Internal Quality Audit

A medical device company should have a robust internal quality audit program which consists of procedure, team, plan, quality audit checklist to audit the quality system regularly.

For quality audit plan:  Quality Assurance (QA) should be responsible for the planning and scheduling of internal audits of the quality system, manufacturing processes and products. QA should establish audit frequency. The audit frequency is often based on the importance of manufacturing processes, products and areas. Should there be customer complaints, internal and external nonconformities regarding a product and process, internal audit for that area of interest should be carried out.

Internal audit should be performed at the very least once a year or semiannually or quarterly.

The internal quality audit plan should be mapped out clearly in a matrix with all the quality system elements like that of 21 CFR 820 and ISO 14971. In this plan, there should be responsible group who will be performing the internal audit on the desired date of the audit.

The audit team should consist of qualified, experienced and independent quality auditors who are very well versed in the quality system about to be audited.

During the audit, auditors seek objective evidence demonstrating whether the audited activities conform to the requirements of the documented quality system, and whether the system is effectively implemented and maintained. When nonconformity is noted, it is brought to the attention of, and discussed with, the responsible individual of the department in question.

Before the end of the audit, each noted nonconformity is documented using the Audit Nonconformity Report form. Auditors fill out only the first part of the form, describing the noted nonconformity. The form is then handed over to the responsible individual who uses its second part to propose a corrective action.

Documentation and record: Internal audits, implementation of resulting corrective actions, and follow-up audits are documented using the audit nonconformity report form.

At the end of an auditing cycle, all nonconformity reports established during the cycle are compiled and analyzed, and are presented at the management review meeting.

The following is the exact working from FDA website.

820.22	Each manufacturer shall establish procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system.
820.22	Quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited.
820.22	Corrective action(s), including a re-audit of deficient matters, shall be taken when necessary.
820.22	A report of the results of each quality audit, and re-audit(s) where taken, shall be made and such reports shall be reviewed by management having responsibility for the matters audited..
820.22	The dates and results of quality audits and re-audits shall be documented

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

Organization Structure

Medical Device manufacturer should have a procedure for upgrading and recording organizational structure information and the organizational structure chart. Normally this responsibility is being performed by human resource.

Human Resource should have to upkeep the employment record of all employees including resumes, CV, performance review, certification, diploma, patents, offer letter, employment agreement, resignation letter and termination letter etc.  

Human Resource should also update the organization chart regularly if there is any changes in the organization. Below is a simple sample of the organization chart. Human Resource should complete the chart completely.

Below is the exact wording from FDA website.

820.20(b)	Each manufacturer shall establish and maintain and adequate organizational structure to insure that devices are designed and produced in accordance with the requirements of this part
820.20(b)(1)	Responsibility and authority. Each manufacturer shall establish the appropriate responsibility, authority, and interrelation of all personnel who manage, perform, and assess work affecting quality, and provide the independence and authority necessary to perform these tasks.
820.20(b)(2)	Resources. Each manufacturer shall provide adequate resources, including the assignment of trained personnel, for management, performance of work, and assessment activities, including internal quality audits, to meet the requirements of this part.

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

Management Representative

One of the key requirements is for top management of a medical device company to appoint a ‘management representative’ with executive responsibility to oversee the quality system practiced in the medical device company. Of course, this management representative must be qualified enough with years of quality system experience.

Often time, when the officials from a regulatory body show up, this management representative will have to interact with them.

Basically some of the executive responsibility of this management representative is to

a)  Ensuring quality system requirements such as 21 CFR 820 and ISO 13485 etc in the company are effectively established and effectively maintained accordingly.

b) Reporting on the performance of the quality system to management with executive responsibility for review to ensure it is in compliance with all related quality system related to the company. For example, if the company is selling product to Australia, the company ought to be in compliance with quality system stipulated by Australian Government Therapeutic Goods Administration (TGA).

c) Management and management representative shall review the suitability and effectiveness of the quality system at defined intervals like twice a year. All the activity must be made into a procedure for example with quality policy and objectives.

The dates and results of the quality system reviews shall be documented with detail of what had been discussed.

Another thing, it is advisable for the top management to write a letter of appointment to formalize the appointment. The CEO or quality director should sign the letter of appointment. Below is the exact wording from FDA website.

820.20(3)	Executive management shall appoint a Management representative (MR).with executive responsibility.
820.20(3)(i)	He or She shall have authority over and responsibility for:a) Ensuring quality system requirements are effectively established and effectively maintained accordingly.
820.20(b)(ii)	b) Reporting on the performance of the quality system to management with executive responsibility for review

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time. 

