21 CFR 820.100 Corrective and Preventive Action (CAPA)

Per many citations, an example of the citation entitled “GxP Process Management Software, Master Control, White Paper: Ten Most Common Reasons for FDA 483 Observations and Warning Letter Citations”, CAPA is among the top reason of the citations. Examples are:

·        ‘Corrective and Preventive Action (CAPA) procedures are inadequate’.

·        ‘Corrective and Preventive Action are inadequately documented’.

Therefore, sponsors should pay a lot of attention to CAPA, its initiation, implementation, effectiveness, closure and documentation. Sponsor should have a system, procedure, work instruction and forms and to assign responsibilities for the initiating, requesting, implementing and verifying the effectiveness of CAPA. The CAPA procedure applies to prevent and correct nonconformities related to materials, components, subassemblies, finished products, manufacturing processes and the whole quality system.

Some of the associated documents with CAPA procedure are as follows:

·        Corrective and Preventive Action Request Log

·        Corrective and Preventive Action Request Form

·        Work Instruction for Corrective and Preventive Action Request

·        Corrective and Preventive Action Records.

Corrective Actions are implemented to address actual nonconformities occurred in the organization. Anyone can initiate a CAPA, but it is advisable that QA should authorize CAPA request and review all CAPA for completeness and effectiveness before closure.

CAPA request includes a description of the unsatisfactory condition to be corrected and explain how quality is impacted. CAPA request may be directed to the company's internal departments as well as to its suppliers and subcontractors as well.

Examples of cases which may initiate corrective actions are shown as follows:

·        Identification of a nonconforming product;

·        Identified problem with a manufacturing process or work operation;

·        A nonconformity identified during a regulatory or third-party audit;

·        Field performance problem reported by servicing;

·        Customer or regulatory complaint like patient’s injury;

·        Nonconforming delivery from a subcontractor;

·        Findings from internal audit or customers;

·        Identification of any other component, device, process or condition that does not conform to specifications, documented quality system, or requirements of the ISO 13485 standard or 21 CFR 820.

Preventive actions, however are initiated when quality performance data indicates that there are trends of decreasing quality capability or effectiveness of the quality system. For example: increasing incidence of product nonconformities traceable to the same common cause; excessive equipment problems; or increasing number of internal audit findings against the same element of the quality system or department.

When a problem requiring preventive action is identified, the process of dealing with the problem follows the same steps that apply to corrective actions as described above.

Upon receiving a request for corrective action or preventive action, the responsible manager investigates the cause of the problem that initiated the request, proposes a corrective action or preventive action to be taken, and indicates the date by which the corrective action or preventive action will be fully implemented.

Another key concept for CAPA is the effectiveness of the corrective action and preventive action taken to remediate the nonconformity. QA should follow up with an inquiry or an audit to determine if the corrective action or preventive action has been implemented effectively. When there is objective evidence that the corrective action is effective, the CAPA can be closed out. Examples of methods to gauge the effectiveness is the measurement of any recurrences of the nonconformity or also perform trending for a certain period after the corrective action and preventive action had been implemented. If more work is needed to fully implement the action, a new follow-up date is set.

Sponsor should also have a spreadsheet to track all the CAPA outstanding and ensure all CAPAs are reasonably closed within a time-frame. I once have a client who get a 483 observation for not closing CAPA in 4 years.

The following table show the exact wordings from www.fda.gov.

820.100 (a)	Has the company established and maintained procedures for implementing corrective and preventive actions inclusive of the necessary requirements identified in the regulation?
820.100 (a)(1)	Do the procedures include requirements for analyzing processes, work operations, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems?
820.100 (a)(1)	Is appropriate statistical methodology employed where necessary to detect recurring quality problems?
820.100 (a)(2)	Do the procedures include requirements for investigating the cause of nonconformities relating to product, processes, and the quality system?
820.100 (a)(3)	Do the procedures include requirements for identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems?
820.100 (a)(4)	Do the procedures include requirements for verifying or validating the corrective and preventive actions to ensure that such action is effective and does not adversely affect the finished device?
820.100 (a)(5)	Do the procedures include requirements for implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems?
820.100 (a)(6)	Do the procedures include requirements for ensuring that information related to quality problems or nonconforming products is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems?
820.100 (a)(7)	Do the procedures include requirements for submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review?
820.100 (b)	Have all corrective and preventive action activities been documented?

