FDA Medical Device
Enforcement and
Quality System Update
Kimberly Trautman
FDA’s Medical Device Quality Systems Expert
Office of Compliance, CDRH
1
FDA Enforcement Update
Remarks by:
Margaret Hamburg, M.D.
Commissioner of Food and Drugs
"Effective Enforcement and Benefits to Public Health“
August 6, 2009
FDA must be vigilant, strategic, quick and visible
2
FDA Enforcement Update
Post Inspection deadlines – 15 day
Warning Letter Response deadline
Decrease time between the inspection and
issuance of a Warning Letter
Increase collaboration with regulatory
partners such as local, state and
international partners
3
FDA Enforcement Update
Prioritize enforcement follow-up
Act swiftly and aggressively to protect the
public health
Warning Letter “Close Out” process
4
QS Regulation Cites by Subsystem
P&PC
CAPA
MGMT
DC
DOC
820.50
820.120
820.60
820.130
820.70
820.140
820.72
820.150
820.75
820.160
820.80
820.170
820.86
820.200
820.250
820.90
820.100
820.198
820.5
820.20
820.22
820.25
820.30
820.40
820.180
820.181
820.184
820.186
5
Warning Letter Cites by QS Subsystem - 2008
P&PC
=
241
CAPA
=
237
DESIGN
=
155
MGMT
=
130
DOC
=
82
--------------------------------Total
=
845
6
Warning Letter Cites by QS Subsystem - 2008
900
845
800
700
600
500
241
400
237
155
300
130
82
200
100
0
TOTAL
P&PC
CAPA
DESIGN
MGMT
DOC
7
Top Ten Warning Letter Cites - 2008
21 CFR 820.22
21 CFR 820.30(g)
21 CFR 820.198(a)
21 CFR 820.75(a)
21 CFR 820.100(a)
21 CFR 820.30(i)
21 CFR 820.184
21 CFR 820.30(a)
21 CFR 820.80(d)
21 CFR 820.198(c)
41
28
28
27
25
21
21
20
19
19
8
Warning Letters with CAPA Subsystem
Cites 2008
January – December 2008
FDA issued 98 Warning
Letters to medical device
firms for QS/GMP
deficiencies
86/98 or 88% contained cites
for CAPA system
deficiencies
9
Warning Letters CAPA Subsystem Data
Year
# WLs
# w/ CAPA cite
%
2008
98
86
88
2007
74
62
84
2006
79
69
87
2005
97
85
88
2004
113
89
79
2003
69
61
88
10
Warning Letters with P&PC Subsystem
Cites 2008
January – December 2008
FDA issued 98 Warning
Letters to medical device
firms for QS/GMP
deficiencies
80/98 or 82% contained cites
for P&PC subsystem
deficiencies
11
Warning Letters with Design Control
Cites 2008
January – December 2008
FDA issued 98 Warning
Letters to medical device
firms for QS/GMP
deficiencies
54/98 or 55% contained cites
for Design Control
deficiencies
12
Warning Letters Design Control
Subsystem Data
Year
# WLs
# w/ DC cite
%
2008
98
54
55
2007
74
42
57
2006
79
47
60
2005
97
49
51
2004
113
57
50
2003
69
39
57
13
Quality System Hot Topics
Supplier Controls
Corrective and Preventive Actions
14
What is unique about medical
devices?
Medical Devices utilize a wide range of supplied
products and services
Supplied products:
Finished medical devices or accessories
in the case of kits or device systems
Electronic parts to include anything from
individual resistors, capacitors, etc. to
completed hybrid boards
15
What is unique about medical
devices?
Supplied products:
Raw materials such as chemicals,
polymers, metals, etc.
Software packages
Antibodies, antigens, etc. for invitro diagnostic products
Finished drugs or APIs in the case
of combination products
16
What is unique about medical
devices?
Supplied services:
Contract manufacturers
Contract laboratories
Contract sterilizers
Calibration test houses
Contract installers and service providers
Auditors
Consultants
17
What is unique about medical
devices?
Further the supplied products and
services cover the entire range from a
risk perspective.
Same supplied product or service for
one manufacturer may not have the
same risks depending upon multiple
factors.
18
What is unique about medical
devices?
Same supplier for one product or service
may have different risks for a different
supplied product or service.
Be wary of utilization of supplier audits
without understanding the scope of the
previous supplier audit.
19
Quality System (QS) Regulation
21 CFR 820.50
Purchasing Controls
Each manufacturer shall establish and
maintain procedures to ensure that all
purchased or otherwise received
product and services conform to
specified requirements.
