Checklist for the assessment based on the standards

ISO & MDD & Checklist for the assessment based on the standards ISO :2016 ISO :2016 associate with EC Directive 93/42 EEC Where applicable EC Directive 93/42/EEC Annex II/V/VI Company: Audit date Auditor: Signature Name Audit date Audit date Auditor: Name Auditor: Name Signature Signature 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 1 / 51

ISO & MDD & Explanations for the application of the DQS assessment check list Applicable standards and marking This assessment checklist is based on the requirements of the standards DIN EN ISO :2016, DIN EN ISO :2008, MDD 93/42/EEC, Annex II/V/VI and the German Medical Device Law (MPG). The following references are used to address the requirements of the standards: Requirement of the DIN EN ISO :2016 Requirement of the DIN EN ISO :2008 Special additional questions with regards to implants are marked with Impl. and special additional questions relevant for sterile products are marked with sterile. MDD/MPG: Questions related to the requirements of the MDD 93/42/EEC (MPG, Germany, resp.). The numbering of the QM-Elements of DIN EN ISO :2016 is used for the chapters. Use of the Assessment Checklist The questions of this checklist are addressed to the auditor, who evaluates and documents the fulfillment of the requirements. The auditor should formulate the questions asked to the company s representative/s in a different way, please remember your audit training. The Checklist must be used for the documentation of the assessment. The checklist will also be used for 5 years (Certification period for MDD). Therefore 5 columns for the assessment results are given, one for each year. Certification period for and is 3 years. In the 1 st year audit every requirements of the standards must be assessed (if applicable). In the 2 nd to the 5 th year the audit will be performed on a statistical basis, but in summery within these 4 years all requirements must be assessed. The requirements regarding Management responsibility, Internal Audits, Human resources and Corrective & preventive actions must be audited every year. The results of the assessment regarding the documentation and the realization of the QM-System has to be documented as follows: 1 = fulfilled 2 = partially fulfilled, acceptable 3 = partially fulfilled, not acceptable 4 = not fulfilled n.a. = not applicable 0 = not audited Audit protocol The results of the audit and the objectives/findings must be documented on the protocol Findings. In the row Reference the objectives must be referenced to the nomenclature of the questions. Please use the numbers given in the checklist with 2 digits only (e.g. 4.2 for Documentation requirements of the ISO ). Additional pages, e.g. from the company s documents should be added to the protocol and numbered as pages. 4. Important Notes / Exemptions Because the regulatory requirements of the MDD 93/42 and the German Medical Device Law permit exclusions of design and development controls (see 7.3), this can be used as a justification for their exclusion from the quality management system. If any requirement(s) in Clause 7 of this International Standard is(are) not applicable due to the nature of themedical device(s) for which the quality management system is applied, the organization does not need to include such a requirement(s) in its quality management system, but a rational has to be provided [see 4.2 a)]. 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 2 / 51

ISO & MDD & The processes required by this International Standard, which are applicable to the medical device(s), but which are not performed by the organization, are the responsibility of the organization and are accounted for in the organization s quality management system [see 4.1 a)]. These regulations can provide alternative arrangements that are to be addressed in the quality management system. 0 General 0.1 1 General questions for the certification 0.1 Is the guideline Regulation for the use of the DQS certificate symbols, the IQ-Net symbol, the DQS documents and the DQS-symbol applied correctly? 0.2 Are the improvement potentials to the QM-System, mentioned in the last audit report used? 0.2 2 Additional requirements of the 93/42/EEC to establish the procedure MDD/MPG 0.1 Does the company keep the correspondence with DQS? MDD/MPG 0.2 Was the company completely informed about the previous and present (today s) activities of the auditortor(s)? Is the declaration Auditors /Experts Independence and Objectivity countersigned? MDD/MPG 0.3 Are the company and the products registered to the legal authorities? MDD/MPG 0.4 Is there a procedure in place to inform DQS about essential changes of the Medical Devices covered by the Quality Management System? (Advice company about the application forms 360.11 (Certification application) & 360.12 (Product application) and hand it out). 4 Quality management system 4.1 General requirements MDD/MPG 4.1 Is the MDD 93/42/EEC Annex II/V/VI (and if necessary the MPG/the MPV for Germany) referenced correctly? MDD/MPG 4.2 Is, if necessary, an authorized representative designated within the EEC? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 3 / 51

ISO & MDD & 4.3 Does the organization ensure the control of any outsourced processes, that affects product conformity with requirements and is the control of such outsourced processes identifiable within the QM system? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 4 / 51

