Services / Medical devices

Project governance in medical device development

Governance on a device programme has two jobs. It steers the project like any other investment, and it produces decisions that stand up as quality records in an audit. These are the practices that make it do both.

Separate the decision-making bodies

Use three bodies with clear roles. Mixing them puts business pressure into design reviews and technical detail into steering meetings.

Steering

A steering committee or portfolio board owns the business decisions: funding, priority, go or no-go, launch timing.

Core team

The cross-functional team runs the project day to day: R&D, quality, regulatory, clinical, manufacturing, supply chain and marketing.

Design review

The design review board makes the formal technical judgement at each phase.

Write decision rights down. A decision matrix should say who approves design freeze, accepts residual risk, signs off verification and validation, releases labelling and approves a submission. Ambiguity here is where audits find gaps and where schedules stall.

Keep quality and regulatory independent of the project line. They should report outside the project manager's chain and have the authority to stop a gate. That independence is what makes their sign-off credible.

Build the regulatory compliance role into the gates. Under the EU MDR (Article 15) and the Swiss Medical Devices Ordinance, the person responsible for regulatory compliance must be able to carry out their duties. Give them a formal place in the gate reviews rather than an informal one.

Stage gates and design reviews

Agree gate criteria before the gate. Entry and exit criteria, required deliverables and the possible outcomes belong in the design and development plan, not in a negotiation at the meeting.

Go

Criteria met; the next phase is funded.

Conditional go

Proceed, with named actions, owners and due dates.

Recycle

Repeat or extend the current phase.

Stop

End or shelve the project, with the reasons recorded.

Separate the business gate from the design review, and hold them together. The design review judges whether the design is adequate; the gate decides whether to invest further. Each needs the other's output.

Include a reviewer with no direct responsibility for the work. The FDA required this explicitly for years, and it remains expected practice in a quality system built on ISO 13485.

Close conditional approvals. The next gate checks that every action from a conditional go was completed.

Risk governance

Let top management set the risk acceptability criteria. ISO 14971 requires a policy for establishing them. The project applies the criteria; it does not invent them.

Escalate on agreed tolerances. Set thresholds for schedule, cost, scope and risk, such as a slip of more than four weeks or any new unacceptable risk. Crossing one goes straight to steering rather than waiting for the next scheduled meeting.

Keep project risk and product risk separate, and linked. Schedule and resource risks belong in the project risk register; patient and user safety risks belong in the ISO 14971 file. A delayed test can touch both.

Change and configuration control

Run a change control board once a baseline exists. It is cross-functional and assesses each change for its effect on risk, verification, labelling, suppliers and regulatory status, including whether a new submission or a notified body notification is needed.

Make design freeze a governed decision. After freeze, scope changes go through the board, not through the project manager's discretion.

Records and reporting

Treat governance outputs as quality records. Gate minutes, attendees, decisions, rationale and open actions go into the design history file or the technical documentation. To an auditor, a decision that was not recorded was not made.

Report the same measures at every level. Milestones against the baseline, budget, top risks, open design review actions, traceability coverage and verification and validation progress. Make the status honest enough that amber means something.

Beyond the single project

Connect project governance to management review. Project problems that reveal something systemic, such as supplier quality, resourcing or a process gap, belong in CAPA and in the quality system's management review.

Govern the portfolio as well. Test labs, regulatory staff and notified body capacity are shared. Without prioritisation across projects, every plan assumes it has them to itself.

Govern the handover to the product life cycle. At launch, post-market surveillance, complaints, vigilance and design changes move to sustaining engineering and the quality system. That handover is a gate of its own, with its own record.

Good governance makes decisions early, in the right forum, and leaves a record of who decided what and why. For the wider set of practices, see project management for medical device development.

Need this on your project?

A review of an existing governance model or design control plan, or setting one up for a new device programme. Describe the project and you will get a straight answer about whether I can help.