January 12, 2024

A Guide for Managers: Employee Training Requirements for Medical Device and IVD Companies

Why Training Matters

Countless studies have shown that successful training fosters individual and organizational effectiveness. While some companies view training as a cost to be minimized, high-performing medical device and IVD manufacturers view it as an investment that pays for itself many times over in the form of:

Increased productivity
Fewer errors
Higher employee retention
Improved patient protections
Lower compliance costs
FDA and ISO 13485 training requirements

From a compliance perspective, managers often wonder:

Who needs to be trained?
What do they need to be trained on to perform their job?
Do we need to train everyone on everything?
How often do people need to be trained?
And most importantly: How should we measure and document competency?

Although training is required, the FDA Quality System Regulation (FDA QSR) and ISO 13485 do not prescribe training for specific roles. To better understand the requirements, let’s first compare the relevant sections of the FDA QSR 820.25(b) and Clause 6.2 of ISO 13485:2016 (emphasis added).

FDA Quality System Regulation 820.25(b)

(a) General. Each manufacturer shall have sufficient personnel with the necessary education, background, training, and experience to assure that all activities required by this part are correctly performed.

(b) Training. Each manufacturer shall establish procedures for identifying training needs and ensure that all personnel are trained to adequately perform their assigned responsibilities. Training shall be documented.

(1) As part of their training, personnel shall be made aware of device defects which may occur from the improper performance of their specific jobs.

(2) Personnel who perform verification and validation activities shall be made aware of defects and errors that may be encountered as part of their job functions.

ISO 13485: 2016 – Clause 6.2

Personnel performing work affecting product quality shall be competent on the basis of appropriate education, training, skills and experience.

The organization shall document the process(es) for establishing competence, providing needed training, and ensuring awareness of personnel.

The organization shall:

a) determine the necessary competence for personnel performing work affecting product quality;

b) provide training or take other actions to achieve or maintain the necessary competence;

c) evaluate the effectiveness of the actions taken;

d) ensure that its personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives;

e) maintain appropriate records of education, training, skills, and experience.

NOTE: The methodology used to check effectiveness is proportionate to the risk associated with the work for which the training or other action is being provided.

As you can see, the QSR and ISO 13485 intentionally sidestep the specifics of how to train and how much training is appropriate. Given the vast differences in training needs between a medical device start-up and a multinational device manufacturer, that makes sense.

Who Needs to Be Trained and on What?

FDA QSR 820.25(b) stipulates that employees must be “trained to adequately perform their assigned responsibilities.” That language is key, because FDA is saying that you do not need to train everyone on everything – you just need to train people on quality management system (QMS) basics plus sections of the regulation or standard relevant to their role. For example, as the company grows it would be a waste of time to train marketing staff on design controls. On the other hand, all company employees need to recognize a complaint and know how to escalate it within the organization. This table shows examples of important sections within the FDA QSR and ISO 13485 that employees are often trained on.

COMPLIANCE AREAS	QMS Compliance Basics	Complaint Handling	Design Controls	Management Controls	Document Controls	Postmarket Surveillance	Product Realization	Purchasing Controls	Risk Management	Validation
JOB FUNCTION	QMS Compliance Basics	Complaint Handling	Design Controls	Management Controls	Document Controls	Postmarket Surveillance	Product Realization	Purchasing Controls	Risk Management	Validation
Accounting & Finance	Yes	Yes	No	No	No	No	No	Yes	No	No
Customer Service	Yes	Yes	No	No	No	Yes	No	No	No	No
Engineering	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Executive Management	Yes	Yes	No	Yes	Yes	No	No	No	No	No
Human Resources	Yes	Yes	No	No	No	No	No	No	No	No
Manufacturing & Operations	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Purchasing & Logistics	Yes	Yes	Yes	Yes	Yes	No	Yes	Yes	Yes	No
RA/QA	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Clinical/Medical Affairs	Yes	Yes	Yes	No	Yes	Yes	No	No	Yes	Yes
Sales & Marketing	Yes	Yes	No	No	Yes	Yes	No	No	No	No

Defining and Assessing Employee Competency

FDA and ISO 13485 require you to define the minimum competency needed to perform a specific job and determine if the person in that role meets those requirements. For most staff, managers would typically define the education, background, and experience required in the job posting and/or the job description.

Sometimes this can be perplexing. If your purchasing manager did not finish college but is a star performer with 8 years of experience with the company in that role, is that adequate? Because the FDA QSR and ISO 13485 do not define competency, it is up to managers to justify to an auditor that a specific person is competent to fill the position. If you do not have well-defined job qualifications for each role and employee, you may want to first determine what education, background, and experience are necessary and then conduct a competency gap analysis.

Employees performing highly specialized tasks may require expert training, licenses, or certifications (e.g., QMS auditor, CPA, etc.) The personnel file should contain their certifications. No manager is going to train someone without an accounting background to become their finance director, and that’s why establishing a written baseline for education, background, and experience is so important for each role.