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

21 CFR 820.90 Nonconforming Product

Sponsor should have a system and instructions and to assign responsibilities to identify, document, evaluate and disposition of nonconforming products. Nonconforming products are very expensive to handle and should be prevented its occurrence in the first place.

The system and instruction should applies to all purchased, in-house manufactured materials, components, subassemblies and finished products. The system should also have a form called Product Nonconformity Report Template to record the detail of the nonconformity product and its disposition.

Let us talk about identification, documentation, evaluation, disposition, Advisory Note and Recall for nonconforming products.

Identification: All associates in the company especially QC inspectors and production personnel are responsible for identifying nonconforming products in the course of their inspection and process monitoring activities.

Documentation: When a nonconformity is identified, it should be documented in detail in Nonconformity Report form. Only certain personnel can initiate this form like QC inspectors and Quality Assurance. All other personnel report identified nonconformities to QA.

Disposition: The nonconformity report form should document, the identity of the device in question, department, area, operation where nonconformity occurred. The report should also describes objective facts detailing the nature of the nonconformity. The nonconforming product shall be labeled ‘rejected’ and quarantined until QA decides its disposition- reworked, accepted as-is and scrapped.

Advisory Notices and Recall: When nonconforming product is detected after delivery to the customers, customers should be notified expeditiously and be instructed on how to mitigate or avoid the effects, or potential effects, of the nonconformity. If the product need to be recalled, the sponsor should instruct them how to send back the product in question.

Below is the exact wording from the www.fda.gov.

820.90 (a)	Has the company established and maintained procedures to control product that does not conform to specified requirements?
820.90 (a)	Do the procedures address the identification, documentation, evaluation, segregation, and disposition of a nonconforming product?
820.90 (a)	Does the evaluation of nonconformance include a determination of the need for an investigation and notification of the persons or organizations responsible for the nonconformance?
820.90 (a)	Have evaluations and investigations been documented?
820.90 (b)(1)	Has the company established and maintained procedures that define the responsibility for review and the authority for the disposition of the nonconforming product?
820.90 (b)(1)	Do the procedures set forth the review and disposition process?
820.90 (b)(1)	Is the disposition of nonconforming product documented?
820.90 (b)(1)	Does documentation include the justification for use of nonconforming product and the signature of the individual(s) authorizing the use?
820.90 (b)(2)	Has the company established and maintained procedures for rework, including retesting and reevaluation of the nonconforming product after rework, to ensure that the product meets its current approved specifications?
820.90 (b)(2)	Are rework and reevaluation activities, including a determination of any adverse effect from the rework upon the product, documented in the device history record (DHR)?

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

External Quality Audits

As described in post 15 entitled “the internal quality audit” and conversely, there should also be an external quality audits program in the medical device company. The internal quality plan is to audit the state of things with the internal quality system while the external audit is to audit the state of things with external business entities associated with the sponsor. Examples are contract research organization (CRO), contract manufacturing organization (CMO) and all sort of suppliers. Depending on the complexity of the medical device, sometimes, the sponsors has literally a few to a few hundred suppliers. These suppliers need to be constantly audited to ensure their quality system is in compliance to 21 CFR 820, ISO 13485, ISO 14971 etc.

Therefore, sponsor should have a procedure that can provide a system and instructions and to assign responsibility for conducting external audits of the quality management system.

Aside from the procedure, sponsor should also has external audit plan, audit nonconformity report template, quality audit checklist and a great external quality audit team.

For audit plan: QA is responsible for planning and scheduling external audits of the quality system, CMO manufacturing processes and raw materials suppliers. Because of the enormity of the external audit program, therefore, it is prudent to choose the audit frequency based on status and importance of the processes, products and areas to be audited and as well as results from previous audits, previous nonconformities, CAPA and customer complaints. Typically, each supplier should be audited once in two years.

In the external audit plan, the dates, assignment of audit teams, areas to be audited should be set clearly and to be followed. External audit plans should be synchronized with management reviews of the sponsor’s quality system.

