Blog

What are the most common FDA Form 483s inspection observations?

I recently had a couple of clients request a quotation for training on best practices for creating a design history file (DHF). Typically the most experienced quality managers request this training, even when they personally know a lot about design controls, because they know that the FDA issues a lot of FDA Form 483s against this requirement.

The most frequent category of FDA Form 483 inspection observation is design controls (i.e., 21 CFR 820.30). There are 10 different sections of the design controls requirement. Manufacturers that do not have design controls in place will frequently receive multiple observation findings during the same inspection–all related to design controls. The most common design control observations are:

  1. A procedure for design and development has not been established in accordance with 21 CFR 820.30a
  2. A procedure for design transfer has not been established in accordance with 21 CFR 820.30h
  3. A procedure for design changes has not been established in accordance with 21 CFR 820.30i
  4. A design history file (DHF) has not been established in accordance with 21 CFR 820.30j

Therefore, if a manufacturer has no procedure for design controls, then the manufacturer could receive 4 different observations on FDA Form 483.

ISO 13485:2016 Requirements

On March 1, 2016 the 2016 version of ISO 13485 was released. The new version of the Standard now requires procedures for design transfer, design changes and design and development files in an effort to be harmonized further with US regulatory requirements. Therefore, this presentation was created to specifically identify changes needed to your design controls procedure in order to comply with the latest version of the Standard.​​​​​​​

Design History File (DHF) Webinar

You can register for this live training webinar on April 14. For a cost of $129 you will receive:

  • a link to join the live webinar @ 10am EDT
  • a native slide deck for the new live webinar
  • a link to download a recording of the live webinar

This live webinar explains what needs to be included in your procedures for design and development, but the webinar explains how and when to create a design history file (DHF). After you create a procedure, you can show the recording of this webinar to your design and development team to ensure that design and development documentation is compliant and updates are efficiently maintained.

CLICK HERE to register for the DHF Webinar.

Posted in: Uncategorized

Leave a Comment (0) →

483 Response: Which corrective action plan should you write first?

Article explains how to determine which FDA Form 483 response you should write a corrective action plan for first and why.

chicken and egg 483 Response: Which corrective action plan should you write first?

In a perfect world, you would not receive any inspection observations from your next FDA inspection. However, most companies get at least one observation resulting from an FDA inspection and often there are multiple observations on an FDA Form 483. If you

Most Common FDA 483 inspection observation

Companies that have not experienced an FDA inspection before worry too much and prepare too little. Inspections are predictable and certain inspection observations are much more common than others. A couple of years ago I wrote an article analyzing the most common FDA inspection observations. The most common observations are specific to design controls (i.e., 21 CFR 820.30). However, this fact is distorted because many companies receive multiple observations during the same inspection related to design controls. For example, a client of mine recently received three from one inspector: 1) lack of design reviews, 2) lack of design validation, and 3) lack of risk analysis. All three were found during the review of the same design history file and the one corrective action addresses all three observations.

how to determine which FDA Form 483 response you should write a corrective action plan for first

2nd Most Common FDA 483 inspection observation

The second most common observation is specific to corrective and preventive actions (i.e., 21 CFR 820.100). Typically the company has inadequate procedures for verifying and validating effectiveness of corrective actions taken. If this is one of your FDA 483 observations, then you may have a problem with CAPA training or with the design of your CAPA form. If there is no place on the CAPA form to document your effectiveness check, then you might easily forget to perform the verification and validation of effectiveness. Another possibility is that personnel are confused between verification of implementation and the verification of effectiveness.

What if you have multiple FDA 483 observations?

Other common FDA 483 observations include medical device reporting, complaint handling and rework of nonconforming product. If you receive more than one FDA 483 inspection observation, you need to assume there is a chance that the inspection outcome will be “Official Action Indicated” (OAI). In this case, you need to provide a 483 response to your FDA district office within 15 business days. With such a short time to prepare your 483 response, you need to be efficient. Which 483 response should you initiate first and why?

If one of the inspection observations is related to the CAPA process, that 483 response should be your top priority. The reason for this is that the FDA will want to see objective evidence of implementing corrective actions whenever possible. If you use your CAPA procedure and form to document the 483 response, then you can show the FDA how the revised procedure or form will be used in your 483 response. If you write your 483 response for other inspection observations first, then the other 483 responses are using the existing procedure or form that the identified as inadequate.

Your first step should always be to implement corrective actions to address an inadequate CAPA process by revising the procedure or the form. Once the procedure or form is updated, then you can use the new process to document the rest of your 483 responses.