21 CFR 820.65 Traceability

Basically, traceability is based on identifying the finished product with unique control numbers. It is a regulatory requirement. This traceability is useful should there be a product recall.

The extent of traceability includes

·        Serial or batch numbers

·        identification of Purchase Order for critical materials and components used;

·        Identification of key processes and inspection equipment and their operators;

·        Inspection and testing results and identification of inspectors;

·        Identification of personnel performing final labeling operations.

The actual traceability information required for a given medical device should be able to be called out in the production work order for this product.

Traceability Records for purchased materials and components. Their origination and verification records, such as certificates of analysis, testing inspection reports supplied with the product, etc., are linked to the products through their purchase orders. Purchase Orders are maintained by Purchasing. Purchasing department must keep all of these records for a certain period even after the product is discontinued. It is because there might be old product out in the market.

Traceability Records for finished products can be achieved by the work order. Work order is the main traceability record linking the product to its production history. Some data may also be recorded in logs, tables, or databases associated with particular workstations or processes. Work orders and any additional traceability records are maintained in the Device History Record (DHR) or Lot History Record (LHR).

Sponsor should also have a recall plan to test the efficiency of the traceability program. Perform a mock recall periodically.

The following is the exact wording of the traceability requirement from the FDA website.

Sec. 820.65 Traceability.

Each manufacturer of a device that is intended for surgical implant into the body or to support or sustain life and whose failure to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury to the user shall establish and maintain procedures for identifying with a control number each unit, lot, or batch of finished devices and where appropriate components. The procedures shall facilitate corrective action. Such identification shall be documented in the DHR.

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

21 CFR 820.60 Identification. Identification of Medical Device

To be in compliance with this section of identification, sponsor should always establish procedures and protocols to provide a system and instruction for product identification. It is not only apply to finished products, the system should also apply to materials, parts, sub-assemblies and other critical components.

Sponsor should establish part number and device configuration record and traceability record. Purchased materials, parts and components are identified with unique numbers, codes, or names. The identifications should be maintained while the ‘products’ are in the production, finished product, storage and even at consumers locations.

Identification should be performed during production. During all stages of production, manufactured parts and sub-assemblies are identified by the work order. Work orders accompany products as they move from one workstation or production process to the next.

Identification should be performed during finished product. Finished products are identified by a label that is permanently affixed to the product. The identification label includes the name and model of the product; the name, address and phone number of the manufacturer; and the serial or lot number.

Identification of Returned Product: Products returned for servicing are brought to the receiving desk in the servicing department and are tagged with the service job number. New products returned for exchange, refund or for any other reason are labeled HOLD and are placed in a designate a holding (quarantine) area before moving redistribution area or being repaired.

The following is the exact wording from FDA website.

Sec. 820.60 Identification.

Each manufacturer shall establish and maintain procedures for identifying product during all stages of receipt, production, distribution, and installation to prevent mixups.

1.     –CFR-Code of Federal Regulation Title 21 part 820 Quality System Regulation, www.fda.gov, page last updated 06/01/2013.

The next I shall blog about traceability of product.

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

SEC 820.50 PURCHASING CONTROLS

Some of the key requirements in purchasing controls are always have procedures to evaluate and select potential suppliers, contractors and consultants. Sponsor are advised to have an ‘Approved Supplier List’ where the detail of each sponsor evaluation. How and when it is being evaluated. What is the outcome of each evaluation? Qualified auditor should physically go to the site to audit thoroughly the whole site and should also re-audit per schedule. Update the Approved Supplier List regularly. Should any supplier disqualified, inform all purchasing department of the sponsor’s status.

Another key issue is that sponsor must sign a quality agreement with the supplier so that part/parts must be made accordingly to sponsor specification.

Sponsor must have a supplier evaluation form to ‘evaluate’ each supplier. Example of items in the form are: Name, Contact Information, Supplier Quality Certification like ISO 13485, Job/Part Description, Initiation Date, on-time delivery, evaluation results etc.

The following are the exact working I copy from FDA website (1).

Each manufacturer shall establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements.
(a)Evaluation of suppliers, contractors, and consultants.	Each manufacturer shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants. Each manufacturer shall: (1) Evaluate and select potential suppliers, contractors, and consultants on the basis of their ability to meet specified requirements, including quality requirements. The evaluation shall be documented. (2) Define the type and extent of control to be exercised over the product, services, suppliers, contractors, and consultants, based on the evaluation results. (3) Establish and maintain records of acceptable suppliers, contractors, and consultants.
(b)Purchasing data.	Each manufacturer shall establish and maintain data that clearly describe or reference the specified requirements, including quality requirements, for purchased or otherwise received product and services. Purchasing documents shall include, where possible, an agreement that the suppliers, contractors, and consultants agree to notify the manufacturer of changes in the product or service so that manufacturers may determine whether the changes may affect the quality of a finished device. Purchasing data shall be approved in accordance with 820.40.

