AI Generated Quality Assurance Manual for use in the United States
PDF & Word - 2026 Updated

This Quality Assurance Manual establishes standardized procedures for ensuring product quality compliance with regulations and continuous improvement across all operations of MediTech Innovations Inc. hereinafter referred to as the Company. This manual affirms the Company\’s commitment to compliance with FDA Quality System Regulation (21 CFR Part 820), ISO 13485, ISO 14971, and HIPAA where applicable.

The Manual provides an overview of the quality management system its purpose and its importance within the organization emphasizing Regulatory Compliance Operational Efficiency and Customer Satisfaction.

The Manual becomes effective on 2024-01-01 and was issued on 2023-12-15 with an initial publication date of 2023-12-01.

This Manual is governed by American law and shall be interpreted and enforced in accordance with the laws of the United States of America.

The Table of Contents for this Manual is detailed with subsections and includes page numbers for easy navigation.

This Manual is assigned version number 2.0.

This revision standardizes the company name to MediTech Innovations Inc., updates product scope to medical devices, aligns all references to 21 CFR Part 820, ISO 13485, ISO 14971 and HIPAA, and adds sections 32-39 to ensure full compliance with FDA QSR and ISO 13485 requirements.

The first revision was triggered by a Regulatory Change with a detailed description of Updated section 3.2 to reflect new FDA guidelines on quality control procedures and became effective on 2023-05-15 as approved by Jane Doe Quality Assurance Manager.

The second revision was triggered by an Error Correction with a detailed description of Corrected typographical errors in Appendix A and became effective on 2023-05-15 as approved by Jane Doe Quality Assurance Manager.

The quality policy statement that outlines the Company commitment to quality and has been approved by top management states Our organization is committed to delivering high-quality medical devices that meet or exceed customer expectations while maintaining compliance with 21 CFR Part 820, ISO 13485, ISO 14971 and HIPAA.

The Company strives for continuous improvement in all processes ensuring compliance with applicable standards and regulations.

This policy is endorsed by top management and communicated throughout the organization and was approved by top management on 2023-01-15.

Top management shall review the quality policy annually.

The Quality Objectives section outlines the key measurable goals that support the Company commitment to excellence and continuous improvement.

The quality objectives align with the strategic goals of Customer Satisfaction and Operational Efficiency.

The first quality objective is to Achieve a 95 percent on-time delivery rate for all customer orders with a target numerical value of 95 percent.

Progress of the first quality objective shall be reviewed by 2024-12-31.

The Company shall define three quality objectives in total using Key Performance Indicators as the method for measuring the quality objectives.

The Quality Assurance Manager and Operations Team shall be responsible for achieving and monitoring the quality objectives.

The planned start date for implementing these quality objectives is 2024-01-01.

The Company shall include a provision for annual review and update of the quality objectives.

The Quality Assurance Manual applies to all processes involved in the design production and distribution of medical devices within the Company ensuring compliance with 21 CFR Part 820, ISO 13485, ISO 14971 and HIPAA.

The quality management system encompasses the entire lifecycle of the products from initial research and development through manufacturing quality control and customer support focusing on continuous improvement and regulatory compliance.

The products included in the scope of the quality management system are medical devices.

The applicable services include installation support product maintenance and customer training programs all of which are managed to meet quality standards and customer satisfaction goals.

The quality management system shall apply to the Production Department Research and Development and Quality Assurance Team.

Servicing is excluded from the scope of the QMS as the Company does not provide post-market servicing for its medical devices. This exclusion does not affect the conformity of the QMS to ISO 13485 or 21 CFR Part 820.

The start date for the implementation of the quality management system is 2024-01-01.

21 CFR Part 820 - Quality System Regulation.

ISO 13485:2016 - Medical devices - Quality management systems - Requirements for regulatory purposes.

ISO 14971:2019 - Medical devices - Application of risk management to medical devices.

HIPAA - Health Insurance Portability and Accountability Act.