Training Webinar for an FDA 483 response

If you need help preparing an FDA 483 response, click here for our webinar explaining the 7 steps for responding to an FDA Form 483 inspection observation. You can also download a CAPA procedure and CAPA form from our SOP page.

Posted in: FDA

Leave a Comment (0) →

Usability Engineering and Human Factors Engineering for Devices

Yesterday, February 3, the FDA released a new guidance document on the subject of “Applying Human Factors and Usability Engineering to Medical Devices.” This is a final guidance document that replaces the previous version that was released in 2000 and the draft that was released in 2011. The diagram below is Figure 3 from this new FDA guidance, and it includes references to sections 5 through 9 of the guidance document.

 

Screenshot 2016 02 04 at 1.24.04 PM Usability Engineering and Human Factors Engineering for Devices

Applying Human factors engineering and usability engineering to medical devices

What’s in the new FDA Guidance on Usability Engineering?

Click here in order to download the new FDA guidance. The organization of the guidance is similar to an ISO standard. Section 1 is the introduction. Section 2 is the scope of the guidance. Section 3 includes definitions, and Section 4 provides an overview of human factors engineering and usability engineering as these concepts apply to medical devices. Sections 5 through 9 of the guidance explain the details of the process for applying these concepts to medical devices and risk management. The guidance document includes six references to national and international standards that include human factors engineering or usability engineering, and there are 19 references to articles about human factors engineering and usability engineering at the end of the guidance document.

Adding Usability Engineering to Your Risk Management Procedure

The steps in the process for human factors engineering and usability engineering mirror the risk management process as defined in ISO 14971 except this guidance does not specify developing a risk management plan or the need to create a risk management file. Identification of hazards related to use errors is the first step. Then risk controls are implemented in order to reduce risk of harm due to use errors. The risk controls are verified and validated, typically through simulated use studies or clinical studies. Therefore, you should be able to integrate usability engineering into your risk management process by specifying that hazards should include use errors, environment of use and the device/user interface. The risk controls section does not need to be revised, but the verification and validation of risk controls needs to include simulated use and/or clinical studies in order to verify that risk controls specifically reduce the risk of use errors. It might also be useful to specify that the environment for use should be included in simulated use studies.

Creating a Usability Engineering Report Template

Clients often ask me what they need to do with regard to human factors engineering and usability engineering for documentation in their technical file and design history file. I recommend that they create a usability engineering report based upon ANSI/AAMI/IEC 62366. However, companies often do not want to purchase the standard, and they seldom have time to read and understand what the standard is recommending. Now we have a free guidance document that is available from the FDA. Therefore, I recommend that you create a template for your usability engineering report based upon this new guidance. If your company makes many types of products with multiple hazard types, then you will need a somewhat generic report template. However, companies with only one or two device families should be able to pre-populate a report template with the sections for specific categories of hazards that are applicable to their device family. Once you have a template, this can be used to create a usability engineering report during the design process for any new medical device you are developing.

Updating Your Risk Management File to Include Usability Engineering

For products that are already on the market, you should already have human factors engineering and usability engineering incorporated into your risk management file. If you don’t, I recommend updating your risk management file in the following ways:

  1. update your post-market surveillance plan / risk management plan to specifically gather information about use errors related to the use environment, the user and the device/user interface

  2. update your hazard identification report to include hazards related to use errors

  3. update your risk analysis to include risk controls that you have implemented to reduce the risk of harm related to use errors

  4. perform and document verification and validation of any new risk controls that you may implement related to use errors

  5. update you instructions for use to include warnings and precautions about use errors

  6. develop training tools, such as videos, to demonstrate possible use errors and how to avoid them

The bulk of human factors engineering and usability engineering is documented in the risk management file. Risk management documentation is only required for FDA submissions that include: 1) software of moderate level of concern or higher, 2) De Novo applications and 3) PMA submission. If you have a non-software device for which you are submitting a 510(k), then you do not include a risk analysis with your submission. Therefore, the only way that the usability factors are addressed is by reviewing the simulated use validation of the device and the instructions for use. It is still critical that design teams address usability engineering, however, because identifying use errors and implementing risk controls to eliminate use errors will prevent product complaints and adverse events. If these issues are not addressed during the design of a new product, corrective actions and possibly recalls will be needed after product launch. FDA inspectors will also identify weaknesses in your risk management activities when they identify complaints that are not addressed in your risk analysis.

If you need help with applying human factors engineering or usability engineering to design your medical devices, please contact me.

Posted in: FDA

Leave a Comment (1) →

De Novo Application: The beginning of a new device product class

This article explains the FDA’s De Novo application process for regulatory clearance of medical devices that do not meet the requirements of a 510k submission.

