5.3–5.4: Quality policy and objectives

The quality policy required by 5.3 must be appropriate to the purpose of the organization, include a commitment to comply with requirements and maintain the effectiveness of the QMS, provide a framework for establishing and reviewing quality objectives, be communicated and understood within the organization, and be reviewed for continuing suitability. It is not a marketing statement — auditors expect staff to be able to explain, in their own words, what the policy means for their day-to-day work.

Clause 5.4.1 requires quality objectives, including those needed to meet product requirements, to be established at relevant functions and levels within the organization. Objectives must be measurable and consistent with the quality policy. Clause 5.4.2 then requires planning to ensure the QMS meets both the general requirements of the standard and these objectives, and — importantly — requires that the integrity of the QMS is maintained when changes to it are planned and implemented.

5.5.1–5.5.3: Responsibility, authority, and the Management Representative

Clause 5.5.1 requires top management to ensure that responsibilities and authorities are defined, documented, and communicated within the organization. So far, this reads similarly to the equivalent requirement in ISO 9001.

Clause 5.5.2 is where ISO 13485 diverges in a way that matters operationally. It requires top management to appoint a member of the organization's management who, irrespective of other responsibilities, has defined responsibility and authority that includes: ensuring processes needed for the QMS are documented; reporting to top management on the effectiveness of the QMS and on any need for improvement; and ensuring the promotion of awareness of applicable regulatory requirements and QMS requirements throughout the organization. This individual is widely referred to in industry practice as the Management Representative, a title that ISO 13485 used explicitly in its 2003 edition and that persists in common usage even though the 2016 text describes the role by function rather than by that exact label in the clause itself.

Clause 5.5.3 requires top management to ensure appropriate communication processes are established within the organization, and that communication takes place regarding the effectiveness of the QMS. In practice, this is usually evidenced through management review minutes, internal quality bulletins, or documented briefings following audits or CAPA closures.

5.6: Management review

Clause 5.6.1 requires top management to review the organization's QMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness, and to include an assessment of opportunities for improvement and the need for changes, including to the quality policy and objectives. Records of these reviews must be maintained.

Clause 5.6.2 specifies the inputs that must feed into the review — at minimum, feedback, complaint handling, reporting to regulatory authorities, audits, monitoring and measurement of processes and product, corrective and preventive actions, follow-up actions from previous reviews, changes that could affect the QMS, and recommendations for improvement. Clause 5.6.3 specifies the outputs: decisions and actions related to improvement needed to maintain the suitability, adequacy, and effectiveness of the QMS and its processes; improvement of product related to customer requirements; and resource needs.

Practical implications for device manufacturers

The appointment requirement in 5.5.2 is not paperwork for its own sake. Notified bodies and regulatory auditors use it as an anchor point: when they want to understand how a nonconformity was escalated, how a regulatory reporting decision was made, or who is accountable for QMS effectiveness between management reviews, they expect to be pointed to this named individual. Smaller manufacturers sometimes assign the role to the quality manager by default without documenting the specific authorities listed in 5.5.2 — that gap between "does the job" and "is formally appointed with defined authority" is exactly what auditors probe.

Management review is the other area where organizations underinvest. A review that happens on schedule but skips required inputs — say, it covers audit results but not complaint trends or regulatory reporting — technically satisfies 5.6.1's timing requirement while failing 5.6.2's content requirement. Keeping a standing agenda that maps directly to the 5.6.2 input list is the simplest way to avoid this.

Common mistakes

• No formal appointment record for the Management Representative role: the person performs the function informally, but there is no documented appointment defining the specific 5.5.2 responsibilities and authority.
• Quality objectives that are not measurable: vague statements with no indicator or target, making 5.4.1 conformity impossible to demonstrate.
• Management review missing required inputs: reviews that cover only a subset of the 5.6.2 inputs, commonly omitting regulatory reporting or follow-up on actions from prior reviews.
• Policy known to management but not understood by staff: 5.3 requires the policy to be communicated and understood, not merely published.
• Review outputs not tracked to closure: decisions recorded in review minutes but never linked to a resourced action with an owner and due date.

This is also where a tool like IgeraIndustria fits naturally into a QMS: when an auditor or a newly appointed Management Representative asks "what did the last three management reviews decide about complaint trends," a system that answers directly from your own QMS records — appointment letters, review minutes, objective trackers — and cites the exact source document is faster and more defensible than searching through shared drives for the right version.

Frequently asked questions about ISO 13485 Clause 5

Does ISO 13485 still use the term "Management Representative"?

The 2016 edition of ISO 13485 describes the role by its responsibilities in Clause 5.5.2 rather than using "Management Representative" as a formal clause heading, but the role is functionally the same one that carried that title in the 2003 edition, and the term remains in common industry and auditor use to describe the appointed individual.

How is this different from ISO 9001's approach to management responsibility?

ISO 9001:2015 allows organizations to distribute the equivalent responsibilities and authorities across roles without requiring a single formally appointed representative. ISO 13485:2016 keeps the explicit requirement in 5.5.2 for top management to appoint one specific member of management with defined responsibility and authority for the QMS, making the role more clearly mandated than under ISO 9001.

Can the Management Representative also hold another role, such as quality manager?

Clause 5.5.2 states the appointment is "irrespective of other responsibilities," which means the role can be combined with another position such as quality manager. What matters is that the specific responsibilities and authority described in 5.5.2 are formally documented and assigned to that individual, not that the role stands alone on an org chart.

What must be covered in a management review under Clause 5.6?

Clause 5.6.2 lists the required inputs, including feedback, complaint handling, reporting to regulatory authorities, audit results, process and product monitoring data, corrective and preventive actions, follow-up from previous reviews, changes affecting the QMS, and improvement recommendations. Clause 5.6.3 requires the review to produce outputs covering QMS and process improvement, product improvement related to customer requirements, and resource needs.

How often must management review take place?

Clause 5.6.1 requires review "at planned intervals" without specifying a fixed frequency, so the organization must define and justify its own interval and demonstrate it is actually followed. Many manufacturers run reviews annually with more frequent interim reviews, but the specific cadence should be documented in the QMS rather than assumed.

What evidence do auditors typically ask for under Clause 5?

Common requests include the appointment record and job description for the Management Representative, the current quality policy with evidence of staff awareness, quality objectives with tracked performance, and management review minutes showing the required inputs were discussed and that outputs were assigned to owners with due dates.

Is a small manufacturer exempt from appointing a Management Representative?

No. Clause 5.5.2 applies regardless of organization size, though in a small company the role is often combined with another position, such as the quality manager or even the general manager, as permitted by the "irrespective of other responsibilities" wording. The size of the organization does not remove the requirement to formally document the appointment and its specific authorities.

IgeraSolutions · ISO 13485 medical devices QMS series