The management review is one of the most audited processes under ISO 13485, and one of the most poorly conducted. It is not an annual review meeting documented after the fact just to tick the box before the audit. It is a process by which top management decides on the effectiveness of the QMS. Clause 5.6 of the standard is precise about what it must contain.
An experienced auditor systematically asks to see the minutes of the most recent review. Within five minutes, they know whether the process is real or merely formal.
The mandatory inputs (clause 5.6.2)
Clause 5.6.2 lists twelve types of information that must be presented to top management. The list is not indicative. Omitting any one of these elements constitutes a deviation.
a. Feedback. User and field feedback, including post-market surveillance data. A trend analysis, not a stack of forms.
b. Complaint handling. A distinct input from feedback. Is the number of complaints rising? Do they relate to the same products, the same defects?
c. Reporting to regulatory authorities. Vigilance reports, incident reports, field safety corrective actions (FSCA). This is the input most specific to medical devices, and the one most often forgotten.
d. Audits. Internal audits and supplier audits carried out since the previous review. Non-conformities identified, closure status, trends across several cycles.
e. Monitoring and measurement of processes. The performance indicators of key processes. They must exist before the review. You do not build them for the review.
f. Monitoring and measurement of product. Rejection rates, product non-conformities, control results. A distinct input from process monitoring.
g. and h. Corrective and preventive actions. CAPA in progress and closed since the previous review. Effectiveness of the actions, adherence to deadlines, trends.
i. Follow-up of actions from previous reviews. The progress status of decisions taken at the earlier review. A mandatory input, not a mere courtesy.
j. Changes that could affect the QMS. Regulatory developments, product changes, organisational changes, new customer requirements, new manufacturing technologies.
k. Recommendations for improvement. Arising from continuous improvement, field feedback, and process reviews.
l. New or revised applicable regulatory requirements. New standards, MDCG guidance, developments in the MDR or the IVDR.
The mandatory outputs (clause 5.6.3)
A review that observes without deciding does not comply. The outputs must document decisions on four points, not three.
Improvement of the QMS and its processes. Which improvements are decided, with which owner, which deadline, which resources.
Improvement of the product in relation to customer requirements. When the review reveals a gap between the product and customer expectations, the corresponding actions are decided.
Changes needed to meet new regulatory requirements. An output regularly forgotten. Faced with a development in the MDR or a new guidance, top management decides which changes to undertake.
Resource needs. Top management explicitly allocates the resources for the decided actions. A decision without resources is an intention, not a decision.
The four mistakes that generate non-conformities
Mistake 1: the review did not take place. Even during busy periods, the absence of a review at the planned interval is a systematic deviation.
Mistake 2: the inputs do not cover the twelve requirements of 5.6.2. Glossing over complaints, omitting reports to authorities or new regulatory requirements: each missing item is a deviation.
Mistake 3: the minutes list observations without decisions. A list of discussed points is not a management review record within the meaning of the standard.
Mistake 4: the previous decisions are not followed up. The auditor compares the current minutes with the previous ones. Actions decided twelve months earlier and never undertaken signal a QMS running on empty.