ISO & MDD & :2016 4.1 Does the organization document a quality management system and maintain its effectiveness in accordance with the requirements of this International Standard and applicable regulatory requirements? :2016 Does the organization establish, implement and maintain any requirement, procedure, activity or arrangement required to be documented by this International Standard or applicable regulatory requirements? :2016 Does the organization document the role(s) undertaken by the organization under the applicable regulatory requirements? :2016 4.2 Does the organization :2016 a) determine the processes needed for the quality management system and the application of these processes throughout the organization taking into account the roles undertaken by the organization? :2016 b) apply a risk based approach to the control of the appropriate processes needed for the quality management system? :2016 c) determine the sequence and interaction of these processes? :2016 4.3 Does the organization for each quality management system process? :2016 a) determine criteria and methods needed to ensure that both the operation and control of these processes are effective :2016 b) ensure the availability of resources and information necessary to support the operation and monitoring of these processes :2016 c) implement actions necessary to achieve planned results and maintain the effectiveness of these processes :2016 d) monitor, measure as appropriate, and analyse these processes :2016 c) establish and maintain records needed to demonstrate conformance to this International Standard and compliance with applicable regulatory requirements :2016 4.4 The organization shall manage these quality management system processes in accordance with the requirements of this International Standard and applicable regulatory requirements. Are the following changes to these processes made: 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 5 / 51

ISO & MDD & :2016 4.4.1 a) evaluated for their impact on the quality management system? :2016 b) evaluated for their impact on the medical devices produced under this quality management system? :2016 c) controlled in accordance with the requirements of this International Standard and applicable regulatory requirements? :2016 4.5 Does the organization monitor and ensure control to any outsourced processes that affects product conformity to requirements? :2016 Does the organization retain responsibility of conformity to this International Standard and to customer and applicable regulatory requirements for outsourced processes? :2016 Are the controls proportionate to the risk involved and the ability of the external party to meet the requirements in accordance with 7.4? :2016 Do the controls include written quality agreements? :2016 4.6 Does the organization document procedures for the validation of the application of computer software used in the quality management system? :2016 Are such software applications validated prior to initial use and, as appropriate, after changes to such software or its application? :2016 Are the specific approach and activities associated with software validation and revalidation proportionate to the risk associated with the use of the software? :2016 Are records of such activities maintained (see 4.5)? 4.2 Documentation requirements 4.1 General Does the quality manual include - a quality manual? - documented procedures as required by the standard? - all other by national or regional regulations required documents and records? - documented statements of a quality policy and quality objectives? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 6 / 51

ISO & MDD & :2016 4.1 :2016 - documents needed by the organization to ensure the effective planning, operation and control of its processes? - records as required by the standard? General Does the quality management system documentation (see 4.4) include: :2016 :2016 :2016 :2016 :2016 a) documented statements of a quality policy and quality objectives? b) a quality manual? c) documented procedures and records required by this International Standard? d) documents, including records, determined by the organization to be necessary to ensure the effective planning, operation, and control of its processes? e) other documentation specified by applicable regulatory requirements? 4.3 Product documentation Are files available, containing all products specifications and quality assurance specifications, or is the location of those documents described exactly? ( NB-MED 5.1-5) (see also Annex II / V/ VI 93/42/EWG and if necessary DQS-Support checklists) Is this information available and comprehensible for each type or each model of the medical device? (if necessary also the information for installation / maintenance) MDD/MPG Are correct declarations of conformity issued? ( EK-MED 9 A4) MDD/MPG Are the classifications of the Medical Devices traceable to the MDD? MDD/MPG Are designated harmonized standards, which are applicable to the product / procedures defined and available (Is the adherence systematically ensured)? If no harmonized standards are available, is there proof, which ensures the safety and suitability of the products? MDD/MPG Is it defined and documented for each product how the applicable Essential Requirements (Annex I) are fulfilled and are there proofs to validate the statements made? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 7 / 51