20
Quality System (QS) Regulation
21 CFR 820.50(a)
(a) Evaluation of suppliers, contractors,
and consultants. Each manufacturer
shall establish and maintain the
requirements, including quality
requirements, that must be met by
suppliers, contractors, and consultants.
Each manufacturer shall:
21
21 CFR 820.50(a) Purchasing
Controls
(1) Evaluate and select potential
suppliers, contractors, and consultants on
the basis of their ability to meet specified
requirements, including quality
requirements. The evaluation shall be
documented.
22
21 CFR 820.50(a) Purchasing
Controls
(2) Define the type and extent of control to be
exercised over the product, services,
suppliers, contractors, and consultants,
based on the evaluation results.
(3) Establish and maintain records of
acceptable suppliers, contractors, and
consultants.
23
21 CFR 820.50(b) Purchasing
Data
(b) Purchasing data. Each manufacturer
shall establish and maintain data that
clearly describe or reference the
specified requirements, including quality
requirements, for purchased
or otherwise received product and
services.
24
21 CFR 820.50(b) Purchasing
Data
Purchasing documents shall include,
where possible, an agreement that the
suppliers, contractors, and consultants
agree to notify the manufacturer of
changes in the product or service so
that manufacturers may determine
whether the changes may affect the
quality of a finished device. Purchasing
data shall be approved in accordance
with Sec. 820.40.
25
Preamble to the 1996 QS
Regulation
Comment #99
Since FDA is not regulating component
suppliers, FDA believes that the explicit
addition to CGMP requirements of the
purchasing controls of ISO 9001:1994 is
necessary…
26
Preamble to the 1996 QS
Regulation
Comment #99
To ensure purchased or otherwise
received product or services conform to
specifications, purchasing must be carried
out under adequate controls, including
the assessment and selection of suppliers,
contractors, and consultants,
27
Preamble to the 1996 QS
Regulation
Comment #99
the clear and unambiguous specification of
requirements, and the performance of suitable
acceptance activities. Each manufacturer
must establish an appropriate mix of
assessment and receiving acceptance to
ensure products and services are
acceptable for their intended uses. ..
28
Preamble to the 1996 QS
Regulation
Comment #99
FDA generally believes that an appropriate mix
of supplier and manufacturer quality controls are
necessary. However, finished device
manufacturers who conduct product quality
control solely in-house must also assess the
capability of suppliers to provide acceptable
product. Where audits are not practical, this may
be done through, among other means, reviewing
historical data, monitoring and trending, and
inspection and testing.
29
Preamble to the 1996 QS
Regulation
Comment #99
Thus the degree of supplier control
necessary to establish compliance may vary
with the type and significance of the product
or service purchased and the impact of that
product or service on the quality of the
finished device.
30
Preamble to the 1996 QS
Regulation
Comment #100
Thus, a manufacturer must comply with
these provisions when it receives product
or services from its ``sister facility'' or
some other corporate or financial affiliate.
``Otherwise received product'' would
include ``customer supplied product'' as
in ISO 9001:1994, section 4.7, but would
not apply to ``returned product'' from the
customer.
31
Preamble to the 1996 QS
Regulation
Comment #102
…FDA believes that all suppliers of such
services must be assessed and evaluated,
just like a supplier of a product. As always,
the degree of control necessary is related
to the product or service purchased…
32
Preamble to the 1996 QS
Regulation
Comment #103
…certification may play a role in evaluating
suppliers, but cautions manufacturers against
relying solely on certification by third parties
as evidence that suppliers have the capability
to provide quality products or services. FDA
has found during inspections that some
manufacturers who have been certified to the
ISO standards have not had acceptable
problem identification and corrective action
programs.
33
Preamble to the 1996 QS
Regulation
Comment #103
Therefore, the initial assessment or
evaluation, depending on the type and
potential effect on device quality of the
product or service, should be a
combination of assessment methods, to
possibly include third party or product
certification.
34
Preamble to the 1996 QS
Regulation
Comment #103
However, third party certification should
not be relied on exclusively in initially
evaluating a supplier. If a device
manufacturer has established confidence
in the supplier's ability to provide
acceptable products or services,
certification with test data may be
acceptable.
35
Preamble to the 1996 QS
Regulation
Comment #106
The intent of Sec. 820.50 is to ensure
that device manufacturers select only
those suppliers, contractors, and
consultants who have the capability to
provide quality product and services. As
with finished devices, quality cannot be
inspected or tested into products or
services.