21 CFR Part 803 - Medical Device Reporting.

21 CFR Part 806 - Medical Devices - Reports of Corrections and Removals.

21 CFR Part 821 - Medical Device Tracking Requirements.

This Manual ensures compliance with the above standards and regulations.

Quality Assurance is a systematic process of creating and maintaining a quality management system to ensure that organizational activities consistently meet customer and regulatory requirements.

Quality Control refers to the operational techniques and activities used to fulfill requirements for quality including inspection testing and verification of products or services.

Non Conformance is the failure of a product process or service to meet specified requirements or standards.

Corrective Action is the action taken to eliminate the cause of a detected non-conformity or other undesirable situation preventing its recurrence.

Preventive Action is the action taken to eliminate the cause of a potential non-conformity or other undesirable potential situation preventing its occurrence.

Design History File (DHF) is a compilation of records which describes the design history of a finished device per 21 CFR 820.30.

Device Master Record (DMR) is a compilation of records containing the procedures and specifications for a finished device per 21 CFR 820.181.

Device History Record (DHR) is a compilation of records containing the production history of a finished device per 21 CFR 820.184.

Risk Management is the systematic application of management policies, procedures and practices to the tasks of analyzing, evaluating, controlling and monitoring risk per ISO 14971.

The Company includes custom industry-specific terms beyond the standard ones in the Terms and Definitions section with a scope of Company Specific and General and a last revision date of 2023-10-15.

The principal business address of the Company is 123 Quality Street Suite 100 Austin TX 78701.

The Company has approximately 150 full-time employees.

The Company establishes a dedicated Quality Assurance Department in its organizational structure with a Hierarchical Diagram format for the organizational chart.

The Quality Assurance Director shall have the specific responsibilities to Oversee all quality assurance processes develop and implement quality policies lead audits and compliance efforts and report directly to the CEO on quality metrics.

The key roles included in the quality assurance organizational structure are Quality Auditor Compliance Officer and Process Engineer.

The reporting structure for quality assurance personnel is that quality assurance personnel report to the QA Director who reports to the Vice President of Operations.

Auditors and engineers report directly to the Director while coordinators report to senior QA staff.

The high-level description of the scope of the quality management system states that the QMS covers the design manufacture and distribution of medical devices ensuring compliance with 21 CFR Part 820, ISO 13485, ISO 14971 and HIPAA.

The statement of the Company quality policy that outlines commitment to quality and customer satisfaction is We are committed to delivering superior medical devices and services that meet or exceed customer expectations fostering continuous improvement and ensuring total customer satisfaction through our dedicated QMS.

The Company currently holds quality management system certifications of ISO 13485 Certified.

The key processes in the quality management system include quality planning document control supplier management production control internal auditing corrective actions risk management and continuous improvement initiatives.

The key processes in the QMS interrelate such that quality planning establishes objectives that inform production control and monitoring processes.

Monitoring data feeds into internal auditing and corrective actions which drive continuous improvement creating a feedback loop throughout the QMS.

The Company began implementing the current quality management system on 2020-01-15 and management reviews the quality management system annually to ensure its continuing suitability adequacy and effectiveness.

Top management of the Company issues a formal statement declaring its commitment to the Quality Management System.

Top management shall establish implement and maintain a quality policy that aligns with the organization purpose and strategic direction.

The quality policy reflects top management commitment by stating Our organization is committed to delivering high-quality medical devices that meet customer requirements and exceed expectations.

Top management ensures the Quality Management System is effectively implemented maintained and continually improved to support strategic objectives.

Top management shall use the Internal Website or Intranet Employee Training Sessions and Email Distributions to communicate the quality policy to relevant interested parties.

Top management shall define and communicate the responsibilities and authorities for relevant roles to ensure Quality Management System effectiveness.

Top management shall implement mechanisms for allocating resources to the Quality Management System through Annual Budget Planning Dedicated Quality Department and Training Budget Allocation.

Top management shall ensure that the Quality Management System is integrated into the organization business processes.

Top management shall use Executive Communications Integrated Training Programs and Performance Incentives to promote the use of a process approach and risk-based thinking within the organization.

