ISO 13485 Medical Workflow

ByCable Assembly Manufacturer

Posted by SZFRS Engineering Team

ISO 13485 is the international quality management system standard for medical devices. Aligned with FDA 21 CFR Part 820 in the United States, EU MDR 2017/745 in the European Union, and similar regulations in major markets, ISO 13485 provides the framework that medical device manufacturers and their suppliers use to design, produce, and ship compliant products. For cable suppliers building components for medical devices, understanding ISO 13485 workflow is essential — the standard governs how design controls flow from device manufacturer to component supplier, what documentation gets exchanged, and how supplier audits validate compliance. This guide walks through the workflow from concept through production with the practical detail medical cable programs need.

Get a Medical Cable Quote

TL;DR — ISO 13485 in One Page

ISO 13485 governs medical device QMS through structured workflow: Design Controls capture intended use, design inputs, design outputs, design review, design verification, design validation, and design transfer; the resulting Design History File (DHF) documents the device’s complete development. The Device Master Record (DMR) contains the production specifications; the Device History Record (DHR) documents what was actually built. Risk management per ISO 14971 identifies and mitigates hazards. CAPA (Corrective and Preventive Action) handles non-conformances and customer feedback. Supplier qualification applies these controls to component suppliers. Major regulatory pathways (FDA 510(k) and PMA, EU MDR Class IIa/IIb/III, similar globally) all build on ISO 13485 framework. Below covers each element with practical detail for cable supplier programs.

The Standard — ISO 13485:2016

ISO 13485:2016 is the current revision of the medical device QMS standard. Published in 2016, the standard structure follows ISO 9001 (the general QMS standard) with medical-device-specific additions throughout. Key elements:

  • Scope. Applies to organizations involved in any stage of the medical device lifecycle — design, production, installation, servicing, supply of components, supply of services. The standard accommodates different roles in the supply chain.
  • Risk-based approach. The standard requires risk-based decision-making throughout the QMS. Higher-risk products (life-critical, sterile, implantable) get more rigorous controls.
  • Documentation requirements. ISO 13485 is documentation-heavy. Procedures, records, design files, risk files, manufacturing records — all maintained and retained per defined retention periods (typically 10-15+ years for medical device records).
  • Management responsibility. Top management has explicit responsibility for QMS effectiveness, including resource provision, management review, and quality policy.
  • Continual improvement. The QMS must include processes for continually improving its effectiveness — internal audits, management review, CAPA, post-market surveillance.

Certification audits typically occur every 3 years for organizations holding ISO 13485 certification, with surveillance audits annually. Notified Bodies (FDA-recognized auditing organizations and similar globally) conduct the audits and issue certifications.

Design Controls — The Foundation

Design Controls (Section 7.3 of ISO 13485, mirrored in 21 CFR 820.30 from FDA) establish the framework for medical device development. The structured flow:

  • Design Planning. Establish the design plan — schedule, responsibilities, design review timing, and the design output deliverables. Updated as the design evolves.
  • Design Inputs. The functional and operational requirements the device must meet. Includes intended use statement, regulatory requirements, performance characteristics, environment of use, biocompatibility requirements (per ISO 10993), and electrical safety (per IEC 60601-1). Design inputs are the design’s contract with reality.
  • Design Outputs. The drawings, specifications, code, and other deliverables that result from the design effort. Each output traces back to specific design inputs through the traceability matrix.
  • Design Review. Formal evaluations at defined points in the development. Cross-functional review covering technical, regulatory, manufacturing, and quality aspects. Documented with review minutes, action items, and approvals.
  • Design Verification. Confirms that design outputs meet design inputs. “Did we build it right?” Test methods, test results, and analyses demonstrating that each design input requirement is satisfied by the corresponding design output.
  • Design Validation. Confirms that the device meets user needs and intended use. “Did we build the right thing?” Typically involves clinical evaluation, simulated use testing, or actual user testing. Validation differs from verification — verification confirms specifications; validation confirms intended use.
  • Design Transfer. The handoff from design to production. Manufacturing procedures, work instructions, training records, qualified equipment — all in place to manufacture the device per the design.
  • Design Changes. Any change to a verified, validated design follows formal change control. Each change goes through the same review-verify-validate process as the original design (scoped to the change).

For cable suppliers, design controls flow downstream from the device manufacturer. The cable assembly’s design inputs derive from the device’s design outputs. The cable supplier contributes design outputs (drawings, specifications, BOMs, test reports) that the device manufacturer incorporates into the device’s DHF.