ISO & MDD & MDD/MPG Are there, for all products/product groups, complete risk analyses defined and documented? (copy the risk analysis to the documents for the DQS as example; if necessary apply 370.13 Checklist Risk Management) MDD/MPG Are all the possible safety risks comprehensibly determined? Are the initial risks evaluated? Is the evaluation of the risks comprehensible? MDD/MPG Do designated suppliers with activities having a substantial influence on the quality identified exist? (EK-MED 9 B17) (see 360.5 BasicData-Organization) MDD/MPG MDD/MPG MDD/MPG MDD/MPG MDD/MPG MDD/MPG MDD/MPG MDD/MPG Are they listed including their activities and are appropriate certificates of the subcontractors/ suppliers available? If no appropriate certificates for subcontractors/suppliers are available, are they appropriately assessed to fulfill the requirements of the suppliers / subcontractors? Are contractual declarations/agreements signed with subcontractors/suppliers with defined activities and responsibilities, if they have a substantial influence on the quality? Does the contract with e.g. OEM suppliers contain sufficient descriptions and regulations on notification of the legal authorities and to ensure appropriate information in case of vigilance? ( EK-MED 9 B16) Is there a procedure to evaluate the actuality of the subcontractor s/supplier s proofs (certificates of analysis, etc.)? Has the company established that the purpose is fulfilled? (in accordance with MDD Annex X) Are there corresponding pre-clinical product reviews for the products? Is there a evaluation of the essential requirements of the Machinery Directive, if this is applicable to the product? (NB-MED 2 Rec. 5) MDD/MPG If the destination of the products falls below the standards for personal protective equipment, is a notified body involved for this? 4.2 Quality manual Does the quality manual include... 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 8 / 51

ISO & MDD & - the scope of the QM system, including details of and justifications for any exclusions and / or non-application? - the documented procedures established for the QM system, or reference to them? - a description of the interaction between the processes of the QM system? - an overview of the structure of the used documentation? :2016 Does the organization document a quality manual that includes: :2016 :2016 :2016 :2016 a) the scope of the quality management system, including details of and justification for any exclusion or non-application? b) the documented procedures for the quality management system, or reference to them? c) a description of the interaction between the processes of the quality management system? Does the quality manual shall outline the structure of the documentation used in the quality management system? 4.3 Control of documents Is there a procedure in place for control of documents (including external documents) 4.3 Medical device file :2016 Does the organization establish and maintain for each medical device type or medical device family, one or more files either containing or referencing documents generated to demonstrate conformity to the requirement of this International Standard and compliance with applicable regulatory requirements? :2016 Does the content of the file(s) include (but is not limited to): :2016 a) general description of the medical device, intended use/purpose, and labelling, including any instructions for use? :2016 b) specifications for product? :2016 c) specifications or procedures for manufacturing, packaging, storage, handling and distribution? :2016 d) procedures for measuring and monitoring? :2016 e) as appropriate, requirements for installation? :2016 f) as appropriate, procedures for servicing? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 9 / 51

ISO & MDD & Has a documented procedure been established to define the controls needed to... - approve documents for adequacy prior to issue? Review and update documents as necessary and re-approve documents? - ensure that changes and the current revision status of documents are identified? - ensure that relevant versions of documents are available at point of use and that documents remain legible / readily identifiable? - ensure that documents of external origin are identified and that their distribution is controlled? - prevent the unintended use of obsolete documents (to apply suitable identification to them, if they are retained for any purpose)? Does the organization ensure that changes to documents are reviewed and approved either by the original approving function or another designated function which has access to pertinent background information upon which to base its decisions? Is a retention period set for the keeping of at least one copy of outdated documents, especially if these documents contain specifications of how the medical devices were manufactured? Are manufacturing and test documents for the life time of the medical device accessible? Is the useful life time of the product appropriately determined? Does period ensure that documents to which medical devices have been manufactured and tested are available for at least the lifetime of the medical device as defined by the organization, but not less than the retention period of any resulting record (see 4.4), or as specified by relevant regulatory requirements? 4.4 Control of records Has a documented procedure been established to define the controls of records (Identification, storage, protection, retrieval, legibility, retention periods and disposal of records)? Are records established and maintained to provide evidence of conformity to requirements and of the effective operation of the QM system? Are the quality records maintained for the life time of the products (at least 2 years after product release / date of shipment) or according to the storage requirements of the relevant rules (MPG min. 5 years, for implants min. 15 years) 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 10 / 51

ISO & MDD & 4.4 Control of documents :2016 Are documents controlled required by the quality management system? :2016 Records are a special type of document. Are they controlled according to the requirements given in 4.5? :2016 Does a documented procedure define the controls needed to: :2016 a) review and approve documents for adequacy prior to issue? :2016 b) review, update as necessary and re-approve documents? :2016 c) ensure that the current revision status of and changes to documents are identified? :2016 d) ensure that relevant versions of applicable documents are available at points of use? :2016 e) ensure that documents remain legible and readily identifiable? :2016 f) ensure that documents of external origin, determined by the organization to be necessary for the planning and operation of the quality management system, are identified and their distribution controlled? :2016 g) prevent deterioration or loss of documents? :2016 h) prevent the unintended use of obsolete documents and apply suitable identification to them? 5 Management responsibility 5.1 Management commitment :2016 Does top management provide evidence of its commitment to the development and implementation of the quality management system and maintenance of its effectiveness by: :2016 a) communicating to the organization the importance of meeting customer as well as applicable regulatory requirements? :2016 b) establishing the quality policy? :2016 c) ensuring that quality objectives are established? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 11 / 51