Top management shall support the organization continual improvement processes related to the Quality Management System.

The specific quality objectives established for the organization are Achieve 95 percent on-time delivery rate for all products by the end of the fiscal year reduce defect rate to below 2 percent through enhanced quality controls and improve customer satisfaction scores to 90 percent or higher.

The Company has already conducted a preliminary risk assessment for its operations.

The start date for implementing the planning actions in this section is 2024-01-01 with the first review of the planning actions scheduled by 2024-06-30.

The Company assigns a High priority level to addressing identified risks in its planning.

The Company shall pursue opportunities of Process Improvement Technology Adoption and Training and Development in its quality planning.

The Company has identified 5 specific risks that need to be addressed in planning.

The specific actions the Company plans to take to address risks and opportunities are Conduct quarterly risk audits to identify and mitigate supply chain disruptions implement new automated quality inspection software to reduce errors develop a cross-functional team for ongoing process optimization and provide advanced training sessions for employees on quality standards.

The Company shall integrate opportunity planning with its existing quality objectives.

The resources allocated for the Quality Management System are that the company allocates dedicated personnel including a full-time Quality Manager and two support staff along with software tools for document management and annual training budgets to ensure effective implementation of the Quality Management System.

The Company utilizes external providers for resources in the Quality Management System.

The Company uses Formal Education Verification Training Records Review and Performance Evaluations to assess competence of personnel for Quality Management System roles.

The Company provides awareness training to personnel on the Quality Management System policy and objectives.

The Company uses Email Notifications Team Meetings and Training Sessions for internal communication about the Quality Management System.

The Company communicates externally regarding the Quality Management System on the topics of Quality Policy Complaint Procedures and Certification Status.

The Company controls documented information for the Quality Management System through a centralized electronic document management system that ensures version control access restrictions based on roles regular reviews and secure backups to prevent unauthorized changes or loss.

The date of the last review of Quality Management System documented information was 2023-06-15.

The operational planning process for the Company involves quarterly strategy sessions where the Company assesses market demands allocates resources and defines key performance indicators to ensure alignment with quality objectives.

The Company currently has operational control measures in place for its products and services.

The types of requirements specified for products in the Operation section are Performance Standards Safety Regulations and Material Specifications.

The types of requirements specified for services in the Operation section are Delivery Timelines Quality Metrics and Customer Support Protocols.

The criteria for releasing products and services in operations are that products and services are released only after passing all quality tests including functionality checks compliance audits and customer feedback simulations ensuring they meet or exceed established standards.

Operational planning shall be reviewed 4 times per year.

The annual budget amount allocated for operational quality controls is 15000.50 USD.

The method used for approving the release of products and services is Quality Team Review.

Regular operational control checks shall be scheduled on the 15th day of the month.

The detailed description of the monitoring processes for performance evaluation is that monitoring processes involve regular tracking of key performance indicators using automated dashboards to ensure real-time visibility into operational efficiency. Data analysis per 21 CFR 820.100 and 820.250 shall include statistical techniques where appropriate.

The Company shall establish daily monitoring for performance evaluation.

The measurement metrics included in the performance evaluation section are Error Rate On Time Delivery and Customer Satisfaction Score. Additional metrics shall include complaint rates, audit findings, and CAPA effectiveness.

The method for analyzing performance data is that statistical analysis software shall be used to review trends and identify areas for improvement in performance data.

The types of internal audits implemented for performance evaluation are Process Audit and System Audit with 4 internal audits conducted annually.

The Company shall schedule regular management reviews for performance evaluation. Management review inputs shall include the elements required by 21 CFR 820.20 and ISO 13485 Clause 5.6.

The Company shall incorporate specific methods for continual improvement of PDCA Cycle Six Sigma and Internal Audits. Improvement activities shall be linked to analysis of data per 21 CFR 820.100, customer complaints, audits and nonconformities.

The preventive measures the Company will implement to avoid potential nonconformities are that the company will implement preventive measures including regular risk assessments proactive monitoring of processes and employee feedback mechanisms to identify and mitigate potential nonconformities before they occur.

