Greenfield Medical Device Companies Building a QMS

Establishing a Quality Management System from the Ground Up

Greenfield medical device companies face a distinct challenge when establishing a quality management system (QMS). Unlike established manufacturers, new organisations cannot rely on mature procedures, historical records, experienced internal quality teams or proven operational processes. They must develop the systems, responsibilities and controls needed to support safe, compliant medical device development and manufacture while their products, facilities and commercial operations are still taking shape.

At Quality Systems Now, helping your organisation get off the ground is what we do. Chat with us today to find out more

A well-designed QMS provides the structure for managing product quality, regulatory obligations, risk, design activities, suppliers, manufacturing processes and post-market responsibilities. It must reflect the company's intended activities, the regulatory markets it plans to enter and the characteristics of the devices it intends to supply.

For Australian businesses, ISO 13485 implementation Australia requirements and Therapeutic Goods Administration (TGA) obligations are important considerations during early planning. The appropriate approach is to establish a system that meets applicable requirements without introducing unnecessary administrative complexity or procedures that the organisation cannot effectively maintain.

Greenfield QMS medical device projects benefit from early decisions about regulatory scope, process ownership, risk management and documentation architecture. These decisions influence how efficiently the company can progress from product development to manufacturing readiness and commercial supply.

Defining the Regulatory and Operational Scope

Before drafting procedures, a company should establish what its QMS needs to control. This requires a clear understanding of the device portfolio, intended purpose, development stage, manufacturing model and intended markets.

A company developing a software-based medical device will have different operational needs from a manufacturer producing sterile implantable devices. Both may require design controls, risk management, supplier oversight and complaint handling, but the technical controls, validation activities and supporting evidence will differ considerably.

The initial scope assessment should consider whether the organisation will design, manufacture, assemble, package, label, store or distribute medical devices. It should also identify activities performed by contractors and suppliers, including outsourced manufacturing, sterilisation, testing and software development.

Outsourcing an activity does not automatically remove the company's responsibility for ensuring that the activity is appropriately controlled. Responsibilities must be defined through suitable agreements, supplier controls and documented processes.

Regulatory classification should also be established for each device under the applicable jurisdiction's rules. In Australia, medical devices are generally classified according to risk, with different requirements applying to different classes and device categories. Classification influences conformity assessment, evidence expectations and the regulatory pathway for supply.

This initial assessment provides the foundation for a proportionate medical device QMS setup. It prevents the organisation from developing a generic collection of procedures without understanding which controls are necessary for its actual products and activities.

Building the QMS Around ISO 13485

ISO 13485 provides an internationally recognised framework for quality management systems used by medical device organisations. Its requirements address areas including management responsibility, resource management, product realisation, measurement, analysis and improvement.

For a greenfield company, implementation should begin with a structured assessment of the applicable standard requirements and their relevance to the proposed operating model. The objective is to translate those requirements into defined processes, responsibilities, records and controls.

A practical system typically includes document and record control, training and competency management, design and development controls, supplier management, purchasing, production controls, equipment management, nonconformity management, corrective action, internal auditing and management review.

The final structure should reflect the company's activities rather than a predetermined list of documents. For example, a business that does not perform manufacturing internally may not need detailed internal production instructions for processes undertaken entirely by an external manufacturer. It will, however, need effective controls over the outsourced activities for which it retains responsibility.

An ISO 13485 consultant can help interpret requirements, identify gaps, design appropriate processes and establish an implementation plan. The value of this work lies in creating a system that is both compliant and operationally practical.

Procedures should describe how work is actually performed, identify accountable personnel and specify the records needed to demonstrate that controls are functioning. Excessive documentation can obscure responsibilities, while insufficient documentation can leave important decisions and activities uncontrolled.

Integrating ISO 14971 Risk Management

Risk management should be established alongside the QMS rather than introduced as a separate exercise immediately before regulatory submission or certification.

ISO 14971 describes a framework for managing risks associated with medical devices throughout their life cycle. This includes identifying hazards, estimating and evaluating associated risks, implementing risk controls, assessing residual risk and monitoring relevant information after production and distribution.

A greenfield company should define how risk management connects with design and development, verification and validation, manufacturing, supplier oversight and post-market activities.

