Quality in the Medical Device Industry –
And Beyond
Presented to:
American Society for Quality (ASQ)
Madison, WI Section 1217
September 13, 2016
Presented by:
Dale Thanig
Principal Consultant
Quality & Compliance Services
(608) 469-4406
djthanig@yahoo.com
Page 1
Outline







Thank You
Exercise for Tables
Some History, What I Do and Don’t Do
Disclaimers
Trends I See
QMS Tour
Questions and Answers
Page 2
Table Assignment
 Each Table assign a Spokesperson
- the one who has been ASQ member the longest -
 Each person at the Table share: Who is the
most impressive person you have had at
least 5 min to talk to One-on-One?
 Share your choice with others
 Vote/debate to Pick ONE for your Table
 Can’t pick someone in your family
 Write the impressive name on your Table’s
“Sticky”.
Page 3
Some History
Position
Quality &
Nuclear Senior
Quality Director Director of
Test
Submarine Quality
Quality
Director QA & RA
Officer Engineer Manager
Location Pacific
Fleet
Palo Alto
CA
Madison
WI
Chantilly
VA
Louisville
CO
Organization US Navy
Varian
Marquette
Associates
Univ.
Nicolet
Instrument
Corporation
Dynatech
Labs
Ohmeda
Medical
1972
1976
1980
1984
1988
1993
1996
Global Director of
QMS
Director Reg.
Affairs
Principal
Consultant
Madison & Milwaukee
WI
GE Healthcare
Medical
Systems
Datex-Ohmeda
2001
2004
Quality & Compliance
Services
2007
2016
Recognition / Certs / Affiliations
B.S.
Mathematics
Chief
Engineer/
Nuclear
Submarines
Navy
Achievement
Medal
ASQ
Certified
Quality
Engineer
Board of Examiners Malcolm Baldrige
National Quality
Award
Lead Auditor
ISO Standards
Acquisition
Team Leader
Senior
Lead Auditor
Management
Award
Notified Body
Lead Auditor:
ISO13485
MDD
ISO9001
CMDCAS
Guest Lecturer:
Medical College of Wisconsin &
Marquette University–Biomedical Engineering
Page 4
What I Do Lately
None of Your
Business
Training and
Building Quality
Systems
Staying Connected /
Family & Friends
QMS Auditing for
Manufacturers and
their Suppliers / FDA
Inspection Prep.
Page 5
Quality Management System Standards & Regulations
Quality System Regulation (QSR)
U.S. FDA - 21 CFR 820
Customers’ Needs
Canadian Medical
Device Regulations
SOR/98-282
+
Other FDA CFR’s
11
801
803
806
812
814
Electronic Records
Labeling
MDRs
Recalls
IDEs
510(k)/PMA
+ Other Countries
e.g. China, Japan, Australia, Italy . .
.
ISO 13485 Standard
ISO 9001:2008
Quality Systems – Generic Std
Quality Systems – Medical Devices
(ISO9001:2008 + add-ons)
IEC 62304:2006
Medical Device SoftwareSoftware Life Cycle Processes
Risk Management
ISO 14971
ISO 14000
Environmental Std
European Law
Medical Device Directive
(MDD, 93/42/EEC)
Page 6
D. Thanig, June 2009
Quality Management System Standards & Regulations
Changes Coming Soon+
Canadian Medical
Device Regulations
Customers’ Needs
Always evolving
ISO 13485:2016
Other Countries
MDSAP Process
ISO 9001:2015
Quality Systems – Generic Std
(not just ISO9001+ add-ons)
Medical Device Directive
MDr released at end of 2016
Page 8
What I Don’t Do
ᴓ 510(k)s to FDA
ᴓ Class 3 devices/PMAs
ᴓ UDI/UPC
ᴓ Pharma
ᴓ Endorse particular Data System Tools
ᴓ Look for work – It finds me, no website, no employees
ᴓ Fancy PowerPoints
Page 9
Some Trends I See –
Affecting Quality Systems
 Mobile / Remote device applications
 Transition from Hardcopy to e-Docs or Webbased QMSs
 Contract Manufacturing & Outsourcing
 “Virtual” companies
 Acquisitions driving changes
 FDA Inspection Process - QSIT & MDSAP
Page 10
What is a “Quality” ?
The degree to which a set of inherent characteristics fulfills
requirements. ISO 9000:2005
Requirements may vary by product(s), customers and geography:
Feature Set
Safety
Product Technology
Ease of Use
Product Compatibility
Compliance Profile
RELIABILITY
$ Cost of Ownership $
Serviceability
Page 11
What is a “Quality Management System?”
(QMS)
“The organizational structure,
responsibilities,
procedures,
processes and
resources
for implementing quality management.”
“Management” emphasizes that the scope of a quality system
spans the entire organization, not just the Quality and
Regulatory departments.
Strong support by management is needed to ensure that the
QMS is effective and successful in supporting the business.
Think of the QMS as your company’s ‘Rule Book’.
Page 12
Quality Management Principles
 Customer Focus – Regulators are Customers too
 Leadership Involvement
 Responsibility defined at all Org. Levels
 Process Approach: Inputs ⇨ Outputs ⇨ Measures
 Ongoing Improvement of QMS and Product Quality
 Data Driven: Measure ⇨ Analyze ⇨ Improve ⇨
Repeat
 Mutually Beneficial Supplier and Customer Relationships
Page 13
Quality Management Principles
Page 14
Quality Management Principles
Page 15
Relationship Between
the Requirements and your QMS
External Quality System
Requirements [QSR & ISO]
Your QMS
• Establishes requirements
• Establishes your processes
• The Law or Expectation
• Rules for The Way you
work,
Defines “WHAT”
you need to do
Defines “HOW”
you do it
Page 16
ISO 13485:2003 Documented Procedure(s)
4.2.2 – Quality Manual
4.2.3 – Control of Documents
4.2.4 – Control of records
6.2 – Resources/Training (if regulations require)
6.4 b) Work Environment (if processes require)
7.3.1- Design and development
7.4.1- Purchasing process
7.5.1 Control of production and service provision 7.5.1.1 General requirements b)
7.5.1.2.3 Servicing activities (if processes require)
7.5.2.1 - Validation of the application of computer software
7.5.2.2 Sterility (if sterile devices)
7.5.3.1 – Product identification
7.5.3.2.1- Traceability
7.5.5 - Preservation of product
7.6 – Control of monitoring and measuring devices
8 Measurement, analysis, improvement (for statistical techniques if reg’s require)
8.2.1- Feedback
8.2.2 - Internal audits
8.2.4 Monitoring and measurement of product
8.3 – Control of non-conforming product
8.4-Analysis of data
8.5.1 Advisory notices
8.5.1 Adverse Events ( if regulations require)
8.5.2-Corrective action
Page 17
8.5.3-Preventive action
QSR/ISO - Roadmap
Quality System
Management Responsibility
Personnel / Training
Customer Complaints
Corrective and Preventive Actions
Statistical Techniques
Process
Controls