The Company shall require regular training on preventive measures for employees.

The procedure for creating documents and records in the Quality Assurance Manual is that all documents and records shall be created using approved templates in the company document management system.

The creator must include a unique identifier date of creation and their name.

Drafts must be reviewed by the relevant department head before finalization.

The Company shall require version control for all documents and records.

The Quality Assurance Manager shall be designated as the authority responsible for approving documents and records.

Documents shall be reviewed for updates annually.

Records shall be retained for at least 2 years from the date of manufacture or for a period equal to the design and expected life of the device, whichever is longer.

The procedure for controlling access to sensitive documents and records is that access to sensitive documents and records shall be restricted based on role-based permissions in the document management system.

Users must authenticate with unique credentials and access logs shall be maintained.

Unauthorized access attempts will trigger immediate alerts to the IT security team.

The method used for disposing of records after the retention period is Shredding.

The Company shall require an audit trail for all changes to documents and records.

The primary method the organization uses to identify risks and opportunities in the Quality Management System is that the organization uses a combination of brainstorming sessions with cross-functional teams SWOT analysis and review of historical incident data to identify risks and opportunities in the Quality Management System.

The Company shall conduct an annual risk assessment as part of its Quality Management System in accordance with ISO 14971.

The criteria the organization uses to assess the severity of risks in the Quality Management System are Likelihood of Occurrence Potential Impact and Detectability.

The step-by-step process for mitigating identified risks in the Quality Management System is that the risk mitigation process includes prioritizing risks based on assessment scores assigning responsible parties and timelines developing and implementing action plans such as process improvements or controls monitoring effectiveness through follow-up reviews and updating the risk register accordingly.

The approaches the organization uses to identify opportunities within the Quality Management System are Customer Feedback Analysis Internal Audits and Performance Data.

The procedure for documenting risks assessments and mitigations in the Quality Management System is that risks assessments and mitigations are documented in a centralized risk register using a standardized template.

The procedure involves entering details such as risk description assessment criteria scores mitigation actions responsible owners and review dates.

All updates are version-controlled and accessible to authorized personnel via the Quality Management System software platform.

Risk management per ISO 14971 shall be integrated with design and development, production and process controls, and CAPA processes. Risk analysis, evaluation, control, residual risk evaluation, benefit-risk analysis, and production/post-production monitoring shall be documented.

Risk management files shall be maintained as part of the QMS and reviewed during management reviews and internal audits.

Internal audits will be conducted quarterly with additional audits as needed based on risk assessments.

The Company shall designate a specific team leader for conducting internal audits.

The aspects of operations included in the scope of internal quality audits are Process Compliance Documentation Review and Employee Training.

The Company shall allocate 3 persons as internal auditors for each quality audit.

Detailed guidelines for planning internal audits are that planning should include defining objectives selecting the audit team developing checklists and scheduling audits at least two weeks in advance.

The format for reporting internal audit findings is a Detailed Written Report.

The procedures for following up on audit corrective actions are that follow-up procedures include verifying corrective actions within 30 days documenting completion and conducting re-audits if necessary to ensure sustained compliance.

The criteria used for selecting suppliers and vendors are Cost-effectiveness quality certifications such as ISO 9001 delivery reliability financial stability and environmental sustainability practices.

The Company shall conduct regular evaluations of selected suppliers.

The Company shall evaluate supplier performance quarterly using the performance metrics of On-time delivery rate defect rate responsiveness to issues cost variance and compliance with quality standards.

The Company shall include a process for corrective actions when supplier performance is inadequate.

The Company shall use On-Site Audits and Performance Reports to monitor suppliers.

The criteria used for disqualifying underperforming suppliers are Repeated failure to meet delivery deadlines more than 3 instances in a year defect rates exceeding 5 percent non-compliance with regulatory standards or bankruptcy filing.

The Company shall enable periodic customer satisfaction surveys conducted quarterly and distributed by Email distribution to all customers with an online survey link.

The key topics included in the customer satisfaction surveys are Product quality customer service responsiveness ease of use and overall satisfaction.