Risk management planning should identify responsibilities, the methods used to assess risk, criteria for acceptability and the records required to demonstrate that decisions are justified. The process should also establish how risk controls are verified and how their effectiveness is evaluated.

An ISO 14971 risk management consultant can support the development of a risk management process that aligns with the device's intended purpose, technology and foreseeable conditions of use.

The risk management file should remain connected to the design history, technical documentation and post-market information. When a design changes, a supplier introduces a different material or a complaint identifies an emerging hazard, the company needs a defined method for evaluating the implications.

This integration is particularly important for startups, where engineering decisions, supplier selections and product specifications can change rapidly. A consistent process helps ensure that changes are assessed systematically rather than managed through informal discussions alone.

Establishing Design and Development Controls

Design and development controls are central to the QMS of a company responsible for creating a medical device. They establish how user needs and intended use are translated into design inputs, outputs, verification activities, validation evidence and an approved product configuration.

The company should define design stages, review responsibilities, required records and criteria for progressing between stages. These controls should be proportionate to the device's complexity and development risk while maintaining appropriate traceability.

Design inputs should address relevant performance, safety, usability, regulatory and technical requirements. Design outputs should provide sufficient information for verification, validation and subsequent production or implementation.

Verification determines whether specified design requirements have been met. Validation evaluates whether the resulting device meets user needs and its intended use under defined conditions. The methods and evidence required depend on the device and the claims being made.

Design reviews provide structured opportunities to evaluate progress, identify deficiencies and confirm that outstanding issues are addressed. Design changes should be reviewed, verified or validated as appropriate, and approved before implementation.

For software, the applicable controls should also address software development, configuration management, testing, cybersecurity considerations and maintenance where relevant. For devices involving biological materials, sterilisation, electrical safety or other specialised technologies, additional technical and regulatory considerations may apply.

The QMS should create a traceable connection between requirements, design decisions, testing results and risk controls. This evidence becomes important during regulatory assessment, certification activities and investigations of product performance.

Controlling Suppliers and Outsourced Activities

Greenfield companies frequently depend on external organisations for component manufacture, contract assembly, laboratory testing, sterilisation, packaging and other specialised activities. Supplier management therefore requires early attention.

The company should establish criteria for evaluating, selecting and monitoring suppliers according to the significance of the supplied product or service and its potential effect on device quality and safety.

Supplier qualification may include document reviews, technical assessments, quality agreements, audits or performance monitoring. The depth of assessment should be justified by the relevant risks and applicable requirements.

Purchasing controls should communicate specifications, acceptance criteria and other necessary requirements to suppliers. Incoming inspection and other verification activities should be appropriate to the materials, components or services received.

A quality agreement can clarify responsibilities for change notification, nonconformities, records, investigations, traceability and regulatory support. However, an agreement alone does not demonstrate that outsourced activities are adequately controlled. The company must also maintain evidence that its controls operate effectively.

Supplier changes should be evaluated for their potential effects on product performance, validated processes, risk assessments and regulatory documentation. Establishing these processes early reduces dependence on informal communication and helps maintain control as the supplier network expands.

Preparing for TGA Medical Device Compliance

Australian regulatory requirements should be considered during product planning, not only when a company is preparing to launch its first device.

The TGA regulates medical devices supplied in Australia under the applicable legislative framework. Requirements depend on factors such as device classification, the manufacturer's role, the conformity assessment pathway and the circumstances of supply.

Most medical devices must be included in the Australian Register of Therapeutic Goods (ARTG) before lawful supply, unless an applicable exemption or other specific provision applies. The precise obligations should be confirmed for the device and proposed supply arrangements.

Manufacturers should determine which conformity assessment evidence is required and whether a relevant quality management system certification, audit or other assessment is applicable. ISO 13485 certification can provide important evidence of QMS conformity, but certification alone does not automatically authorise a device for Australian supply.

A business should also distinguish between requirements applying to the manufacturer and those applying to an Australian sponsor. These roles can involve different responsibilities for regulatory submissions, records, complaints, adverse event reporting and post-market activities.

Medical device site licensing should not be treated as a universal requirement for every Australian medical device business. The applicable authorisations, registrations and assessment arrangements depend on the activities performed, the products involved and the regulatory framework governing those activities.

