Requirements traceability in ISO 13485

The organization plans and controls how the product is designed and developed, and keeps the planning documents up to date as the work moves forward. The planning documents set out the stages of design and development; the reviews each stage needs; the verification, validation and design transfer work suited to each stage; responsibilities and authorities; how design outputs will be traced back to design inputs; and the resources required, including staff competence.

Held text: ISO 13485:2016, our statement of the clause, not the instrument verbatim.

what an assessor asks to see Design and development plan per project with stages, reviews, verification, validation and transfer activities; Responsibilities and authorities for design; Traceability method (trace matrix) from outputs to inputs; Resource and competence planning; Evidence the plan was updated as the design progressed

where it usually breaks Plan written at project start and never updated; Transfer activities absent from the plan; No method for traceability, so verification coverage cannot be shown

Every ISO 13485 clause we hold

Verification of design and development follows planned, documented arrangements and confirms that the outputs satisfy the input requirements. The organization documents verification plans setting out the methods, the acceptance criteria and, where appropriate, statistical techniques together with the reasoning behind the sample size. If the intended use means the device must connect or interface with other devices, verification must show the outputs meet the inputs in that connected state. Records are kept of verification results, conclusions and any actions needed.

Held text: ISO 13485:2016, our statement of the clause, not the instrument verbatim.

what an assessor asks to see Verification plans with methods, acceptance criteria and sample-size rationale; Verification reports and records of actions; Interface or connected-use verification where applicable; Traceability showing every input verified

where it usually breaks Sample sizes chosen without a documented rationale; Verification of interfaces with other devices omitted; Inputs with no corresponding verification evidence

Every ISO 13485 clause we hold

Changes to design and development are controlled through documented procedures. For each change the organization judges how significant it is for the device and its intended use, looking at function, performance, usability, safety and the regulatory requirements that apply. Every change is identified, then reviewed, verified, validated where appropriate and approved before it is put into effect. The review of a change weighs its effect on constituent parts, on product being made or already delivered, on the inputs and outputs of risk management, and on the processes used to realize the product. The organization keeps records of each change, of its review and of any actions the review found necessary.

Held text: ISO 13485:2016, our statement of the clause, not the instrument verbatim.

what an assessor asks to see Design change procedure with a significance assessment covering function, performance, usability, safety and regulatory impact; Change records showing review, verification, validation and approval before implementation; Evaluation of effect on parts, product in process, delivered product, risk management and realization processes; Regulatory assessment of whether the change requires notification or approval

where it usually breaks Significance assessed only for regulatory notification, not for safety or usability; Effect on delivered product never evaluated; Changes implemented in production before verification is complete

Every ISO 13485 clause we hold

The organization determines and records the design and development inputs that relate to product requirements. These include the functional, performance, usability and safety needs arising from the intended use; applicable regulatory requirements and standards; relevant risk management outputs; information from earlier similar designs where appropriate; and any further requirements essential to designing the product and its processes. The inputs are reviewed for adequacy and approved. Requirements must be complete and unambiguous, must be capable of verification or validation, and must not contradict each other.

Held text: ISO 13485:2016, our statement of the clause, not the instrument verbatim.

what an assessor asks to see Design input specification covering functional, performance, usability, safety, regulatory and standards requirements; Risk management outputs incorporated as inputs; Record of input review for adequacy and approval; Evidence each input is verifiable or validatable and free of conflict

where it usually breaks Usability requirements absent from inputs; Risk controls identified in the risk file never entered as design inputs; Inputs approved without a check for ambiguity or conflict

Every ISO 13485 clause we hold

Validation of design and development follows planned, documented arrangements and confirms that the finished product can satisfy what its intended use or specified application demands. The organization documents validation plans giving methods, acceptance criteria and, where appropriate, statistical techniques with the reasoning for the sample size. Validation is done on representative product, such as initial production units or batches or their equivalents, and the reasons for that choice are recorded. Clinical or performance evaluations of the device form part of validation, carried out as the relevant regulatory requirements demand; a device supplied for such an evaluation does not count as released to the customer. Where the intended use needs the device to connect or interface with other devices, validation must show the requirements are satisfied in that connected state. Validation must be finished before the product is released to the customer for use, and records of its results, conclusions and any actions are kept.

Held text: ISO 13485:2016, our statement of the clause, not the instrument verbatim.

what an assessor asks to see Validation plans with methods, acceptance criteria and sample-size rationale; Rationale for the representative product used; Clinical evaluation or performance evaluation records meeting regulatory requirements; Validation reports completed before release for use; Connected-use validation where applicable

where it usually breaks Validation performed on prototypes rather than representative production units without a recorded rationale; Clinical evaluation treated as a regulatory-affairs deliverable disconnected from design validation; Product released for use before validation is closed

Every ISO 13485 clause we hold