De Novo Pathway 300x169 De Novo Application: The beginning of a new device product class

De Novo Application:
The beginning of a new device product class

The best regulatory experts plan regulatory submissions months before the performance testing is completed, and often the strategic regulatory pathway is determined before the design of the device even begins. If your design team is developing an innovative technology, you may have difficulty finding a predicate device that is substantially equivalent to your device. If you have not completed a De Novo application before, where do you start?

History of the De Novo Application

Historically, a De Novo application required that your device be submitted through the 510k process first. If the FDA determined that your device was not substantially equivalent to the predicate you chose, then you received a “Not Substantially Equivalent” (NSE) letter from the FDA. Once you receive an NSE letter, you have three options: 1) select a different predicate and re-submit, 2) re-submit the device through the Pre-Market Approval (PMA) process, or 3) submit the device through the De Novo application process. You were not allowed to submit a De Novo application until you received an NSE letter.

The De Novo application process was revised on July 9, 2012 to allow manufacturers to submit a De Novo application without a preceding 510k submission. This was done because there are many products that are technologically equivalent to a predicate device, but the indications for use are quite different. For example, many in vitro diagnostic (IVD) products are indicated for diagnosis of new viruses, but the device uses technology equivalent to another IVD product the manufacturer already makes. For this reason, most of the first 100+ De Novo application approvals were for IVD products.

De Novo Application Draft Guidance Document

The De Novo application process still (updated September 6, 2017) does not have an approved final guidance document. For now, there is only a draft guidance document. However, with the new fees being charged for De Novo applications as part of MDUFA IV for FY 2018 FDA user fees, you can expect that a final guidance document with an application checklist will be expedited.

Pre-Sub Meetings Prior to a De Novo Application

Pre-sub meetings are generally recommended by the FDA for manufacturers that intend to submit a De Novo application without a prior 510k submission and subsequent NSE letter. If the device is a Class II, a  pre-sub meeting allows the manufacturer to request input from the FDA,  regarding performance testing and special controls. The draft De Novo guidance document specifically recommends following the existing content guidelines for a pre-sub meeting request, but the guidance also recommends including the following elements in the pre-sub meeting request:

  1. Proposed product classification (i.e., Class I, Class II exempt, or Class II)
  2. Details of efforts previously taken in order to identify a predicate
  3. Risks and Risk/Benefit Analysis
  4. Proposed Performance Testing and/or Special Controls

Before you submit a pre-submission request for a potential De Novo application, you should consider the following questions. First, is your device suitable for a De Novo application (see point #2 above)? Second, when is the ideal time for you to submit your application? At least 90 days before your design freeze is needed if the meeting request is going to have any impact on the performance testing plans. Third, what questions do you want the FDA to answer regarding data requirements. Sometimes providing some preliminary data can help you persuade the FDA to accept less total data for approval of the final application. Finally, you may want to consider preparing a draft Special Controls Guidance for the FDA to review as a supplement to your pre-submission meeting. 

De Novo Applications for Class I and Class II Exempt Devices

Most manufacturers mistakenly assume that De Novo applications are only for devices that are Class II and will require a 510k submission for future product submissions in the same classification. However, the regulations require that the application cover letter include both a “Classification Summary” and a “Classification Recommendation.” The recommendation for a classification may be for Class I, Class II exempt or Class II non-exempt. If you recommend that the FDA classify the device as Class II exempt, then the recommendation must include a justification for why premarket notification is not required.

Regardless of which classification is recommended, the justification for classification needs to be based upon a risk/benefit analysis. Class I and Class II exempt classifications are likely to be recommended more in the future for many of the standalone software products that are being developed by manufacturers, because those software devices generally have a low risk. Existing product classifications may be used, but if the indications for use are not substantially equivalent to a predicate the manufacturers will submit a 510k and receive NSE letters. For the companies that are claiming substantial equivalence to products that already have a product classification that is exempt from premarket notification, manufacturers will continue to register and list products under existing classification codes until the FDA intervenes–even if the indications for use are not equivalent.

