21 CFR 820.100 Corrective and Preventive Action (CAPA)

Per many citations, an example of the citation entitled “GxP Process Management Software, Master Control, White Paper: Ten Most Common Reasons for FDA 483 Observations and Warning Letter Citations”, CAPA is among the top reason of the citations. Examples are:

·        ‘Corrective and Preventive Action (CAPA) procedures are inadequate’.

·        ‘Corrective and Preventive Action are inadequately documented’.

Therefore, sponsors should pay a lot of attention to CAPA, its initiation, implementation, effectiveness, closure and documentation. Sponsor should have a system, procedure, work instruction and forms and to assign responsibilities for the initiating, requesting, implementing and verifying the effectiveness of CAPA. The CAPA procedure applies to prevent and correct nonconformities related to materials, components, subassemblies, finished products, manufacturing processes and the whole quality system.

Some of the associated documents with CAPA procedure are as follows:

·        Corrective and Preventive Action Request Log

·        Corrective and Preventive Action Request Form

·        Work Instruction for Corrective and Preventive Action Request

·        Corrective and Preventive Action Records.

Corrective Actions are implemented to address actual nonconformities occurred in the organization. Anyone can initiate a CAPA, but it is advisable that QA should authorize CAPA request and review all CAPA for completeness and effectiveness before closure.

CAPA request includes a description of the unsatisfactory condition to be corrected and explain how quality is impacted. CAPA request may be directed to the company's internal departments as well as to its suppliers and subcontractors as well.

Examples of cases which may initiate corrective actions are shown as follows:

·        Identification of a nonconforming product;

·        Identified problem with a manufacturing process or work operation;

·        A nonconformity identified during a regulatory or third-party audit;

·        Field performance problem reported by servicing;

·        Customer or regulatory complaint like patient’s injury;

·        Nonconforming delivery from a subcontractor;

·        Findings from internal audit or customers;

·        Identification of any other component, device, process or condition that does not conform to specifications, documented quality system, or requirements of the ISO 13485 standard or 21 CFR 820.

Preventive actions, however are initiated when quality performance data indicates that there are trends of decreasing quality capability or effectiveness of the quality system. For example: increasing incidence of product nonconformities traceable to the same common cause; excessive equipment problems; or increasing number of internal audit findings against the same element of the quality system or department.

When a problem requiring preventive action is identified, the process of dealing with the problem follows the same steps that apply to corrective actions as described above.

Upon receiving a request for corrective action or preventive action, the responsible manager investigates the cause of the problem that initiated the request, proposes a corrective action or preventive action to be taken, and indicates the date by which the corrective action or preventive action will be fully implemented.

Another key concept for CAPA is the effectiveness of the corrective action and preventive action taken to remediate the nonconformity. QA should follow up with an inquiry or an audit to determine if the corrective action or preventive action has been implemented effectively. When there is objective evidence that the corrective action is effective, the CAPA can be closed out. Examples of methods to gauge the effectiveness is the measurement of any recurrences of the nonconformity or also perform trending for a certain period after the corrective action and preventive action had been implemented. If more work is needed to fully implement the action, a new follow-up date is set.

Sponsor should also have a spreadsheet to track all the CAPA outstanding and ensure all CAPAs are reasonably closed within a time-frame. I once have a client who get a 483 observation for not closing CAPA in 4 years.

The following table show the exact wordings from www.fda.gov.

820.100 (a)	Has the company established and maintained procedures for implementing corrective and preventive actions inclusive of the necessary requirements identified in the regulation?
820.100 (a)(1)	Do the procedures include requirements for analyzing processes, work operations, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems?
820.100 (a)(1)	Is appropriate statistical methodology employed where necessary to detect recurring quality problems?
820.100 (a)(2)	Do the procedures include requirements for investigating the cause of nonconformities relating to product, processes, and the quality system?
820.100 (a)(3)	Do the procedures include requirements for identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems?
820.100 (a)(4)	Do the procedures include requirements for verifying or validating the corrective and preventive actions to ensure that such action is effective and does not adversely affect the finished device?
820.100 (a)(5)	Do the procedures include requirements for implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems?
820.100 (a)(6)	Do the procedures include requirements for ensuring that information related to quality problems or nonconforming products is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems?
820.100 (a)(7)	Do the procedures include requirements for submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review?
820.100 (b)	Have all corrective and preventive action activities been documented?

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

21 CFR 820.90 Nonconforming Product

Sponsor should have a system and instructions and to assign responsibilities to identify, document, evaluate and disposition of nonconforming products. Nonconforming products are very expensive to handle and should be prevented its occurrence in the first place.

The system and instruction should applies to all purchased, in-house manufactured materials, components, subassemblies and finished products. The system should also have a form called Product Nonconformity Report Template to record the detail of the nonconformity product and its disposition.

Let us talk about identification, documentation, evaluation, disposition, Advisory Note and Recall for nonconforming products.

Identification: All associates in the company especially QC inspectors and production personnel are responsible for identifying nonconforming products in the course of their inspection and process monitoring activities.