For external audit team: External quality team member should be qualified, experienced, have the necessary education, independent and able to write well and fast. External auditors must have expert level in ISO 13485, 21 CFR 820 and EU MDD.

During the external auditing, external auditors seek objective evidence demonstrating whether the audited activities conform to the requirements of the documented quality system, and whether the system is effectively implemented and maintained. When nonconformity is noted, it is brought to the attention of, and discussed with, the responsible individual of the department.

At the end of the audit, each noted nonconformity is documented using the audit Nonconformity Report. External audit should fill out only the first part of the form, describing the nonconformity and handed over to the responsible individual who uses the second part to propose correction, corrective action or perhaps a remediation plan.

Upon receiving the report, the responsible individual investigates the cause/s of the problem noted as a nonconformity, proposes a correction or corrective action to be taken, and indicates the date by which the corrective action will be fully implemented. The external auditor reviews and approves the proposed action.

Documentation and Record: this is a critical part. External audits, implementation of resulting corrective actions, and follow-up audits are documented. At the end of an auditing cycle, all nonconformity reports established during the cycle are compiled and analyzed, and are presented at the management review meeting.

Below is the exact wording from FDA website on 21 CFR 820.22

820.22	Has the company established procedures for quality audits?
820.22	Does the company conduct quality audits to assure that the quality system is in compliance with the established quality system requirements and determined to be effective?
820.22	Are quality audits conducted by individuals who do not have direct responsibility for the matters being audited?
820.22	Are corrective actions, including a re-audit of deficient matters, taken when necessary?
820.22	Are reports of the results of each quality audit and re-audit(s), where taken, prepared?
820.22	Are the quality audit reports reviewed by management having responsibility for the matters being audited?
820.22	Are the dates and results of quality audits and re-audits documented?

Courtesy of www.ISO.org

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

Internal Quality Audit

A medical device company should have a robust internal quality audit program which consists of procedure, team, plan, quality audit checklist to audit the quality system regularly.

For quality audit plan:  Quality Assurance (QA) should be responsible for the planning and scheduling of internal audits of the quality system, manufacturing processes and products. QA should establish audit frequency. The audit frequency is often based on the importance of manufacturing processes, products and areas. Should there be customer complaints, internal and external nonconformities regarding a product and process, internal audit for that area of interest should be carried out.

Internal audit should be performed at the very least once a year or semiannually or quarterly.

The internal quality audit plan should be mapped out clearly in a matrix with all the quality system elements like that of 21 CFR 820 and ISO 14971. In this plan, there should be responsible group who will be performing the internal audit on the desired date of the audit.

The audit team should consist of qualified, experienced and independent quality auditors who are very well versed in the quality system about to be audited.

During the audit, auditors seek objective evidence demonstrating whether the audited activities conform to the requirements of the documented quality system, and whether the system is effectively implemented and maintained. When nonconformity is noted, it is brought to the attention of, and discussed with, the responsible individual of the department in question.

Before the end of the audit, each noted nonconformity is documented using the Audit Nonconformity Report form. Auditors fill out only the first part of the form, describing the noted nonconformity. The form is then handed over to the responsible individual who uses its second part to propose a corrective action.

Documentation and record: Internal audits, implementation of resulting corrective actions, and follow-up audits are documented using the audit nonconformity report form.

At the end of an auditing cycle, all nonconformity reports established during the cycle are compiled and analyzed, and are presented at the management review meeting.

The following is the exact working from FDA website.

820.22	Each manufacturer shall establish procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system.
820.22	Quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited.
820.22	Corrective action(s), including a re-audit of deficient matters, shall be taken when necessary.
820.22	A report of the results of each quality audit, and re-audit(s) where taken, shall be made and such reports shall be reviewed by management having responsibility for the matters audited..
820.22	The dates and results of quality audits and re-audits shall be documented

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

Organization Structure

Medical Device manufacturer should have a procedure for upgrading and recording organizational structure information and the organizational structure chart. Normally this responsibility is being performed by human resource.

Human Resource should have to upkeep the employment record of all employees including resumes, CV, performance review, certification, diploma, patents, offer letter, employment agreement, resignation letter and termination letter etc.  