How to Modify Your 510k Templates

Twenty sections comprise a 510k submission, but regulatory experts typically use templates for each section in order to streamline the process of preparing a new device submission. For a De Novo application, a large percentage of the sections required for a 510k submission are the same. The draft guidance identifies one unique section to a De Novo application: the cover letter (i.e., Attachment II in the De Novo guidance). However, there are three sections of a 510k submission that also need to be eliminated for a De Novo application:

  1. Section 1: User Fee Cover Sheet, because De Novo applications do not require a user fee
  2. Section 5: 510k Summary or 510k Statement is not required, because this is not a 510k submission
  3. Section 12: Substantial Equivalence Comparison, because De Novo applications do not claim equivalence to a predicate

New De Novo Application Webinar

Companies developing devices with truly innovative technologies frequently have difficulty identifying suitable predicate devices. The best regulatory experts plan in advance for these regulatory submissions by honing their knowledge of the De Novo application process. On Thursday, January 28th we recorded a webinar sharing our tips and templates for De Novo applications. Click here to learn more about the webinar.

Posted in: 510(k)

Leave a Comment (2) →

Three (3) important technical file and 510k submission differences

This article summarizes the three (3) important technical file and 510k submission differences: 1) the risk management file, 2) the clinical evaluation report, and 3) the post-market clinical follow-up report.

3 different apples Three (3) important technical file and 510k submission differences

3 important technical file and 510k submission differences

ISO 14971 requires a risk management file whether you are selling a medical device in the EU or the USA, but the US FDA doesn’t require that you submit a risk management file as part of the 510k submission. If you design and develop a medical device with software, you must submit a risk analysis if the software has a moderate level of concern or higher. However, the risk analysis is only a small portion of a risk management file.

Only 10-15% of 510k submissions require clinical studies, but 100% of medical devices with CE Marking require a clinical evaluation report (CER) as an essential requirement in the technical file. The clinical evaluation report (CER) is essential requirement (ER) 6a in Annex I of the Medical Device Directive (MDD). Even class 1 devices that are non-sterile and have no measuring function require a clinical evaluation report (CER). Yes, even adhesive tape with a CE Mark requires a clinical evaluation report in the technical file.

Annex X, 1.1c of the Medical Device Directive (MDD) requires that medical device manufacturers perform a post-market clinical follow-up (PMCF) study or provide a justification for not conducting a post-market clinical follow-up (PMCF) study. In the past, companies attempted to claim that their device is equivalent to other medical devices and therefore a post-market clinical follow-up (PMCF) study is not required. However, in January 2012 a guidance document (MEDDEV 2.12/2) was published to provide guidance regarding when a PMCF study needs to be conducted. This guidance makes it clear that PMCF studies are required for many devices–regardless of equivalence to other devices already on the market.

Risk management file for technical file and 510k submission

The FDA only requires documentation of risk management in a 510k submission if the product contains software and the risk is at least a “moderate concern.” Even though you are required to perform risk analysis, a knee implant would not require submission of the risk analysis with the 510k. If a product is already 510k cleared, you may be surprised to receive audit nonconformities related to your risk management documentation for CE Marking. The most common deficiencies with a risk management file are:

  1. compliant with ISO 14971:2007 instead of EN ISO 14971:2012
  2. reduction of risks as low as reasonably practicable (ALARP) instead of reducing risks as far as possible (AFAP)
  3. reducing risks by notifying users and patients of residual risks in the IFU
  4. only addressing unacceptable risks with risk controls instead of all risks–including negligible risks

If you are looking for a risk management procedure, please click here. You might also be interested in my previous blog about preparing a risk management file.

Clinical evaluation report (CER) for technical file and 510k submission

The FDA does not require a clinical evaluation report (CER), and up until 2010 only some CE Marked products were required to provide a clinical evaluation report (CER). In 2010 the Medical Device Directive (MDD) was revised and now a clinical evaluation report (CER) is a general requirement for all medical devices (i.e., Essential Requirement 6a). This requirement can be met by performing a clinical study or by performing a literature review. Since 510k devices only require a clinical study 10-15% of the time, it is unusual for European Class 1, Class IIa and Class IIb devices to have clinical studies. This also means that very few clinical studies are identified in literature reviews of these low and medium risk devices.

The most common problem with the clinical evaluation reports (CERs) is that the manufacturer did not use a pre-approved protocol for the literature search. Other common problems include an absence of documented qualifications for the person performing the clinical evaluation and failure to include a copy of the articles reviewed in the clinical evaluation report (CER). These requirements are outlined in MEDDEV 2.7/1, but the amount of work required to perform a clinical evaluation that meets these requirements can take 80 hours to complete.

If you are looking for a procedure and literature search protocol for preparing a clinical evaluation report (CER), please click here. You might also be interested in my previous blog about preparing a clinical evaluation report (CER).

