based
on the evaluation results.

(3) Establish and maintain records of

acceptable suppliers, contractors,
and consultants.

7.4.2 Purchasing information 820.50 Purchasing controls. The intent of both documents is
Purchasing information shall describe (b) Purchasing data. Each consistent.
the product to be purchased, manufacturer shall establish and
including where appropriate maintain data that clearly describe or The Standard contains a requirement
a) requirements for approval of reference the specified requirements, associated with the organization
product, procedures, including quality requirements, for ensuring the adequacy of purchasing
processes and equipment, purchased or otherwise received requirements prior to communicating
b) requirements for qualification product and services. Purchasing them to the supplier.
of personnel, and documents shall include, where
c) quality management system possible, an agreement that the The QSReg contains a requirement
requirements. suppliers, contractors, and that the organization obtain, where
consultants agree to notify the possible, the agreement of the
The organization shall ensure the manufacturer of changes in the supplier to notify the organization of
adequacy of specified purchase product or service so that changes to the product or service so
requirements prior to their manufacturers may determine that the organization can assess the

communication to the supplier. whether the changes may affect the potential effect on the quality of the
To the extent required for traceability quality of a finished device. medical device.
given in 7.5.3.2, the organization shall Purchasing data shall be approved in
maintain relevant purchasing accordance with 820.40.
information, i.e. documents (see
4.2.3) and records (see 4.2.4).

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 38

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
7.4.3 Verification of purchased 820.80 Receiving, in-process, and The Standard contains requirements
product finished device acceptance. related to the scenario where the
The organization shall establish and (b) Receiving acceptance organization seeks to verify
implement the inspection or other activities. Each manufacturer shall purchased product at the supplier’s
activities necessary for ensuring that establish and maintain procedures for location.
purchased product meets specified acceptance of incoming product.
purchase requirements.
Incoming product shall be inspected,
Where the organization or its tested, or otherwise verified as
customer intends to perform conforming to specified requirements.
verification at the supplier's premises, Acceptance or rejection shall be
the organization shall state the documented.
intended verification arrangements
and method of product release in the
purchasing information.

Records of the verification shall be

maintained (see 4.2.4).

7.5 Production and service 820.70 Production and process The intent of both documents is
provision controls. consistent, with each of the
7.5.1 Control of production and (a) General. Each manufacturer shall documents providing details of control
service provision develop, conduct, control, and or the types of processes that must
7.5.1.1 General requirements monitor production processes to be controlled in a way that
The organization shall plan and carry ensure that a device conforms to its supplements each other.
out production and service provision specifications. Where deviations from
under controlled conditions. device specifications could occur as a It is suggested that the sections be
Controlled conditions shall include, as result of the manufacturing process, read together in order to get a
applicable the manufacturer shall establish and complete list of processes and
a) the availability of information maintain process control procedures process controls that are to be
that describes the that describe any process controls included in the quality management
characteristics of the product, necessary to ensure conformance to system.
b) the availability of documented specifications.
procedures, documented
requirements, work Where process controls are needed
instructions, and reference they shall include:
materials and reference
measurement procedures as 1) Documented instructions, standard
necessary, operating procedures (SOP's), and
c) the use of suitable methods that define and control the
equipment, manner of production;
d) the availability and use of
monitoring and measuring 2) Monitoring and control of process
devices, parameters and component and

e) the implementation of device characteristics during

monitoring and production;
measurement, and
f) the implementation of 3) Compliance with specified
release, delivery and post- reference standards or codes;
delivery activities, and
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 39

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
g) the implementation of defined (4) The approval of processes and
operations for labelling and process equipment; and
packaging.
(5) Criteria for workmanship which
shall be expressed in documented
standards or by means of identified
and approved representative
samples.

The organization shall establish and 820.184 Device history record.

maintain a record (see 4.2.4) for each Each manufacturer shall maintain
batch of medical devices that device history records (DHR's). Each
provides traceability to the extent manufacturer shall establish and
specified in 7.5.3 and identifies the maintain procedures to ensure that
amount manufactured and amount DHR's for each batch, lot, or unit are
approved for distribution.The batch maintained to demonstrate that the
record shall be verified and approved. device is manufactured in accordance
with the DMR and the requirements
NOTE A batch can be a single of this part. The DHR shall include, or
medical device. refer to the location of, the following
information:

(a) The dates of manufacture;

(b) The quantity manufactured;

(c) The quantity released for

distribution;

(d) The acceptance records which

demonstrate the device is
manufactured in accordance with the
DMR;

(e) The primary identification label

and labeling used for each production
unit; and

(f) Any device identification(s) and

control number(s) used.

7.5.1.2 Control of production and (b) Production and process The Standard does not address
service provision — Specific changes. Each manufacturer shall process changes apart from the
requirements establish and maintain procedures for general controls related to production
7.5.1.2.1 Cleanliness of product changes to a specification, method, and process control.
and contamination control process, or procedure. Such changes
The organization shall establish shall be verified or where appropriate
documented requirements for validated according to Sec. 820.75,
cleanliness of product if before implementation and these
a) product is cleaned by the activities shall be documented.
organization prior to Changes shall be approved in
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 40

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
sterilization and/or its use, or accordance with Sec. 820.40.
b) product is supplied non-
sterile to be subjected to a (c) Environmental control. Where
cleaning process prior to environmental conditions could
sterilization and/or its use, or reasonably be expected to have an
c) product is supplied to be adverse effect on product quality, the
used non-sterile and its manufacturer shall establish and
cleanliness is of significance maintain procedures to adequately
in use, or control these environmental
d) process agents are to be conditions. Environmental control
removed from product during system(s) shall be periodically
manufacture. inspected to verify that the system,
including necessary equipment, is
If product is cleaned in accordance adequate and functioning properly.
with a) or b) above, the requirements These activities shall be documented
contained in 6.4 a) and 6.4 b) do not and reviewed.
apply prior to the cleaning process.
(d) Personnel. Each manufacturer
shall establish and maintain
requirements for the health,
cleanliness, personal practices, and
clothing of personnel if contact
between such personnel and product
or environment could reasonably be
expected to have an adverse effect
on product quality. The manufacturer
shall ensure that maintenance and
other personnel who are required to
work temporarily under special
environmental conditions are
appropriately trained or supervised by
a trained individual.