DHF, DMR, DHR — The Three Documents

Three documents form the core of medical device records:

Design History File (DHF)

The DHF documents the design and development of the medical device. Contents include:

  • Design plan with schedule and responsibilities.
  • Design inputs (requirements specifications).
  • Design outputs (drawings, specifications, code).
  • Traceability matrix linking inputs to outputs.
  • Design review meeting records.
  • Design verification test plans, test reports, and analysis.
  • Design validation test plans, clinical evaluation reports, simulated use studies.
  • Design transfer documentation.
  • Design change records.
  • Risk management file (per ISO 14971).

The DHF is the device manufacturer’s record. Cable suppliers contribute components — drawings, test reports for the cable assembly, biocompatibility documentation if applicable, IPC/WHMA-A-620 certification — that the device manufacturer incorporates into their DHF.

Device Master Record (DMR)

The DMR contains the production specifications — what to build to manufacture the device. Contents include:

  • Device specifications (dimensions, materials, performance).
  • Production procedures (work instructions, process specifications).
  • Quality assurance procedures (inspection plans, sampling plans, test methods).
  • Packaging and labeling specifications.
  • Installation, maintenance, and servicing procedures (if applicable).

The DMR is the production blueprint. It’s typically maintained by the device manufacturer with supplier-contributed sections covering the cable component (drawings, specifications, BOM, inspection criteria).

Device History Record (DHR)

The DHR documents the manufacturing history of each individual device or batch. Contents include:

  • Lot or batch identification.
  • Date of manufacture.
  • Quantity manufactured.
  • Quantity released for distribution.
  • Records of conformance to specifications.
  • Records of inspection and test results.
  • Records of process events (deviations, non-conformances, corrective actions during production).
  • Operator and inspector identification.
  • Material lot codes (traceability to incoming inspection).

The DHR enables traceability — given a device serial number or batch code, the manufacturer can identify exactly when, how, and from what materials the device was made. This is essential for adverse event investigation, recall management, and regulatory submissions.

For cable suppliers, our equivalent is the cable assembly DHR — manufacturing records, material traceability, inspection results — that we provide to device manufacturers either with each batch or upon request. We maintain DHR-equivalent records for medical cable programs.

Risk Management — ISO 14971

ISO 14971 is the medical device risk management standard, integrated with ISO 13485 throughout the lifecycle. The risk management process:

  • Risk identification. Identify hazards associated with the device — clinical, electrical, biocompatibility, software, mechanical. Hazard analysis covers normal use and reasonably foreseeable misuse.
  • Risk estimation. Assess each hazard’s severity and probability. Severity ranges from negligible to catastrophic; probability ranges from improbable to frequent.
  • Risk evaluation. Determine if each risk requires mitigation. Risk acceptance criteria vary by application — life-critical devices have lower acceptable risk thresholds.
  • Risk control. Implement mitigation measures — design changes, protective measures, information for safety. The hierarchy is: design changes (preferred), protective measures, information for users (last resort).
  • Residual risk evaluation. After mitigations, evaluate remaining risk. Document acceptability or further mitigation.
  • Risk-benefit analysis. For higher-risk devices, demonstrate benefits outweigh residual risks.
  • Post-market risk monitoring. Ongoing surveillance for new hazards or unexpected severity/probability after release.

FMEA (Failure Mode and Effects Analysis) is the typical tool used for risk identification and estimation. Each component, process step, or use scenario is evaluated for failure modes, effects, and detection probability. RPN (Risk Priority Number) ranks risks for prioritization.

For cable suppliers, FMEA participation is common in medical programs. We contribute FMEA inputs covering cable assembly failure modes — connector breakdown, jacket failure, conductor break, dielectric failure, contamination — and the design controls and inspection methods that prevent or detect each.

CAPA — Corrective and Preventive Action

CAPA is the process for handling non-conformances, customer complaints, and other quality issues. The CAPA workflow:

  • Issue identification. Non-conformance from inspection, customer complaint, internal audit finding, supplier non-conformance, or other source.
  • Investigation. Root cause analysis using techniques like Five Whys, Ishikawa fishbone diagram, or formal RCA methods. The investigation identifies the underlying cause, not just the immediate failure mode.
  • Containment. Immediate actions to prevent further occurrences while the root cause investigation continues. Quarantine affected product, halt production if needed, alert customers if shipped product is affected.
  • Corrective action. Permanent fix addressing the root cause. Could be process change, equipment upgrade, material change, training enhancement, procedural revision.
  • Preventive action. Action preventing similar issues in other products or processes. Extends the corrective action’s reach across the QMS.
  • Effectiveness verification. Confirm the action actually fixed the issue. Could be statistical analysis of subsequent production, audit findings, customer feedback.
  • Documentation and closure. Document the entire CAPA in the quality records. Trend analysis identifies recurring issue categories.