Careful regulatory planning helps companies identify the evidence, approvals and operational controls needed before committing to launch dates. It also reduces the risk of developing documentation that does not support the intended regulatory pathway.

Designing Document Control and Quality Records

Documentation provides evidence that the QMS is defined, implemented and maintained. It also enables employees to perform activities consistently and supports investigations when problems arise.

A controlled document framework should establish how documents are drafted, reviewed, approved, issued, revised and withdrawn. Employees need access to current instructions, while obsolete versions must be prevented from unintended use.

Quality records should be legible, identifiable, retrievable and protected against inappropriate alteration or loss. Retention periods should reflect applicable regulatory requirements, product characteristics and the organisation's documented policies.

An electronic quality management system can support document workflows, training records, approvals, audit trails and change management. However, software does not replace the need for clearly defined processes, suitable access controls, appropriate validation where required and effective oversight.

Smaller organisations may initially operate with simpler controlled systems if these adequately meet their needs and applicable requirements. The important consideration is whether the selected arrangements reliably maintain control and can support increasing operational complexity.

Implementing Training, Internal Audits and Management Review

A QMS becomes effective through implementation, not simply through approved procedures. Personnel must understand their responsibilities, possess the necessary competence and follow the processes relevant to their work.

Training arrangements should identify required competencies, maintain appropriate records and evaluate effectiveness where necessary. Competence may be demonstrated through qualifications, experience, supervised work, assessment or other suitable evidence.

Internal audits provide a structured means of evaluating whether QMS processes conform to planned arrangements and applicable requirements. An audit programme should consider process importance, changes, previous findings and areas of identified risk.

Audit findings should be documented, assessed and addressed through appropriate corrections and corrective actions. Investigations should examine causes rather than automatically treating retraining or procedure revision as sufficient responses.

Management review provides senior leadership with an opportunity to assess QMS suitability, adequacy and effectiveness. Inputs may include audit results, complaints, process performance, supplier performance, nonconformities, corrective actions, resource requirements and opportunities for improvement.

These activities should be established early enough to generate meaningful evidence before external certification or regulatory assessment. A system that exists only on paper is unlikely to provide reliable assurance of consistent operational control.

Establishing an Effective Implementation Roadmap

A successful greenfield QMS implementation requires a realistic sequence of activities, with responsibilities and dependencies clearly defined.

The initial phase should establish regulatory scope, product requirements, organisational responsibilities and the processes necessary to control development and supply. A gap assessment can then identify applicable requirements, existing capabilities and the work needed to establish compliance.

The next phase involves designing and approving core procedures, defining records, establishing risk management arrangements and implementing design, supplier and document controls. Personnel training and operational implementation should proceed alongside documentation development.

Once processes are operating, the company can generate records, assess performance, conduct internal audits and address identified deficiencies. Management review and readiness assessments can then help determine whether the system is sufficiently implemented for the planned certification or regulatory assessment.

Timelines depend on device complexity, existing capabilities, supplier arrangements, resource availability and the scope of the proposed assessment. A fixed implementation duration should not be assumed without evaluating these factors.

External support can help establish priorities, resolve technical questions and build internal capability. The long-term objective should be an organisation that understands and maintains its own QMS, rather than one that depends indefinitely on external consultants to operate routine quality processes.

Building a QMS That Supports Sustainable Growth

For greenfield medical device companies, establishing a QMS is an opportunity to embed quality, risk management and regulatory discipline into everyday operations from the beginning.

An effective system connects product development, supplier oversight, manufacturing controls, documentation, regulatory responsibilities and post-market monitoring. It also provides a consistent framework for evaluating changes, investigating problems and demonstrating that decisions are supported by evidence.

Quality Systems Now supports organisations establishing and strengthening quality systems through practical implementation, regulatory planning and internal capability development. This includes ISO 13485 implementation Australia projects, ISO 14971 risk management support, medical device QMS setup and assessment of relevant regulatory obligations.

The appropriate approach depends on the company's device portfolio, operating model, development stage and intended markets. A carefully scoped implementation can avoid unnecessary complexity while ensuring that essential controls are established and maintained.

The objective is not simply to produce a set of procedures or prepare for an external audit. It is to build a quality management system that supports safe and consistent products, informed decision-making, regulatory compliance and sustainable business growth.