ISO & MDD & :2016 d) conducting management reviews? :2016 e) ensuring the availability of resources? Communicating to the organization the importance of meeting customer, as well as statutory and regulatory requirements? Does top management provide evidence of its commitment to the continues improvement of the quality system? Is the availability of necessary resources ensured? 5.2 Customer focus Does top management ensure that customer requirements are determined and are met with the aim of enhancing customer satisfaction gets attended? :2016 Does top management ensure that customer requirements and applicable regulatory requirements are determined and met? 5.3 Quality policy Is the quality policy appropriate to the purpose of the organization and does it provide a framework for establishing and reviewing quality objectives? Does the quality policy include a commitment to comply with requirements and continually improve the effectiveness of the QM system? Is the quality policy communicated and understood within the organization? Is the quality policy reviewed for continuing suitability? :2016 Does top management ensure that the quality policy: :2016 a) is applicable to the purpose of the organization? :2016 b) includes a commitment to comply with requirements and to maintain the effectiveness of the quality management system? :2016 c) provides a framework for establishing and reviewing quality objectives? :2016 d) is communicated and understood within the organization? :2016 e) is reviewed for continuing suitability? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 12 / 51

ISO & MDD & 5.4 Planing 5.4.1 Quality objectives Are quality objectives (preferably measurable) established at relevant functions and levels within the organization? Are the quality objectives measurable and consistent with the quality policy? Are there objectives needed to meet the requirements for products? :2016 Does top management shall ensure that quality objectives, including those needed to meet applicable regulatory requirements and requirements for product, are established at relevant functions and levels within the organization? :2016 Does the quality objectives shall be measurable and consistent with the quality policy? 5.4.2 Quality management system planning Does top management ensure that the planning of the QM system is carried out in order to meet the requirements given in 4.1, as well as the quality objectives? Is it ensured that the integrity of the quality management system is maintained when changes to the quality management system are planned and implemented? :2016 Does top management ensure that: :2016 a) the planning of the quality management system is carried out in order to meet the requirements given in 4.1, as well as the quality objectives? :2016 b) the integrity of the quality management system is maintained when changes to the quality management system are planned and implemented? 5.5 Responsibility, authority and communication 5.5.1 Responsibility and authority :2016 Does the top management ensure that the responsibilities and authorities are defined, communicated and documented within the organization? Does the top management establish the interrelation of all personnel who manage, perform and verify work affecting quality? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 13 / 51

ISO & MDD & Is the necessary independence and authority to perform these tasks ensured and is particular attention paid to the nomination of specific persons responsible for activities related to product monitoring from the postproduction stage and reporting adverse events? :2016 Does top management shall document the interrelation of all personnel who manage, perform and verify work affecting quality and shall ensure the independence and authority necessary to perform these tasks? :2016 :2016 :2016 :2016 MDD/MPG MDD/MPG 5.5.2 Management representative Has the top management appointed a member of the organization's management, who irrespective of other responsibilities, has responsibility and authority that includes... - ensuring that processes needed for the QM system are established, implemented and maintained? - reporting to top management on the performance of the QM system and any need for improvement? - ensuring the promotion of awareness of customer requirements throughout the organization? a) ensuring that processes needed for the quality management system are documented? b) reporting to top management on the effectiveness of the quality management system and any need for improvement? c) ensuring the promotion of awareness of applicable regulatory requirements and quality management system requirements throughout the organization? Who is appointed (and trained) as Medical Device Safety Representative? Is the expertise provided sufficiently? ( 30 MPG; Statement in the report) Are the Medical Device Safety Representative s responsibilities and competencies defined and documented and was the Medical Device Safety Representative notified to the legal authorities? 5.5.3 Internal communication Does top management ensure that appropriate communication processes are established within the organization and that communication takes place regarding the effectiveness of the QM system? :2016 Does top management shall ensure that appropriate communication processes are established within the organization and that communication takes place regarding the effe tiveness of the quality management system? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 14 / 51