1.     –CFR-Code of Federal Regulation Title 21 part 820 Quality System Regulation,  www.fda.gov, page last updated 06/01/2013.

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

820.40 Document controls.

The whole points of this section ‘Document Controls” are nobody can simply revise and approve any procedure and documents. All new revision of procedures, documents, protocol, manufacturing processes must be well thought of and be implemented effectively throughout the whole organization.    Associates whom have been effectively trained on the documents can perform a task according to the procedure.

Each stage of a document must be indicated as either ‘DRAFT’, ‘Controlled’ or OBSOLETE’. Only approved documents can be used. Effective date of each document must be conspicuously shown on the document or the effective date is easily accessible. It is not uncommon for careless associate to work on the old revision of a procedure resulting in a messy deviation.  This obsolete document must be marked ‘OBSOLETE” and be removed promptly from being inadvertently used.

Any change to each document must be performed according to corporate procedure. It is critical to get all related departments managers involved to ensure the change can be reviewed, edit, approved and implemented.

A sponsor should have a document control department to ensure all new documents are initiated, edited and written properly and present documents revised accordingly. There should not be any obsolete document floating around.  

The table below is the exact working from FDA website.

Sec. 820.40 Document controls.
Each manufacturer shall establish and maintain procedures to control all documents that are required by this part. The procedures shall provide for the following:
(a)Document approval and distribution	Each manufacturer shall designate an individual(s) to review for adequacy and approve prior to issuance all documents established to meet the requirements of this part. The approval, including the date and signature of the individual(s) approving the document, shall be documented. Documents established to meet the requirements of this part shall be available at all locations for which they are designated, used, or otherwise necessary, and all obsolete documents shall be promptly removed from all points of use or otherwise prevented from unintended use.
(b)Document changes.	Changes to documents shall be reviewed and approved by an individual(s) in the same function or organization that performed the original review and approval, unless specifically designated otherwise. Approved changes shall be communicated to the appropriate personnel in a timely manner. Each manufacturer shall maintain records of changes to documents. Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective.

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

21 CFR 820.30 Design Control

Design Control is one of the most important quality elements of medical device quality system. Table below tabulate each element of design control(1,2). I just copied verbatim directly from the FDA website.

Since the brevity of the blog post, it is impractical to discuss every element in detail. But,
when initiating a medical device, follow and comply with all elements of design control. The keys are having a plan, write procedures for everything and documents every activities in detail about the medical device. Have all the protocols and reports of all testing filed and organized in one location. Always keep the Design History File (DHF) most updated.

Basically, Design Controls are an interrelated set of practices and procedures that are incorporated into the design and development process (2).

Subpart C: 21 CFR 820.30 Design Control(1)
820.30 Design Controls (a) General	(1) Each manufacturer of any class III or class II device, and the class I devices listed in paragraph (a)(2) of this section, shall establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met
21 CFR 820.30 Design Control (b) Design and development planning.	Each manufacturer shall establish and maintain plans that describe or reference the design and development activities and define responsibility for implementation. The plans shall identify and describe the interfaces with different groups or activities that provide, or result in, input to the design and development process. The plans shall be reviewed, updated, and approved as design and development evolves.
21 CFR 820.30 Design Control (c)Design input.	Each manufacturer shall establish and maintain procedures to ensure that the design requirements relating to a device are appropriate and address the intended use of the device, including the needs of the user and patient. The procedures shall include a mechanism for addressing incomplete, ambiguous, or conflicting requirements. The design input requirements shall be documented and shall be reviewed and approved by a designated individual(s). The approval, including the date and signature of the individual(s) approving the requirements, shall be documented.
21 CFR 820.30 Design Control (d)Design output	Each manufacturer shall establish and maintain procedures for defining and documenting design output in terms that allow an adequate evaluation of conformance to design input requirements. Design output procedures shall contain or make reference to acceptance criteria and shall ensure that those design outputs that are essential for the proper functioning of the device are identified. Design output shall be documented, reviewed, and approved before release. The approval, including the date and signature of the individual(s) approving the output, shall be documented.
21 CFR 820.30 Design Control (e)Design review.	Each manufacturer shall establish and maintain procedures to ensure that formal documented reviews of the design results are planned and conducted at appropriate stages of the device's design development. The procedures shall ensure that participants at each design review include representatives of all functions concerned with the design stage being reviewed and an individual(s) who does not have direct responsibility for the design stage being reviewed, as well as any specialists needed. The results of a design review, including identification of the design, the date, and the individual(s) performing the review, shall be documented in the design history file (the DHF).
21 CFR 820.30 Design Control (f)Design verification.	Each manufacturer shall establish and maintain procedures for verifying the device design. Design verification shall confirm that the design output meets the design input requirements. The results of the design verification, including identification of the design, method(s), the date, and the individual(s) performing the verification, shall be documented in the DHF.
21 CFR 820.30 Design Control (g)Design validation.	Each manufacturer shall establish and maintain procedures for validating the device design. Design validation shall be performed under defined operating conditions on initial production units, lots, or batches, or their equivalents. Design validation shall ensure that devices conform to defined user needs and intended uses and shall include testing of production units under actual or simulated use conditions. Design validation shall include software validation and risk analysis, where appropriate. The results of the design validation, including identification of the design, method(s), the date, and the individual(s) performing the validation, shall be documented in the DHF.
21 CFR 820.30 Design Control (h)Design transfer.	Each manufacturer shall establish and maintain procedures to ensure that the device design is correctly translated into production specifications.
21 CFR 820.30 Design Control (i) Design Changes	Each manufacturer shall establish and maintain procedures for the identification, documentation, validation or where appropriate verification, review, and approval of design changes before their implementation.
21 CFR 820.30 Design Control (j)Design history file.	Each manufacturer shall establish and maintain a DHF for each type of device. The DHF shall contain or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan and the requirements of this part.

