3.3: ISO

ISO 9000

Quality management is the primary concern of the ISO 9000 standard with its focus on product design, manufacturing, sales, and service. It is accepted in over 90 countries and applicable not only to product-focused organizations but service-oriented organizations as well (e.g., hospitals). This standard strives to involve employees at all levels to participate in the quality process.

The guiding principle underlying the entire standard is transparency. Every member of an organization should be able to communicate what they intend to do to address a quality issue, do what they say they are going to do and, prove through documentation, they carried through the plan, and have a continuous improvement plan.

ISO 9000 Management Categories

1. Scope.
2. Normative Reference.
3. Terms and Definitions.
4. Quality Management System.
5. Management Responsibility.
6. Resource Management.
7. Production Realization.
8. Measurement, analysis, and improvement.

ISO 9000:2008

By the early 1990s, ISO 9000 was becoming increasingly outdated. The revision and improvement of the standard were a long, arduous process. The first round of major revisions was completed in 2000. The last round of additional revisions was finalized in 2008. Some of the features of the newly revised standard include the integration of the plan-do-check-act cycle as a system standard, stronger emphasis on customer feedback in analyzing the quality process, and a complete overhaul of the language the standard is written in (about an eighth-grade level) for improved readability.

Eight Fundamental Principles of ISO 9001:2008 Standards:

1. Customer-focused.
2. Leadership.
3. Involvement of people.
4. Process approach.
5. Systems approach to management.
6. Continual improvement.
7. Factual approach to decision making.
8. Mutually beneficial supplier relationship.

ISO 9000:2008 consists of three areas:

1. ISO 9000:2008, Quality Management Systems: Fundamentals and Vocabulary: Provides a standard of reference to the concepts and vocabulary used in ISO 9001:2008 and ISO 9004: 2008.
2. ISO 9001:2008, Quality Management Systems: Requirements: Intended for use by all organizations regardless of type, size, or industry. Specifies requirements for achieving ISO certification. (1) Management Responsibility: Discusses the impact of data analysis on an organization’s quality management system. (2) Resource Management: Detailed documentation of resource availability and deployment specified as a certification requirement. (3) Product and Service Realization: Specifies continual process improvement through self-assessment and customer requirements. (4) Measurement, Analysis & Improvement: Methods of a measuring system, processes, products or services.
3. ISO 9004:2008, Quality Management Systems: Guidelines for Performance Improvement: Not a requirement for certification. This standard specifies a means for those companies wishing to go beyond ISO 9001:2008 and develop a quality management system designed for continuous improvement of performance in all areas.

Documentation

A valid QMS requires rigorous documentation and disciplined record keeping. Some of the activities of record required by ISO 9000 include, but may not be limited to, training records, policies, procedures, instructions, protocols, purchasing records, test data, audit records, and calibration records. ISO 9001 requirements on documentation are published in Document: ISO/TC 176/SC 2/N525R2, October 2008. ISO 9001:2008 clause 4.1 General requirements require an organization to “establish, document, implement, and maintain a quality management system and continually improve its effectiveness in accordance with the requirements of this International Standard.” (www.iso.org)

Clause 4.2.1 explains that the quality management system documentation shall include:

1. Quality policy and quality objectives.
2. A quality manual.
3. Documented procedures; established, documented, implemented, and maintained.
4. Documented processes; effective planning, operation, and control of its processes.
5. Records required

QMS documentation differs from one organization to another relative to the size of the organization, the scope, and complexity of its activities in addition to many other factors, such as federal regulations.

Quality Manual

The Company establishes and maintains a quality manual that includes:

1. The scope of the quality management system, in detail.
2. Procedures established for the quality management system, documented or referenced.
3. A description of the interaction between the processes of the quality management system.

Control of Records and Documents

All documents formally describing the QMS must be strictly controlled. No changes can be made to these documents without first passing through an official change procedure as outlined within the company’s QMS. The company must establish a procedure to control everything from storage and retrieval of records to their identification, legibility, and disposal.

A documented procedure is established to define the controls needed to:

• Approve documents for adequacy before the issue.
• Review and update as necessary and re-approve documents.
• Ensure that changes to documents are traceable
• Ensure that relevant versions of applicable documents are available
• Ensure that documents remain legible and readily identifiable.
• Prevent the unintended use of obsolete documents

ISO 14000

"Environmental management" is the focus of the ISO 14000 standard. Environmental management can be loosely defined as the steps a company takes to minimize its impact on the natural environment and to continuously improve its environmental track by reducing harmful waste by-products from the manufacturing process.

Initially, the issue of environmental management was addressed only briefly in ISO 9000. As social and political attitudes towards environmental safety changed, the ISO organization decided to address the issue by creating a complete set of guidelines and standards. This new environmental management system is not a regulation or law (none of ISO's standards are). However, it does mirror the kinds of steps a company must take to come into compliance with local legislation and regulations. In other words, it provides a useful framework for businesses to follow when planning and implementing their own EMS. Some companies will even go a step further by requiring partners and suppliers to come into compliance with them. For example, Ford and GM both require their suppliers to be ISO-14000 certified.

To become ISO 14000 certified, a company must:

1. Implement an Environmental Management System.
2. Assure compliance with existing laws and regulations.
3. Demonstrate a commitment to continual improvement.
4. Minimize waste.
5. Prevent pollution.

