1.1 QMS Scope, Process Map & Mandatory Records

A Quality Management System (QMS) actswithout asdefined theboundaries organization'sbecomes engineereda operatingbureaucracy logic,engine. We define scope not merelyto asatisfy repositoryauditors, of documents. Its primary function isbut to decouplefocus productengineering qualityresources fromon individualfailure human effort, ensuring that reliability is a systemic outputprevention rather than administrative overhead. If a resultprocess ofaffects heroicproduct intervention.safety, Forreliability, electronicsor manufacturingregulatory servicescompliance, (EMS),it is controlled. If it does not impact the QMSphysical mustproduct satisfyor user risk, it remains outside the dualsystem mandatesto ofpreserve commercialagility.

efficiency

Determining (ISOQMS 9001)Scope

Define the boundary based on risk and patient/userproduct safetyimpact. (ISODo 13485),not creating a "defense in depth" against defect propagation.

The Context & Risk-Based Approach 

ISO 9001:2015 and ISO 13485:2016 mandate thatencompass the organizationentire determineorganization.

its

Decision "Context"—theLogic: specificIn-Scope internalvs. and external variables that threaten quality.Out-Scope

• Risk-Based Thinking:IF Every process mapalters mustForm, featureFit, anor integrated risk assessment. In PCBA manufacturing, this requires identifying failure modes such as supply chain volatility (counterfeit component risk), process drift (reflow oven profile changes), and regulatory obsolescence (RoHS exemptions expiring).
• The Medical Device File (MDF): For ISO 13485 compliance, a specific MDF must be maintained for each device family. This file acts as the "DNA"Function of the product, linking the physical assembly to its validated process parameters. If a parameterdevice (e.g., torquePCB setting,Layout, solderFirmware pasteCommit, type)Supplier Selection) -> THEN Process is notControlled explicitly(In-Scope).
• IF definedprocess ingenerates thedata MDF, it is unauthorizedused for productionproduct use.

validation

Managementor Responsibility & Review 

Quality is not solely the domain of the Quality Department; it is a leadership deliverable.

• Management Review: Top management must analyze QMS metrics—Yield, Customer Complaints, CAPA aging, and Supplier Performance—at defined intervalsrelease (e.g., quarterly)QA toTesting, resourceMetrology) -> THEN Process is Controlled (In-Scope).
• IF process is purely administrative (e.g., Payroll, Finance, Office Management) -> THEN Process is Uncontrolled (Out-of-Scope).

Pro-Tip: Never exclude "Outsourced Processes" from scope. If a Contract Manufacturer (CM) builds the PCBA, the "Management of Outsourced Processes" is a critical internal control. You cannot outsource liability.

The Process Map (Interaction of Processes)

The QMS is a system adequately.of linked pipes, not a pile of silos. Inputs must equal outputs.

Core Architecture:

1. Input (Requirements): Market needs convert into System Requirements Specifications (SRS).
2. ResourceTransformation Provision:(Realization):
   • Design Control: Converts SRS into Technical Specifications (Gerbers, Schematics, BOM).
   • Production: Converts Technical Specifications into Physical Goods.
3. Output (Delivery): LeadershipVerified product reaches the customer.
4. Feedback (Loop): RMA and Complaint data feeds back into Design Inputs for the next revision.

Linkage Rules:

• IF Design Transfer is obligatedincomplete (e.g., missing Assembly Instructions) -> THEN Production Halis. Do not rely on tribal knowledge.
• IF Non-Conformance (NC) rate > Trigger Limit -> THEN CAPA process Initiates automatically.

Mandatory Records (Evidence of Control)

Records are not generated for the auditor; they are generated to provideenable Root Cause Analysis (RCA) 5 years from now. If it isn't written down, it didn't happen, and the batch is suspect.

Traceability Hierarchy:

• DHF (Design History File): Why we built it. (Contains: SRS, Risk Analysis, Design Reviews).
• DMR (Device Master Record): What we build. (Contains: Approved BOM, Gerbers, SOPs).
• DHR (Device History Record): How we built this specific infrastructureunit. (cleanrooms,Contains: ESDSerial flooring,Numbers, calibratedTest tools)Logs, Rework Notes, Date Codes).

Retention Policy:

• IF Product Lifecycle is $X$ years -> THEN Retain records for $X + 2$ years (or as required toby achievelocal productlaw, conformity.whichever Failureis longer).
• IF Record pertains to provideSafety theseCritical resourcesComponent constitutes-> aTHEN majorRetain non-conformance.Indefinitely.

Pro-Tip: Digitally sign records at the moment of creation. Retroactive signing (backdating) is fraud and destroys data integrity.

Final Checklist

QMSControl ElementPoint	Critical Requirement	AuditNon-Negotiable EvidenceRule
RiskScope ManagementBoundary	ISOExclusions 14971must be justified (Medical)e.g., or"We ISOdo 9001not Risk Registerservice").	FMEADo Documentsnot /claim Risk"Design" Registerexclusion if you modify firmare.
DeviceProcess MasterInteraction	Outputs Recordof A must meet Inputs of B.	No "Throw it over the wall" handoffs.
DHR Integrity	Full technicaltraceability fileto forcomponent everylot PNlevel.	MDFMissing /serial DMRnumber index= linkScrap the unit.
ManagementRecord ReviewRetention	QuarterlyRetrieveable Performancewithin Analysis24 hours.	MeetingBackups Minutesmust &be Actiontested Itemsquarterly.
TraceabilityChange Control	Forward/BackwardRevision linkagehistory ofon materialsall DMR docs.	ERPNo Genealogyuncontrolled Reports"Redline" changes on the production floor.