Medical Device Quality Systems FAQ
Medical-device quality systems raise a lot of practical questions, especially in growing companies where people wear several hats. Who owns complaints? Does every process need an SOP? When does a spreadsheet stop being enough? Groundwork answers these questions from a practical operating perspective, with a focus on clear responsibilities, appropriate controls, and avoiding unnecessary bureaucracy.
Getting Started
Do we really need a quality system while we are still a startup?
Yes, but that does not mean building a large or complicated system on day one. The quality system should grow with the company, product, risk, and activities being performed. Early-stage companies usually need clear responsibilities, controlled records, appropriate design and development practices, risk management, and a way to manage the processes already occurring. The goal is to build enough control for the work happening now while creating a foundation that can expand later.
Won’t SOPs and quality processes slow us down?
Poorly designed ones can. Good procedures should make work more consistent, clarify who is responsible, reduce repeated decisions, and create the records the company needs without adding unnecessary steps. The problem is usually not having procedures. It is building procedures that are more complicated than the business requires or that do not reflect how the work actually happens.
What does a practical early-stage quality system look like?
It focuses first on the processes that matter to the company’s current stage. That may include document control, training, design and development controls, risk management, supplier controls, and other activities already being performed. Additional processes such as complaints, CAPA, installation, service, and postmarket activities become increasingly important as the company moves toward commercialization and customer use.
Roles & Responsibilities
Who is responsible for the quality system?
Executive management is ultimately responsible for ensuring the company has an effective quality system and that appropriate responsibilities, authority, and resources are defined. Quality often provides oversight and process governance, but the quality system belongs to the business. Engineering, Operations, Regulatory, Service, and other functions remain responsible for the work and records within their areas.
Can one person wear several roles in a small medical-device company?
Yes. Small companies often need people to wear several hats. What matters is that responsibilities and decision authority are clear, required work is completed by people with appropriate competence, and conflicts or gaps are managed. A company does not necessarily need a separate person for every quality-system function, but it does need to know who is responsible for each activity.
Does Quality have to perform all quality-related work?
No. Quality should not become the department that performs every regulated activity. Quality commonly defines or oversees the process, verifies that required controls are followed, and helps ensure records and decisions are complete. Subject-matter experts perform the technical work that requires their expertise. For example, Engineering may perform a failure analysis while Quality ensures the investigation process, documentation, escalation, and follow-up requirements are met.
If Quality oversees complaints, what is the role of Field Service or other technical teams?
Field Service may identify the issue, gather customer information, inspect equipment, collect logs, replace or return parts, reproduce failures, and provide important technical evidence. Engineering, Operations, suppliers, or other specialists may also participate in the investigation. The designated complaint-handling function coordinates the overall complaint process, ensures required evaluations and records are completed, and helps connect individual events to broader trends or systemic issues. Technical participation and process ownership are different responsibilities.
Complaints, Investigations & CAPA
Does every customer-reported problem become a complaint?
Not every customer interaction is automatically a complaint, but any communication alleging a deficiency related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a released device should be evaluated through the company’s complaint process. The important point is to have a defined method for recognizing potential complaints rather than relying on individual judgment or job title.
Who should investigate a complaint or failed part?
The investigation should involve the people with the expertise needed to understand the issue. That may include Field Service, Engineering, Manufacturing, suppliers, or other specialists. Quality or the designated complaint-handling function typically coordinates the process and ensures the investigation is appropriately documented, evaluated, and completed. The person with the technical expertise does not have to be the person who owns the complaint process.
Who is responsible for looking for trends across complaints or part failures?
Trend evaluation should be part of the company’s quality-system oversight. Individual technical teams may recognize recurring failures within their area, but the organization needs a defined way to review data across complaints, service events, returned parts, nonconformances, and other quality information. Quality often coordinates this broader review so isolated events can be recognized as possible systemic issues.
Does every complaint or investigation require a CAPA?
No. CAPA is intended for issues that require a more systematic corrective or preventive response. A single complaint may be adequately addressed through the complaint investigation itself. CAPA should be considered when the issue is significant, recurring, systemic, presents meaningful risk, or indicates that an existing process or control is not working effectively. The company should define how those escalation decisions are made and documented.
