How do you verify ISO 13485 for a medical PCBA supplier?

Short answer. Verify three things, not one: that the certificate is real, that its scope covers the process you are buying, and that the supplier is operating the system rather than holding a certificate for a different site or a different activity. For a contract assembler the scope paragraph is the part that matters, because it states which processes at which address are covered.

What ISO 13485:2016 asks of an assembler

ISO 13485 is a quality management system for medical devices. For a contract manufacturer that builds boards to a customer's design, the parts of the standard that change daily work are:

• Process validation. Special processes - soldering, cleaning, coating, sterilisation where applicable - must be validated rather than inspected into compliance.
• Traceability. Records must allow a finished unit to be traced back through the material and processes used to build it.
• Change control. A change in material, process or supplier requires assessment and, where the customer's procedure requires it, approval before implementation.
• Risk management. Process risk is assessed and controlled, not only product risk.
• Record retention. Records are kept for the period the customer specifies, which for a medical device is usually the device lifetime plus a defined margin.

Reading the scope paragraph

The scope names the activities certified and the site they are performed at. Two questions follow. First, does the scope name electronic assembly, or does it name something adjacent? Second, is the address the site that will actually build the boards? A certificate for a head office, a trading entity or a different plant does not cover the line your order will run on. This is the single most common finding when a buyer checks properly.

How to verify the certificate

• Match the number to the issuing body's record. The certificate number is the part a supplier has no reason to alter, so it is the part worth checking at source.
• Check the standard year. ISO 13485:2016 is the current revision; a certificate citing 2003 is out of date.
• Check validity and surveillance. A certificate is maintained through surveillance audits. A lapsed certificate and a suspended one look identical on a PDF.
• Ask for a downloadable copy. A supplier that publishes its certificate as a file has usually already been asked for it by a customer's quality department.
• Ask for one record. A sample device history record, redacted if needed, tells you more about the system than a certificate does.

What a medical PCBA record should contain

At minimum: incoming material records for the lot, the assembly and inspection results including AOI and X-ray where specified, electrical test results, the programming version where firmware is loaded, any rework performed with its approval, and the identification that links the unit to all of it. If the device is implanted or life-supporting, the record requirements are set by the customer's procedure and should be agreed before the first build rather than at the audit.

What Kilandu holds

Kilandu holds ISO 13485:2016 under certificate 35825MDQMS0021R0S, alongside IATF 16949:2016 (0596984), ISO 9001:2015 (CN27125Q0392R0S) and ISO 14001:2015 (CN27125E0142R0S). The certificate numbers, issuing bodies, scope and validity dates are published on the quality assurance page, and the certificates can be downloaded there as PDF files. Medical builds follow the ISO 13485 system with lot-level traceability from incoming material through final test.

Where the detail is documented

The application is described on the medical PCBA page and a build is written up on the medical PCBA case study page. Quality-system scope, certificates and download links are on the quality assurance page. Send a supplier questionnaire or audit checklist to alden@kilandu.com.