Design
Purchas- Producting
ion
Process
Acceptance
Activities
Non Conforming
Product
Labeling/
Packaging
H, S, D and
Installation
ID and Traceability
IMT Equipment
Process Validation
Service
Internal Audits
Documents
Records
Page 18
Enforcement of QSR vs. ISO
FDA - QSR
INSPECTIONS
Notified Body –
ISO 13485:2003 AUDITS
Document Type
Regulation
Standard
Scope of
enforcement
Processes creating product destined
for US Market
Path to compliance with European
Medical Device Directive, accepted
by many other countries
Certification
Process
Inspection by authorized enforcers
of the Law
Audits by certification services;
limited consulting allowed
Form of Results
Form 483 itemizing Violations of
Regulation;
Establishment Inspection Report
available
Audit report lists
Non-conformities
Terminology in
your QMS
Some specific terms
required/expected
e.g. DMR, DHR, DHF, MDR
Fewer terminology requirements
Nature of
response
Letter itemizing actions
CAPA response to Nonconformities
Worst case
scenario
Fines, Court Injunctions, other legal
actions
Lose certification temporarily,
Improve QMS
Re-audit
Page 19
FDA “QSIT” view of a QMS
 QSIT = Quality System Inspection Technique
 FDA’s process-based method to inspect a manufacturer’s QMS
 QSIT identifies four high-priority subsystems
to look at:




Corrective and Preventive Action (CAPA)
Management Controls
Design Controls
Production and Process Controls
The subsystems inspected depends on the “Level” of
the inspection.
.
Page 20
FDA “QSIT” view of a QMS
Page 21
FDA / QSR Inspection Process
 FDA usually gives a few days notice prior to inspection.
 Inspections usually cover CAPA and Management Controls plus
one or more of Production/Process and/or Design Controls.
 Inspections usually last 3-5 days with one inspector – if you are
in good shape and the inspector has no interruptions.
 Prepare for inspections by reviewing QSIT inspection protocol.
 Your QMS needs to reflect current practice and cover all of the
regulations.
 Possible Results:
 No issues  No Form 483
 Some issues  Findings documented on Form 483
 If deemed serious or firm is non-responsive  Warning Letter
 Follow-up Response by Manufacturer: Be prompt and complete.
Get to root cause(s). Go the “extra mile”.
Page 22
QSR / ISO
- Roadmap
Quality System
Management Responsibility
Personnel / Training
Customer Complaints
Corrective and Preventive Actions
Statistical Techniques
Process
Controls

Design
Purchas- Producting
ion
Process
Acceptance
Activities
Non Conforming
Product
Labeling/
Packaging
H, S, D and
Installation
ID and Traceability
IMT Equipment
Process Validation
Service
Internal Audits
Documents
Records
Page 23
Quality System and Management Responsibility
 Quality Manual, System and Culture
 Create a Table of how QMS procedures Map to external requirements
 Make the Quality Manual/Policy relevant for setting MEASURABLE

