Process mapping is the backbone of an ISO 13485 QMS. Section 4.1 of the standard requires you to determine the processes needed for the QMS, their interactions, and the criteria ensuring their effective operation. The process map is the documentary response to that requirement.
It is also the document an auditor consults first. If the process map does not reflect the reality of the organisation, everything that follows is weakened.
The three families of processes
Before drawing anything, you need to understand the logic of the classification.
Management processes. They steer the QMS: quality policy, planning, management review, definition of objectives. These processes do not directly produce value for the customer, but they condition the effectiveness of everything else.
Realisation processes. They directly create value: design and development, purchasing, manufacturing and control, delivery, after-sales service. This is the operational core.
Support processes. They enable the realisation processes to function: human resources management, infrastructure and maintenance, document control, training, management of measuring equipment.
The processes the standard explicitly requires
Some processes are required by name in the standard in the form of “documented procedures”. Not having them constitutes an immediate nonconformity.
Control of documents (section 4.2.3), control of records (section 4.2.4), internal audits (section 8.2.2), control of nonconforming product (section 8.3), corrective actions (section 8.5.2), preventive actions (section 8.5.3). To these must be added the risk management process (by reference to ISO 14971) and the post-market surveillance process.
The four-step method
Step 1: list the company’s actual activities. Before thinking “ISO 13485”, list what the organisation really does day to day. Design, manufacture, purchase, inspect, deliver, handle complaints, train teams, maintain equipment. This is the raw material of the process map.
Step 2: group into coherent processes. Group the activities into processes with a logical scope: clear inputs, measurable outputs, an identifiable owner. A process without a clearly designated owner is a process that will not work.
Step 3: map the interactions. The output of one process is the input of the next. Mapping these flows makes it possible to identify the grey areas of responsibility and the interface risks.
Step 4: stay at the minimum sufficient level. A one-page map that faithfully describes what happens is more useful than a 20-page flowchart describing the ideal QMS. The auditor will check the consistency between the process map and the practices observed in the field.
The most costly mistake
Building the process map from the requirements of the standard rather than from the reality of the company. This approach produces QMSs that formally meet the standard but correspond to nothing that actually happens. An auditor who observes practices that differ from the process map raises a systematic nonconformity. It is better to have a humble map that faithfully describes the real processes, even if they are then improved.