How to Audit & Select a CRO for the Updated ISO 10993-1 Standard

Navigating the updated ISO 10993-1 standard for the biological evaluation of medical devices requires a significant shift in strategy for manufacturers. The standard’s increased emphasis on a comprehensive, risk-based approach means that selecting a contract research organization (CRO) is no longer a simple procurement task. It is a critical strategic decision that can directly impact regulatory submission timelines and success. An effective audit and selection process must extend far beyond verifying foundational credentials like ISO/IEC 17025 accreditation and Good Laboratory Practice (GLP) compliance. Manufacturers must now probe a CRO’s proactive readiness for the revised standard, their depth of expertise in chemical characterization and toxicological risk assessment, and their ability to function as a strategic partner. A forward-thinking CRO will be able to demonstrate how they have adapted their internal processes, trained their staff, and structured their documentation to align with the new regulatory expectations, ensuring a testing strategy is not just compliant, but defensible. ## Key Points * **Beyond Basic Accreditation:** While ISO/IEC 17025 accreditation and GLP compliance are essential prerequisites, they are merely the starting point. A robust audit must evaluate a CRO's specific expertise relevant to the updated standard. * **Proactive Readiness is Paramount:** The best partners have already invested in preparing for the new ISO 10993-1. Look for evidence of staff training, revised standard operating procedures (SOPs), and updated Biological Evaluation Plan (BEP) templates. * **Mastery of the Risk-Based Approach:** A qualified CRO must demonstrate proficiency in developing a comprehensive BEP that integrates device materials, manufacturing processes, and intended use into a holistic biological risk assessment, rather than simply following a checklist of tests. * **Chemical Characterization as a Cornerstone:** The updated standard places heavy emphasis on chemical characterization. Scrutinize a CRO's analytical chemistry capabilities (e.g., ISO 10993-18) and, crucially, their ability to use that data in a toxicological risk assessment (e.g., ISO 10993-17). * **Strategic Partnership over Task Execution:** The goal is to find a partner who can help build a scientifically sound and defensible testing strategy, provide consultative feedback, and anticipate regulator questions—not just a lab that executes tests on command. * **Documentation for Defensibility:** A top-tier CRO should be able to articulate precisely how their final reports are structured to demonstrate compliance with the new standard and proactively address potential questions from FDA or other regulatory bodies. ## Understanding the Paradigm Shift in ISO 10993-1 The evolution of ISO 10993-1 represents a fundamental shift from a prescriptive, test-based checklist to a comprehensive, risk-management framework. Historically, biocompatibility was often demonstrated by conducting a predefined set of biological tests based on device category and contact duration. The updated approach, strongly endorsed by regulators like the FDA, requires a much more integrated and scientific thought process. The core elements of this new paradigm include: 1. **Centrality of the Biological Evaluation Plan (BEP):** The BEP is no longer a preliminary document but the foundational roadmap for the entire biological evaluation. It must detail a systematic plan based on a thorough risk analysis of the device's materials, manufacturing processes (including sterilization and cleaning), and clinical use. 2. **Physical and Chemical Information First:** Before any biological testing is considered, the standard requires a thorough collection of data on the device's material composition and manufacturing. This includes understanding potential chemical residues, degradation products, and process contaminants. 3. **Integration of Chemical Characterization:** For many devices, particularly those with long-term patient contact, analytical chemistry testing to identify and quantify extractable and leachable (E&L) substances is now a default expectation. This data, gathered under standards like ISO 10993-18, serves as a critical input for the risk assessment. 4. **Toxicological Risk Assessment:** The chemical information gathered must be evaluated by a qualified toxicologist to assess the risk posed by each substance. This assessment, guided by ISO 10993-17, can often be used to demonstrate device safety without the need for certain animal tests, supporting the principles of the 3Rs (Replacement, Reduction, and Refinement). 5. **Justified Testing:** Any subsequent biological tests must be scientifically justified within the BEP. The plan should explain why the information from chemical and physical analysis is insufficient to address a particular biological endpoint and why a specific test is necessary. This shift means manufacturers and their CRO partners must act more like scientific investigators, building a case for safety based on a weight of evidence, rather than simply checking boxes. ## A Step-by-Step Framework for Auditing a Biocompatibility CRO A thorough CRO audit should be conducted in phases, moving from high-level qualification to a deep technical and strategic assessment. ### Phase 1: Initial Screening and Documentation Review This phase serves to create a shortlist of qualified candidates by verifying foundational credentials. * **ISO/IEC 17025 Accreditation:** Request the CRO's certificate of accreditation. Critically, review the **scope of accreditation** to ensure the specific ISO 10993 tests relevant to your device are listed. * **GLP Compliance:** Confirm the CRO's adherence to Good Laboratory Practice regulations (e.g., as outlined in 21 CFR Part 58). This is non-negotiable for data intended for regulatory submissions. * **Relevant Experience:** Ask for a summary of their experience with devices similar to yours in terms of materials, clinical application, and risk class. * **Sample Documentation:** Request redacted samples of key documents to evaluate their quality, clarity, and thoroughness. This includes: * A Biological Evaluation Plan (BEP) template * A final Biological Evaluation Report (BER) * A final report for a key analytical study (e.g., chemical characterization) ### Phase 2: The Technical Deep-Dive Audit This is the most critical phase, where you assess the CRO's readiness for the updated standard. This evaluation should involve your own technical experts (e.g., materials scientists, toxicologists). #### Assessing Proactive Readiness * **Training and Competency:** Ask for details on the specific training their technical staff (study directors, chemists, toxicologists) have received on the updated ISO 10993-1 and related standards. Have they participated in industry