 

1.     –21 CFR-Code of Federal Regulation Title 21, www.fda.gov, page last updated: 06/01/2013.

2.     –Design Control Guidance For Medical Device Manufacturers, March 11 1997, FDA

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

 

 

Medical Device Quality System 21 CFR 820

This blog talks about the medical device regulations and there are many regulations and guidelines which sponsors (companies, manufacturers) are obligated to comply with when they manufacturer or import products in or into the US respectively. Let us start with the Quality System Regulation (QS)/Good Manufacturing Practices (GMP) – 21 CFR Part 820.  This 21 CFR Part 820 is the key regulation pertains to medical device quality system in the US.

Per (1)- “The quality system regulation includes requirements related to the methods used in and the facilities and controls used for: designing, purchasing, manufacturing, packaging, labeling, storing, installing and servicing of medical devices. Manufacturing facilities undergo FDA inspections to assure compliance with the QS requirements”.

Since this is a big topic. There will be several blogs to discuss each subpart of 21 CFR Part 820. The following subparts for 21 CFR Part 820 are tabulated below. If warranted, each subpart shall be discussed in subsequently blog in more detail.  The Subparts are shown below(2):

21 CFR 820 Quality System Regulation(2)

Subpart A—General Provisions	Sec. 820.1 Scope, Sec. 820.3 Definitions., Sec. 820.5 Quality system.
Subpart B—Quality System Requirements	Sec. 820.20 Management responsibility, Sec. 820.22 Quality audit, Sec. 820.25 Personnel.
Subpart C--Design Controls	Sec. 820.30 Design controls.
Subpart D--Document Controls	Sec. 820.40 Document controls.
Subpart E--Purchasing Controls	Sec. 820.50 Purchasing controls.
Subpart F—Identification and Traceability	Sec. 820.60 Identification, Sec. 820.65 Traceability.
Subpart G--Production and Process Controls	Sec. 820.70 Production and process controls. Sec. 820.72 Inspection, measuring, and test equipment.
Subpart H--Acceptance Activities	Sec. 820.80 Receiving, in-process, and finished device acceptance. Sec. 820.86 Acceptance status.
Subpart I--Nonconforming Product	Sec. 820.90 Nonconforming product.
Subpart J--Corrective and Preventive Action	Sec. 820.100 Corrective and preventive action.
Subpart K--Labeling and Packaging Control	Sec. 820.120 Device labeling. Sec. 820.130 Device packaging.
Subpart L--Handling, Storage, Distribution, and Installation	Sec. 820.140 Handling. Sec. 820.150 Storage. Sec. 820.160 Distribution. Sec. 820.170 Installation.
Subpart M--Records	Sec. 820.180 General requirements. Sec. 820.181 Device master record. Sec. 820.184 Device history record. Sec. 820.186 Quality system record. Sec. 820.198 Complaint files.
Subpart N--Servicing	Sec. 820.200 Servicing.
Subpart O--Statistical Techniques	Sec. 820.250 Statistical techniques.

 1.     –Overview of Device Regulation, US, Food and Drug Administration, www.fda.gov, page last
updated: 06/26/2014.

2.     –21 CFR 820 Qualtiy System Regulation, US, Food and Drug Administration, www.fda.gov, page
last 06/01/2013.  

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.