Documentation: When a nonconformity is identified, it should be documented in detail in Nonconformity Report form. Only certain personnel can initiate this form like QC inspectors and Quality Assurance. All other personnel report identified nonconformities to QA.

Disposition: The nonconformity report form should document, the identity of the device in question, department, area, operation where nonconformity occurred. The report should also describes objective facts detailing the nature of the nonconformity. The nonconforming product shall be labeled ‘rejected’ and quarantined until QA decides its disposition- reworked, accepted as-is and scrapped.

Advisory Notices and Recall: When nonconforming product is detected after delivery to the customers, customers should be notified expeditiously and be instructed on how to mitigate or avoid the effects, or potential effects, of the nonconformity. If the product need to be recalled, the sponsor should instruct them how to send back the product in question.

Below is the exact wording from the www.fda.gov.

820.90 (a)	Has the company established and maintained procedures to control product that does not conform to specified requirements?
820.90 (a)	Do the procedures address the identification, documentation, evaluation, segregation, and disposition of a nonconforming product?
820.90 (a)	Does the evaluation of nonconformance include a determination of the need for an investigation and notification of the persons or organizations responsible for the nonconformance?
820.90 (a)	Have evaluations and investigations been documented?
820.90 (b)(1)	Has the company established and maintained procedures that define the responsibility for review and the authority for the disposition of the nonconforming product?
820.90 (b)(1)	Do the procedures set forth the review and disposition process?
820.90 (b)(1)	Is the disposition of nonconforming product documented?
820.90 (b)(1)	Does documentation include the justification for use of nonconforming product and the signature of the individual(s) authorizing the use?
820.90 (b)(2)	Has the company established and maintained procedures for rework, including retesting and reevaluation of the nonconforming product after rework, to ensure that the product meets its current approved specifications?
820.90 (b)(2)	Are rework and reevaluation activities, including a determination of any adverse effect from the rework upon the product, documented in the device history record (DHR)?

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

External Quality Audits

As described in post 15 entitled “the internal quality audit” and conversely, there should also be an external quality audits program in the medical device company. The internal quality plan is to audit the state of things with the internal quality system while the external audit is to audit the state of things with external business entities associated with the sponsor. Examples are contract research organization (CRO), contract manufacturing organization (CMO) and all sort of suppliers. Depending on the complexity of the medical device, sometimes, the sponsors has literally a few to a few hundred suppliers. These suppliers need to be constantly audited to ensure their quality system is in compliance to 21 CFR 820, ISO 13485, ISO 14971 etc.

Therefore, sponsor should have a procedure that can provide a system and instructions and to assign responsibility for conducting external audits of the quality management system.

Aside from the procedure, sponsor should also has external audit plan, audit nonconformity report template, quality audit checklist and a great external quality audit team.

For audit plan: QA is responsible for planning and scheduling external audits of the quality system, CMO manufacturing processes and raw materials suppliers. Because of the enormity of the external audit program, therefore, it is prudent to choose the audit frequency based on status and importance of the processes, products and areas to be audited and as well as results from previous audits, previous nonconformities, CAPA and customer complaints. Typically, each supplier should be audited once in two years.

In the external audit plan, the dates, assignment of audit teams, areas to be audited should be set clearly and to be followed. External audit plans should be synchronized with management reviews of the sponsor’s quality system.

For external audit team: External quality team member should be qualified, experienced, have the necessary education, independent and able to write well and fast. External auditors must have expert level in ISO 13485, 21 CFR 820 and EU MDD.

During the external auditing, external auditors seek objective evidence demonstrating whether the audited activities conform to the requirements of the documented quality system, and whether the system is effectively implemented and maintained. When nonconformity is noted, it is brought to the attention of, and discussed with, the responsible individual of the department.

At the end of the audit, each noted nonconformity is documented using the audit Nonconformity Report. External audit should fill out only the first part of the form, describing the nonconformity and handed over to the responsible individual who uses the second part to propose correction, corrective action or perhaps a remediation plan.

Upon receiving the report, the responsible individual investigates the cause/s of the problem noted as a nonconformity, proposes a correction or corrective action to be taken, and indicates the date by which the corrective action will be fully implemented. The external auditor reviews and approves the proposed action.

Documentation and Record: this is a critical part. External audits, implementation of resulting corrective actions, and follow-up audits are documented. At the end of an auditing cycle, all nonconformity reports established during the cycle are compiled and analyzed, and are presented at the management review meeting.

Below is the exact wording from FDA website on 21 CFR 820.22

820.22	Has the company established procedures for quality audits?
820.22	Does the company conduct quality audits to assure that the quality system is in compliance with the established quality system requirements and determined to be effective?
820.22	Are quality audits conducted by individuals who do not have direct responsibility for the matters being audited?
820.22	Are corrective actions, including a re-audit of deficient matters, taken when necessary?
820.22	Are reports of the results of each quality audit and re-audit(s), where taken, prepared?
820.22	Are the quality audit reports reviewed by management having responsibility for the matters being audited?
820.22	Are the dates and results of quality audits and re-audits documented?

Courtesy of www.ISO.org

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.