(e) Contamination control. Each

manufacturer shall establish and
maintain procedures to prevent
contamination of equipment or
product by substances that could
reasonably be expected to have an
adverse effect on product quality.

(f) Buildings. Buildings shall be of

suitable design and contain sufficient
space to perform necessary
operations, prevent mixups, and
assure orderly handling.

(g) Equipment. Each manufacturer

shall ensure that all equipment used
in the manufacturing process meets
specified requirements and is
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 41

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
appropriately designed, constructed,
placed, and installed to facilitate
maintenance, adjustment, cleaning,
and use.

(1) Maintenance schedule. Each

manufacturer shall establish and
maintain schedules for the
adjustment, cleaning, and other
maintenance of equipment to ensure
that manufacturing specifications are
met.

Maintenance activities, including the

date and individual(s) performing the
maintenance activities, shall be
documented.

(2) Inspection. Each manufacturer

shall conduct periodic inspections in
accordance with established
procedures to ensure adherence to
applicable equipment maintenance
schedules. The inspections, including
the date and individual(s) conducting
the inspections, shall be documented.

(3) Adjustment. Each manufacturer

shall ensure that any inherent
limitations or allowable tolerances are
visibly posted on or near equipment
requiring periodic adjustments or are
readily available to personnel
performing these adjustments.

(h) Manufacturing material. Where

a manufacturing material could
reasonably be expected to have an
adverse effect on product quality, the
manufacturer shall establish and
maintain procedures for the use and
removal of such manufacturing
material to ensure that it is removed
or limited to an amount that does not
adversely affect the device's quality.
The removal or reduction of such
manufacturing material shall be
documented.
(i) Automated processes. When
computers or automated data
processing systems are used as part
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 42

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
of production or the quality system,
the manufacturer shall validate
computer software for its intended
use according to an established
protocol. All software changes shall
be validated before approval and
issuance. These validation activities
and results shall be documented.

7.5.1.2.2 Installation activities 820.170 Installation.

If appropriate, the organization shall (a) Each manufacturer of a device
establish documented requirements requiring installation shall establish
which contain acceptance criteria for and maintain adequate installation
installing and verifying the installation and inspection instructions, and
of the medical device. where appropriate test procedures.
If the agreed customer requirements Instructions and procedures shall
allow installation to be performed include directions for ensuring proper
other than by the organization or its installation so that the device will
authorized agent, the organization perform as intended after installation.
shall provide documented The manufacturer shall distribute the
requirements for installation and instructions and procedures with the
verification. device or otherwise make them
available to the person(s) installing
Records of installation and the device.
verification performed by the
organization or its authorized agent (b) The person installing the device
shall be maintained (see 4.2.4). shall ensure that the installation,
inspection, and any required testing
are performed in accordance with the
manufacturer's instructions and
procedures and shall document the
inspection and any test results to
demonstrate proper installation.

7.5.1.2.3 Servicing activities 820.200 Servicing.

If servicing is a specified requirement, (a) Where servicing is a specified The QSReg requires statistical
the organization shall establish requirement, each manufacturer shall analysis of service records.
documented procedures, work establish and maintain instructions
instructions and reference materials and procedures for performing and
and reference measurement verifying that the servicing meets the
procedures, as necessary, for specified requirements.
performing servicing activities and
verifying that they meet the specified (b) Each manufacturer shall analyze
requirements. service reports with appropriate
Records of servicing activities carried statistical methodology in accordance
out by the organization shall be with Sec. 820.100.
maintained (see 4.2.4).

NOTE Servicing can include, for (c) Each manufacturer who receives
example, repair and maintenance. a service report that represents an
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 43

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
event which must be reported to FDA
under part 803 of this chapter shall
automatically consider the report a
complaint and shall process it in
accordance with the requirements of
Sec. 820.198.

(d) Service reports shall be

documented and shall include:

(1) The name of the device serviced;

(2) Any device identification(s) and

control number(s) used;

(3) The date of service;

(4) The individual(s) servicing the

device;

(5) The service performed; and

(6) The test and inspection data.

7.5.1.3 Particular requirements for
sterile medical devices
The organization shall maintain
records of the process parameters for
the sterilization process which was
used for each sterilization batch (see
4.2.4).Sterilization records shall be
traceable to each production batch of
medical devices (see 7.5.1.1).

820.30 Design controls.

(h) Design transfer. Each There is no specific reference to
manufacturer shall establish and design transfer in the Standard.
maintain procedures to ensure that
the device design is correctly
translated into production
specifications.

7.5.2 Validation of processes for 820.75 Process validation. No significant differences. The
production and service provision (a) Where the results of a process QSReg contains a number of
7.5.2.1 General requirements cannot be fully verified by subsequent prescriptive requirements associated
The organization shall validate any inspection and test, the process shall with documentation of validation
processes for production and service be validated with a high degree of activities.
provision where the resulting output assurance and approved according to
cannot be verified by subsequent established procedures. The
monitoring or measurement. This validation activities and results,
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 44

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
includes any processes where including the date and signature of
deficiencies become apparent only the individual(s) approving the
after the product is in use or the validation and where appropriate the
service has been delivered. major equipment validated, shall be
documented.
Validation shall demonstrate the
ability of these processes to achieve (b) Each manufacturer shall establish
planned results. and maintain procedures for
monitoring and control of process
The organization shall establish parameters for validated processes to
arrangements for these processes ensure that the specified
including, as applicable requirements continue to be met.
a) defined criteria for review and
approval of the processes, (1) Each manufacturer shall ensure
b) approval of equipment and that validated processes are
qualification of personnel, performed by qualified individual(s).
c) use of specific methods and
procedures, (2) For validated processes, the
d) requirements for records (see monitoring and control methods and
4.2.4), and data, the date performed, and, where
e) revalidation. appropriate, the individual(s)
performing the process or the major
The organization shall establish equipment used shall be
documented procedures for the documented.
validation of the application of
computer software (and changes to (c) When changes or process
such software and/or its application) deviations occur, the manufacturer
for production and service provision shall review and evaluate the process
that affect the ability of the product to and perform revalidation where
conform to specified requirements. appropriate. These activities shall be
Such software applications shall be documented.
validated prior to initial use.