ISO & MDD & 5.6 Management review 5.6.1 General Does top management review the organization s QM system at planned intervals, to ensure its continuing suitability, adequacy and effectiveness? Does this review include assessing opportunities for improvement and the need for changes of the QM system, including the quality policy and quality objectives? Are records from management reviews maintained? :2016 Does the organization document procedures for management review. Top management shall review the organization s quality management system at documented planned intervals to ensure its continuing suitability, adequacy and effectiveness? :2016 Does the review include assessing opportunities for improvement and the need for changes to the quality management system, including the quality policy and quality objectives? :2016 Are records from management reviews maintained (see 4.5)? 5.6.2 Review input Does the input to management review include information on... - results of audits? - customer feedback? - process performance and product conformity? - status of preventive and corrective actions? - follow-up actions from previous management reviews? - changes that could affect the QM system? - recommendations for improvement? - new or revised regulatory requirements? :2016 :2016 :2016 :2016 Does the input to management review shall include, but is not limited to, information arising from: a) feedback? b) complaint handling? c) reporting to regulatory authorities? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 15 / 51

ISO & MDD & :2016 d) audits? :2016 e) monitoring and measurement of processes? :2016 f) monitoring and measurement of product? :2016 g) corrective action? :2016 h) preventive action? :2016 :2016 :2016 :2016 :2016 :2016 :2016 :2016 :2016 i) follow-up actions from previous management reviews? j) changes that could affect the quality management system? k) recommendations for improvement? l) applicable new or revised regulatory requirements? 5.6.3 Review output Does the output of the management review include any decisions and actions related to... - improvement of the effectiveness of the QM system and its processes? - improvements needed to maintain the effectiveness of the quality management system and related to customer requirements? - resource needs? Does the output from management review be recorded (see 4.5) and include the input reviewed and any decisions and actions related to: a) improvement needed to maintain the suitability, adequacy, and effectiveness of the quality management system and its processes? b) improvement of product related to customer requirements? c) changes needed to respond to applicable new or revised regulatory requirements? d) resource needs? 6 Resource management 6.1 Provision of resources Does the organization determine and provide the resources needed to - to implement and maintain the quality management system, to continually improve its effectiveness and enhance customer satisfaction by meeting customer requirements? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 16 / 51

ISO & MDD & - to implement and maintain the quality management system, to continually improve its effectiveness and to meet regulatory and customer requirements? :2016 a) implement the quality management system and to maintain its effectiveness? :2016 b) meet applicable regulatory and customer requirements? 6.2 Human Resources :2016 Does personnel performing work affecting product quality be competent on the basis of appropriate education, training, skills and experience? :2016 Does the organization document the process(es) for establishing competence, providing needed training, and ensuring awareness of personnel? :2016 Does the organization: :2016 a) determine the necessary competence for personnel performing work affecting product quality? :2016 b) provide training or take other actions to achieve or maintain the necessary competence? :2016 c) evaluate the effectiveness of the actions taken? :2016 d) ensure that its personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives? :2016 e) maintain appropriate records of education, training, skills and experience (see 4.5)? 6.1 General Is personnel competent on the basis of appropriate education, training, skills and experience if they perform work affecting conformity to product requirements? MDD/MPG Is the training of new medical device representatives and sales personnel planned, executed and recorded? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 17 / 51

ISO & MDD & 6.2 Competence, training and awareness Does the organization. determinate the necessary competence of personnel performing work affecting conformity to product requirements? provide training or take other actions to achieve the necessary competence? evaluate the effectiveness of the actions taken? ensure that its personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives? maintain appropriate records of education, training, skills and experience? 6.3 Infrastructure Does the organization determine, provide and maintain the infrastructure needed to achieve conformity to product requirements? Does that include, as applicable, buildings, workspace and associated utilities, process equipment (both hardware and software) and supporting services (such as transport, communication or information system)? Are the documented requirements for maintenance activities, including their frequency established, when such activities or lack thereof can affect product quality? Are records of such maintenance getting maintained? :2016 Does the organization document the requirements for the infrastructure needed to achieve conformity to product requirements, prevent product mixup and ensure orderly handling of product? Infrastructure includes, as appropriate: a) buildings, workspace and associated utilities; b) process equipment (both hardware and software); c) supporting services (such as transport, communication, or information systems). 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 18 / 51

