Q&A

Compliance with 21 CFR

820 and ISO 13485
using MasterControl
What You Need to Know

1
What is 21 CFR 820 and
what is ISO 13485:2003
2
Who is covered by 21 CFR
820 and who is covered by
ISO 13485?
3
What’s the relationship
between 21 CFR 820 and
ISO 13485?
Compliance with 21 CFR 820 and ISO 13485 using MasterControl
Q&A
Title 21 of the Code of Federal Regulations (CFR) covers the broad area
of food and drugs, but Part 820 pertains to quality systems for medical
devices. It outlines Current Good Manufacturing Practice (CGMP)
regulations that govern the methods used in, and the facilities and controls
used for, the design, manufacture, packaging, labeling, storage, installation,
and servicing of all finished devices intended for human use. These
requirements are meant to ensure that medical devices are safe, effective,
and in compliance with the Federal Food, Drug, and Cosmetic Act.
ISO 13485:2003 is an international standard that specifies requirements
for regulatory purposes for medical device manufacturers. It provides
a framework for companies to meet their customer and regulatory
requirements. The main goal is to provide a harmonized model for quality
management system requirements in the international market since
different countries might have different standards. ISO (derived from the
Greek word isos, meaning equal) refers to the International Organization
for Standardization, a non-governmental organization based in Geneva.
21 CFR 820 is applicable to manufacturers of finished medical
devices sold in the United States, including foreign manufacturers who
import devices. Some manufacturers might be subject only to certain
requirements, depending on the operations they are engaged in.
Medical device manufacturers that sell their products in the global market
find it advantageous to get ISO 13485 certification because ISO standards
are recognized worldwide. Certain countries require such certification.
Many customers also prefer medical devices that are ISO certified.
Although the two are similar, they have significant differences. For
example, complaint handling and reporting requirements are integral
to the FDA’s quality systems regulation (QSR), but the FDA thinks they
are not adequately addressed in ISO 13485. In this case, conformity to
the ISO standard would not suffice to demonstrate conformity with the
QSR and the FDA’s Center for Devices and Radiological Health will not
recognize the standard for this particular purpose.
1
 Q&A

4
Who enforces 21 CFR 820 The Food and Drug Administration enforces 21 CFR 820.
and ISO 13485? Third parties usually conduct assessment of a manufacturer’s
system and processes to make sure they are in accordance with the
requirements of ISO 13485.

5
What’s the connection Developed more than a decade ago, the MasterControl quality
management software solution was the first software specifically
between 21 CFR designed to help companies comply with FDA regulations and adhere to
820, ISO 13485, and ISO standards. Hundreds of companies worldwide rely on MasterControl
MasterControl? to help them automate, document, control, track, interconnect, and
manage their quality processes.

MasterControl v4.0 offers a holistic software solution to medical device

manufacturers’ needs pertaining to compliance with 21 CFR 820 and
ISO 13485. It’s a configurable, off-the-shelf software that’s easy to use,
install, implement, and validate. The different MasterControl modules —
MasterControl Documents, MasterControl Forms, MasterControl CAPA,
MasterControl Training, MasterControl Submissions, MasterControl
Collaboration, and MasterControl PDF Publishing — can be used as
stand-alone applications or as an integrated system under a single
Internet-based portal.

MasterControl offers comprehensive services that include hands-

on software training, installation assistance, validation services, and
continuing customer and technical support. The MasterControl solution
helps medical device manufacturers’ quality processes stay compliant,
connected, and complete.

6
What are some of The following are highlights of 21 CFR 820 and ISO 13485 and the relevant
MasterControl modules and features that are crucial in compliance.
MasterControl’s features
and how can they
help medical device
manufacturers comply
with 21 CFR 820 and
ISO 13485?

Compliance with 21 CFR 820 and ISO 13485 using MasterControl 2

 Q&A

21 CFR 820 ISO 13485 MasterControl™

(Subpart B) (Clause 4) MasterControl Quality Management

software solution was developed
Quality system refers to a medical Quality management system specifically to help companies comply
device manufacturer’s responsibilities, requirements were developed to satisfy with 21 CFR parts 11, 210, 211,
procedures, processes, and resources for international medical device regulations.
820, 821, and quality standards like
implementing quality management.
ISO, QS/TS.

(Subparts C, D, E, G) (Clause 4) MasterControl Documents, the building

Require controls in design, document,
purchase, and production process. This
entails establishment of processes to
ensure that a medical device conforms
to specifications. Requirements stress
maintenance of records of document
changes, documentation of instructions
of production processes and SOPs, and
monitoring of process parameters.
Requires establishment of a quality
management system for medical
devices. A manufacturer must
have quality procedures that are
documented, controlled, and effectively
implemented and maintained.
block within the MASTERControl Quality
Suite, automates, controls, and manages
quality processes to improve efficiency
and compliance. It can handle all
types of documents, regardless of the
software used to create them. It offers
advanced routing, approval, escalation,
and revision control.