SOPs & Documentation
Does every process need its own SOP?
No. Not every task or activity needs a separate SOP. A company needs documented procedures where they are required and where documentation is necessary to make work consistent, controlled, and repeatable. Combining related activities into a practical procedure is often better than creating a large number of narrowly focused documents that become difficult to maintain.
Who should write and own an SOP?
The people who understand and perform the process should be actively involved in defining it. The process owner is often the most appropriate functional owner of the procedure, while Quality helps ensure the document fits the company’s quality-system requirements and document-control process. Procedures tend to work better when they describe how the business actually operates rather than being written by Quality in isolation.
Can Engineering, Operations, Service, or another function own a quality-system procedure?
Yes. Quality-system procedures do not all have to be owned by the Quality department. Engineering may own design and development processes, Operations may own manufacturing activities, Service may own service procedures, and other functions may own the processes they operate. Quality commonly provides oversight, document control, and compliance guidance while functional owners remain responsible for executing and maintaining their processes.
How detailed should an SOP be?
Detailed enough that trained people can perform the process consistently and understand the required responsibilities, decisions, controls, and records, but not so detailed that the procedure becomes difficult to follow or maintain. A useful SOP explains what must happen and who is responsible while leaving appropriate room for technical expertise, work instructions, forms, or supporting tools where more detail is needed.
Systems & Software
When does a medical-device company need an eQMS?
Not every startup needs an eQMS immediately. Early-stage companies can sometimes manage controlled documents, training, records, and approvals with simpler tools if the processes are clearly defined and properly controlled. An eQMS becomes more valuable as the number of users, documents, records, approvals, training requirements, complaints, CAPAs, suppliers, and other quality activities grows.
Can spreadsheets and shared folders work at the beginning?
They can, provided the company has appropriate controls for access, approval, revision, record retention, and change management. The issue is not whether a tool is simple. The issue is whether the company can maintain reliable, controlled records with it. As complexity grows, manual systems often become harder to manage consistently and may need to be replaced.
Should we choose the software first and build the process around it?
Usually no. Define the process, users, responsibilities, required records, approvals, reporting, integrations, and other requirements first. Then evaluate software against those needs. Choosing the tool first can lead to workflows being shaped around software limitations rather than what the business and quality system actually require.
Who should be involved in selecting a quality or operating system?
The people who will use, administer, support, and rely on the system should be involved. That often includes Quality, Regulatory, Engineering, Operations, IT, Service, or other functions depending on the tool. Quality can help define compliance and record requirements, while functional users help ensure the system supports the actual work. System selection works best as a cross-functional decision rather than a purchase made by one department in isolation.
Management & Scaling
What responsibilities should executive management retain?
Executive management remains responsible for making sure the company’s quality system is appropriate, resourced, supported, and effective. Leaders can delegate specific activities, but they should still understand major quality risks, provide resources, review performance, and make sure responsibilities and authority are clear across the organization.
Can we outsource Quality or Regulatory work?
Yes, companies can use consultants or external specialists for quality, regulatory, auditing, documentation, and other support. Outsourcing the work does not outsource the company’s responsibility. Management still needs to understand what is being performed, approve appropriate decisions, maintain required records, and ensure external work is integrated into the company’s own quality system.
How do we know when our quality system needs to become more formal?
Look for signs that informal methods are becoming difficult to control: more employees, more documents, more suppliers, increasing training needs, repeated customer issues, growing product complexity, multiple sites, commercialization, or increasing regulatory activity. The system should become more structured when the company can no longer rely on individual memory, informal communication, or a small number of people to maintain consistent control.
How do we keep the quality system from becoming bureaucratic as the company grows?
Add structure in response to real needs and risk rather than adding controls simply because larger companies use them. Keep ownership clear, combine related processes where practical, automate only after the process is understood, review procedures that no longer add value, and make sure quality requirements remain connected to everyday operations. A scalable quality system should become more capable as the company grows, not just more complicated.