Records of validation shall be

maintained (see 4.2.4).

7.5.2.2 Particular requirements for There are no specific requirements

sterile medical devices related to process validation of
The organization shall establish sterilization processes in the QSReg.
documented procedures for the
validation of sterilization processes.

Sterilization processes shall be

validated prior to initial use.

Records of validation of each

sterilization process shall be
maintained (see 4.2.4).

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 45

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
7.5.3 Identification and traceability 820.60 Identification. The Standard addresses the
7.5.3.1 Identification Each manufacturer shall establish identification and traceability of
The organization shall identify the and maintain procedures for product returned to the organization
product by suitable means throughout identifying product during all stages of in order to ensure it is distinguished
product realization, and shall receipt, production, distribution, and from normal product.
establish documented procedures for installation to prevent mixups.
such product identification.

The organization shall establish

documented procedures to ensure
that medical devices returned to the
organization are identified and
distinguished from conforming
product [see 6.4 d)].

7.5.3.2 Traceability 820.65 Traceability.

7.5.3.2.1 General Each manufacturer of a device that is
The organization shall establish intended for surgical implant into the
documented procedures for body or to support or sustain life and
traceability. Such procedures shall whose failure to perform when
define the extent of product properly used in accordance with
traceability and the records required instructions for use provided in the
(see 4.2.4, 8.3 and 8.5). labeling can be reasonably expected
to result in a significant injury to the
Where traceability is a requirement, user shall establish and maintain
the organization shall control and procedures for identifying with a
record the unique identification of the control number each unit, lot, or batch
product (see 4.2.4). of finished devices and where
appropriate components. The
NOTE Configuration management is procedures shall facilitate corrective
a means by which identification and action. Such identification shall be
traceability can be maintained. documented in the DHR.

7.5.3.2.2 Particular requirements 820.80 Receiving, in-process, and The QSReg reserves traceability
for active implantable medical finished device acceptance. requirements for those devices that
devices and implantable medical (e) Acceptance records. Each are intended by surgical implant or
devices manufacturer shall document intended to his port or sustain life.
In defining the records required for acceptance activities required by this The Standard leaves the extent of
traceability, the organization shall part. These records shall include: traceability up to the organization to
include records of all components, determine for other devices. The
materials and work environment (1) The acceptance activities requirements for implantable and
conditions, if these could cause the performed; active implantable devices found in
medical device not to satisfy its both documents are supplementary to
specified requirements. (2) the dates acceptance activities each other and should all be
are performed; incorporated into the quality
The organization shall require that its management system of an
agents or distributors maintain (3) the results; organization supplying such medical
records of the distribution of medical devices.
devices to allow traceability and that (4) the signature of the individual(s)
such records are available for conducting the acceptance activities;
inspection. and
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 46

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
Records of the name and address of (5) where appropriate the equipment
the shipping package consignee shall used.
be maintained (see 4.2.4).
These records shall be part of the
DHR.

7.5.3.3 Status identification 820.86 Acceptance status. The QSReg contains a number of
The organization shall identify the Each manufacturer shall identify by prescriptive requirements associated
product status with respect to suitable means the acceptance status with the records of acceptance status.
monitoring and measurement of product, to indicate the
requirements. conformance or nonconformance of
product with acceptance criteria. The
The identification of product status identification of acceptance status
shall be maintained throughout shall be maintained throughout
production, storage, installation and manufacturing, packaging, labeling,
servicing of the product to ensure that installation, and servicing of the
only product that has passed the product to ensure that only product
required inspections and tests (or which has passed the required
released under an authorized acceptance activities is distributed,
concession) is dispatched, used or used, or installed.
installed.

7.5.4 Customer property Aside from the general controls to be

The organization shall exercise care exerted by the organization over
with customer property while it is purchased product, the QSReg does
under the organization's control or not specifically address the issue of
being used by the organization. care to be exercised over customer
The organization shall identify, verify, property when it is being held or
protect and safeguard customer processed by the organization.
property provided for use or
incorporation into the product.
If any customer property is lost,
damaged or otherwise found to be
unsuitable for use, this shall be
reported to the customer and records
maintained (see 4.2.4).

NOTE Customer property can include

intellectual property or confidential
health information.

7.5.5 Preservation of product 820.120 Device labeling. While the intent of the two documents
The organization shall establish Each manufacturer shall establish is consistent, the QSReg contains
documented procedures or and maintain procedures to control many prescriptive requirements
documented work instructions for labeling activities. related to label control and the
preserving the conformity of product handling, storage, packaging,
during internal processing and (a) Label integrity. Labels shall be preservation, and distribution of
delivery to the intended destination. printed and applied so as to remain product not specifically called out in
legible and affixed during the the Standard. The Standard treats
This preservation shall include customary conditions of processing, control of labeling generally, allowing
identification, handling, packaging, storage, handling, distribution, and the organization to determine the
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 47

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
storage and protection. Preservation where appropriate use. nature and extent of controls as it
shall also apply to the constituent would for any other device
parts of a product. (b) Labeling inspection. Labeling component.
shall not be released for storage or
The organization shall establish use until a designated individual(s)
documented procedures or has examined the labeling for
documented work instructions for the accuracy including, where applicable,
control of product with a limited shelf- the correct expiration date, control
life or requiring special storage number, storage instructions,
conditions. Such special storage handling instructions, and any
conditions shall be controlled and additional processing instructions.
recorded (see 4.2.4). The release, including the date and
signature of the individual(s)
performing the examination, shall be
documented in the DHR.

