ISO 13485 management responsibility

ISO 13485:2016 clause 5 makes top management answerable for the quality system. They commit to it (5.1), make sure customer and regulatory requirements are met (5.2), set the quality policy (5.3) and objectives (5.4), define who does what and appoint a management representative (5.5.2), and review the system under a documented procedure (5.6).

The requirement in plain English

Commitment and focus (ISO 13485:2016 5.1 and 5.2). Top management show their commitment: they explain why meeting customer and regulatory requirements matters, set the policy and objectives, hold the reviews and provide the resources. They make sure customer requirements and the regulations that apply are identified and met.

Quality policy (ISO 13485:2016 5.3). The policy fits the organisation’s purpose, commits to meeting requirements and keeping the system effective, frames the objectives, is understood by staff and is reviewed for continued fit.

Planning (ISO 13485:2016 5.4.1 and 5.4.2). Quality objectives, including those needed to meet regulatory and product requirements, are set at the relevant functions and levels, are measurable and match the policy. When you plan changes to the system, you keep it intact while they happen.

Responsibility, authority and communication (ISO 13485:2016 5.5.1 to 5.5.3). Responsibilities and authorities are defined, documented and communicated. You document how the people who manage, perform and verify work affecting quality relate to one another, and give them the independence and authority they need. A member of management, the management representative, has documented responsibility for keeping the processes documented, reporting to top management on how the system performs, and promoting awareness of regulatory and quality system requirements (5.5.2). Internal communication about the system’s effectiveness is set up and happens (5.5.3).

Management review (ISO 13485:2016 5.6). A documented procedure sets the review at documented intervals, to judge whether the system is still suitable, adequate and effective and what needs to change, including the policy and objectives (5.6.1). The inputs (5.6.2) cover:

feedback and complaints, and any reports made to regulators;
audit results and the monitoring of processes and product;
corrective and preventive actions, and follow-up on earlier reviews;
changes that could affect the system, recommendations for improvement, and new or revised regulations.

The outputs (5.6.3) are recorded with the inputs reviewed, and cover improvements needed to keep the system effective, product improvements related to customer requirements, changes needed for new or revised regulations, and resource needs.

ISO 13485 asks you to maintain effectiveness rather than improve continually, and its review inputs lean towards regulators: reports made and regulations changed are both required.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 15-person company makes a Class IIa home-use monitoring device. The chief executive and two directors are top management. The quality lead is appointed management representative in writing, with authority to stop shipment, and reports to the chief executive, not to the head of operations whose targets a stop would hit. The same person is the company’s person responsible for regulatory compliance under EU MDR Article 15, because she meets its qualification requirements.

The quality policy is one page, reviewed at each management review, and staff can say what it means for their job. Objectives are measurable and owned: complaints acknowledged within two working days, CAPAs closed on time, no overdue calibrations, every critical supplier re-evaluated in the year. A regulatory objective covers planning for the EU MDR changes that affect the company.

The management review runs twice a year under a procedure that fixes that interval. The pack follows the inputs in order. The minutes record outputs in the four kinds the standard lists, each with an owner and a date, and the next review opens with them.

Evidence an auditor expects

Quality policy (required): content, review and staff awareness; the auditor asks people on the floor about it.
Quality objectives (required): measurable, owned, including regulatory and product objectives, with results.
Organisation chart and role descriptions (required in substance): responsibilities, authority and independence documented.
Management representative appointment (required): documented responsibility and authority, and evidence of reports to top management.
Management review procedure (required): the documented interval.
Management review records (required): every input considered and the outputs recorded with actions.
Top management interview: the auditor asks a director what the last review decided.

Common mistakes

A representative in name only

The management representative is named in the manual but has no documented authority and never reports to top management. Write the authority into the role description and minute the representative’s report at each review.

Treating the representative and the PRRC as one requirement

A team assumes appointing a management representative satisfies EU MDR Article 15, or the reverse. They are different roles with different tests. Check the person responsible for regulatory compliance meets the regulation’s qualification rules, and document both appointments.

Objectives with no regulatory content

Objectives cover revenue and delivery but nothing about complaints, reporting or regulatory change. Clause 5.4.1 asks for objectives that meet regulatory and product requirements. Add measures that show the system keeps devices safe and compliant.

Regulatory inputs missing from the review

Packs built from an ISO 9001 template skip reports to regulators and new regulations. Auditors check for both. Add them as standing agenda items.

No documented interval

The review happens when people find time. Clause 5.6.1 asks for documented intervals. Fix them in the procedure and keep to them.

How Sted helps

For ISO 13485 clause 5 Sted’s knowledge base carries the Quality Policy (POL-QMP) and the Management Review Procedure (PRC-MRP) with its Management Review Schedule (REC-MRS), Management Review Record (REC-MRR) and Management Review Action Record (REC-MRA); the schedule and the review record come with a suggested annual frequency.
Nothing is scheduled until an owner picks a first due date, and records are part of the Full Management System plan.
Management-system registers (scope, interested parties, obligations, issues, objectives, risks and opportunities, processes) are edited by administrators; the first three are drafted from your onboarding answers and the rest start empty.
An administrator or the owner of a record type’s document sets how often it repeats and its next due date under Repeating records; a task to complete it opens 30 days before each due date, goes to the document’s owner, and closing that period’s record moves the date on. Event-driven record types never fall due on their own.
A record is opened, completed, submitted for closure and closed (or withdrawn); closure is reviewed by the document owner.

Sted holds the review record and raises it when it falls due. Top management decide the policy, the objectives and every review output; Sted does not attend or decide.

Management review guide: preparing the pack and minuting decisions, with an ISO 13485 complaints and vigilance example.
Management review: the term, and how ISO 13485’s version differs.
Measurement, analysis and feedback: where the complaint, audit and data inputs come from.
Quality management system and documentation: the quality manual the policy and objectives sit in.
Repeating records: how Sted raises the review when it falls due.
ISO 13485 hub: how clause 5 fits the rest of the standard.

Frequently asked questions

Is the ISO 13485 management representative the same as the EU MDR PRRC?

No. The management representative is an ISO 13485 role inside the quality system. The person responsible for regulatory compliance is a legal role under EU MDR Article 15, with qualification requirements of its own. One person can hold both if they meet both sets of requirements, and many small manufacturers do it that way.

How often must an ISO 13485 management review happen?

At intervals you document in your management review procedure; the standard sets no number. Once a year is the common minimum and certification bodies expect one before stage 2. Many device companies review twice a year, because complaint and regulatory inputs change quickly.