36
Preamble to the 1996 QS
Regulation
Comment #106
Rather, the quality of a product or service
is established during the design of that
product or service, and achieved through
proper control of the manufacture of that
product or the performance of that
service…
37
Quality System (QS) Regulation
21 CFR 820.30 Design Controls
820.30(c) Design Input
…ensure that the design requirements relating
to a device are appropriate and address the
intended use of the device, including the needs
of the user and patient…
38
Quality System (QS) Regulation
21 CFR 820.30 Design Controls
820.30(d) Design Output
…shall contain or make reference to
acceptance criteria and shall ensure that
those design outputs that are essential for
the proper functioning of the device are
identified…
39
Quality System (QS) Regulation
21 CFR 820.30 Design Controls
820.30(g) Design Validation
Design validation shall ensure that
devices conform to defined user needs
and intended uses and shall include
testing of production units under actual or
simulated use conditions. Design
validation shall include software
validation and risk analysis...
40
Preamble to the 1996 QS
Regulation
Comment #106
…Section 820.80 is specific to a device
manufacturer's acceptance program. While
finished device manufacturers are required
to assess the capability of suppliers,
contractors, and consultants to provide
quality products and services, inspections
and tests, and other verification tools, are
also an important part of ensuring that
components and finished devices conform to
approved specifications.
41
Quality System (QS) Regulation
21 CFR 820.80 Acceptance
Activities
820.80(a) General
Each manufacturer shall establish and
maintain procedures for acceptance
activities. Acceptance activities include
inspections, tests, or other verification
activities….
42
Preamble to the 1996 QS
Regulation
Comment #106
The extent of incoming acceptance
activities can be based, in part, on the
degree to which the supplier has
demonstrated a capability to provide
quality products or services. An
appropriate product and services quality
assurance program includes a
combination of assessment techniques,
including inspection and test.
43
Purchasing Controls and
Acceptance Activities
Commensurate to the Risk
44
Global Harmonization Task
Force (GHTF) Guidance
document
GHTF Study Group 3 Final Guidance:
Quality Management System – Medical
Devices – Guidance on the Control of
Products and Services Obtained from
Suppliers
Posted Feb. 5, 2009
http://www.ghtf.org/documents/sg3/sg3fin
al-N17.pdf
45
Global Harmonization Task Force
(GHTF) Study Group 3
Drafting a guidance document:
Proposed Document for Comment estimated
to be published in Dec 2009.
“Quality Management System –Medical
Devices – Guidance on corrective action and
preventive action and related QMS
processes”
46
Key Terms
Correction: repair, rework, or adjustment and
relates to the disposition of an existing
nonconformity.
Corrective Action: the action taken to eliminate the
causes of an existing nonconformity, defect or
other undesirable situation in order to prevent
recurrence.
Preventative Action: action taken to eliminate the
cause of a potential nonconformity, defect, or other
undesirable situation in order to prevent
occurrence.
47
CAPA Summary
Planning
for Measurement, Monitoring, Analysis & Improvement processes
Supplier
Performance/Controls
Spare parts usage
Service Reports
Returned Product
Quality Audits
(internal / external)
Process Controls
Market / customer
survey
Complaints
Establish Data Sources and Criteria
Coordination / linkage of data / data sources
(review and analysis of data sources)
Verify future Action
before Implementation
Improvement
Identify Actions
Root Cause
Specific & System
Implement
Determine Effectiveness
(Measuring & Monitoring)
Investigations
Management Review
48
Providing Industry Assistance
CDRH Resources
CDRH Learn [New]
Modules include various premarket and post-market information
Available 24/7
Certificate generated per topic upon passing post-tests
Suggest Future topics
http://www.fda.gov/cdrh/cdrhlearn/
Device Advice
Self-service website
Searchable by topic
http://www.fda.gov/cdrh/devadvice/
Division of Small Manufacturers, International, and Consumer Assistance
(DSMICA)
Technical Assistance for the Medical Device Industry
800-638-2041 or 240-276-3150
DSMICA@cdrh.fda.gov
49
Providing Industry Assistance
CDRH Learn
What is CDRH Learn?
New Online Training tool
Multi-Media Presentation
Available 24/7
Certificate generated per topic upon passing post-tests
Suggest Future topics
Examples of Modules
Overview of Regulatory Requirements: Medical Devices
Quality System Regulation 21 CFR 820 Basic Introduction
Overview of the Premarket Notification Process – 510(k)
How to Get Your Electronic Product on the U.S. Market.
BIMO (under development)
Registration & Listing (under development)
http://www.fda.gov/cdrh/cdrhlearn/
50
Thank you!
Kimberly Trautman
FDA’s Medical Device Quality Systems
Expert
Office of Compliance
kimberly.trautman@fda.hhs.gov
51