The Company shall set a specific timeline to acknowledge receipt of customer complaints within 2 days.

The primary method the Company shall use for resolving customer complaints is Direct Resolution by Support Team.

Complaints shall be logged and tracked by entering all complaints into the central CRM system with details including customer info complaint description date received and assigned resolver.

Actions for improving customer satisfaction shall be triggered under the conditions of Low Survey Scores or Recurring Complaint Patterns.

The Company shall provide training to employees on handling customer complaints through Annual workshops on active listening empathy problem-solving techniques and company policies for complaint resolution.

The requirements for employee training in quality-related tasks are that all employees involved in quality-related tasks must undergo comprehensive training to ensure they understand and can apply quality standards effectively.

Training will cover company policies procedures and best practices with a focus on continuous improvement.

The Company shall require annual training for all employees involved in quality-related tasks including the quality training topics of Quality Management Systems Process Control Techniques and Regulatory Compliance.

All current employees shall complete their initial quality training by 2024-12-31.

The Company shall require formal assessments to evaluate employee competence after training using the methods of Written Examinations Practical Demonstrations and Supervisor Observations.

The conditions that trigger retraining for employees are when there are changes in processes regulations or procedures after performance issues are identified or every three years for refresher purposes.

The Company shall allow the use of external providers for quality training.

The detailed description of the calibration policy in the Quality Assurance Manual is that the calibration policy ensures that all measuring and test equipment is calibrated against certified standards at specified intervals to maintain accuracy within acceptable tolerances in compliance with ISO 13485 standards.

The Quality Assurance Manual shall require the organization to maintain a detailed inventory of all equipment subject to calibration.

The organization shall follow a frequency of Annually for calibrating equipment in the Quality Assurance Manual with an annual budget of 50000.00 USD allocated for calibration and maintenance activities.

The step-by-step procedures the organization will follow for calibrating equipment are Inspect equipment for damage Verify current calibration status Perform calibration using certified standards Record results and apply labels and Test functionality post-calibration.

The Company shall implement a Preventive type of maintenance schedule for facilities in the Quality Assurance Manual.

The roles and responsibilities of personnel involved in calibration and maintenance are that the Quality Manager oversees the program Maintenance Technicians perform calibrations and Department Supervisors ensure compliance in their areas.

The organization shall maintain digital records for all calibration and maintenance activities.

A detailed definition of what constitutes a nonconformity in operations is that a nonconformity is any deviation from specified requirements including product specifications process standards or quality procedures that could affect product quality or safety.

The Company shall require an initial investigation immediately upon discovery of a nonconformity.

Nonconformities shall be categorized by severity levels of Minor Major and Critical.

The step-by-step procedure for handling identified nonconformities is that the procedure includes Immediate isolation of the affected product Notification to the Quality Manager Documentation of the nonconformity details Initial assessment for containment and Initiation of root cause analysis.

Corrective actions shall be reviewed for effectiveness 30 days after implementation.

Root cause analysis shall be mandatory for all corrective actions.

The process for approving and documenting corrective actions is that the process involves Proposal of corrective action by the responsible team Review and approval by the Quality Manager and Documentation in the Corrective Action Log including dates actions taken and verification results.

Nonconforming product is any item that does not meet the established quality standards specifications or regulatory requirements including defects in materials workmanship or performance.

The Company shall require segregation of nonconforming products from conforming ones.

The method used for identifying nonconforming products is that nonconforming products will be tagged with red labels indicating Nonconforming - Do Not Use and moved to a designated quarantine area.

The disposition options included for nonconforming products are Return to supplier Rework or repair Scrap or destroy and Use as is with concession.

The control procedures for nonconforming products include physical segregation in a locked quarantine area restricted access and tracking via a digital inventory system to prevent unintended use or shipment.

The maximum review period for nonconforming products is 14 days.

The Quality Manager shall be designated as responsible for final disposition of nonconforming products.