(c) Labeling storage. Each

manufacturer shall store labeling in a
manner that provides proper
identification and is designed to
prevent mixups.

(d) Labeling operations. Each

manufacturer shall control labeling
and packaging operations to prevent
labeling mixups. The label and
labeling used for each production
unit, lot, or batch shall be
documented in the DHR.

(e) Control number. Where a control

number is required by Sec. 820.65,
that control number shall be on or
shall accompany the device through
distribution.

820.150 Storage. There is no significant difference in

(a) Each manufacturer shall establish intent between the Standard and the
and maintain procedures for the QSReg. The Standard treats all
control of storage areas and stock aspects of product preservation
rooms for product to prevent mixups, generally, including storage,
damage, deterioration, contamination, packaging, handling, and distribution.
or other adverse effects pending use The QSReg treats them individually.
or distribution and to ensure that no
obsolete, rejected, or deteriorated
product is used or distributed. When
the quality of product deteriorates
over time, it shall be stored in a
manner to facilitate proper stock
rotation, and its condition shall be
assessed as appropriate.
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 48

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(b) Each manufacturer shall establish
and maintain procedures that
describe the methods for authorizing

receipt from and dispatch to storage

areas and stock rooms.

820.130 Device packaging. There is no significant difference in

Each manufacturer shall ensure that intent between the Standard and the
device packaging and shipping QSReg. The Standard treats all
containers are designed and aspects of product preservation
constructed to protect the device from generally, including storage,
alteration or damage during the packaging, handling, and distribution.
customary conditions of processing, The QSReg treats them individually.
storage, handling, and distribution.

820.140 Handling. There is no significant difference in

Each manufacturer shall establish intent between the Standard and the
and maintain procedures to ensure QSReg. The Standard treats all
that mixups, damage, deterioration, aspects of product preservation
contamination, or other adverse generally, including storage,
effects to product do not occur during packaging, handling, and distribution.
handling. The QSReg treats them individually.

820.160 Distribution. There is no significant difference in

(a) Each manufacturer shall establish intent between the Standard and the
and maintain procedures for control QSReg. The Standard treats all
and distribution of finished devices to aspects of product preservation
ensure that only those devices generally, including storage,
approved for release are distributed packaging, handling, and distribution.
and that purchase orders are The QSReg treats them individually.
reviewed to ensure that ambiguities
and errors are resolved before
devices are released for distribution.
Where a device's fitness for use or
quality deteriorates over time, the
procedures shall ensure that expired
devices or devices deteriorated
beyond acceptable fitness for use are
not distributed.

(b) Each manufacturer shall maintain

distribution records which include or
refer to the location of:

(1) The name and address of the

initial consignee;

(2) The identification and quantity of

devices shipped;
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 49

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(3) The date shipped; and

(4) Any control number(s) used.

7.6 Control of monitoring and 820.72 Inspection, measuring, and The intent of the two documents is
measuring devices test equipment. consistent, with the Standard giving
The organization shall determine the (a) Control of inspection, generalized guidance as to the
monitoring and measurement to be measuring, and test equipment. control of monitoring and measuring
undertaken and the monitoring and Each manufacturer shall ensure that devices and the QSReg focusing
measuring devices needed to provide all inspection, measuring, and test more specifically on the process of
evidence of conformity of product to equipment, including mechanical, calibration of such equipment.
determined requirements (see 7.2.1). automated, or electronic inspection
and test equipment, is suitable for its
The organization shall establish intended purposes and is capable of
documented procedures to ensure producing valid results. Each
that monitoring and measurement manufacturer shall establish and
can be carried out and are carried out maintain procedures to ensure that
in a manner that is consistent with the equipment is routinely calibrated,
monitoring and measurement inspected, checked, and maintained.
requirements. The procedures shall include
provisions for handling, preservation,
Where necessary ensure valid and storage of equipment, so that its
results, measuring equipment shall accuracy and fitness for use are
a) be calibrated or verified at maintained.
specified intervals, or prior to
use, against measurement These activities shall be documented.
standards traceable to
international or national (b) Calibration. Calibration
measurement standards; procedures shall include specific
where no such standards directions and limits for accuracy and
exist, the basis used for precision. When accuracy and
calibration or verification shall precision limits are not met, there
be recorded; shall be provisions for remedial action
b) be adjusted or re-adjusted as to reestablish the limits and to
necessary; evaluate whether there was any
c) be identified to enable the adverse effect on the device's quality.
calibration status to be These activities shall be documented.
determined;
d) be safeguarded from (1) Calibration standards.
adjustments that would Calibration standards used for
invalidate the measurement inspection, measuring, and test
result; equipment shall be traceable to
e) be protected from damage national or international standards. If
and deterioration during national or international standards are
handling, maintenance and not practical or available, the
storage. manufacturer shall use an
independent reproducible standard. If
In addition, the organization shall no applicable standard exists, the
assess and record the validity of the manufacturer shall establish and
previous measuring results when the maintain an in-house standard.
equipment is found not to conform to
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 50

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
requirements. The organization shall (2) Calibration records. The
take appropriate action on the equipment identification, calibration
equipment and any product affected. dates, the individual performing each
Records of the results of calibration calibration, and the next calibration

and verification shall be maintained date shall be documented. These

(see 4.2.4). records shall be displayed on or near
each piece of equipment or shall be
When used in the monitoring and readily available to the personnel
measurement of specified using such equipment and to the
requirements, the ability of computer individuals responsible for calibrating
software to satisfy the intended the equipment.
application shall be confirmed. This
shall be undertaken prior to initial use
and reconfirmed as necessary.

NOTE See ISO 10012 for guidance

related to measurement management
systems.

8 Measurement, analysis and There is no one section of the QSReg

improvement that corresponds to this clause of the
8.1 General Standard. It is clear from a reading of
The organization shall plan and the overall QSReg that the objectives
implement the monitoring, of this clause of the Standard and the
measurement, analysis and QSReg are consistent.
improvement processes needed
a) to demonstrate conformity of
the product,
b) to ensure conformity of the
quality management system,
and
c) to maintain the effectiveness
of the quality management
system.

