Quality System Regulation IMDMC FDA Regulatory 101 August 19, 2014

1. Quality System RegulationIMDMC FDA Regulatory 101August 19, 2014

2. Agenda This will be an overview presentation This won’t be a verbatim recitation of the regulation • A Brief History & Comparison • The QSR Big Picture • The Four Major QSR Subsystems • (A break in here somewhere…) • Documents & Records • Back-up slides

3. QSR – A Little History • 1976 – Food, Drug, and Cosmetic Act (“The Act”) expanded to include medical devices • 1978 – Part 820 – Good Manufacturing Practice (GMP) regulation for medical devices issued • 1990 – Safe Medical Devices Act (SMDA) passed • 1996 – Part 820 becomes the Quality System Regulation (QSR) with expanded requirements for medical devices

4. Old QSR vs. “New” QSR Part 820 - 1978 ~7000 words 218 “Shall” statements “Establish” –used 71 times (all tenses) Design Controls – major subpart Part 820- 1996 • ~5000 Words • 159 “Shall” statements • “Establish” –used 7 times (all tenses) • Design Controls - silent

5. Old QSR vs. “New” QSR Complaint Files - 1978 (a) Each manufacturer shall maintain complaint files. Each manufacturer shall establish and maintain procedures for receiving, reviewing, and evaluating complaints by a formally designated unit. Such procedures shall ensure that: (1) All complaints are processed in a uniform and timely manner; (2) Oral complaints are documented upon receipt; and (3) Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA under part 803 of this chapter, Medical Device Reporting. (b) Each manufacturer shall review and evaluate all complaints to determine whether an investigation is necessary. When no investigation is made, the manufacturer shall maintain a record that includes the reason no investigation was made and the name of the individual responsible for the decision not to investigate. (c) Any complaint involving the possible failure of a device, labeling, or packaging to meet any of its specifications shall be reviewed, evaluated, and investigated, unless such investigation has already been performed for a similar complaint and another investigation is not necessary. (d) Any complaint that represents an event which must be reported to FDA under part 803 of this chapter shall be promptly reviewed, evaluated, and investigated by a designated individual(s) and shall be maintained in a separate portion of the complaint files or otherwise clearly identified. In addition to the information required by 820.198(e), records of investigation under this paragraph shall include a determination of: (1) Whether the device failed to meet specifications; (2) Whether the device was being used for treatment or diagnosis; and (3) The relationship, if any, of the device to the reported incident or adverse event. (e) When an investigation is made under this section, a record of the investigation shall be maintained by the formally designated unit identified in paragraph (a) of this section. The record of investigation shall include: (1) The name of the device; (2) The date the complaint was received; (3) Any device identification(s) and control number(s) used; (4) The name, address, and phone number of the complainant; (5) The nature and details of the complaint; (6) The dates and results of the investigation; (7) Any corrective action taken; and (8) Any reply to the complainant. (f) When the manufacturer's formally designated complaint unit is located at a site separate from the manufacturing establishment, the investigated complaint(s) and the record(s) of investigation shall be reasonably accessible to the manufacturing establishment. (g) If a manufacturer's formally designated complaint unit is located outside of the United States, records required by this section shall be reasonably accessible in the United States at either: (1) A location in the United States where the manufacturer's records are regularly kept; or (2) The location of the initial distributor. Complaint Files - 1996 (a) Written and oral complaints relative to the identity quality, durability, reliability, safety, effectiveness or performance of a device shall be reviewed, evaluated and maintained by a formally designated unit. This unit shall determine whether or not an investigation is necessary. When no investigation is made, the unit shall maintain a record that includes the reason and the name of the individual responsible for the decision not to investigate. (b) Any complaint involving the possible failure of a device to meet any of its performance specifications shall be reviewed evaluated, and investigated. Any complaint pertaining to injury, death, or any hazard to safety shall be immediately reviewed, evaluated, and investigated by a designated individual(s) and shall be maintained in a separate portion of the complaint file. (c) When an investigation is made, a written record of each investigation shall be maintained by the formally designated unit identified in paragraph (a) of this section. The record of investigation shall include the name of the device, any control number used, name of complainant, nature of complaint, and reply to complainant. (d) Where the formally designated unit is located at a site separate from the actual manufacturing establishment, a duplicate copy of the record of investigation of any complaint shall be transmitted to and maintained at the actual manufacturing establishment in a file designated for device complaints.

