One of the toughest decisions for early-stage medtech companies revolves around how to build out their Quality Management System (QMS). These teams are often operating under funding pressure and tight timelines, and they often don’t have a lot of experience with regulations and standards like 21 CFR Part 820 or ISO 13485:2016.
Some companies will end up underestimating what they need for a QMS in the early stages of design and development, only realizing later on that they need to go back and try to retroactively document their work.
However, a lot of companies run into the opposite problem. They overestimate their QMS should include as they’re working toward submission. They think they need everything in place right away, and they spend precious time and energy building out processes they won’t need to use for months or even years.
What all of these companies should be shooting for is the "Goldilocks" zone. The ideal QMS should be just right: enough to ensure that you have the processes and documentation you need at every stage, but without the added bloat of unnecessary pieces.
So, what does that look like? What is the “just enough” QMS for an early-stage company? And how do you know when to add your next pieces?
What do early-stage medtech companies need in their QMS?
You don’t need your entire QMS build out when you start design and development, but you do need some foundational elements in place. Without documenting (and following) these processes in the early stages, you set yourself up for enormous amounts of rework that will almost certainly delay your submission.
The “just enough” QMS starts with these four must-haves as the basis for your QMS:
-
Design controls
-
Risk management
-
Supplier management
-
Document & records management
Design controls
“When should we start design controls?” That’s one of the most common questions I hear from early-stage medtech companies.
The safest answer? As early as possible. That’s because without a formalized process for documenting what’s happening during design, you may not capture everything your engineers are doing. Engineers are notorious for disliking documentation, and if their work isn’t captured immediately, it will be difficult to retroactively document.
However, I know that in the real world, not every team has design controls in place before the engineers start tinkering. If that’s your situation, that’s okay, but you definitely need to have your formalized process for design controls documented before you begin verification and validation. Remember, the first step in design controls is documenting user needs. User needs are the basis of your design inputs, and your design inputs are the basis of your design outputs.
.png)
You can’t verify that your design outputs meet your inputs, or validate your device against its user needs, if you haven’t already documented those items.
Risk management
Risk management is one of the early-stage must-haves because it needs to happen alongside design controls. Risk management should be interwoven with your design controls in order to inform your design inputs and ensure your device is as safe as possible.
The initial design inputs you choose to meet your user needs might actually create a risk to the user. Your risk management process is meant to uncover those risks so that you can iterate on your design inputs to eliminate or mitigate the risk.
Supplier management
The point of a supplier quality management plan is to ensure that a supplier will provide you with products or services that meet your specifications and that you know if and when they fail to do so. This is a great opportunity to point out that the regulations, which may seem overbearing at first, are really there to ensure you’re making the best possible product. A device is only as good as its parts.
Supplier management needs to be in place early so that your verification and validation are accurate tests of your product. The only way to ensure that accuracy is by using parts or components that you know meet your specifications.
Document control & records management
Document control really begins as soon as you begin documenting the three previous processes. For example, for design controls you’ll need a standard operating procedure (SOP) that lays out how you document design controls. You’ll also need a design and development plan with roles and responsibilities. Creating those documents is part of your document control and records management.
Think of it like this: During design controls, you’re documenting your design. And with supplier management, you’re documenting your relationship with your supplier. The same goes for risk management; you’re documenting risks and the controls you put in place to mitigate them. In each of those situations, you’re carrying out documents and records procedures.
How should you scale your QMS as your company matures?
Your QMS should grow naturally as your business progresses to different stages. We went over what’s required in the early stages of design and development, but eventually every company wants to see their product on the market. That means you’ll eventually need post-market QMS processes in place, like CAPA, nonconformance management, and complaint management.
It’s okay not to have those built out right now, but you should have a plan in place that addresses them. For instance, your quality manual can state that your current approach only includes the four processes we just covered but you plan on adding more later on. You might call that “Phase Two” and have it include CAPA, nonconformance, and supplier corrective action request (SCAR).
This isn’t to say that you wait until these things are problems to implement a solution. But if you’re still in design and development, your Complaints SOP can wait until you can expect some complaints. Save it for an appropriate phase, when you’re closer to actually putting a product on the market. Right now, you need enough to ensure you’re meeting the applicable regulatory requirements without going overboard.
During the recent Virtual Summit on the Future of Medtech, Kyle Rose, Founder and CEO of Rook Quality Systems, told the audience that part of the reason he started Rook was because he saw consultants sending “big company” quality systems to small companies. That was inefficient for the small companies, but sometimes the same heavy QMS was slowing down innovation at large medtech companies.
“Bigger companies have actually brought us in because they realized, ‘If we want to create new products and develop new things, we need to have another eQMS like Ultralight that can help us move efficiently like a startup.’”
That’s the power of a fast, flexible, “just enough” QMS. It ensures you have exactly what you need and nothing that will slow you down without adding value.
Ultralight is the the lightweight, scalable eQMS you’ve been waiting for
The “just enough” QMS is great in theory, but without the right QMS solution, your team may still end up drowning in manual documentation while missing or outdated records leave you vulnerable to audit findings.
Ultralight by Greenlight Guru is purpose-built to be a lightweight, flexible eQMS that keeps small, Product-led teams compliant from the start. Ultralight combines easy implementation with powerful medtech-specific modules like design controls, risk management, supplier management and more. And because it integrates with the tools engineers love, like GitHub and Jira, you won’t have to worry about work happening outside the system that isn’t documented. With Ultralight, you’ll have exactly what you need right now in a system that’s built to grow with you for the long-term.
If you’re ready to stop compromising on your QMS solution, then get your free demo of Ultralight today!
Your QMSR Readiness Playbook
.png?width=575&name=Quality%20Lead%20Magnet%20Slide-in%20(3).png)
.png?width=250&height=321&name=Quality%20Lead%20Magnet%20Slide-in%20(3).png)