(Subpart B, Sec. 820.25) (Clause 6) MasterControl Training controls

Each manufacturer must have
sufficient personnel with the necessary
background, training, and experience. It
must have established procedures for
identifying training needs and ensuring
that employees are adequately trained
to perform their jobs. Training should
be documented.
A manufacturer must ensure that its
personnel have the right experience,
education, training, and skills.
Acceptable levels of competence must
be defined. Training needs must be
established and assessed. A record of
competence must be maintained.
role-based training requirements and
employee competencies. It allows
creation and deployment of training
courses, requiring users to learn
their duties and also demonstrate
proficiency. It can be integrated
with MasterControl Documents to
automatically task trainees when
required SOPs or other documents
change and a new training becomes
necessary. This software automatically
performs gap analysis for all training
tasks, all the time.

Compliance with 21 CFR 820 and ISO 13485 using MasterControl 3


(Subparts I, J)
Require establishment and maintenance
of nonconformance and corrective and
preventive action (CAPA) procedures.
Nonconformances relating to product,
processes, and quality system should
be investigated. Actions needed to
correct and prevent recurrence must be
identified. Corrective action has to be
validated to ensure effectiveness. All
activities pertaining to nonconformance
and CAPA must be documented.
(Subpart F)
Requires procedures for
identifying products.
(Subpart G, Sec. 820.70)
When computers or automated data
processing systems are used as part
of production or the quality system,
the manufacturer should validate
computer software for its intended use
according to an established protocol.
Validation activities and results should
be documented.
Compliance with 21 CFR 820 and ISO 13485 using MasterControl
(Clause 8)
Remedial processes are required.
Quality should be monitored and
measured by gathering customer
feedback, setting up internal audits,
establishing a nonconformance
procedure, and analyzing quality
information. Nonconformances must
be corrected, recorded, and prevented.
(Clause 7)
Requires development of procedures
to identify and track products.
(Clause 7)
Requires validation of monitoring
and measuring software before use.
Revalidation should be conducted
when necessary.
Q&A
MasterControl CAPA automates
corrective/preventive action processes
based on input of complaints/
incidents, audits/investigations, out of
specifications, deviations,
nonconformances, and safety and
defects issues. It collects data from
multiple sources, manages trends,
and automatically triggers subsystem
processes to solve production issues
before or after they arise. This module
offers a pre-packaged, best practice set
of electronic forms, workflow routes,
and business analytics.
MasterControl Forms, a closely related
module, offers the capability to create
electronic forms that look identical
to existing forms or create new ones
altogether. This module integrates
workflow processes, data entry, and
form/data approval. It also offers
business analytics. As users complete
input along the workflow, the form is
automatically routed to the next user.
MasterControl’s InfoCard feature
makes searching and identification
easy. A search can be made using
the metadata associated with the
InfoCard like document type, vault,
or author, or any unique field created
by the customer. MASTERControl’s
Organizer tool is similar to “Windows
Explorer,” allowing even users with
minimal computer skills to quickly
find and access documents. The same
documents can be housed in multiple
Organizers across the company.
MasterControl validation services
are comprehensive. The Validation
Toolkit offers detailed, prewritten
installation qualification (IQ) and
operational qualification (OQ)
validation test protocols and scripts,
so a company can complete necessary
validation requirements on its own. A
MASTERControl Professional
Services consultant can also come
onsite to complete IQ/OQ validation
protocols and resolve any testing
deviations promptly.
4
 Q&A

About MasterControl
MasterControl Inc. creates software solutions that enable life science and other
regulated companies to deliver life-improving products to more people sooner.
MasterControl’s integrated solutions accelerate ROI and increase efficiencies by
automating and securely managing critical business processes throughout the
entire product lifecycle. More than 1,000 companies worldwide, ranging in size
from five employees to tens of thousands, rely on MasterControl cloud solutions
to automate processes for new product development, clinical, regulatory, quality
management, supplier management, manufacturing and postmarket surveillance.
MasterControl solutions are well-known for being scalable, easy to implement, easy
to validate and easy to use. For more information, visit www.mastercontrol.com.

Contact information and addresses

for other regional MasterControl
offices and MasterControl
partner offices are listed on
the MasterControl website at
www.mastercontrol.com.

© 2019 MasterControl Inc. All rights reserved.

QAXX2017.2USENLT-03/19