This shall include determination of 820.250 Statistical techniques.

applicable methods, including (a) Where appropriate, each
statistical techniques, and the extent manufacturer shall establish and
of their use. maintain procedures for identifying
valid statistical techniques required
NOTE National or regional for establishing, controlling, and
regulations might require documented verifying the acceptability of process
procedures for implementation and capability and product characteristics.
control of the application of statistical
techniques. (b) Sampling plans, when used, shall
be written and based on a valid
statistical rationale. Each
manufacturer shall establish and
maintain procedures to ensure that
sampling methods are adequate for
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 51

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
their intended use and to ensure that
when changes occur the sampling
plans are reviewed. These activities
shall be documented.

8.2 Monitoring and measurement 820.198 Complaint files. The QSReg contains prescriptive
8.2.1 Feedback (a) Each manufacturer shall maintain requirements regarding the handling
As one of the measurements of the complaint files. Each manufacturer of complaints and other user input
performance of the quality shall establish and maintain that would be useful in conducting
management system, the procedures for receiving, reviewing, corrective or preventive action. These
organization shall monitor information and evaluating complaints by a requirements are not spelled out in
relating to whether the organization formally designated unit. detail in the Standard, but compliance
has met customer requirements. with the requirements set out in the
Such procedures shall ensure that: QSReg would satisfy the
The methods for obtaining and using requirements of the Standard.
this information shall be determined. (1) All complaints are processed in a
uniform and timely manner;
The organization shall establish a
documented procedure for a (2) Oral complaints are documented
feedback system [see 7.2.3 c)] to upon receipt; and
provide early warning of quality
problems and for input into the (3) Complaints are evaluated to
corrective and preventive action determine whether the complaint
processes (see 8.5.2 and 8.5.3). represents an event which is required
to be reported to FDA under part 803
If national or regional regulations or 804 of this chapter, Medical Device
require the organization to gain Reporting.
experience from the post-production
phase, the review of this experience (b) Each manufacturer shall review
shall form part of the feedback and evaluate all complaints to
system (see 8.5.1). determine whether an investigation is
necessary. When no investigation is
made, the manufacturer shall
maintain a record that includes the
reason no investigation was made
and the name of the individual
responsible for the decision not to
investigate.

(c) Any complaint involving the

possible failure of a device, labeling,
or packaging to meet any of its
specifications shall be reviewed,
evaluated, and investigated, unless
such investigation has already been
performed for a similar complaint and
another investigation is not
necessary.

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 52

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(d) Any complaint that represents an
event which must be reported to FDA
under part 803 or 804 of this chapter
shall be promptly reviewed,
evaluated, and investigated by a
designated individual(s) and shall be
maintained in a separate portion of
the complaint files or otherwise
clearly identified. In addition to the
information required by Sec.
820.198(e), records of investigation
under this paragraph shall include a
determination of:

(1) Whether the device failed to meet

specifications;

(2) Whether the device was being

used for treatment or diagnosis; and

(3) The relationship, if any, of the

device to the reported incident or
adverse event.

(e) When an investigation is made

under this section, a record of the
investigation shall be maintained by
the formally designated unit identified
in paragraph (a) of this section. The
record of investigation shall include:

(1) The name of the device;

(2) The date the complaint was

received;

(3) Any device identification(s) and

control number(s) used;

(4) The name, address, and phone

number of the complainant;

(5) The nature and details of the

complaint;

(6) The dates and results of the

investigation;

(7) Any corrective action taken; and

(8) Any reply to the complainant.

ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 53

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)

(f) When the manufacturer's formally

designated complaint unit is located
at a site separate from the
manufacturing establishment, the
investigated complaint(s) and the
record(s) of investigation shall be
reasonably accessible to the
manufacturing establishment.
(g) If a manufacturer's formally
designated complaint unit is located
outside of the United States, records
required by this section shall be
reasonably accessible in the United
States at either:

(1) A location in the United States

where the manufacturer's records are
regularly kept; or

(2) The location of the initial

distributor.

8.2.2 Internal audit 820.22 Quality audit.

The organization shall conduct Each manufacturer shall establish
internal audits at planned intervals to procedures for quality audits and
determine whether the quality conduct such audits to assure that
management system the quality system is in compliance
a) conforms to the planned with the established quality system
arrangements (see 7.1), to requirements and to determine the
the requirements of this effectiveness of the quality system.
International Standard and to Quality audits shall be conducted by
the quality management individuals who do not have direct
system requirements responsibility for the matters being
established by the audited. Corrective action(s),
organization, and including a reaudit of deficient
b) is effectively implemented matters, shall be taken when
and maintained. necessary. A report of the results of
each quality audit, and reaudit(s)
An audit programme shall be where taken, shall be made and such
planned, taking into consideration the reports shall be reviewed by
status and importance of the management having responsibility for
processes and areas to be audited, the matters audited. The dates and
as well as the results of previous results of quality audits and reaudits
audits. The audit criteria, scope, shall be documented.
frequency and methods shall be
defined. Selection of auditors and
conduct of audits shall ensure
objectivity and impartiality of the audit
process. Auditors shall not audit their
own work.
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 54

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
The responsibilities and requirements
for planning and conducting audits,
and for reporting results and
maintaining records (see 4.2.4) shall
be defined in a documented
procedure.

The management responsible for the

area being audited shall ensure that
actions are taken without undue delay
to eliminate detected nonconformities
and their causes. Follow-up activities
shall include the verification of the
actions taken and the reporting of
verification results (see 8.5.2).

NOTE See ISO 19011 for guidance

related to quality auditing.

