FDA’s Voluntary ISO Audit Submission Program

By Jeffrey K. Shapiro & Jessica A. Ritsick –

ISO 13485 (2003) is an internationally recognized management system for the design and manufacture of medical devices.  Most device manufacturers have quality systems intended to comply with ISO 13485.  FDA has finally implemented a 2007 statutory requirement to allow firms to leverage their ISO compliance to potentially delay an inspection for compliance with FDA’s QSR (Quality System Regulation, 21 C.F.R. Part 820).

To be more specific: on June 5, 2012, FDA launched the “Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program,” implementing Section 228 of the Food and Drug Administration Amendments Act of 2007 (“FDAAA”) – see here and here.  Under Section 228, FDA shall “[f]or the purpose of setting risk-based inspectional priorities . . . accept voluntary submissions of reports of audits assessing conformance with appropriate quality system standards set by the International Organization for Standardization (ISO).”

So how does the program work?  A device manufacturer must have been audited under Global Harmonization Task Force (“GHTF”) members Canada, Australia, Japan, or the EU’s ISO system.  If so, the firm can voluntarily submit—within 90 days of its issuance, via FDA’s e submitter system—the ISO 13485 audit report to FDA, along with all ISO 13485 audit reports issued in the preceding two years, the establishment’s ISO certificate, and any communications from the most recent audit report.  The audit report is required to conform with Canada’s GD211 guidance for quality management system audit reports.

FDA will review the submission to determine whether “there is minimal probability . . . that the establishment will produce nonconforming and/or defective finished devices.”  If the answer is yes, FDA will use the audit as part of its risk assessment to determine whether the establishment can be removed from routine annual field inspection for one year from the last day of the ISO 13485 audit, such that the establishment’s bi annual inspection would be postponed for a year. 

As might be expected, voluntary submission of an ISO 13485 audit does not preclude FDA from conducting “for-cause” or preapproval inspections. 

It remains to be seen whether many companies will take advantage of this program.  Frankly, the benefit seems modest, especially since FDA routinely fails to inspect many companies in the required biannual time frame in any event.