How to Approach Design Control From Both FDA and ISO Viewpoints


When designing, developing or manufacturing a medical device or in vitro diagnostic (IVD) tool, it’s important for a manufacturer to grasp the crucial role that design control plays in the product’s overall quality and its compliance with the Quality System Regulation requirement (1). Not only is design control critical in the various phases of a successful device’s initial development, it’s also essential for effective premarket and postmarket design control considerations.

Peter Knauer, co-founder and managing partner of Sage BioPartners, a regulatory, compliance and CMC consulting firm for device and drug combo products, recently compared the two primary strategies — those of the U.S. Food and Drug Administration (FDA) and the International Organization for Standardization (ISO) — to pinpoint some key takeaways for manufacturers. Knauer has more than 30 years’ CMC/regulatory leadership experience in the biomedical industry and is a board member of BioUtah Institute.

Getting Started with FDA and ISO

Looking at the introductory statements of FDA’s 21CFR820.30 Regulation for Design Controls (2):

“Each manufacturer of any class III or class II device...shall establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met.”

Meanwhile, the ISO Standard 13485 Section 7.1 states (paraphrased and used under the Fair Use Copyright provision):

Include planning and development processes needed for product realization. Planning of product realization needs to be aligned with the quality management system. Records of risk management activities should be documented.

“There are commonalities between these requirements. For example, both require a formal planning process, but how this is done is left to the developer,” said Knauer. “Also, both require that the plans be updated as development progresses.”

Similarly, for Phase 1 of design control — design development and planning — Knauer advises developing the physical and performance characteristics as the basis of its design.

An example of this might be an auto-injector device (similar to an EpiPen), which requires a high standard to prevent “failure to fire.” The performance characteristics should meet the critical needs of the target acute rescue population.

For both an introduction to design control and Phase 1, he recommends creating the following:

  • Design and development plan (covers overall goals/objectives, intended use, team members, timelines, costs, deliverables, definition of the phases to be used, etc.)
  • Risk management plan (documents the overall risk process and initial overall risk of the system)
  • Initial version of the traceability matrix (start to document in tabular format the user requirements, inputs, outputs, verification and validation of the process)
  • Initial feasibility information (documents early studies to help determine the User Requirements Specifications)
  • Design review for Phase 1


This article is related to the Toolkit:
Design Control Toolkit
To view the full details, please  download  your free Toolkit.

The Total Design Effort

The FDA (21 CFR 820.30[d]) defines Phase 2 — design input — as the results of design effort at each design phase and at the end of the total design effort.

“In this case, we benefit from blending both the FDA regulation and ISO standard,” Knauer said. “The FDA requirement is more descriptive to translating user requirements into unambiguous specifications, while the standard gives instructions on which inputs to use.”

An example would be the requirement for the auto-injector described above, as defined by FDA via a reliability specification; 99.999 percent reliability at a 95 percent confidence interval.

Recommended actions:

  • Establish a design inputs requirements document
  • Perform a hazards analysis
  • Perform a failure mode risk analysis
  • Update the traceability matrix with the inputs developed in Phase 2
  • Perform a design review for this phase

The Device and Its Intended Function

Design outputs — Phase 3 — are the results of a design effort at each design phase and at the end of the total design effort.

From the auto-injector example, the input of minimal “failure to fire” is mapped to the reliability specification to meet the FDA requirement, and the use of a properly vetted supplier/manufacturer to assure minimal “failure to fire” would cover the ISO standard approach.  

Recommended actions:

  • Develop/prototype your device
  • Determine if further device prototyping or redesign is required
  • Iterate if needed
  • Finalize design
  • Finalize production specifications
  • Update traceability matrix
  • Perform design review

Confirmation of the Device's Design

Phase 4 — design verification — is all about confirming by objective evidence that your device’s design output meets its design input, so that a manufacturer can say, “I made the product correctly.”

“In most cases, comparing outputs to inputs shows that the device performs according to specifications,” Knauer said.

From the auto-injector example, if the final device is tested and it meets the reliability specification, then the input met the output. 

Recommended actions:

  • Based on the design input requirements (DIR), develop a verification protocol
  • Produce final representative product
  • Verify product to ensure outputs met inputs
  • Update traceability matrix
  • Perform design review

Yeah, But Does the Design Meet the Users' Needs?

Phase 5 — design validation — helps the manufacturer prove by objective evidence that the device’s specifications conform with user needs and its intended use(s). Or in other words, “I made the correct product.”

“The FDA is specific about the representative nature where the product came from,” Knauer said. “The ISO standard asks for it to be planned in the protocol.”

Using the auto-injector example, the testing must be performed on “representative” final production samples. Otherwise the testing may not be representative of the commercial product and may need to be repeated.   

Recommended actions:

  • Develop a validation protocol
  • Produce first pilot/commercial production run
  • Validate product to ensure outputs met inputs
  • Validate production equipment/facility/utilities
  • Complete traceability matrix
  • Perform design review

The Final Stage of Development

The purpose of Phase 6 — design transfer — is to implement procedures that safeguard correct design transfer from device design on into production.

“There is a good correlation here between the FDA regulation and the ISO standard; you must perform transfer activities of your product into commercial production,” Knauer said.

From the auto-injector example, the device’s final specifications, bill of materials (BOM), production process, validations, release testing, etc. must be fit for commercial purpose prior to marketing the product.

Recommended actions:

  • Transfer checklist of activities needed to be completed prior to commercial production
  • Process validation
  • Production equipment/facility/utility validation
  • Testing/methods validation
  • Initiate device master record
  • Final design review


Adhering to the six phases of design control in the development of a new medical device can pay significant dividends in helping manufacturers get their products to market sooner and with the flexibility to enter diverse global markets. A design control toolkit that offers a suite of document templates can be an indispensable guide for your organization's product development program (PDP) to help ensure your device is both effective and compliant.

“In keeping an eye on overall compliance to both the FDA regulation and the ISO standard, it is possible to utilize the best of both approaches and build a design control system that serves your organization well and positions you for future growth and expansion into overseas markets,” Knauer said.



  1. U.S. Food and Drug Administration. “Design Controls,” by Joseph Tartal

  2. U.S. Food and Drug Administration. “Design Control Guidance for Medical Device Manufacturers.” March 11, 1997

2017-bl-author-michael-rigertMike Rigert is a content marketing specialist at MasterControl Inc.’s headquarters in Salt Lake City, Utah. A native of the Chicago area, he has nearly a decade and a half of experience creating journalism and marketing content for the news media, public safety and higher education. He has a bachelor’s degree in political science from Brigham Young University.