8.2.3 Monitoring and measurement 820.70 Production and process The intent of the two documents is
of processes controls. consistent, even though the QSReg is
The organization shall apply suitable (a) General. Each manufacturer shall far more detailed and has a product
methods for monitoring and, where develop, conduct, control, and focus.
applicable, measurement of the monitor production processes to
quality management system ensure that a device conforms to its
processes. These methods shall specifications. Where deviations from
demonstrate the ability of the device specifications could occur as a
processes to achieve planned results. result of the manufacturing process,
When planned results are not the manufacturer shall establish and
achieved, correction and corrective maintain process control procedures
action shall be taken, as appropriate, that describe any process controls
to ensure conformity of the product. necessary to ensure conformance to
specifications.

Where process controls are needed

they shall include:

(1) Documented instructions,

standard operating procedures
(SOP's), and methods that define and
control the manner of production;

(2) Monitoring and control of process

parameters and component and
device characteristics during
production;

(3) Compliance with specified

reference standards or codes;

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 55

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(4) The approval of processes and
process equipment; and

(5) Criteria for workmanship which

shall be expressed in documented
standards or by means of identified
and approved representative
samples.

820.250 Statistical techniques.

(a) Where appropriate, each
manufacturer shall establish and
maintain procedures for identifying
valid statistical techniques required
for establishing, controlling, and

verifying the acceptability of process

capability and product characteristics.

(b) Sampling plans, when used, shall

be written and based on a valid
statistical rationale. Each
manufacturer shall establish and
maintain procedures to ensure that
sampling methods are adequate for
their intended use and to ensure that
when changes occur the sampling
plans are reviewed. These activities
shall be documented.

8.2.4 Monitoring and measurement 820.80 Receiving, in-process, and The intent of the two documents is
of product finished device acceptance. consistent, even though the QSReg is
8.2.4.1 General requirements (a) General. Each manufacturer shall far more detailed and prescriptive.
The organization shall monitor and establish and maintain procedures for
measure the characteristics of the acceptance activities. Acceptance
product to verify that product activities include inspections, tests, or
requirements have been met. This other verification activities.
shall be carried out at appropriate
stages of the product realization (b) Receiving acceptance
process in accordance with the activities. Each manufacturer shall
planned arrangements (see 7.1) and establish and maintain procedures for
documented procedures (see acceptance of incoming product.
7.5.1.1).
Incoming product shall be inspected,
Evidence of conformity with the tested, or otherwise verified as
acceptance criteria shall be conforming to specified requirements.
maintained. Records shall indicate Acceptance or rejection shall be
the person(s) authorizing release of documented.
product (see 4.2.4).

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 56

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
Product release and service delivery (c) In-process acceptance
shall not proceed until the planned activities. Each manufacturer shall
arrangements (see 7.1) have been establish and maintain acceptance
satisfactorily completed. procedures, where appropriate, to
ensure that specified requirements for
in-process product are met. Such
procedures shall ensure that in-
process product is controlled until the
required inspection and tests or other
verification activities have been
completed, or necessary approvals
are received, and are documented.

(d) Final acceptance activities.

Each manufacturer shall establish
and maintain procedures for finished
device acceptance to ensure that
each production run, lot, or batch of
finished devices meets acceptance
criteria. Finished devices shall be
held in quarantine or otherwise
adequately controlled until released.
Finished devices shall not be
released for distribution until:

(1) The activities required in the DMR

are completed;

(2) the associated data and

documentation is reviewed;

(3) the release is authorized by the

signature of a designated
individual(s); and

(4) the authorization is dated.

8.2.4.2 Particular requirement for (e) Acceptance records. Each The acceptance records
active implantable medical devices manufacturer shall document requirements of the QSReg would
and implantable medical devices acceptance activities required by this appear to satisfy the implantable and
The organization shall record (see part. These records shall include: active implantable requirements of
4.2.4) the identity of personnel the Standard.
performing any inspection or testing. (1) The acceptance activities
performed;
4.2.4 Control of records
Records shall be established and (2) the dates acceptance activities
maintained to provide evidence of are performed;
conformity to requirements and of the
effective operation of the quality (3) the results;
management system. Records shall
remain legible, readily identifiable and
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 57

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
retrievable. A documented procedure (4) the signature of the individual(s)
shall be established to define the conducting the acceptance activities;
controls needed for the identification, and
storage, protection, retrieval,
retention time and disposition of (5) where appropriate the equipment
records. used.

These records shall be part of the

DHR.

820.250 Statistical techniques.

(a) Where appropriate, each
manufacturer shall establish and
maintain procedures for identifying
valid statistical techniques required
for establishing, controlling, and
verifying the acceptability of process
capability and product characteristics.

(b) Sampling plans, when used, shall

be written and based on a valid
statistical rationale. Each
manufacturer shall establish and
maintain procedures to ensure that
sampling methods are adequate for
their intended use and to ensure that
when changes occur the sampling
plans are reviewed. These activities
shall be documented.

8.3 Control of nonconforming 820.90 Nonconforming product. The intent of the two documents is
product (a) Control of nonconforming consistent.
The organization shall ensure that product.
product which does not conform to Each manufacturer shall establish The QSReg provides more detail as
product requirements is identified and and maintain procedures to control to the items to be recorded in a
controlled to prevent its unintended product that does not conform to nonconforming product situation. It
use or delivery. The controls and specified requirements. The explicitly addresses the subject of the
related responsibilities and authorities procedures shall address the need for an investigation in such a
for dealing with nonconforming identification, documentation, situation.
product shall be defined in a evaluation, segregation, and
documented procedure. disposition of nonconforming product.
The evaluation of nonconformance
The organization shall deal with shall include a determination of the
nonconforming product by one or need for an investigation and
more of the following ways: notification of the persons or
a) by taking action to eliminate organizations responsible for the
the detected nonconformity; nonconformance. The evaluation and
b) by authorizing its use, any investigation shall be
release or acceptance under documented.
concession;