Post-Market Surveillance (PMS) & Post-Market Clinical Follow-up (PMCF) Studies for technical file and 510k submission

Post-market clinical follow-up (PMCF) is only required for the highest risk devices by the FDA. For CE Marking, however, all product families are required to have evidence of post-market clinical follow-up (PMCF) studies or a justification for why post-market clinical follow-up (PMCF) is not required. The biggest mistake I see is that manufacturers refer to their post-market surveillance (PMS) procedure as the post-market surveillance (PMS) plan for their product family, and they say that they do not need to perform post-market clinical follow-up (PMCF) study because the device is substantially equivalent to several other devices on the market.

Manufacturers need to have a post-market surveillance (PMS) plan that is specific to a product or family of products. The post-market surveillance (PMS) procedure needs to be updated to identify the frequency and product-specific nature of post-market surveillance (PMS) for each product family or a separate document needs to be created for each product family. For devices that are high-risk, implantable or devices that have innovative characteristics the manufacturer will need to perform some post-market clinical follow-up (PMCF) studies. Even products with clinical studies might require post-market clinical follow-up (PMCF), because changes to the device, accessories and range of sizes may not be covered by the clinical studies. MEDDEV 2.12/2 provides guidance on the requirements for post-market clinical follow-up (PMCF) studies, but most companies manufacturing moderate risk devices do not have experience obtaining patient consent to access medical records in order to collect post-market clinical follow-up (PMCF) data–such as postoperative imaging.

Procedures & Webinars

If you are looking for a procedure for post-market surveillance (PMS), please click here. If you are interested in learning more about post-market surveillance and post-market clinical follow-up (PMCF) studies, we also have a webinar on this topic.

Posted in: 510(k), CE Marking

Leave a Comment (1) →

Regulatory pathway document creation–a case study

This regulatory pathway case study is provided by Medical Device Academy for 510k submission, CE Marking application and Canadian Medical Device License application.

Regulatory Pathway 1 Regulatory pathway document creation  a case study

How do you select the right regulatory pathway for your device?

Manufacturers considering global expansion need to master the process of creating a regulatory pathway analysis. That analysis must be product-specific. I used to create long documents that were tedious to read, but in the past month I found a better way. I now use webinar recordings to help clients analyze the regulatory pathway for their products. I create a slides for each market that my client is considering for expansion. At the end of the 20-30 minute presentation, my client asks clarification questions and we discuss the possible next steps toward regulatory approval.

A Typical Regulatory Pathway Analysis

A typical regulatory pathway analysis involves 3 major markets for a new product: 1) USA, 2) Europe, and 3) Canada. There will be one slide per market identifying the classification rationale for each market, and if there are exceptions this will be explained. Exceptions often arise for specific indications for use, duration of contact and for unique components such as:

nanomaterials (Class III in European new regulations)
– antibiotics (Class III as per Rule 13 or combination product)

Recommended Regulatory Pathway Document Content

There will be a slide per market identifying the regulatory approval process. For devices without predicates, this will be a De Novo application or a PMA submission in the USA. For Canada, you might need an Establishment License or a Medical Device Distribution License.

There will be a slide per market identifying QMS requirements customized to reflect the QMS my client already has. If you already have ISO 13485 certification you only need 2-3 new procedures to launch in Canada, while there are typically more procedures required for launching a product in the USA due to differences between ISO 13485 and 21 CFR 820. Even in Europe, a Japanese company will need: 1) a vigilance reporting procedure, changes to their Advisory Notice Procedure, and 3) a procedure for creating a technical file.

Finally, most clients need help identifying the testing requirements for safety and efficacy. If the FDA has a recent special controls guidance this is much easier. If guidance is non-existent or outdated, then you need experts like Leo to help navigate international and European National (EN) Standards that might be applicable for safety and efficacy testing.

Regulatory pathway case study

In 2015 I published a series of three blogs explaining how to identify the regulatory pathway for different markets:

  1. CE Marking Approval of a Medical Device (Case Study)
  2. 510k Submission to the FDA (Case Study – Part 1)
  3. Obtaining a Health Canada Medical Device License (Case Study)

The blogs were specific to a hypothetical product–a tissue adhesive for topical approximation of skin. Therefore, I decided to use the same hypothetical product for this case study regulatory pathway. If you are interested in watching a recording of this regulatory pathway, click here to download the case study recording.

Are you planning a submission in 2016?

Please visit our regulatory pathway webpage if you are interested in purchasing this service.

Posted in: CE Marking

Leave a Comment (0) →

Management review revisions for ISO 13485:2016

The article explains management review revisions required for ISO 13485:2016 compliance. The article tells a story about a recent re-certification audit nonconformity and how the revised ISO 13485:2016 Standard will help prevent this type of quality issue in the future. The article includes links to information about new and revised regulatory requirements, how to write a procedure and there is a link for downloading a free management review webinar.