ISO & MDD & :2016 Does the organization document requirements for the maintenance activities, including the interval of performing the maintenance activities, when such maintenance activities, or lack thereof, can affect product quality? :2016 Does as appropriate, the requirements apply to equipment used in production, the control of the work environment and monitoring and measurement? :2016 Are records of such maintenance maintained (see 4.5)? 6.4 Work environment 6.4.1 Does the organization determine and manage the work environment needed to achieve conformity to product requirements? 6.4.2 Has the organization established documented requirements for health, cleanliness and clothing of personnel, if contact between such personnel and the product or work environment could adversely affect the quality of the product? If work environment conditions can have an adverse effect on product quality: 6.4.3 Does the organization establish documented requirements for the work environment conditions and documented procedures or work instructions to monitor and control these work environment conditions? 6.4.4 Does the organization ensure that all personnel who are required to work temporarily under special environmental conditions are appropriately trained or supervised by a trained person? 6.4.5 If necessary: are special arrangements established and documented for the control of contaminated or potentially contaminated product in order to prevent contamination of other product, the work environment or personnel? 6.4 Work environment and contamination control :2016 6.4.1 Work environment :2016 Does the organization document the requirements for the work environment needed to achieve conformity to product requirements? :2016 If the conditions for the work environment can have an adverse effect on product quality, does the organization document the requirements for the work environment and the procedures to monitor and control the work environment? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 19 / 51

ISO & MDD & :2016 Does the organization: :2016 a) document requirements for health, cleanliness and clothing of personnel if contact between such personnel and the product or work environment could affect medical device safety or performance? :2016 b) ensure that all personnel who are required to work temporarily under special environmental conditions within the work environment are competent or supervised by a competent person? :2016 6.4.2 Contamination control :2016 Does, as appropriate, the organization plan and document arrangements for the control of contaminated or potentially contaminated product in order to prevent contamination of the work environment, personnel, or product? :2016 Does the organization document for sterile medical devices, requirements for control of contamination with microorganisms or particulate matter and maintain the required cleanliness during assembly or packaging processes? :2016 7 Product realization 7.1 Planning of product realization Does the organization plan and develop the processes needed for product realization? Is the planning of product realization consistent with the requirements of the other processes of the QM system? :2016 Does the organization document one or more processes for risk management in product realization? :2016 Are records of risk management activities maintained (see 4.5)? :2016 Does the organization determine the following, as appropriate, in planning product realization... - quality objectives and requirements for the product? :2016 :2016 - the need to establish processes and documents(see 4.4), and to provide resources specific to the product including infrastructure and work environment? - required verification, validation, monitoring, measurement, inspection and test activities storage, distribution and traceability specific to the product together with the and the criteria for product acceptance? - records needed to provide evidence that the realization processes and resulting product meet requirements (see 4.5)? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 20 / 51

ISO & MDD & :2016 :2016 Is the output of this planning in a suitable form for the organization s method of operations documented? Has the organization established the documented requirements for risk management throughout product realization? Are records arising from risk management including the results getting maintained? (throughout the entire lifecycle of products, see for example EN ISO 14971) 7.2 Customer-related processes 7.1 Determination of requirements related to the product Are procedures and competencies for contract reviews defined? :2016 :2016 :2016 :2016 :2016 Does the organization determine... - requirements specified by the customer, including the requirements for delivery and post-delivery activities? - requirements not stated by the customer but necessary for specified or intended use, where known? - statutory and regulatory requirements applicable to the product and any additional requirements considered necessary by the organization? - applicable regulatory requirements related to the product? - any user training needed to ensure specified performance and safe use of the medical device? - any additional requirements determined by the organization? 7.2 Review of requirements related to the product :2016 Does the organization review the requirements related to the product? Is this review conducted prior to the organization s commitment to supply a product to the customer (for exemple: Submission of tenders, acceptance of contracts or orders, acceptance of a contract or orders, acceptance of changes to contracts or orders) Does this review ensure that... :2016 a) product requirements are defined and the organization has (the ability to meet the) defined requirements? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 21 / 51

ISO & MDD & :2016 b) contract or order requirements differing from those previously expressed are resolved? :2016 c) applicable regulatory requirements are met? :2016 d) any user training identified in accordance with 7.1 is available or planned to be available? :2016 e) the organization has the ability to meet the defined requirements? :2016 :2016 :2016 Are the records of the results of the review and actions arising from the review maintained and stored (see 4.5)? Does the organization confirm the customer requirements before acceptance, where the customer provides no documented statement of requirement? Does the organization ensure that relevant documents are amended and that relevant personnel are made aware of the changed requirements? 7.3 Customer communication 1 Has the organization determined and implemented effective arrangements for communication with customers in relation to: product information, enquiries, contracts or order handling, including amendments and customer feedback, including customer complaints and advisory notices (see 8.5.1)? 7.3 Communication :2016 The organization shall plan and document arrangements for communicating with customers in relation to: :2016 a) product information? :2016 b) enquiries, contracts or order handling, including amendments? :2016 c) customer feedback, including complaints? :2016 d) advisory notices? :2016 Does the organization communicate with regulatory authorities in accordance with applicable regulatory requirements? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 22 / 51