For cable suppliers serving medical programs, CAPA participation is essential. Customer-detected issues (cable failure in field, inspection finding) trigger our CAPA process. Internal CAPA covers supplier non-conformances, our own quality issues, and trend analysis from production.

Supplier Qualification — How Cable Suppliers Fit In

Medical device manufacturers operate supplier qualification programs to manage component supply chain risk. The typical workflow for qualifying a cable supplier:

  • Initial qualification audit. The device manufacturer audits the supplier’s QMS, capabilities, and records. Audit covers ISO 13485 compliance, IPC/WHMA-A-620 certification, manufacturing capabilities, quality control, and material traceability.
  • First-article inspection. Sample production runs evaluated against drawings and specifications. First-article inspection establishes the baseline for production.
  • Process validation (for some programs). Statistical demonstration that the manufacturing process consistently produces compliant product. Common for sterile devices and high-risk programs.
  • Approval and qualified supplier list addition. Successful qualification adds the supplier to the device manufacturer’s approved supplier list (ASL or QSL).
  • Ongoing surveillance. Periodic audits, performance monitoring, supplier scorecards. Re-qualification typically every 2-3 years.
  • Supplier change control. Any change to qualified supplier (process change, material change, location change) requires customer notification and may require re-qualification.

For our medical cable work, we maintain ISO 13485 supplier QMS aligned with the device manufacturer’s quality system. Documentation provided to medical customers includes our quality manual, ISO 13485 certificate, IPC/WHMA-A-620 CIS personnel list, biocompatibility test references for cable materials we use, FMEA contributions, and DHR-equivalent manufacturing records.

Regulatory Pathways — How They Build on ISO 13485

Major regulatory pathways build on the ISO 13485 framework:

  • FDA 510(k). Premarket notification for moderate-risk devices (Class II in FDA classification). Demonstrates substantial equivalence to a legally marketed predicate device. Most aesthetics and many medical devices pursue this pathway.
  • FDA Premarket Approval (PMA). For Class III high-risk devices (life-critical, implantable, life-supporting). More extensive submission with clinical data demonstrating safety and effectiveness.
  • FDA De Novo. For novel low-to-moderate risk devices without predicate. Establishes new device classification.
  • EU MDR 2017/745. European Medical Device Regulation, replacing the older Medical Device Directive (MDD 93/42/EEC). Risk-based classification (Class I, IIa, IIb, III) with progressively stricter controls. Notified Body involvement increases with class. CE marking is the regulatory output.
  • EU IVDR 2017/746. In Vitro Diagnostic Regulation for IVD devices. Similar structure to MDR with IVD-specific elements.
  • UK MDR 2002 (post-Brexit). UK retained MDR substantially aligned with EU MDR but with UK-specific Notified Bodies (UKCA marking).
  • China NMPA. National Medical Products Administration. Risk-based classification (Class I, II, III). NMPA registration required for sale in China.
  • Japan PMDA. Pharmaceuticals and Medical Devices Agency. Quasi-medical device, Controlled Medical Device, Highly Controlled Medical Device, Specially Controlled Medical Device classifications.
  • Brazil ANVISA. National Health Surveillance Agency. Class I, II, III, IV classifications for medical devices.
  • India CDSCO. Central Drugs Standard Control Organization regulates medical devices in India.

For cable suppliers, ISO 13485 certification provides the foundation. Specific regulatory pathways may add documentation requirements (FDA design controls, EU MDR technical documentation, NMPA-specific submissions) but ISO 13485 covers the core QMS requirement across all major markets.

Practical Workflow — A Medical Cable Program Example

How an ISO 13485-aligned medical cable program typically flows from start to production:

  • Phase 1 — Concept and feasibility. Device manufacturer engages cable supplier early. Discussion of cable architecture, regulatory pathway, expected volumes. Cable supplier provides technical input on feasible constructions and cost ranges.
  • Phase 2 — Design inputs. Device manufacturer’s design inputs cascade to cable component specifications. Cable supplier confirms understanding and identifies potential design issues.
  • Phase 3 — Design outputs and prototype. Cable supplier produces drawings and BOMs based on inputs. Prototype samples produced for testing. Design outputs become part of device manufacturer’s DHF.
  • Phase 4 — Verification testing. Cable supplier produces verification samples; device manufacturer runs verification testing per the design verification plan. Iterations may occur if any test fails.
  • Phase 5 — Validation testing. Cable assembly tested in actual device prototypes during clinical evaluation, simulated use, or other validation activities. Issues identified flow back to cable supplier for resolution.
  • Phase 6 — Design transfer. Cable supplier prepares production capacity, qualifies tooling, completes first-article inspection. Manufacturing procedures and work instructions established.
  • Phase 7 — Production launch. Initial production runs with enhanced inspection. Process validation runs (for some programs) statistically demonstrate process capability.
  • Phase 8 — Ongoing production. Standard production with documented DHR-equivalent records, periodic supplier audits, change control for any process or material changes.
  • Phase 9 — Post-market surveillance. Field performance feedback flows from device manufacturer to cable supplier. CAPA actions for any issues. Continuous improvement initiatives.

The full workflow takes 12-26 months for a new program, depending on regulatory pathway and complexity. Subsequent reorders and minor changes happen much faster — 4-12 weeks typical for production cycles after qualification.

Real-World Case Study — A Medical Class III Program

A medical device manufacturer was developing a new Class III ablation system for cardiac arrhythmia treatment. The system required a specialty handpiece cable carrying RF energy plus signal and feedback to the catheter ablation tip. The program followed full ISO 13485 design controls with FDA PMA pathway.

The program timeline:

  • Months 1-3. Concept and feasibility. We provided technical input on RF cable construction options, push-pull aviation connector selection, biocompatibility considerations.
  • Months 4-6. Design inputs received and confirmed. Drawings produced, BOMs developed, biocompatibility documentation prepared (referencing existing ISO 10993 test data for our medical-grade silicone).
  • Months 7-9. Verification samples produced. Two iteration rounds for connector grip force and cable flex life concerns.
  • Months 10-15. Validation testing in prototype device with simulated procedure use. Cable performed without issues across the validation panel.
  • Months 16-19. Design transfer, first-article inspection, process validation runs. Audit by FDA-aligned consultant.
  • Months 20-22. Initial production runs (50 cables for clinical investigator-initiated studies). 100% inspection per Class 3 IPC/WHMA-A-620 requirements.
  • Months 23-26. Production validation. The customer ramped to commercial volumes after FDA clearance.

The total program duration was 26 months from concept to commercial launch. Cable assembly NRE was approximately $85,000 — covering tooling, qualification, design iterations, and FDA-aligned documentation. The customer reached over 5,000 cables shipped per year by year 4 of the program.

This is typical for Class III medical programs. The investment is substantial but the long-term revenue stream and market exclusivity (PMA approval is challenging to obtain, creating real barriers to entry) make the investment economical.

Common Workflow Mistakes

Patterns we see in medical cable programs:

Engaging cable supplier too late. Device manufacturers sometimes complete most of their internal design before consulting cable suppliers. Earlier engagement helps surface manufacturability issues before they become expensive design changes.

Inadequate design inputs to cable supplier. Vague performance requirements or missing environmental specifications make supplier work harder. Specific, measurable design inputs produce better cable specifications.

Skipping prototype iterations. Programs sometimes rush to production without adequate prototype iterations. Issues that would have been caught early surface during validation or production launch, costing time and money.

Inadequate change control. Material changes, process changes, or supplier changes that bypass formal change control create regulatory and quality risk. Document changes formally and notify customers before implementing.

Underestimating documentation overhead. Medical cable manufacturing carries 25-50% more administrative cost than commercial manufacturing. Programs that don’t budget for documentation effort end up cutting corners.

Bottom Line

ISO 13485 governs medical device QMS through structured design controls, document management (DHF, DMR, DHR), risk management (ISO 14971), CAPA, and supplier qualification. Medical cable programs follow this framework with cable supplier roles in design inputs, design outputs, verification, validation, and ongoing manufacturing. Major regulatory pathways (FDA 510(k) and PMA, EU MDR, NMPA, PMDA, ANVISA) build on the ISO 13485 foundation. The investment in proper QMS — both at device manufacturer and supplier — is substantial but enables medical device development with safety, effectiveness, and regulatory compliance. For procurement and engineering teams managing medical cable programs, understanding the ISO 13485 workflow speeds program execution and reduces both regulatory risk and supply chain risk.

Related Reading

Medical Cable Program?

Send us your medical device program — regulatory pathway, design inputs, target market, expected volume. We’ll quote within 5-10 days with full ISO 13485 supplier QMS alignment, biocompatibility documentation references, and IPC/WHMA-A-620 Class 2 or 3 workmanship.

Contact Us for Medical Cable Quote

Similar Posts