The documentation requirements specified for nonconforming products are that all nonconforming products must be documented using Nonconformity Report forms including details of the issue photographs if applicable disposition decision and sign-off by authorized personnel.

The detailed description of the organization policy on corrective and preventive actions is that the organization is committed to a proactive quality management system that identifies and addresses nonconformities through corrective actions to eliminate root causes and prevent recurrence. CAPA shall be linked to customer complaints, audits, and post-market surveillance per 21 CFR 820.100.

Preventive actions will be implemented to mitigate potential risks before they impact operations.

The Company shall require formal root cause analysis for all identified nonconformities using the methods of 5 Whys Technique and Fishbone Diagram.

The step-by-step procedure for implementing corrective actions in the organization is Identify and document the nonconformity Conduct root cause analysis using approved methods Develop and approve corrective action plan Implement the actions with assigned responsibilities Monitor and verify effectiveness and Update procedures to prevent recurrence.

The Company shall include procedures for preventive actions to address potential nonconformities before they occur.

The maximum number of days set for responding to identified nonconformities is 30.

The roles in the organization designated as responsible for overseeing corrective and preventive actions are Quality Manager and Department Supervisor.

The process for verifying the effectiveness of implemented corrective and preventive actions is that effectiveness will be verified through follow-up audits performance metrics review and monitoring for a period of at least 6 months post-implementation.

If nonconformities recur the actions will be reevaluated and adjusted as necessary.

The Company shall require training for employees on corrective and preventive action procedures and shall use an Electronic Quality Management System and Spreadsheet Software for documenting corrective and preventive actions.

The detailed description of the statistical techniques the company uses for monitoring controlling and improving processes is that the company employs a range of statistical techniques including control charts for real-time monitoring of process variations regression analysis to identify key variables affecting output quality and design of experiments to optimize process parameters and reduce defects systematically. Statistical techniques shall be applied per 21 CFR 820.250 where appropriate.

The Company shall incorporate capability analysis for assessing process performance.

The company shall conduct statistical reviews for process control Monthly using a sample size of 30 samples with a minimum process capability index threshold of 1.33 index.

The start date for implementing these statistical methods in process control is 2024-01-01.

The training requirements for employees on statistical methods and process control are that all employees involved in process control will undergo mandatory training on statistical methods including a 16-hour workshop covering control charts capability analysis and basic hypothesis testing followed by annual refreshers to ensure ongoing proficiency.

The statistical techniques the company shall apply in the process control section are Hypothesis Testing Regression Analysis and Design of Experiments.

The full legal name of the company is MediTech Innovations Inc.

The U.S. federal regulations that apply to the company operations are FDA 21 CFR Part 820, 21 CFR Part 803 (Medical Device Reporting), 21 CFR Part 806, 21 CFR Part 821, and HIPAA.

The state-specific regulations the company needs to comply with are California Medical Device Regulations and New York Privacy Laws.

The industry-specific regulations that apply to the company products or services are ISO 13485 and ISO 14971.

The company has an existing regulatory compliance program in place and has 5 dedicated personnel for regulatory compliance with Dr. Emily Carter designated as the compliance officer.

The company shall conduct regulatory compliance training for employees Upon Hire and Annually with an annual budget of 150000.00 allocated for regulatory compliance activities.

The company has an internal mechanism for reporting potential regulatory violations including whistleblower protections and anti-retaliation policies.

The primary regulatory compliance risks the company faces are Data privacy breaches under HIPAA and device quality control failures under FDA regulations.

Post-market surveillance procedures shall be maintained to monitor device performance in the field.

Adverse event reporting (MDR) shall be conducted per 21 CFR Part 803. Procedures for recalls and field corrections shall be documented per 21 CFR Part 806 and linked to the CAPA system.

The Company shall maintain preparedness for FDA inspections including mock audits and document retrieval procedures.

All activities shall be integrated with risk management per ISO 14971.

The appendices provide essential supporting materials including standardized forms checklists and templates to ensure compliance and efficient quality management processes.

The Company shall include custom templates in the appendices of the Quality Assurance Manual.