6. Medical Devices and the CFR’s

7. QSR – Subparts as Issued Subpart A--General Provisions Subpart B--Quality System Requirements Subpart C--Design Controls Subpart D--Document Controls Subpart E--Purchasing Controls Subpart F--Identification and Traceability Subpart G--Production and Process Controls Subpart H--Acceptance Activities Subpart I--Nonconforming Product Subpart J--Corrective and Preventive Action Subpart K--Labeling and Packaging Control Subpart L--Handling, Storage, Distribution, and Installation Subpart M--Records Subpart N--Servicing Subpart O--Statistical Techniques

8. QSR – Major Subsystems • Management Responsibility • Design Control • Production and Process Controls • Corrective and Preventive Action http://balancedscorecard.org

9. Management Responsibility

10. Management Responsibility Subsystem Quality System Record .186

11. MANAGEMENT RESPONSIBILITY • Direction • Quality Policy • Implemented at all levels • Empowerment • Resources – adequately trained • “Management Representative” • Evaluation • Review • Audit

12. Management Responsibility - I • (a)Quality policy...policy and objectives for, and commitment to, quality…understood, implemented, and maintained at all levels of the organization. • (b)Organization...adequate organizational structure to ensure that devices are designed and produced in accordance with the requirements of this part. • (1)Responsibility and authority.… responsibility, authority, and interrelation … independence and authority necessary to perform these tasks.

13. Management Responsibility - II • (2)Resources...adequate resources, including the assignment of trained personnel, for management, performance of work, and assessment activities, including internal quality audits, to meet the requirements of this part. • (3)Management representative.…shall have established authority over and responsibility for: • (i) Ensuring that quality system requirements are effectively established and effectively maintained in accordance with this part; and • (ii) Reporting on the performance of the quality system to management with executive responsibility for review.

14. Management Responsibility - III (c)Management review...review the suitability and effectiveness of the quality system … to ensure that the quality system satisfies the requirements of this part and the manufacturer's established quality policy and objectives. (d)Quality planning. Each manufacturer shall establish a quality plan which defines the quality practices, resources, and activities relevant to devices that are designed and manufactured. The manufacturer shall establish how the requirements for quality will be met. (e)Quality system procedures. Each manufacturer shall establish quality system procedures and instructions. An outline of the structure of the documentation used in the quality system shall be established where appropriate.

15. 820.22 Quality audit. Each manufacturer shall establish procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system. Quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited. Corrective action(s), including a reaudit of deficient matters, shall be taken when necessary. A report of the results of each quality audit, and reaudit(s) where taken, shall be made and such reports shall be reviewed by management having responsibility for the matters audited. The dates and results of quality audits and reaudits shall be documented.

16. Training Sec. 820.25 Training • (a)General. Each manufacturer shall have sufficient personnel with the necessary education, background, training, and experience to assure that all activities required by this part are correctly performed. • (b)Training. Each manufacturer shall establish procedures for identifying training needs and ensure that all personnel are trained to adequately perform their assigned responsibilities. Training shall be documented. • (1) As part of their training, personnel shall be made aware of device defects which may occur from the improper performance of their specific jobs. • (2) Personnel who perform verification and validation activities shall be made aware of defects and errors that may be encountered as part of their job functions.

17. Design Controls

18. Design Controls Design Development and Planning Design Inputs Design Outputs Design Review Design Verification Design Validation Design Transfer Design Changes Design History File (DHF)

19. Design Process

20. Production and Process Controls

21. Process Control Subsystem

22. Production and Process Controls (.70)

23. Process Validation (.75) • “Where the results of a process cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance and approved according to established procedures.” • Monitoring and control procedures • Qualified individuals • Records – monitoring methods and data • Changes and revalidation

24. Purchasing Controls (.50) • “Each manufacturer shall establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements.” • Supplier Evaluation • Ability based selection • Extent of control • Records • Purchasing Data

25. Identification and Traceability • Identification (.60) • Procedures to identify throughout lifecycle • “…to prevent mix-ups” • Traceability (.65) • Risk based additional requirements • Batch numbers • Facilitate corrective action • Captured in DHR

26. Inspection, Measuring, and Test Equipment (.72) • IMTE Control • Suitable and capable • Control procedures with records • Calibration • Precision and accuracy limits. • Remediation process • Calibration standards • Calibration records

27. Acceptance Activities and Status • Acceptance Activities (.80) • Receiving Acceptance • In-process Acceptance • Final Acceptance (4 requirements for release) • Records • Acceptance Status (.86) • Conformance/Nonconformance status throughout product lifecycle