ISO 14001:2015

Anne-Marie Warris, Chair of ISO/TC 207/SC1, the technical committee that developed the standard and revision, believes "the new version helps with a stronger integration between environmental issues and an organization's strategic action planning and thinking.”

ISO 14001:2015 key components include:

• Factoring in both external and internal elements that influence their impact
• A greater commitment from leadership
• An increased alignment with strategic direction
• Increased protection for the environment, with a focus on proactive initiatives
• More efficient communication, driven by a communications strategy
• Lifecycle thinking, considering each stage of a product or service, from development to end-of-life

ISO/IEC Standards for Testing Laboratories

Testing and calibration laboratories follow the ISO/IEC 17025 standard. This standard is very similar to ISO 9000 but addresses the additional issue of competence as it applies to create and maintain a quality system the laboratory to produce valid results. Greater emphasis on the responsibilities of senior management and communication with customers became a part of this standard in its 2005 revision.

The Five Top Elements of ISO/IEC 17025:

1. Scope.
2. Normative References.
3. Terms and Definitions.
4. Management requirements.
5. Technical requirements.

Further information, including other relevant laboratory testing ISO guidelines, are listed at the American Association for Laboratory Accreditation (www.a2la.org):

• ISO/IEC17025 Testing/Calibration Laboratories
• ISO/IEC17020 Inspection Bodies
• ISO/IEC17043 Proficiency Testing Providers
• ISO/IEC17065 Product Certification Bodies
• Clinical Testing Laboratories
  • ISO 15189
  • CLIA Requirements
  • CLIA and ISO 15189
• ISO Guide 34 Reference Materials Producers

ISO Device Regulations ISO 13485

ISO13485 is the standard for a quality management system for the design and manufacture of medical devices. This standard (although a stand-alone document) is harmonized with ISO 9001 with the exception that 13485 need only demonstrate the quality system is implemented and maintained whereas 9001 requires a continual improvement aspect.

ISO Clinical Practices and Devices

The medical device industry is quickly becoming a major player in the medical biotechnology industry. Moreover, regulations governing them can be complicated due to their unchartered territory as well as their multi-disciplinary applications. For example, what regulations would apply to an ocular device inserted into the eye (medical device), which measures and responds to eye pressure (diagnostic) to release several drugs (drug)? As you can imagine, global regulations vary widely. To address this, ISO and the European Committee for Standardization (CEN) worked together to come up with comprehensive clinical study regulations governing devices. ISO 14155 addresses these procedures including, risk assessment, ethical issues, constructing protocols and scientific conduct to name a few. More on this ISO regulation in following chapters that delve into devices and clinical studies.

ISO Certification

The process of obtaining certification is expensive, complicated, and time-consuming. To receive certification, a company must hire an independent, certified auditor (registrar) to perform an audit of the company’s QMS. For a company to get the certification, they must first create a quality system (described in their quality manual), create all the systems and documents, and put them in place (implementation). The company then hires a certified ISO auditor that audits the business to ensure all their systems and documentation are in place. The company then must apply for ISO certification and maintain the process. The largest and most frequent obstacle for most businesses is coming into compliance with the documentation process. Eventually, however, certification pays for itself through the product quality benefits it provides. Processes can be streamlined and improved by coming into compliance. Additionally, consumer confidence in a product goes up with the ISO 9001 label and gives the company a definite competitive advantage.

Test Your Knowledge!

GMP versus ISO: Presented below is a table that compares the differences and similarities between regulations and ISO 9000 standards. Fill in the missing parts of the table

GMP	ISO
Mandatory system
Federal (US) Law
	Can apply to any industry
Enforced by the FDA
Standards are generic and broad in scope but apply to the pharma/medical industry only
Standards rely heavily on testing and inspection; functional areas are clearly defined	Standards rely on management commitment, systems, procedures, and documentation; the quality system needs to be only as comprehensive as necessary
	Compliance is monitored by outside auditors paid by the company

Standards for Pharmaceutical Companies

Published in March 2006, ISO 15378 is a standard specifically developed for suppliers of pharmaceutical primary packaging. The standard specifies the QMS requirements necessary to demonstrate an organization's ability to provide primary packing materials for medicinal products that meet customer requirements. It also defines the applications for design, manufacture, and supply of primary packaging materials. It also guarantees that the legal requirements and the standards of the pharmaceutical industry for medical devices are met and that the company operates on an effective and efficient quality management system.

ISO 15378 Key Areas:

1. Risk analysis
2. Checking / qualification / validation
3. Manufacturing tools
4. Computerized systems
5. Contamination risk & cleanliness control
6. Traceability
7. Change control
8. Operators training in GMP practices

Test Your Knowledge!

1. Since ISO 9000 certification and compliance are voluntary, what motivates companies to adopt these stringent quality standards?
2. In your own words, explain why you would want or need to have a voluntary standard such as ISO 15378 when the pharmaceutical industry is already following FDA-regulated CGMP.
3. In your own words, compare the issues addressed by the following standards. You may be brief (2-3 sentences) each.

ISO Standard	Issues addressed by this standard
ISO 9001:2008
ISO 9004:2008
ISO 14000:2015
ISO/IEC 17025
ISO 15378
ISO 13485
ISO 14155