The types of forms referenced or included in the appendices section are Incident Report Form Audit Checklist and Non-Conformance Report.

The date of the last revision for the forms and appendices in the Quality Assurance Manual is 2023-10-15 and the appendices and forms shall be reviewed by the quality team Annually.

Compliance Matrix: The following matrix summarizes alignment of this QMS with key requirements: 21 CFR 820.20 (Management Responsibility) - Section 32; 21 CFR 820.30 (Design Controls) - Section 33; 21 CFR 820.50 (Purchasing Controls) - Section 34; 21 CFR 820.70 (Production and Process Controls) - Section 35; 21 CFR 820.120 (Labeling and Packaging) - Section 36; 21 CFR 820.140-170 (Handling, Storage, Distribution) - Section 37; 21 CFR 820.180/184 (Records and DHR) - Section 38; 21 CFR 820.200 (Servicing) - Excluded per Section 6; ISO 13485 Clauses 5-8 mapped to respective sections; ISO 14971 integrated throughout.

ISO 13485 is An international standard that specifies requirements for a quality management system for medical devices helping organizations ensure consistent product quality while meeting regulatory and customer needs and belongs to the category of Standard.

21 CFR Part 820 is The FDA Quality System Regulation for medical devices.

CAPA is Corrective and Preventive Action.

MDR is Medical Device Reporting per 21 CFR Part 803.

UDI is Unique Device Identification.

ISO 14971 is The international standard for the application of risk management to medical devices.

Quality Control Procedures is listed in the alphabetical index with a Specific Page Number reference of 45.

Management Responsibility - 32.

Design and Development - 33.

Purchasing Controls - 34.

Production and Process Controls - 35.

Labeling and Packaging Controls - 36.

Handling, Storage, Distribution, and Installation - 37.

Records and Device History - 38.

Servicing - 39.

Risk Management - 18.

Regulatory Compliance - 27.

The Company and its authorized representative hereby approve and adopt this Quality Assurance Manual as of the effective date stated herein.

Approved by Jane Doe Quality Assurance Manager on behalf of MediTech Innovations Inc. on the date of 2023-12-15.

Signature _______________________________ Date _______________

This document is governed by American law.

Top management shall demonstrate leadership and commitment to the QMS in accordance with ISO 13485 Clause 5.1 and 21 CFR 820.20.

Top management shall establish the quality policy, ensure that quality objectives are established, and ensure that the QMS is resourced adequately.

Management reviews shall be conducted at least annually. Inputs shall include audit results, customer feedback, process performance, status of corrective actions, follow-up from previous reviews, changes that could affect the QMS, and recommendations for improvement. Outputs shall include decisions and actions related to QMS effectiveness, product improvement, and resource needs.

A management representative shall be appointed who has responsibility and authority to ensure that processes are established and maintained, to report on QMS performance to top management, and to ensure awareness of regulatory requirements.

Authority and responsibilities for all personnel shall be defined and communicated. Job descriptions shall document these responsibilities.

Design and development planning shall be established and maintained per 21 CFR 820.30 and ISO 13485 Clause 7.3. Plans shall identify design stages, responsibilities, resources, interfaces, and update mechanisms.

Design inputs shall be documented, reviewed for adequacy, and include functional, performance, safety, regulatory, and risk management requirements per ISO 14971.

Design outputs shall be documented in terms that allow verification against inputs, include acceptance criteria, and identify critical characteristics.

Design reviews shall be conducted at appropriate stages by participants representing all relevant functions. Records of reviews shall be maintained.

Design verification shall confirm that outputs meet input requirements. Verification plans, methods, and results shall be documented.

Design validation shall be performed under simulated or actual use conditions. Validation shall include risk management per ISO 14971 and shall be completed prior to release for use.

Design transfer shall ensure that design outputs are correctly translated into production specifications.

Design changes shall be identified, documented, reviewed, verified, validated as appropriate, and approved before implementation. Changes shall be evaluated for impact on risk management.

The Design History File (DHF) shall be maintained for each device type to demonstrate compliance with design controls.