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 58

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
c) by taking action to preclude (b) Nonconformity review and
its original intended use or disposition.
application. (1) Each manufacturer shall establish
and maintain procedures that define
The organization shall ensure that the responsibility for review and the
nonconforming product is accepted authority for the disposition of
by concession only if regulatory nonconforming product. The
requirements are met. Records of the procedures shall set forth the review
identity of the person(s) authorizing and disposition process. Disposition
the concession shall be maintained of nonconforming product shall be
(see 4.2.4). documented. Documentation shall
include the justification for use of
Records of the nature of nonconforming product and the
nonconformities and any subsequent signature of the individual(s)
actions taken, including concessions authorizing the use.
obtained, shall be maintained (see
4.2.4).
When nonconforming product is (2) Each manufacturer shall establish
corrected it shall be subject to re- and maintain procedures for rework,
verification to demonstrate conformity to include retesting and reevaluation
to the requirements. of the nonconforming product after
rework, to ensure that the product
When nonconforming product is meets its current approved The Standard addresses the handling
detected after delivery or use has specifications. Rework and of already released product that is
started, the organization shall take reevaluation activities, including a subject to a finding of nonconformity.
action appropriate to the effects, or determination of any adverse effect
potential effects, of the from the rework upon the product,
nonconformity. shall be documented in the DHR.

If product needs to be reworked (one The Standard provides requirements

or more times), the organization shall related to rework of nonconforming
document the rework process in a product.
work instruction that has undergone
the same authorization and approval
procedure as the original work
instruction. Prior to authorization and
approval of the work instruction, a
determination of any adverse effect of
the rework upon product shall be
made and documented (see 4.2.3
and 7.5.1).

8.4 Analysis of data 820.250 Statistical techniques. There is no one section of the QSReg
The organization shall establish (a) Where appropriate, each that corresponds directly with
documented procedures to manufacturer shall establish and subclause 8.4 of the Standard.
determine, collect and analyse maintain procedures for identifying Requirements for analysis of data
appropriate data to demonstrate the valid statistical techniques required related to various elements of the
suitability and effectiveness of the for establishing, controlling, and quality management systems is
quality management system and to verifying the acceptability of process contained in a number of QSReg
evaluate if continual improvement of capability and product characteristics. sections. The intent of the two

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 59

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
the effectiveness of the quality (b) Sampling plans, when used, shall documents as it relates to analysis of
management system can be made. be written and based on a valid data is consistent.
statistical rationale. Each
This shall include data generated as manufacturer shall establish and
a result of monitoring and maintain procedures to ensure that
measurement and from other relevant sampling methods are adequate for
sources. their intended use and to ensure that
when changes occur the sampling
The analysis of data shall provide plans are reviewed. These activities
information relating to shall be documented.
a) feedback (see 8.2.1),
b) conformity to product
requirements (see 7.2.1),
c) characteristics and trends of
processes and products
including opportunities for
preventive action, and
d) suppliers.

Records of the results of the analysis

of data shall be maintained (see
4.2.4).

8.5 Improvement 820.20 Management responsibility. There is no one section of the QSReg
8.5.1 General (c) Management review. that corresponds directly with
The organization shall identify and Management with executive subclause 8.5.1 of the Standard. The
implement any changes necessary to responsibility shall review the intent of the two documents as it
ensure and maintain the continued suitability and effectiveness of the relates to improvement of the quality
suitability and effectiveness of the quality system at defined intervals management system through the use
quality management system through and with sufficient frequency of corrective and preventive action is
the use of the quality policy, quality according to established procedures consistent.
objectives, audit results, analysis of to ensure that the quality system
data, corrective and preventive satisfies the requirements of this part
actions and management review. and the manufacturer's established
quality policy and objectives. The
The organization shall establish dates and results of quality system
documented procedures for the issue reviews shall be documented.
and implementation of advisory
notices. 820.198 Complaint files. The requirements of the QSReg are
(a) Each manufacturer shall maintain significantly more prescriptive related
These procedures shall be capable of complaint files. Each manufacturer to the handling and documentation of
being implemented at any time. shall establish and maintain complaints.
Records of all customer complaint procedures for receiving, reviewing,
investigations shall be maintained and evaluating complaints by a
(4.2.4). If investigation determines formally designated unit.
that the activities outside the
organization contributed to the Such procedures shall ensure that:
customer complaint, relevant (1) All complaints are processed in a
information shall be exchanged uniform and timely manner;

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 60

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
between the organizations involved (2) Oral complaints are documented
(see 4.1). upon receipt; and

If any customer complaint is not (3) Complaints are evaluated to

followed by corrective and/or determine whether the complaint
preventive action, the reason shall be represents an event which is required
authorized (see 5.5.1) and recorded to be reported to FDA under part 803
(see 4.2.4). or 804 of this chapter, Medical Device
Reporting.
If national or regional regulations
require notification of adverse events (b) Each manufacturer shall review
that meet specified reporting criteria, and evaluate all complaints to
the organization shall establish determine whether an investigation is
documented procedures to such necessary. When no investigation is
notification to regulatory authorities. made, the manufacturer shall
maintain a record that includes the
reason no investigation was made
and the name of the individual
responsible for the decision not to
investigate.
(c) Any complaint involving the
possible failure of a device, labeling,
or packaging to meet any of its
specifications shall be reviewed,
evaluated, and investigated, unless
such investigation has already been
performed for a similar complaint and
another investigation is not
necessary.

(d) Any complaint that represents an

event which must be reported to FDA
under part 803 or 804 of this chapter
shall be promptly reviewed,
evaluated, and investigated by a
designated individual(s) and shall be
maintained in a separate portion of
the complaint files or otherwise
clearly identified. In addition to the
information required by Sec.
820.198(e), records of investigation
under this paragraph shall include a
determination of:

(1) Whether the device failed to meet

specifications;

(2) Whether the device was being

used for treatment or diagnosis; and

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 61

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(3) The relationship, if any, of the
device to the reported incident or
adverse event.

