How to set up a quality system for a medical startup

(or “achieving compliance without bringing everything to a crawl”)

Creating a quality system is fundamental for a medical startup because 1) it’s the law, and 2) it ensures a safe, reliable product. While a good quality system encompasses best practices at a company and makes the most of each employee’s work, a bad one hinders progress at every step in development and results in lots of frustrated employees.

Taking the time to create a good quality system–one that emphasizes good processes over documentation and focuses initially on implementation and training–is one of the secrets to building a successful medical startup. It’s also something that you have complete control over (unlike tricky technical challenges, marketing challenges, etc.).

As a consultant, I focus on processes for product development (risk management, design controls, etc.) and not everything else in a QMS. However, after working with many, many medical startups (>25), I’ve seen the same mistakes and misunderstandings repeated over and over. So I’ve made this summary of what to do and what not to do based on my first-hand experience.

What to do

Most important: take a staged approach to implementation; develop and release quality system procedures in stages as they’re needed by the phase of product development and as the company grows.

Make sure all the employees, especially those who are new to the medical device industry, understand the full framework and concepts behind the new quality system you’re building (the “why” behind all the new rules).

Focus on processes first, with minimal documentation. Use slimmed down draft SOPs that are easily modified to optimize processes. Then, as the organization becomes comfortable with following the processes, release full SOPs with increased controls and documentation (forms, templates, etc.). This encourages everyone to view the quality system as something dynamic that can be refined over time to best suit the needs of the company (not simply a static set of rules).

Provide ample opportunities for training with lots of face-to-face discussions (minimize the dreary “read and understand” approach to training, which is really only adequate for changes to existing procedures and not implementation of brand new procedures).

A full quality system typically has 30 or more Standard Operating Procedures (SOPs) but many of these are for production, for audits, and for handling customer complaints and other post-market issues so you don’t need them in the beginning. Instead, focus first on these procedures:

SOP03 Documents and Records – defines Doc Control operations, including ECOs
SOP04 Risk Management – Risk assessment and risk controls across entire product lifecycle, including compliance to ISO 14971
SOP05 Design Controls – Covers all product development and transfer to manufacturing
SOP06 Software Development – Special design controls for product SW, including compliance to IEC 62304 standard
SOP10 Supplier Management – How to select and qualify suppliers; controlling quality of components they deliver

The next procedures to implement depend on your product and organization but typically include:

QM1 Quality Manual – Highest level document; general policy, scope, objectives of the quality system
SOP01 General Quality System Controls – Covers management reviews, changes to the quality system, etc.
SOP02 Personnel and Training – Ensures that employees are qualified for the work they do; describes management of training records
SOP08 Cybersecurity and Data Privacy – Making your device secure and your operations secure
SOP11 Data Analysis and Statistical Techniques – Defines how product testing and other measurements are made and evaluated

What not to do

Implement everything at once (all 30+ SOPs); nothing is more demoralizing to a fast-moving product development team than to stop their progress and spend weeks trying to navigate a bewildering new set of rules
Focus on forms and templates instead of processes; if everyone understands the processes then learning the formal documentation is simple but if they don’t understand the processes then the forms and templates will seem like a lot of arbitrary paperwork
Wait until the end of product development to do “all the paperwork”; it is much harder and more expensive for a startup to play catch-up and there’s never any “spare time” at the end of development for this
Outsource all quality work to someone else (“we just want to focus on R&D”); if you want to be a successful medical device company, you will eventually need to own this work
Set up a quality system with vaguely worded procedures based on subjective decisions (instead of clearly defined procedures and requirements)
Pro Tip: Don’t just buy the ISO 13485 standard and try to write everything from scratch yourself. Your time is too valuable. Instead, use experienced quality consultants who have set up new quality systems for dozens of companies and will make sure you don’t make newbie errors.

Bonus Points

Since you’re starting from a blank page, how about creating a more user-friendly quality system for your new company? Consider adopting some of these tips that I’ve observed at some well-managed startups:

Develop graphical representations of every process (flowcharts, etc) that summarize the main requirements of each SOP and show how it relates to other SOPs
Use a wiki or similar collaboration forum to capture questions and comments from employees about particular procedures; use it for ongoing improvements to the quality system
Provide a visual representation of the entire (future) quality system and show, by color coding, the progress in implementing each portion (e.g., we’ve released 4 SOPs and are working on 2 more)
Schedule lunch and learn sessions where experienced employees relate particular issues they’ve experienced with product development and compliance with more junior employees

Resources for Starting a QMS

4 Medical Device Quality System Musts for Startups – by Jon Speer

Medical Device Quality Central – by Sam Lazzara

Standard Operating Procedures (SOPs) for ISO 13485 – by Rob Packard