Understanding the New Requirements for QMS Software Validation in ISO 13485:2016

March 19, 2018


As I am sure many of you know, the ISO 13485 standard was updated in 2016, which means the time to transition your Quality Management System is now!

Most auditing organizations have either cut off ISO 13485:2003 recertifications or are doing so very soon. So, if you have not started the process of transitioning your Quality Management System to comply with the new 2016 updated standard, it is time to get moving.

I was recently at a client’s location helping them through their 2016 transition audit when an auditor from one of the largest notified bodies mentioned that less than 3% of their US clients are ready to transition to ISO 13485:2016…only three percent!!

As a leader in the quality consulting arena, we wanted to share some of our tips and best practices to make sure you're ready to ace your transition audit.

This blog post discusses the inclusion of new requirements for quality system software validation in ISO 13485:2016.

Section 4.1.6 outlines the process for validating computer software used in the quality system as follows:

4.1.6 The organization shall document procedures for the validation of the application of computer software used in the quality management system. Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application.

The specific approach and activities associated with software validation and revalidation shall be proportionate to the risk associated with the use of the software. Records of such activities shall be maintained.

As you read through this section of ISO 13485:2016, there are a few details to focus your attention on. Adjustments will need to be made to your quality system, both as procedures and as records, in order to show your company's compliance with the new revision.

The first detail to focus on is the creation of a ­quality procedure, or SOP, for the evaluation and validation of software used in the quality system. The procedure should reference ISO 13485:2016 and outline a risk-based approach to evaluating current, updated, and new software that will be used in the quality system. This procedure will help guide your company to properly evaluating all QMS software throughout its lifecycle.

Next, you should create a team to evaluate which pieces of software are being used in the quality system and evaluate the risk of each of those applicable pieces of software. This assessment can include Excel spreadsheets, databases, Solidworks/CAD files for design activities, issue tracking software, complaint management software or CRM systems, PLM systems, ERP systems, and/or distribution software programs. The evaluation process should be documented, and the results should be tied to actions.

Often, when we work with our clients through this process, we utilize a Gap Analysis model and prioritize the highest-risk items first. If you decide to use a Gap Analysis during software evaluation, we recommend starting with a requirement review, which includes a user, system, and software level analysis.

Requirement management serves as the foundation for software development and use within the quality system. Without full traceability of the software, it would be difficult to achieve compliance of managing risk and efficacy throughout its lifecycle. This traceability starts from the software requirements and follows through to risk analysis and verification and/or validation activities. We help our clients to determine the appropriate classification for their software and the least-burdensome verification and validation strategy, all based on risk.

The next step in your software lifecycle assessment is a review of the software system architecture and software design rationale. When potential hazards are not properly identified, no control measures can be implemented to address and mitigate the potential risks. The addition of certain tools into your quality system regarding software can help better identify commonly overlooked hazards.

In our experience, the most common reasons for overlooked hazards are:

  • The risk management process, specifically for software systems, needs to be improved. Risks caused by off-the-shelf software (OTS) or software of unknown provenance (SOUP) are often not identified properly. This could be due to improper definitions of these types of software or not classifying software into different categories.
  • A standardized process to identify, evaluate, and validate each category and classification of software is not established. Creating such a process will provide a consistent procedure to aid your company through establishing and assessing proper software controls.

Once you have completed your architecture and design review, software verification and validation activities will need to be performed to assess whether your software system is in a state of control.

Based on our experience, clients will sometimes proceed with software verification / validation activities without completing the necessary pre-requisites (i.e. requirement management and risk analysis). We highly recommend that our clients have a clear understanding of how to achieve compliance throughout the complete software lifecycle, so that verification and validation activities take place once the software has been configured to its usable form.

Achieving compliance will also include software maintenance and configuration management strategies from the beginning of the software lifecycle until its end. Last year, 79% of all software related FDA recalls were caused by software defects that were introduced to the system during changes made to the software after its initial production and distribution. Maintaining a state of control of your software and assessing all software changes after verification/validation is critical to compliance.

Properly assessing your company's QMS software can be difficult to do. Luckily, the Greenlight Guru electronic quality management system (eQMS) provides users with an easy-to-use application and a validation package that helps support their customers through this process.

As I previously mentioned, I was recently helping a client through their transition audit. This client had recently moved their quality system to the Greenlight Guru eQMS platform. Clients of Greenlight Guru are provided with a full validation package (IQ/OQ/PQ) to help them properly validate their system and show compliance to the new standard. So, while only 3% of US based companies are ready for their new ISO 13485:2016 audit, our client was able to breeze through their audit with the support of the Greenlight Guru eQMS platform.

If you are interested in learning more about how Rook Quality Systems can help you achieve compliance to the updated standard, please contact us. We are estimating that about 3-6 months of consulting work is required in order to get our new companies audit-ready. Our team includes Medical Device software consultants, former ISO 13485:2016/MDSAP auditors, and quality experts, all available to help get your quality system up to speed.

Looking for an all-in-one QMS solution to advance the success of your in-market devices and integrates your quality processes with product development efforts? Click here to take a quick tour of Greenlight Guru's Medical Device QMS software →


Medical Device expert specializing in development of efficient Quality Systems for small and startup medical device companies. As President of Rook Quality Systems, Mr. Rose works as a the contract Quality Manager for multiple medical device companies overseeing overall quality strategy and ensuring compliance through...

Free eBook PDF of our guide to ISO 13485:2016
Download Now
UG ISO 13485
Search Results for:
    Load More Results