OBJECTIVES.
Don’t just reword the requirements in your Quality Manual.
Culture must allow anyone to “stand in front of the truck” when
necessary
“The hard stuff is easy, the soft stuff is hard” – Roger Milliken
 Management Reviews
Not a review of the Quality Dept. but of the Quality SYSTEM
Strive to make “Quality” a topic for all Management Mechanisms.
 Integrate meetings with Strategy Deployment (Hoshin) and Company
Planning
 Take Credit for ALL related activities. Can be conducted in “pieces” to
avoid ‘Death by PowerPoint’
Page 24
Quality “Intelligence” – Management Behavior
Maturity
Spectrum
1
2
Minimum
3
Acceptable
Activity/Behaviors (Scale 1-10)
4
5
6
7
Best in Class
8
9
10
“Forget the Regs,
get the product out”
No EOQ/EOY
“Winks”
Support
Improvements to
Compliance and
QMS
Lead Quality Culture
Development
Daily
Activities
Don’t bring any
Bad News.
“I don’t look good
in stripes.”
Engaged in
Management
Reviews
Participate in audits
and Analysis of
Findings
Use Quality
Metrics to drive
decisions on Biz
Quality
Knowledge
The Regulations
are Roadblocks
Aware of FDA and
Int’l Requirements
Standards and Regs
are useful tools
Realize Competitive
advantage through
Compliance
Fix the Big
Problems
Continuous
Improvement via
effective CAPA
Drive Growth
through Quality
Quality
Mindset
Skill, Expertise or Topic
Unacceptable
Quality
Measures
“Can’t Measure
Quality?
It’s too subjective.”
Quality
Resources
Turn to QA/RA
only when you’re
in trouble.
Quality System
Everyone is on the
QA/RA has a
Integrated
with
“Quality” Team
seat “at the
Business Processes
Table”
* Adjust arrow ends to indicate your honest assessment of our business
You impact the Quality Culture
with your decisions every day
Page 25
Quality
“Intelligence” - Business Indicators
Skill, Expertise or Topic
Maturity
Spectrum
Unacceptable
1
2
Minimum
3
Acceptable
Activity/Behaviors (Scale 1-10)
4
5
6
7
Best in Class
8
9
10
Management
Quality is not
measured
Fix the
BIG Problems only
Continuous
Improvement
results seen
Drive Growth
Through Quality
Employees
Every “Man” for
himself
Ad hoc
Team Efforts
Continuous
Improvement
Teams and Tools
Recognized as
partners in
Growth
Processes
Inspection and
Sorting only
Complying with
Regulations is enough
Best Practices
Implemented
Other Companies
Benchmark Us
Suppliers
Squeezed for
Price only
Monitored for
Quality
Improvement
Partner in Product
Development
Stakeholder in
Success
Customers
Who are
They?
Respond only to
their complaints
Partner in Product
Development
Loyal – Delighted
with New Products
* Adjust arrow ends to indicate your honest assessment of our business
Most Everything We DO is Covered by our QMS.
Results are Driven by our Quality “Intelligence”.
Page 26
 Internal Audits
 Map Plans/Checklists to show all Requirements covered.
 Invest audit time consistent with your Process Profile.
 Do some Product Audits
 Adjust Plans to changes in product, processes and org.
 Use the QSIT checklist to practice for FDA
 Small Company? – Find a Partner Company
 Recruit Auditors outside of QA/RA and from other facilities.
 FDA cannot review internal audit reports
Page 27
More on Auditing
What they May Not Tell you in Auditor Class
Techniques
 Follow “trails” early and often
 Start at the end of a Process and go backwards
 Get out of the Conference Room
 Early ‘warning’ of Findings – Velvet Hammer
 Ask for key copies as you go along
 Shorthand helps
Page 28
Even More on Auditing
What they May Not Tell you in Auditor Class
Style / Attitude
∆ Be a Human Being
∆ Tell people Why you are there
∆ Give them a little space, but get to the Point
∆ No “Hotel Room” Findings
 Auditee: “Tell me something I don’t know.”
 Think about what you’re leaving behind for the:
next audit team and the CAPA System
Page 29
Resources / Training
 Hire good People
 Document Training Requirements
 When documenting Changes (ECNs) - capture
whether training is needed
 Define your methods of Training “effectiveness”
 Job Descriptions can help reduce record keeping
 Keep Performance Eval’s Confidential
Page 30
Design Controls
 Can be used as methodology for developing a PROCESS,
e.g PFMEA
 Matrix-out the various records
Design History File (DHF),
Technical File (‘design doss’ier’ from MDD)
Device Master Record (DMR)
leads to Device History Record (DHR)
 Invest in DESIGN INPUT documents (specifications) that have
customer input for ‘usability’.
Page 31
Design Controls
 Do Risk Management Planning early (ISO14971) using a full
tool box, FMEA / HA / Risk Assessment / etc.
 Identify and protect access to Confidential health information
 Include learnings from complaint history on similar products.
 Bring in key suppliers as development partners.
 Project Reviews may not be legitimate Design Reviews;
 Document “Design Reviews” for Process Changes
Page 32
Design Controls (cont.)
 Verifications and Validations.
Trace all Hardware and Software DESIGN OUTPUTS to their appropriate
DESIGN INPUT (traceability matrices)
Verification – we made the product right - INTERNAL view
Validation – we made the right product. - EXTERNAL view
 Control the “transfer“ of new designs into Production to ensure that
processes will be stable and produce consistently conforming
products.
 Design changes need to be assessed for changes in risk, effect on
product in the field and V&V’d.
Page 33
Design Controls – Project Effort
NEW
Cumulative
Man Hours
Old
Early
Phase
Product
Release
Page 34
Acceptance Activities
Acceptance Activities
 Inspection has to happen only when you require it.
 100% Inspection ISN’T.
 Tailor your activities to the criticality of the parts. (risk-based)
Page 35
Non-Conforming Material
Material rejects provide data for the start of CAPA efforts
Use-As-Is decisions need additional “regulatory” review
 Do you really need “The Cage”?
Page 36
Document & Records Controls
 Make quality system documents accessible and readable.
Sometimes “less is more”.
 QMS documents must keep pace with 5S/Kaizen decisions
 Conversely, 5S/Kaizen implementation cannot ignore regulatory
or customer requirements
 Validate new databases/tools for QMS related processes.
 Define what information must be retained for the Device History
Record (DHR). Include checks of Labels and Labeling.
 Establish record retention and disposal schedules.
 Control Electronic Records/Signatures per 21 CFR 11.
Page 37
Purchasing Controls
Quality Agreements in place for contract manufacturers and “critical”
suppliers.
“Critical” Suppliers may be subject to regulatory audits.
Supplier evaluations and Change Notification are required.
 Supplier Quality Issues are usually a 50 / 50 situation
Extend change notification and control process to suppliers;
particularly OEMs and contract manufacturers.
Page 38
Production & Process Controls
 Include the work instructions and procedures for
assembly, test and inspection as part of design
pilot builds/release
 Manufacturing equipment needs qualification,
maintenance schedules and records
 Some processes may need to be validated
 All test fixtures, including their software, need to
be verified and maintained and/or calibrated
 Validate quality system S/W - 21 CFR Part 11
Page 39
Inspection and Test
 Inspection and Test results recorded in the DEVICE
HISTORY RECORD.
 Be clear on who has authority to release product for
shipment.
 Consider which components or assemblies need to be
tracked by serial numbers for possible future corrective
actions. TRACEABILITY
Page 40
Feedback & Complaints
 The Customer is Always Right – “But some need more
Education than Others.”
 Establish Escalation paths
 Hold regular cross-functional meetings for tracking
 Need “Adverse Event/Incident” and “Advisory Notice/Recall”
Procedures to satisfy all regulatory requirements.
Page 41
Corrective and Preventive Actions (CAPA)