Management Review 20161 Management review revisions for ISO 13485:2016

One of my clients recently had a re-certification audit in December with their Notified Body and they received a nonconformity in the first couple of hours of the 4 day audit. Here’s what happened.

First, they had an opening meeting with the auditor from 8:30am – 9:05am. Next they took the auditor on a tour of the facility to show her some of the areas of the facility that had been renovated since last year’s surveillance audit. The management representative and the auditor returned to the conference room at 9:40am and the auditor began with a review of the management review revisions to the procedure. The procedure had not changed since the previous year so the auditor asked to see the most recent management review. The company conducted a management review on Tuesday, December 8, 2015. The audit reviewed all the required inputs since the previous management review–which was conducted on Tuesday, December 9, 2014.

When the auditor reviewed data analysis of complaints, she noticed a spike in complaints related to shipping errors that occurred in the months of February through May. When she asked for an explanation, the management representative explained that the renovations caused some misplacement of inventory that resulted in shipping delays and a few mistakes. The auditor asked when the trend was first observed. The management representative indicated that the trend was observed in April, and corrections were made by the warehouse manager in May. The trend was confirmed to have reversed in the data from the third quarter.

The auditor asked if a formal corrective action was implemented. The management representative said that no formal CAPA was initiated, because the problem did not appear to be a systemic problem due to the small volume of complaints relative to the large volume of shipments. The auditor asked if shipping complaints were a quality objective. The management representative confidently indicated that they were. The auditor then asked when top management was notified of the negative trend and reviewed the spike in the performance of the quality objective. The management representative said that the quality objective performance is reviewed by top management during the management reviews and since the corrections appeared to be effective no further action was warranted.

The auditor responded that she would be issuing a minor nonconformity against the management review process. The reason the auditor provided was that top management and the management representative did not maintain effectiveness of the quality management system during a major renovation, because they did not monitor quality objectives on a sufficient frequency to react to quality issues in a timely manner. Furthermore, they failed to modify there planned interval for management reviews to take into account major changes in the facility that could negatively impact quality.

At the closing meeting, top management asked what should have been done to avoid this finding. The auditor was hesitant to provide advice, but she indicated that management could have been more proactive and taken measures to prevent the shipping complaints in the first place. A quality plan for the renovation could have included increased management oversight and more frequent review of quality objectives related to the areas being renovated. Instead of reviewing quality metrics quarterly, a monthly schedule might have been used during the renovations. Instead of scheduling the management review for December, top management might have scheduled a management review during or immediately after the renovations to address any quality issues with corrective actions or action items in the management review outputs. Another possible, and less proactive, approach would have been for the warehouse manager to initiate a formal corrective action as soon as the negative trend was observed. Then top management would have been aware of the quality issue through the CAPA process. Unfortunately, none of these actions were taken.

The auditor indicated that she could have written the finding against a number of different clauses (e.g., CAPA, monitoring and measurement of processes, quality system planning). She chose to reference the management review process in the finding, because the company will need to make management review revisions in 2016 to document the justification for management review intervals. There are also management review revisions required to address new and revised regulatory requirements in the meeting outputs. Therefore, the company’s corrective action plan might also address the requirements of the revised ISO 13485:2016 Standard.

Management review revisions to frequency of planned intervals

Most companies satisfy the requirement for conducting a management review (i.e., 21 CFR 820.20 and ISO 13485, Clause 5.6) in one of the following ways:

  1. conducting one meeting each year
  2. conducting one meeting each quarter

If your company is conducting only annual reviews, your reviews will be far more useful if you switch to a quarterly schedule. In the case of my client, top management would have discussed the negative trend in shipping complaints in April 2015 instead of December 2015–8 months earlier. Reviewing data from 9-10 months ago is too late to take action.

Management Review Revisions Medical Device Academy Made

You can download the management review procedure from this website that was just updated for compliance with ISO 13485:2016. If you have your own procedure, you might want to read my blog about improving your own management review procedure. The key to writing a procedure is link the procedure to template that will be used as a starting point for each management review. The template should include each of the 8 required inputs (i.e., Clause 5.6.2), the 3 required outputs (i.e., Clause 5.6.3) and a slide for covering both the Quality Policy and the overall effectiveness of the Quality Management System. The procedure should be short and the bullets should match the requirements verbatim.

Training Top Management

The biggest reason why management reviews are ineffective is that there is little engagement by most of the people in the room. Everyone in the room should be familiar with the requirements and contribute to the preparation for a management review and management review revisions. The best management representatives anticipate the needs of top management and give them tools that explain exactly what they need to do to prepare for a management review and their responsibilities during the meeting.