working groups or professional development seminars on the topic? * **SOP and Template Updates:** Inquire how they have revised their internal SOPs, test protocols, and document templates (BEP, BER) to align with the new risk-based requirements. A proactive lab should be able to show you tangible changes. * **Investment in Technology:** Discuss their analytical chemistry instrumentation. Do they have the necessary technology (e.g., GC-MS, LC-MS, ICP-MS) and validated methods to perform comprehensive chemical characterization? #### Evaluating Expertise in the Risk-Based Approach * **BEP Development Process:** Ask them to walk you through their process for creating a BEP. How do they gather the necessary information about the device? How do they perform the initial risk analysis to identify potential biological hazards? * **Justification for Testing (or Not Testing):** Present a hypothetical scenario and ask how they would justify a testing plan. More importantly, ask for an example of how they have successfully used existing data or a risk assessment to justify *waiving* a biological test. This demonstrates a true understanding of the standard's intent. #### Scrutinizing Chemical Characterization and Toxicology * **Analytical Strategy:** How do they design an extraction study? How are extraction conditions (solvents, temperature, duration) selected and justified to be clinically relevant? * **Toxicological Assessment Process:** Who performs the toxicological risk assessment? Ask for the qualifications (e.g., board certification) of their toxicologists. How do they handle chemical substances with limited or no available toxicity data? * **Integration of Data:** How is the chemical and toxicological data integrated into the final Biological Evaluation Report? The report should tell a clear, cohesive story that connects the material data to the overall conclusion of safety. ### Phase 3: Evaluating Strategic Partnership and Communication * **Problem Solving:** Ask for examples of how they have handled unexpected or out-of-specification results. A good partner collaborates on an investigation and solution, while a poor one simply delivers the bad news. * **Project Management and Communication:** Who will be your primary point of contact? What is the expected frequency of communication and progress updates? Clear and consistent communication is vital for keeping submission timelines on track. * **Regulatory Support:** Does the CRO have experience supporting clients during regulatory reviews? Are they prepared to help answer questions from the FDA or a Notified Body regarding the biocompatibility data they generated? ## Evaluating CROs for Different Device Scenarios The audit focus should be tailored to the risk of your device. ### Scenario 1: Low-Risk, Limited Contact Device (e.g., a tongue depressor) * **Audit Focus:** The primary goal is to demonstrate safety efficiently and cost-effectively. The audit should focus on the CRO's ability to leverage existing material data and write a strong scientific rationale to minimize or eliminate the need for new testing. * **Critical CRO Capabilities:** Expertise in literature reviews, material safety data, and writing a concise but robust BEP/BER that justifies a limited testing plan. ### Scenario 2: High-Risk, Permanent Implant (e.g., an artificial heart valve) * **Audit Focus:** This scenario requires the highest level of scientific rigor. The audit must deeply probe the CRO's expertise in advanced chemical characterization, sophisticated toxicological risk assessment, and long-term implantation studies. * **Critical CRO Capabilities:** A team of highly qualified, in-house analytical chemists and board-certified toxicologists. Proven experience with long-term studies and defending novel testing strategies to regulators is essential. The ability to provide data to support a Q-Submission is a significant advantage. ## Strategic Considerations and the Role of Q-Submission For devices involving novel materials, unique manufacturing processes, or a testing strategy that deviates from established practice, early engagement with the FDA is highly recommended. The Q-Submission program provides a formal pathway for manufacturers to get feedback on their proposed testing plans before committing significant time and resources. A high-quality CRO can be an invaluable partner in this process. They can help develop the comprehensive biological evaluation strategy and generate the preliminary data needed to support a Pre-Submission meeting with the FDA. Discussing a complex biocompatibility plan with the agency can significantly de-risk the final marketing submission by ensuring alignment on testing requirements early in the development process. ## Finding and Comparing Biocompatibility Testing Services Providers When selecting a CRO, manufacturers should look beyond the technical audit and consider practical aspects of the partnership. It is advisable to request detailed proposals from at least two to three shortlisted CROs. When comparing these proposals, evaluate the following: * **Scope and Detail:** Does the proposal clearly outline every step of the proposed plan, from BEP development to final reporting? * **Timelines:** Are the proposed timelines realistic? How does the CRO handle potential delays? * **Team and Expertise:** Does the proposal identify the key personnel (study director, toxicologist) who will be assigned to your project and list their qualifications? * **Cost Structure:** Is the pricing transparent? Be wary of proposals that are significantly cheaper, as they may reflect a less thorough, checklist-based approach that is no longer sufficient. The goal is to find the best value, which is a combination of deep technical expertise, strategic partnership, and a fair price. To find qualified vetted providers [click here](https://cruxi.ai/regulatory-directories/biocompatibility_testing) and request quotes for free. ## Key FDA References When developing a biocompatibility strategy for a US submission, sponsors should familiarize themselves with the FDA's current thinking. Key resources often include: * FDA's guidance on the "Use of International Standard ISO 10993-1, 'Biological evaluation of medical devices - Part 1: Evaluation and testing within a risk management process'". * General principles of Good Laboratory Practice (GLP) as described under 21 CFR Part 58. * FDA's Q-Submission Program guidance for information on obtaining agency feedback on testing plans. Sponsors should always consult the FDA website for the latest versions of official guidance documents. --- This article is for general educational purposes only and is not legal, medical, or regulatory advice. For device-specific questions, sponsors should consult qualified experts and consider engaging FDA via the Q-Submission program. --- *This answer was AI-assisted and reviewed for accuracy by Lo H. Khamis.*