Maintaining Traceability Between User Requirements, Risk Controls and Verification Evidence

In the context of modern medical device quality systems and the FDA's QMSR alignment with ISO 13485:2016, "Maintaining Traceability Between User Requirements, Risk Controls and Verification Evidence" is less about producing a larger traceability matrix and more about maintaining a trustworthy product configuration throughout the lifecycle. Traceability is an observable property of that maintained configuration: the ability to determine what configured information objects are connected, why the relationships exist, under which approved state and applicability or effectivity they are valid, and what objective evidence supports them. This topic is especially relevant in organizations transitioning from document-centric quality systems toward configuration-centric, data-centric quality systems. In such systems, documents are controlled views, packages, or outputs assembled from configured information. They should not become isolated containers in which critical relationships or configuration state exist only as repeated text.

_{WHY YOU SHOULD ATTEND:}

Many medical device companies maintain separate documents for:

• User requirements
• Risk management
• Verification testing
• Design history

The challenge is that these documents are often connected manually. As products change, links between them can become outdated, broken, or configuration-wrong, making it difficult to determine how a requirement was addressed, how a risk was controlled, what design output implemented the control, or what evidence proves compliance for the applicable product configuration. This webinar explores how to maintain configured information and its relationships rather than relying on documents alone.

A common assumption is that a traceability matrix equals traceability. It does not. A traceability matrix is a snapshot - a view or report of a configuration at a point in time. It is not the source of truth. The source of truth is the controlled configuration state: the maintained information objects, their defined relationships, their approved states, their applicability or effectivity, and the changes and evidence associated with them. Documents may present that configuration, but they do not create or preserve it on their own. If the underlying configuration is not maintained, a matrix can be complete in appearance and still be stale or wrong.

The maintained product configuration includes controlled relationships among:

• User need
• User requirement or design input
• Hazardous situation or identified risk
• Risk control measure
• Design output implementing the control
• Verification method
• Verification result and objective evidence
• Residual risk evaluation
• Approved change and affected configuration objects
• Applicable or effective product configuration

Attendees will see traceability not merely as connected information or linked documents, but as an observable property of a correctly maintained configuration. A relationship can exist and still be wrong if it points to the wrong revision, an obsolete method, evidence generated against a different configuration, or an object outside its applicability or effectivity. They will begin asking:

• What user need does this requirement support?
• What risk does this control address?
• Which approved design output implements the requirement or risk control?
• What approved verification method demonstrates implementation or effectiveness, and where is the resulting objective evidence?
• For which product configuration, revision, applicability, or effectivity is this relationship valid?

This configuration-centric approach makes traceability easier to maintain as products evolve because traceability is produced by the maintained configuration rather than reconstructed through document updates.

Attendees will learn how to:

• Identify gaps between requirements, risks, design outputs, and testing.
• Distinguish connected relationships from correct configuration relationships.
• Perform change impact assessments more effectively.
• Reduce manual updates across multiple documents.
• Achieve inspection readiness by demonstrating the approved configuration and the evidence supporting it.
• Shift from a document-centric mindset through relationship-centric thinking to a configuration-centric quality system.

A change to one configured information object can affect several related objects and relationships. A user requirement change, for example, may affect risk analysis, risk controls, design outputs, verification methods, verification evidence, residual-risk conclusions, and the product configurations to which those objects apply. The purpose of maintaining traceability is not to reconstruct history during an inspection. It is to expose affected objects and relationships before change approval. A configuration-centric quality system therefore requires practical operational controls such as defined information-object types, defined relationship types, stable identifiers, controlled object and relationship status, revision state, applicability or effectivity, and approved change.

When configured information objects, relationships, states, applicability or effectivity, changes, and objective evidence are maintained as a coherent configuration, documentation becomes easier to generate and maintain, change impact becomes easier to assess, and compliance evidence becomes easier to demonstrate. A traceability matrix, risk-management report, verification summary, design-review package, or inspection response can then be treated as a controlled view of the same configured state rather than as a competing source of truth.

_{AREAS COVERED:}

• Why traceability fails in document-centric systems
• Traceability matrix vs. maintained configuration
• Configured information objects and controlled states
• Relationship types across the design lifecycle
• Applicability and effectivity of relationships
• Risk-control, design-output, and verification relationships
• Connected vs. configuration-correct traceability
• Change-impact assessment
• Identifying missing, broken, stale, and configuration-wrong relationships
• Generating traceability views and controlled documents
• Inspection readiness as an output of maintained configuration
• Practical transition from document-centric to configuration-centric quality systems using lean documents and lean configuration

_{WHO SHOULD ATTEND:}

• Manufacturing Departments 
• Engineering Departments
• Quality Assurance Departments
• Operations Departments
• Systems Engineering Teams
• Design Engineering Teams
• Design Assurance Teams
• Risk Management Teams
• Verification and Validation Teams
• Software Quality Departments
• Regulatory Affairs Departments
• Configuration Management Teams
• Document and Information Management
• Engineering Change Control Teams

Course Director: JOSE MORA

José Ignacio Mora is a seasoned Principal Consultant specializing in Manufacturing Engineering and Quality Systems, with over 30 years of experience in the medical-device and life-sciences industries. His expertise lies in manufacturing, process development, tooling, and quality systems. Before joining Atzari Consulting as a consulting partner, José served as Director of Manufacturing Engineering at Boston Scientific and as Quality Systems Manager at Stryker Orthopedics.

José has an impressive track record of leading the successful launch of manufacturing at a startup urology products company and creating a world-class medical device manufacturing operation using JIT, kanban systems, visual workplace, and lean manufacturing practices. His expertise extends to surgical instruments; PTA and PTCA dilatation and guiding catheters; plastic surgery implants and tissue expanders; urology implants and devices; delivery systems for brachytherapy; orthopedic implants and instruments; and vascular surgery grafts and textiles.

José has received training in, and has decades of hands-on experience applying, world-class methodologies, including Kepner-Tregoe, Taguchi techniques, the Theory of Constraints, Lean Manufacturing, 5S (Visual Workplace), process validation to Global Harmonization Task Force (GHTF) guidance and standards, and similar approaches.