Human Resource should also update the organization chart regularly if there is any changes in the organization. Below is a simple sample of the organization chart. Human Resource should complete the chart completely.

Below is the exact wording from FDA website.

820.20(b)	Each manufacturer shall establish and maintain and adequate organizational structure to insure that devices are designed and produced in accordance with the requirements of this part
820.20(b)(1)	Responsibility and authority. Each manufacturer shall establish the appropriate responsibility, authority, and interrelation of all personnel who manage, perform, and assess work affecting quality, and provide the independence and authority necessary to perform these tasks.
820.20(b)(2)	Resources. Each manufacturer shall provide adequate resources, including the assignment of trained personnel, for management, performance of work, and assessment activities, including internal quality audits, to meet the requirements of this part.

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.

Management Representative

One of the key requirements is for top management of a medical device company to appoint a ‘management representative’ with executive responsibility to oversee the quality system practiced in the medical device company. Of course, this management representative must be qualified enough with years of quality system experience.

Often time, when the officials from a regulatory body show up, this management representative will have to interact with them.

Basically some of the executive responsibility of this management representative is to

a)  Ensuring quality system requirements such as 21 CFR 820 and ISO 13485 etc in the company are effectively established and effectively maintained accordingly.

b) Reporting on the performance of the quality system to management with executive responsibility for review to ensure it is in compliance with all related quality system related to the company. For example, if the company is selling product to Australia, the company ought to be in compliance with quality system stipulated by Australian Government Therapeutic Goods Administration (TGA).

c) Management and management representative shall review the suitability and effectiveness of the quality system at defined intervals like twice a year. All the activity must be made into a procedure for example with quality policy and objectives.

The dates and results of the quality system reviews shall be documented with detail of what had been discussed.

Another thing, it is advisable for the top management to write a letter of appointment to formalize the appointment. The CEO or quality director should sign the letter of appointment. Below is the exact wording from FDA website.

820.20(3)	Executive management shall appoint a Management representative (MR).with executive responsibility.
820.20(3)(i)	He or She shall have authority over and responsibility for:a) Ensuring quality system requirements are effectively established and effectively maintained accordingly.
820.20(b)(ii)	b) Reporting on the performance of the quality system to management with executive responsibility for review

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time. 

21 CFR 820.65 Traceability

Basically, traceability is based on identifying the finished product with unique control numbers. It is a regulatory requirement. This traceability is useful should there be a product recall.

The extent of traceability includes

·        Serial or batch numbers

·        identification of Purchase Order for critical materials and components used;

·        Identification of key processes and inspection equipment and their operators;

·        Inspection and testing results and identification of inspectors;

·        Identification of personnel performing final labeling operations.

The actual traceability information required for a given medical device should be able to be called out in the production work order for this product.

Traceability Records for purchased materials and components. Their origination and verification records, such as certificates of analysis, testing inspection reports supplied with the product, etc., are linked to the products through their purchase orders. Purchase Orders are maintained by Purchasing. Purchasing department must keep all of these records for a certain period even after the product is discontinued. It is because there might be old product out in the market.

Traceability Records for finished products can be achieved by the work order. Work order is the main traceability record linking the product to its production history. Some data may also be recorded in logs, tables, or databases associated with particular workstations or processes. Work orders and any additional traceability records are maintained in the Device History Record (DHR) or Lot History Record (LHR).

Sponsor should also have a recall plan to test the efficiency of the traceability program. Perform a mock recall periodically.

The following is the exact wording of the traceability requirement from the FDA website.

Sec. 820.65 Traceability.

Each manufacturer of a device that is intended for surgical implant into the body or to support or sustain life and whose failure to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury to the user shall establish and maintain procedures for identifying with a control number each unit, lot, or batch of finished devices and where appropriate components. The procedures shall facilitate corrective action. Such identification shall be documented in the DHR.

Disclaimer: Although the author had exhaustively researched all sources to ensure the accuracy and completeness of the information contained in this blog, but no warranty and fitness is implied. I assumed no responsibility and implied warranty of any kind for errors, inaccuracies, omission, or any inconsistency herein. No liability is assumed for incidental or consequential damages in connection with the use of the information contained herein. Readers should always use their own judgment and review all related regulatory guidelines. Guidelines can change over time.