Additional Management Review Resources

If you are looking for more information on this topic, here are some resources:

  1. How to Improve Your Medical Device Management Review Procedure
  2. Management Review Procedure Case Study
  3. Management Review Webinar: Making your meetings more effective
  4. Medical Device Management Review Meetings: 3 Compliance Issues

Posted in: ISO 13485:201x, ISO Certification

Leave a Comment (10) →

Post-market surveillance plans: How to write one for CE Marking.

This article explains how to write a post-market surveillance plan for CE Marking and how to determine if a post-market clinical follow-up (PMCF) study is required.

Screenshot 2015 12 15 at 6.18.57 AM Post market surveillance plans: How to write one for CE Marking.

A post-market surveillance (PMS) plan is only required for the highest risk devices by the FDA (i.e., typically devices that require a PMA or premarket approval). For CE Marking, however, all product families are required to have evidence of post-market clinical follow-up (PMCF) studies or a justification for why PMCF is not required.

Why is a post-market surveillance plan a “hot button” with auditors recently?

Post-Market Surveillance is an area of emerging concern around the world. Not just a procedure for PMS, but an actual product-specific plan for gathering post-production data about your product or product family. Product registries, the anticipated launch of Eudamed and the implementation of UDI regulations are part of this industry-wide movement. The FDA has articulated the US plan for strengthening PMS in a guidance document, while the European PMS efforts are being debated as a central part of the new European Medical Device Regulations.

The biggest mistake I see 

The biggest mistake I see is that manufacturers refer to their PMS procedure as the PMS plan for their product family, and they say that they do not need to perform a PMCF study because the device is similar to several other devices on the market. Manufacturers need to have a PMS plan that is specific to a product or family of products.

How often is post-market surveillance data collected?

Your post-market surveillance procedure needs to be updated to identify the frequency and product-specific nature of post-market surveillance for each product family or a separate document needs to be created for each product family. For devices that are high-risk, implantable or devices that have innovative characteristics the manufacturer will need to perform some PMCF studies. Even products with clinical studies might require PMCF, because changes to the device, accessories and range of sizes may not be covered by the clinical studies. MEDDEV 2.12/2 provides guidance on the requirements for PMCF studies, but most companies manufacturing moderate risk devices do not have experience obtaining patient consent to access medical records in order to collect PMCF data–such as postoperative follow-up data.

Additional Resources

Medical Device Academy has created a post-market surveillance plan template that you can download for free. If you are looking for a procedure for post-market surveillance, please click here. If you are interested in learning more about PMS and PMCF studies, we also have a webinar on this topic.

Posted in: Clinical Studies & Post-Market Surveillance

Leave a Comment (0) →

Define medical device software verification and validation (V&V)

This article defines software verification and validation (V&V) for medical devices. The article also provides an overview of the CE Marking application and 510k submission requirements for medical devices containing software. Finally, we provide a link to our free download of a webinar on 510k software documentation.

Software Validation and Verification 1 Define medical device software verification and validation (V&V)

Software verification and validation is an essential tool for ensuring medical device software is safe. Software is not a piece of metal that can be put into a strain gauge to see if the code is strong enough not to break. That’s because software is intangible. You can’t see if it is in the process of failing until it fails. The FDA is concerned about software safety since many medical devices now include software. Software failure can result in serious injury, or even death to a patient. This places significant liability on the device manufacturer to ensure their software is safe. One way to ensure software safety is to perform software verification and validation (V&V).

What is software verification and validation (V&V)?

Definitions of software verification and validation confuse most people. Which tasks are software verification? and which tasks are software validation? Sometimes the terms are used interchangeably. Even the FDA does not clearly define the meaning of these two terms for software. For example, in the FDA’s design control guidance document the following definitions are used:

“Verification means confirmation by examination and provision of objective evidence that specified requirements have been fulfilled.”

“Validation means confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled.”

Specific intended use requirement…specified requirements…what is the difference? To understand the difference between the two terms, the key is understanding “Intended Use.” It is asking the question: “What is the software’s intended use?”

“Intended Use” is not just about a bunch of engineers sitting around a table coming up with really cool ideas. “Intended Use” refers specifically to the patient/customer of the software and how it fulfills their needs (i.e., “User Needs”). Systematic identification of user needs is required, and the user needs must be addressed by the software. Identification of user needs is done through customer focus groups, rigorous usability studies and consultation with subject matter experts such as doctors and clinicians providing expert insight.