(e) When an investigation is made

under this section, a record of the
investigation shall be maintained by
the formally designated unit identified
in paragraph (a) of this section. The
record of investigation shall include:

(1) The name of the device;

(2) The date the complaint was

received;

(3) Any device identification(s) and

control number(s) used;

(4) The name, address, and phone

number of the complainant;

(5) The nature and details of the

complaint;

(6) The dates and results of the

investigation;

(7) Any corrective action taken; and

(8) Any reply to the complainant.

(f) When the manufacturer's formally

designated complaint unit is located
at a site separate from the
manufacturing establishment, the
investigated complaint(s) and the
record(s) of investigation shall be
reasonably accessible to the
manufacturing establishment.

(g) If a manufacturer's formally

designated complaint unit is located
outside of the United States, records
required by this section shall be
reasonably accessible in the United
States at either:

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 62

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(1) A location in the United States
where the manufacturer's records are
regularly kept; or

(2) The location of the initial

distributor.
8.5.2 Corrective action 820.100 Corrective and preventive The intent of the two documents is
The organization shall take action to action. consistent.
eliminate the cause of (a) Each manufacturer shall establish
nonconformities in order to prevent and maintain procedures for The requirements as set out by the
recurrence. implementing corrective and QSReg are more prescriptive.
preventive action. The procedures
Corrective actions shall be shall include requirements for:
appropriate to the effects of the
nonconformities encountered. (1) Analyzing processes, work
operations, concessions, quality audit
A documented procedure shall be reports, quality records, service
established to define requirements for records, complaints, returned
a) reviewing nonconformities product, and other sources of quality
(including customer data to identify existing and potential
complaints), causes of nonconforming product, or
b) determining the causes of other quality problems. Appropriate
nonconformities, statistical methodology shall be
c) evaluating the need for action employed where necessary to detect
to ensure that recurring quality problems;
nonconformities do not recur, (2) Investigating the cause of
d) determining and nonconformities relating to product,
implementing action needed, processes, and the quality system;
including, if appropriate, (3) Identifying the action(s) needed to
updating documentation (see correct and prevent recurrence of
4.2), nonconforming product and other
e) recording of the results of any quality problems;
investigation and of action
taken (see 4.2.4), and (4) Verifying or validating the
f) reviewing the corrective corrective and preventive action to
action taken and its ensure that such action is effective
effectiveness. and does not adversely affect the
finished device;

(5) Implementing and recording

changes in methods and procedures
needed to correct and prevent
identified quality problems;

(6) Ensuring that information related

to quality problems or nonconforming
product is disseminated to those
directly responsible for assuring the
quality of such product or the
prevention of such problems; and

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 63

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
(7) Submitting relevant information on
identified quality problems, as well as
corrective and preventive actions, for
management review.

(b) All activities required under this

section, and their results, shall be
documented.

8.5.3 Preventive action 820.100 Corrective and preventive The intent of the two documents is
The organization shall determine action. consistent.
action to eliminate the causes of (a) Each manufacturer shall establish
potential nonconformities in order to and maintain procedures for The requirements as set out by the
prevent their occurrence. Preventive implementing corrective and QSReg are more prescriptive.
actions shall be appropriate to the preventive action. The procedures
effects of the potential problems. shall include requirements for:

A documented procedure shall be (1) Analyzing processes, work

established to define requirements for operations, concessions, quality audit
a) determining potential reports, quality records, service
nonconformities and their records, complaints, returned
causes, product, and other sources of quality
b) evaluating the need for action data to identify existing and potential
to prevent occurrence of causes of nonconforming product, or
nonconformities, other quality problems. Appropriate
c) determining and statistical methodology shall be
implementing action needed, employed where necessary to detect
d) recording of the results of any recurring quality problems;
investigation and of action
taken (see 4.2.4), and (2) Investigating the cause of
e) reviewing preventive action nonconformities relating to product,
taken and its effectiveness. processes, and the quality system;

(3) Identifying the action(s) needed to

correct and prevent recurrence of
nonconforming product and other
quality problems;

(4) Verifying or validating the

corrective and preventive action to
ensure that such action is effective
and does not adversely affect the
finished device;

(5) Implementing and recording

changes in methods and procedures
needed to correct and prevent
identified quality problems;

(6) Ensuring that information related

to quality problems or nonconforming
ISO 13485 and 21CFR820 Comparison
© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477
 PAGE 64

Correspondence Between ISO 13485:2003 and 21CFR820

US Quality System
ISO 13485:2003 Comments
Regulation (21CFR820)
product is disseminated to those
directly responsible for assuring the
quality of such product or the
prevention of such problems; and

(7) Submitting relevant information on

identified quality problems, as well as
corrective and preventive actions, for
management review.

(b) All activities required under this

section, and their results, shall be
documented.

About Oriel STAT A MATRIX

Since 1968, Oriel STAT A MATRIX has provided organizations across the globe with best-in-class performance improvement
training and consulting to enhance financial results and customer satisfaction. Our offerings include FDA and International
Regulations, implementation of ISO 9000, and continual improvement methods such as Lean Six Sigma.

In 1978, US FDA regulators chose Oriel STAT A MATRIX to work with the agency in rewriting the Good Manufacturing Practice
(GMP) regulations, the precursor to the current GMP (CGMP)/quality system regulations (QSR). The firm was subsequently
selected to train FDA compliance investigators in the new regulations. Oriel STAT A MATRIX continues to be a global leader in
implementing quality and regulatory requirements at pharmaceutical, biotechnology, and medical device companies, as well as
for hospitals and other healthcare provider organizations.

More than ever you need a strong partner to help you navigate the most up-to-date compliance regulations and avoid
nonconformances. Your partner should also be experienced in continual improvement tools to ensure that the systems you
develop will enhance quality, productivity, efficiency, and profitability. Oriel STAT A MATRIX has been bringing this unique blend
of regulatory compliance and performance excellence to our customers for more than four decades.

For more information about how Oriel STAT A MATRIX can support your needs, please visit www.orielstat.com or call
732.548.0600.

ISO 13485 and 21CFR820 Comparison

© 2012 Oriel STAT A MATRIX. All rights reserved.
www.orielstat.com • 800.472.6477