Documenting Employee Training

FDA and Notified Bodies often cite companies for failing to document training. Here’s an example of how seriously FDA views competency, training, and training records – the excerpt below was taken from a published FDA warning letter, which we have shortened for clarity.

Failure to train production employees responsible for quality functions as required by 21 CFR 820.25(b): Your firm’s training procedure requires all employees to be trained “to perform the assigned responsibilities” and also requires the maintenance of training records. However, no records were provided to demonstrate that employees who performed design control activities had been trained to the design control procedure. In fact, there were no training records at all for these employees. Your written response was reviewed and appears to be adequate, in that you have committed to training your research personnel with applicable QSIT principles. We also acknowledge that you may feel that the personnel who performed the design control activities were trained appropriately in research and innovation capabilities; however, quality assurance activities are not the same. If these employees had adequate experience as you have stated, we may not have discovered deficiencies related to the 510(k) submission which resulted in your firm voluntarily recalling a product from the market. We would like to emphasize that employees performing functions within the realm of the Quality System Regulations for medical devices must be trained as such and that documentation of that training is a cGMP requirement.

Ouch.

Most managers set up a training matrix to help with the following:

Identifying job-specific training requirements
Tracking completed training for individuals and departments
Demonstrating to an auditor or inspector that training is taking place and being tracked

You cannot solely rely on a master Excel spreadsheet listing all employees on one worksheet and a checkbox next to John Smith’s name saying he has been trained on SOP #24 – FDA inspectors and auditors want to see proof that the employee was actually trained. The matrix is helpful for organizing your training efforts, but you still need individual training records to prove that an employee has been trained. Simply asking an employee to “read and acknowledge” a document does not cut it as evidence of training!

Documenting Employee Training
Training Types	Acceptable	Unacceptable
In-person instructor-led group training	Employee sign-in sheet, individual attendance sheet, certificate of competency or certificate of completion	Attendee list without signatures
Virtual instructor-led group training	Certificate of competency, certificate of completion, proof of CEU credit	Registration confirmation email or notice
Online self-paced eLearning training modules	Confirmation of completion (or passing the test) issued by the learning management system (LMS), or proof of CEU credit	Registration confirmation email or notice
SOP or work instructions emailed to an employee	Not acceptable as proof of training	Not acceptable as proof of training
One-on-one training between manager and employee	Individual attendance sheet signed by employee	Screenshot of Outlook meeting invitation, or note in personnel file
Third-party instructor-led (in person, virtual, or eLearning training)	Certificate of competency, certificate of completion, proof of CEU credit	Registration confirmation email or notice

Measuring and Monitoring the Effectiveness of Training

Training is not a “one and done” exercise. In the eyes of regulators and auditors, monitoring of training effectiveness is really important – more so than the training itself. A training matrix helps you track overall training programs, and training records prove that individual employees have been trained. But how do you know if the training has been effective? Simple training records will not cut it – you must assess the effectiveness of training. There are several ways to do this:

Survey employees to see if they feel they have learned the information
Assess them during and/or after the training and periodically thereafter
Evaluate work performance to see if they are following SOPs and work instructions
Review the trainer’s assessment of effectiveness

The importance of measuring effectiveness is driven home in ISO 13485:2016 with regard to risk management. It states:

The risks should be considered if the given training is not fully understood. Consideration should specifically be given to what could be the consequences if employees interpret the essence of a certain training incorrectly and what the subsequent impact could be on a product’s quality.

Training Is Never Done . . .

Supervisors must proactively check employees’ work to make sure they are following specific SOPs, and then document the fact that this has been assessed. Responses to corrective actions sometimes result in changes to procedures. Even if that change is updated in the SOP, managers sometimes forget (or are too busy) to train the employees on the change, or they do so informally but don’t document it. FDA and Notified Bodies will often ding companies for this during audits, so make sure that departmental procedures include instructions to evaluate the impact of changes on relevant training or how that training is conducted. Sorry, annual performance evaluations cannot be used as evidence of “training effectiveness.”

Again, top-performing companies don’t view training as a cost of compliance, they look at it as a long-term investment in people and risk reduction.

Stay One Step Ahead With Oriel STAT A MATRIX

From start-ups to multinationals, 100,000+ life sciences professionals have benefited from our training on a wide range of topics. Let us assess your compliance with FDA 21 CFR Part 820.25(b) and ISO 13485 Clause 6.2. We will work with you to assess training needs, map competencies to determine who requires specific training and when, establish benchmarks for assessing participants’ knowledge base, and design/execute certification programs to ensure that employees obtain and gain expertise in the desired competencies. We can then develop or update your RA/QA curriculum, and design and teach courses to meet your needs. In this paradigm, your organization takes ownership of the program, but we’ll be there to help or update the curriculum to adjust for changing regulations.