As soon as Nonconformity is detected within the organization, it must be recorded. It must be written somewhere. The ISO 9001 Standard requires that any non conforming product would be identified and controlled. The purpose is to prevent using this product or delivering it to your customers. The process of identifying and controlling shall be documented within a procedure. The documentation of the treatment must include authorities and responsibilities. So far, his cousin the ISO 13485 Standard requires pretty much the same. But of course with some additional requirements. Otherwise we wouldn't be here… When dealing with nonconforming products, the organization must refer to the next issues

First thing is first. No? I want to make sure that we mean the same thing when we are referring to non – conformed product. A Non – conformed product: a product that does not conform to its specified requirements:

• Customer's requirements
• Regulatory requirements
• Intended use requirements

Nonconformity is where a result was not achieved according to a specific requirement.  The main idea of controlling a nonconforming product is to separate it from the other conform products:

• Identifying the non conform product in order to eliminate the use or delivery of this product
• Separating the non - conform product form the other conform products.

The requirement includes both medical devices that were detected in house and medical devices that were already delivered to the customer. This paragraph relates to non - conform products and not general non conformances.

The procedure of handling a non conformed product

The ISO 13485 Standard requires defining and maintaining a documented procedure to describe precisely how a non - conformed medical device or any other component of the medical device shall be handled when one is detected. This procedure is one of the obligatory quality procedures. The process shall include the steps while handling a non conformed product. Of course, as any other required procedure, the process of controlling non conformed medical devices shall be controlled under the documents control process within the organization.  In other words, this process is under the quality management system, required to be controlled and would appear on the list of the controlled procedures in your quality manual guide.   

Responsibilities and authorities

The organization is required to determine the authorities and responsible parties to handle non – conformed products. The definition shall refer to all stages of the process; from the detection of the non – conformed medical device until the closure of the case. The definition shall be documented on the required procedure mentioned above.

Identification of the non conformed product

The identification shall differentiate the non-conformed medical device from the conformed medical device in an explicit manner. The identification shall include physic segregation from the conformed medical devices. You may determine a special area or just a special shelve for non-conformed medical devices, but they must be apart from the conformed medical devices. When the non - conformed part is a software element, it is possible to relocate the element form the development area or from the teat area.  

Determination of disposition

This requirement refers to the immediate act required to be made regarding the non-conformed medical device:

• Segregation of the non conformed medical device
• Reply to the customer
• Notifications to the relevant parties
• Short term corrective action

What suits your organization is fine by me. But it is required to be defined and documented. Everybody must know what they are required to do when a non conformed medical device is detected; service call center, the logistics, salesmen, CEO, production manager, quality manager – everybody who is related and a part in handling the defected product.

Evaluation of the nonconformance

The purpose of the evaluation is to determine the type of the non conformance and its severity. It is recommended to define the types of non conformances in order to categorize them. Non conformance may appear as:

• a non conformed product or medical device – something tangible  - that the organization provides to its customers and that it does not meet the prior planned requirements.
• a non conformed process – when there it is not possible to execute or perform according to specific instructions (documented or not).    

The evaluation shall include a reference to whether the nonconformance requires a further investigation of the root cause and notification to the responsible parties. The evaluation shall include which other component in the medical device could be affected from the occurred non- conformance.

Documentation of the non conformed product

The record can appear in any form: form, software, e-mail, whatever appropriate for your organization. But bear in mind that this documentation is the first step of a later corrective action process. Thus, it is recommended to document it where you would be able to trace and document the next steps.

The first level of documentation is primary information gathered about the Nonconformity. By the way, customer's complaints are considered as Nonconformities.
The documentation shall include the records of the problem occurred by the non conformed medical device - why does it fail to meet the requirements – and the affect the problem on other components of the product.

I recommend you to document any characteristic of the medical device (or the service) where you detected the Nonconformity. Why? Because when you can examine all the characteristic of the medical device you would be able to understand the Nonconformity better, you would be able to understand the cause, and far more important, to may come up with an efficient corrective action later on.

The Nonconformity record – which details to document:

• The Nonconformity details – you are required to document any identifying details regarding the Nonconformity: customer's name, product's name, catalogue number, name of the employee that detected the Nonconformity – any information that would help you to investigate the Nonconformity latter on.
• Description of the Nonconformity – you can put here a literal description or even attach another document. Whatever suits your organization.
• Categorization of the Nonconformity – it is not required by the ISO 13485 Standard but it is highly recommended. The categorization would assist you later with a statistical analysis.
• Investigation Details – any Nonconformity must be followed with an investigation. The purpose of the investigation is to identify the root cause for the Nonconformity. This is the essence of the corrective action.
• The organization is required to document the responsible party for the non conformed medical device in order to maintain supervision that a solution is being implemented.  
• Documentation regarding status of the product is required as well:
  • Repair or rework
  • Acceptance or rejection
  • Corrective action required – the medical device must be submitted to the corrective action process.

Records of non conformed medical devices must be kept and included under the records control procedure (the famous 4.2.4). In other words, include the documentation of the non conformed medical device under your records control process.

Reworking non – conformed products

Reworking products must be documented and recorded. The rework shall be documented in the same manner that the original work instruction was documented and would be approved in the same manner as well. The rework shall be reviewed and approved by the same authority that reviewed and approved the original work instruction. Why? To ensure that the rework processes are controlled and would not affect the medical device. The rework process must refer to adverse effects that may occur upon the product during the rework process. Documentation of the rework processes shall be done according to the organization's method for document management (4.2.3 – control of documents). In other words, the documentation of the rework must be controlled.

Concession of Non – conformed medical devices

Perquisite for concession of a non conformed medical device is meeting regulatory requirements. The organization or the customer ordered the medical device is not authorized to approve non conformed medical device as long as the medical device does not meet the regulatory requirements. It is a logical and necessary requirement. Without this requirement, the shortcuts would begin… The reason is that medical devices are manufactured under strict regulations dictated by the local authorities. Concessions can be made only when regulatory requirements are fully met. Records of any concession made must be kept and included under the records control procedure (the famous 4.2.4).

Read the next article about the ISO 13485 Standard analysis of data requirement

 aaa