ISO & MDD & 7.3 Design and development 7.1 General :2016 Does the organization document procedures for design and development? 7.1 Design and development planning Are documented procedures and the responsibilities and authorities for the design and development determined? Does the organization determine during the design and development planning... - the design and development stages, the review, verification and validation that are appropriate to each design and development stage? - design and development transfer activities? If the design and development results to the manufacturing process proved to be suitable? Are the interfaces between different groups involved in design and development managed? Are effective communication and clear assignment of responsibilities ensured? If the output of planning is updated, as the design and development progresses? MDD/MPG If in the design planning, the legal requirements, especially in regard to the licensing and reporting requirements are intent? :2016 Does the organization plan and control the design and development of product? :2016 As appropriate, Are design and development planning documents maintained and updated as the design and development progresses? :2016 During design and development planning, does the organization document: :2016 a) the design and development stages? :2016 b) the review(s) needed at each design and development stage? :2016 c) the verification, validation, and design transfer activities that are appropriate at each design and development stage? :2016 d) the responsibilities and authorities for design and development? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 23 / 51

ISO & MDD & :2016 e) the methods to ensure traceability of design and development outputs to design and development inputs? :2016 f) the resources needed, including necessary competence of personnel? 7.2 7.3 Design and development inputs :2016 :2016 :2016 :2016 :2016 :2016 :2016 MDD/MPG Are inputs related to product requirements determined and records maintained (see 4.5)? Do these inputs include... - functional, performance usability and safety requirements according to the intended use? - applicable (statutory and) regulatory requirements(, as well as the results from the risk management) and standards? - where applicable, information derived from previous similar designs and other requirements essential for design and development? - applicable output(s) of risk management? - as appropriate, information derived from previous similar designs? - other requirements essential for design and development of the product and processes? Are these inputs reviewed for adequacy and approved? Are these requirements complete, unambiguous, able to be verified or validated and not in conflict with each other? Has the applicable harmonized standards for safety requirements for medical devices systematically identified? MDD/MPG If no harmonized standards were applied: Has the safety requirements completely identified (systematically)? :2016 Is the requirement related to the management of the interfaces between different groups involved in design and development eliminated? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 24 / 51

ISO & MDD & 7.3 7.4 Design and development outputs :2016 Are the outputs of the design and development in a form suitable for verification against the design and development input and are approved prior to release? Are the outputs of the design and development approved prior to release? Do the design and development outputs contain or reference product acceptance criteria? Do the design and development outputs provide appropriate information for purchasing, production and for service provision? Do the design and development outputs specify the characteristics of the product that are essential for its safe and proper use? :2016 Do Design and development outputs : :2016 a) meet the input requirements for design and development? :2016 b) provide appropriate information for purchasing, production and service provision? :2016 c) contain or reference product acceptance criteria? :2016 d) specify the characteristics of the product that are essential for its safe and proper use? :2016 Are Records of the design and development outputs maintained (see 4.5)? 7.4 7.5 Design and development review Are systematic reviews of design and development performed at suitable stages to evaluate the ability of the results of design and development to meet requirements and to identify any problems and propose necessary actions? Do the participants in such reviews include representatives of functions concerned with the design and development stage(s) being reviewed? Is specialist personnel included, where necessary? Are records of the results of the reviews and any necessary actions maintained? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 25 / 51

ISO & MDD & :2016 At suitable stages, are systematic reviews of design and development performed in accordance with planned and documented arrangements to: :2016 a) evaluate the ability of the results of design and development to meet requirements? :2016 b) identify and propose necessary actions? :2016 Do participants in such reviews include representatives of functions concerned with the design and development stage being reviewed, as well as other specialist personnel? :2016 Are Records of the results of the reviews and any necessary actions maintained and include the identification of the design under review, the participants involved and the date of the review (see 4.5)? 7.5 7.6 Design and development verification Is verification performed and recorded to ensure that design and development outputs have met the design and development input requirements? :2016 Are design and development verification performed in accordance with planned and documented arrangements to ensure that the design and development outputs have met the design and development input requirements? :2016 Does the organization document verification plans that include methods, acceptance criteria and, as appropriate, statistical techniques with rationale for sample size? :2016 If the intended use requires that the medical device be connected to, or have an interface with, other medical device(s), does verification include confirmation that the design outputs meet design inputs when so connected or interfaced? :2016 Are records of the results and conclusions of the verification and necessary actions maintained (see 4.4 and 4.5)? 7.6 7.7 Design and development validation Is the design and development validation performed to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use? Is validation completed prior to the delivery or implementation of the product 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 26 / 51