28. Labeling and Packaging • Labeling (.120) • Label integrity • Label Inspection • Label Storage • Labeling operations • Control Number • Packaging (.130) • Product preservation to point of use • Requirement touches on design and “execution”

29. Handling, Storage, Distribution, & Installation • Handling (.140) and Storage (.150) • Prevent mix-ups and deterioration • Distribution (.160) • Ensure only approved, non-deteriorated devices are shipped • Shipment records to initial consignee • Installation (.170) • Accessible, adequate instructions for installation and test • Records to demonstrate proper installation

30. Corrective & Preventive Action

31. CAPA Subsystem

32. Corrective and Preventive Action • Definitions (ISO 9000) • Not defined in the QSR (820.3) • Corrective action - action to eliminate the cause of a detected nonconformity or other undesirable situation. • Preventive action - action to eliminate the cause of a potential nonconformity or other undesirable potential situation

33. Corrective and Preventive Action • “(a) Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action. The procedures shall include requirements for: • (1) Analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems. Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems; • (2) Investigating the cause of nonconformities relating to product, processes, and the quality system; • (3) Identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems;

34. Corrective and Preventive Action • “(4) Verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device; • (5) Implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems; • (6) Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems; and • (7) Submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review. • (b) All activities required under this section, and their results, shall be documented.”

35. Sources of Quality Data - Analysis • processes, • work operations, • concessions, • quality audit reports, • quality records, • service records, • complaints, • returned product, • and other sources of quality data… • …to identify existing and potential causes of nonconforming product, or other quality problems. • Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems

36. CAPA Verbs – 820.100 Analyzing Investigating Identifying Verifying or validating Implementing and recording Ensuring …disseminated Submitting…for review

37. Nonconforming Product (.90) • Control • Procedures address identification, documentation, evaluation, segregation, and disposition • Evaluation, investigation, and notification • Review and Disposition • Procedures establish responsibility and authority for disposition • Justification for use of nonconforming product • Rework control • Retesting and re-evaluation • Determination of adverse effects

38. Complaint files (.198) …Receiving, reviewing, and evaluating complaints by a formally designated unit. Such procedures shall ensure that: • (1) All complaints are processed in a uniform and timely manner; • (2) Oral complaints are documented upon receipt; • (3) Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA under part 803 of this chapter, Medical Device Reporting.

39. Complaint files, cont. • Review and evaluate all complaints to determine whether an investigation is necessary. • Required investigations – allegations of failure to meet specifications. • Additional requirements for MDR’s • Investigation records requirements • Record accessibility • Remote FDU • Foreign establishments

40. A Medical Device Complaint is... “...any written, electronic, or oral communicationthat alleges deficiencies related to the • identity, • quality, • durability, • reliability, • safety, • effectiveness or • performance of a device after it is released for distribution.” Which of these terms is not in the ISO 13485 definition??

41. A Brief Digression… • If CAPA is more important than Complaint Handling, why is the CFR section twice as long for one as the other?? • By specifying the resultant work product (files), FDA defines a process and carves an “inspectional path”

42. Servicing (.200) “Where servicing is a specified requirement, each manufacturer shall establish and maintain instructions and procedures for performing and verifying that the servicing meets the specified requirements.” Statistical analysis MDR (Part 803) Connection Service report records

43. Documents and Records • Document Control (.40) • Approval and distribution • Change management • Records – Subpart M • General (.180) • Device Master Record (.181) • Device History Record (.184) • Quality System Record (.186) • Complaint Files (.198)

44. Objective Evidence • “Establish” defined in Part 820.3(k) • (k)Establish means define, document (in writing or electronically), and implement.

45. Quality is not explained, it is demonstrated Why Is Objective Evidence So Important?

46. Resources, Links, etc. Backup slides

47. Triple-D

48. Complaint/AE Investigation and Resolution • Three Basic Questions • Were the specifications of the product fully executed for the complaint device? • Are the device specifications adequate for intended or reasonable uses? • What is required to restore the relationship with the customer?

49. Some Good Links • Full Text of the QSR • http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfCFR/CFRSearch.cfm?CFRPart=820&showFR=1 • Search page for other CFR Sections • http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfCFR/CFRSearch.cfm • CDRH Learn Course List • http://www.fda.gov/training/cdrhlearn/default.htm • Note: the QSR overview developed by CDRH is stored under the “Postmarket” section

50. Embedded Document QSR Preamble - Published when the new Part 820 was released in 1996. Records the FDA’s deliberations in releasing this rule