Purchasing controls shall be established per 21 CFR 820.50 and ISO 13485 Clause 7.4 to ensure that purchased products and services conform to specified requirements.

Supplier evaluation and selection criteria shall include ability to meet quality, regulatory, and risk management requirements. Suppliers shall be evaluated and monitored based on performance, risk level, and criticality of supplied product.

Purchasing information shall describe or reference product specifications, approval requirements, and quality management system requirements. Flow-down of applicable regulatory and QMS requirements to suppliers shall be documented.

Verification of purchased products shall be performed according to risk and supplier performance. Incoming inspection, certificates of conformance, or other methods shall be used as appropriate.

Supplier disqualification criteria shall include repeated failure to meet requirements, regulatory non-compliance, or failure to respond to corrective actions. This section links to and augments Section 20 Supplier and Vendor Management.

Production and process controls shall be established per 21 CFR 820.70 and ISO 13485 Clause 7.5 to ensure that devices are manufactured under controlled conditions.

Processes shall be validated where the output cannot be fully verified by subsequent inspection and test. Validation shall demonstrate that the process consistently produces conforming product.

Criteria for workmanship shall be specified using documented standards, representative samples, or illustrations.

Special processes shall be identified and controlled. Monitoring and measurement of process parameters shall be performed and recorded.

Product shall be identified throughout production. Traceability shall be maintained to the extent required by applicable regulations and risk management.

Contamination control procedures shall be established to prevent product contamination.

Preservation of product shall include controls for handling, storage, packaging, and protection during processing and delivery.

If installation is applicable, procedures shall ensure that installation requirements are met and documented.

Labeling and packaging controls shall be established per 21 CFR 820.120 and ISO 13485 to ensure that labeling is accurate, legible, and properly applied.

Labeling operations shall be controlled to prevent mix-ups. Printed labeling shall be inspected for accuracy prior to release.

Label integrity, storage, and issuance shall be controlled. Obsolete labeling shall be destroyed.

Unique Device Identification (UDI) requirements shall be met where applicable. UDI shall be assigned, marked on devices and packaging, and submitted to the GUDID database in accordance with 21 CFR Part 830.

Procedures shall link with Nonconforming Product Control (Section 24) and Regulatory Compliance (Section 27) for any labeling-related issues or recalls.

Procedures for handling, storage, distribution, and installation shall be established per 21 CFR 820.140-170 and ISO 13485 Clause 7.5.

Handling procedures shall prevent damage, mix-ups, and contamination.

Storage areas shall be controlled to prevent damage, deterioration, or mix-ups. Environmental controls shall be applied as required by product specifications.

Distribution records shall be maintained to enable traceability and recall. Distribution shall ensure only released product is shipped.

If installation services are provided, procedures shall ensure proper installation and verification that the device meets specifications. Installation records shall be maintained.

Device History Record (DHR) maintenance shall ensure that each batch, lot, or unit is traceable and that all required manufacturing records are included per 21 CFR 820.184. This section cross-references Section 38 Records and Device History and integrates with Scope, Operation, and Improvement sections.

Record control procedures shall ensure that records are identifiable, protected, retrievable, and retained for at least 2 years from the date of release or for a period equal to the design and expected life of the device, whichever is longer, per 21 CFR 820.180.

Records shall be maintained in a manner that ensures confidentiality per HIPAA where applicable and prevents unauthorized access or alteration.

The Device History Record (DHR) shall include dates of manufacture, quantities manufactured and released, acceptance records, labeling, device identification, and any control numbers per 21 CFR 820.184.

The Device Master Record (DMR) shall contain all specifications, procedures, drawings, and other documents necessary to manufacture the device per 21 CFR 820.181.

The Design History File (DHF) shall be maintained per Section 33.

This section integrates with Documented Information Management (Section 17). All records shall be accessible for FDA inspection.

Servicing is excluded from the scope of this QMS per Section 6 as the Company does not provide post-market servicing of its medical devices. If servicing is later provided, procedures shall be established per 21 CFR 820.200 and ISO 13485 Clause 7.5.4.