ISO & MDD & or completed until the product has been formally transferred to the customer? MDD/MPG Are records of the results of validation and any necessary actions maintained? Are sufficient clinical data provided, to prove that the product fulfills the performance, design characteristics and intended purpose of the device as stated in MDD 93/42/EEC Annex I (clinical evaluation or if necessary clinical investigation)? :2016 Are design and development validation performed in accordance with planned and documented arrangements to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use? :2016 Does the organization document validation plans that include methods, acceptance criteria and, as appropriate, statistical techniques with rationale for sample size? :2016 Are design validation conducted on representative product? Representative product includes initial production units, batches or their equivalents. :2016 Is the rationale for the choice of product used for validation recorded (see 4.5)? :2016 As part of design and development validation, does the organization perform clinical evaluations or performance evaluations of the medical device in accordance with applicable regulatory requirements? A medical device used for clinical evaluation or performance evaluation is not considered to be released for use to the customer. :2016 If the intended use requires that the medical device be connected to, or have an interface with, other medical device(s), does validation include confirmation that the requirements for the specified application or intended use have been met when so connected or interfaced? :2016 Are validation completed prior to release for use of the product to the customer? :2016 Are records of the results and conclusion of validation and necessary actions maintained (see 4.4 and 4.5)? 7.8 Design and development transfer :2016 Does the organization shall document procedures for transfer of design and development outputs to manufacturing? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 27 / 51

ISO & MDD & :2016 Are these procedures ensure that design and development outputs are verified as suitable for manufacturing before becoming final production specifications and that production capability can meet product requirements? :2016 Are results and conclusions of the transfer shall be recorded (see 4.5)? 7.7 7.9 Control of design and development changes :2016 Does the organization shall document procedures to control design and development changes? :2016 Does the organization determine the significance of the change to function, performance, usability, safety and applicable regulatory requirements for the medical device and its intended use? :2016 :2016 :2016 MDD/MPG Are design and development changes identified and records maintained and reviewed, verified and validated, as appropriate? Are design and development changes approved before implementation? Does the review of design and development changes include evaluation of the effect of the changes on constituent parts and product in process or already delivered or outputs of risk management and product realization processes? Are records of the results of the review of changes and any necessary actions maintained? (see 4.5). Which procedures guarantee that the DQS is informed when substantial modifications are done to the products? 7.10 Design and development files :2016 Does the organization shall maintain a design and development file for each medical device type or medical device family? :2016 Does this file include or reference records generated to demonstrate conformity to the requirements for design and development and records for design and development changes? 7.4 Purchasing 7.4.1 Purchasing process Have documented procedures been established to ensure that the pur- 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 28 / 51

ISO & MDD & chased products conforms to specified purchase requirements? Does the organization evaluate and select suppliers to ensure that products are delivered in accordance with the requirements of the organization? Are the type and extent of control applied to the supplier and the purchased product dependent upon the effect of the purchased product on subsequent product realization or the final product? Are criteria established for selection, evaluation and reevaluation? Are records maintained of the results of evaluations and any necessary actions? :2016 Does the organization document procedures (see 4.4) to ensure that purchased product conforms to specified purchasing information? :2016 Does the organization establish criteria for the evaluation and selection of suppliers? Are the criteria: :2016 a) based on the supplier s ability to provide product that meets the organization s requirements? :2016 b) based on the performance of the supplier? :2016 c) based on the effect of the purchased product on the quality of the medical device :2016 d) proportionate to the risk associated with the medical device? :2016 Does the organization plan the monitoring and re-evaluation of suppliers? :2016 Does supplier performance in meeting requirements for the purchased product be monitored? :2016 Does the results of the monitoring provide an input into the supplier reevaluation process? :2016 Are Non-fulfilment of purchasing requirements addressed with the supplier proportionate to the risk associated with the purchased product and compliance with applicable regulatory requirements? :2016 Are records of the results of evaluation, selection, monitoring and reevaluation of supplier capability or performance and any necessary actions arising from these activities maintained (see 4.5)? 410_09e_Checkliste_for_Assessment MDD.docx Version: 0 29 / 51