Main area for FDA Inspection 483 Findings

Don’t fear documenting issues – can save you in an Inspection

Use a CAPA Board

Use many sources (Design, Manufacturing, Service, Audits,
Suppliers, Management Review meetings, 5S, etc.), not just
Complaints.

Elements of Robust CAPA process:
 Analyze  Identify  Investigate  Determine Root Cause(s) 
Action Plan  Implement  Check Effectiveness Update Docs 
Communicate Progress  Cover in Management Review  Do it Again
 Similar to Plan-Do-Check-Act and DMAIC cycles
 Something has to change !
Page 42
Labeling/Packaging/Storage/Installation
 Labeling, Packaging, Handling, Storage, Distribution,
and Installation requirements need documentation.
Part of Transfer
 FDA now requires Unique Device Identification (UDI)
and/or Universal Product Codes (UPC)
 Product status identification can be via LOCATION
 Identify shelf-life sensitive products and rotate stock to
prevent aging.
Page 43
Service
Servicing
 It’s a process too. (7.5 of ISO13485)
 Decide whether “routine” service calls are “complaints”.
 Plug Service and Sales people into the complaint system.
 Analyze the data. Normalize data to your “installed base”.
Page 44
Statistics
 A simple “Run Chart” is a statistical method and is
often appropriate.
 Sampling plans used need solid rationales and can be
changed based on analyzed data.
 Be careful when setting “thresholds” for quality metrics.
Page 45
Medical Device Directive
Council Directive 93/42/EEC
key elements
Articles
Annexes
1 Essential requirements
1 Definitions
2-7 Conformity Assessment
9 Classification
9 Classification criteria
10 Vigilance (Incidents and
Post market surveillance)
10 Clinical evaluation
11 Conformity assessment
11 Notified Bodies
15 Clinical investigations
12 CE marking
Document(s):
Technical File
Declaration of Conformity
EU Representative
Essential Requirements
Labels and International Symbols
Incident Reports (Vigilance)
Translations
nnnn
Canadian Medical Device Regulations
OVERVIEW
Pre-Market – Manufacturer
Classification, Safety & Effectiveness, Labeling, QMS,
Licence Application
Health Canada – Licensing Process
Assessment of Manufacturer’s Application
CMDR
vs.
CMDCAS
Post-Market – Manufacturer
Maintain Records:
• Safety & Effectiveness
• Distribution records
Report Problems:
• Mandatory Problem
Reports
• Recalls
Report Changes :
• New QMS Certificate
•Licence Amendments
Questions / Comments
Page 48