“Intended Use” also ensures safety of the process through the process of “Hazard Analysis” whereby any hazard that could potentially cause harm to the patient/customer is identified. For each identified hazard, software requirements, software design and other risk controls are used to make sure the hazard does not result in harm, or if it does, the severity of the harm is reduced as far as possible.

So if “Validation” ensures user needs are met, what is “Verification” and how does it apply to the software development process. “Verification” ensures that the software is built correctly based on the software requirements (i.e., design inputs), with regard to each task the software must perform (i.e., unit testing), during communication between software modules (i.e., integration testing) and within the overall system architecture (i.e., system level testing). This is accomplished by rigorous and thorough software testing using prospectively approved software verification protocols.

CE Marking requirements for software verification and validation (V&V)

European CE Marking applications include submission of a technical file that summarizes the technical documentation for the medical device. In order to be approved for CE Marking by a Notified Body, the device must meet the essential requirements defined in the applicable EU directive. The technical file must also include performance testing of the medical device in accordance with the “State of the Art.” For software, IEC/EN 62304:2006, medical device software – software life cycle processes, is considered “State of the Art” for development and maintenance of software for medical devices. This standard applies to stand-alone software and embedded software alike. The standard also identifies specific areas of concern, such as software of unknown pedigree (SOUP). As with most medical device standards, the standard provides a risk-based approach for evaluation of SOUP acceptability and defines testing requirements for SOUP.

FDA requirements for software verification and validation (V&V)

For 510k submissions to the US FDA, section 16 of the 510k submission describes the software verification and validation (V&V) activities that have been conducted to ensure the software is safe and effective. There are 11 documents that are typically included in this section of the submission for software with a moderate level of concern:

  1. Level of Concern
  2. Software Description
  3. Device Hazard Analysis
  4. Software Requirement Specification (SRS)
  5. Architecture Design Chart
  6. Software Design Specification (SDS)
  7. Traceability Analysis
  8. Software Development Environment Description
  9. Verification and Validation Documentation
  10. Revision Level History
  11. Unresolved Anomalies (Bugs or Defects)

The FDA does not require compliance with IEC 62304 as the European Regulations do, but IEC 62304 is a recognized standard and manufacturers must comply with all applicable parts of IEC 62304 if they claim to follow IEC 62304. The FDA also provides a guidance document for the general principles of software validation.

Additional Resources

If you are interested in learning more about the documentation requirements for a 510k submission of a software medical device, please click here to download a free recording of our 510k software documentation webinar.

Medical Device Academy also has a new live webinar scheduled for Tuesday, January 5, 2016 @ Noon (EST). The topic is “Planning Your 2016 Annual Audit Schedule”. We are also offering this live webinar as a bundle with our auditor toolkit.

About the Author

Nancy Knettell is the newest member of Medical Device Academy’s consulting team and this is her first blog contribution to our website. Nancy is an IEC 62304 subject matter expert. To learn more about Nancy, please click here. If you have suggestions for future blogs or webinars on the topic of medical device software, please submit your requests to our updated suggestion box.

Posted in: Software Verification and Validation

Leave a Comment (0) →

How to handle FDA inspector with incompetencies and ego

Handle FDA inspector egos and incompetencies during an audit of your facility–including requests for exempt quality system records.

p31653 p v7 aa e1449491882329 298x300 How to handle FDA inspector with incompetencies and ego

This is not how to handle FDA inspector or auditor!

This topic was submitted to my suggestion box from a colleague in Australia. Originally I posted this as an announcement for my LinkedIn Group, but the post was limited to ISO certification body auditors and excluded FDA inspectors. The basic approach is the same, but there are some important nuances regarding how to handle FDA inspector incompetencies and ego that I am including in this article.

Handle FDA Inspector Distrust

In general anyone that works for the FDA is genuinely concerned about public health and welfare. They also have a very low tolerance for unethical behavior. This has not always been the case at the FDA and the agency has fought hard over the past twenty years to eliminate anyone from their ranks that is not ethical. Therefore, if an FDA inspector thinks that you have something to hide the best approach to handle FDA inspector concerns is to give them anything they ask for–and quickly.

Unlike ISO auditors, FDA inspectors are not allowed to review three types of records:

  1. Management Review Meeting Minutes
  2. Internal Audit Reports
  3. Supplier Audit Reports

The FDA can learn almost everything they want to know by reviewing CAPAs that resulted from Management Reviews, internal audits and supplier audits. However, some FDA inspectors will still ask to see records that are part of the quality system record exceptions (i.e., 21 CFR 820.180c). Some quality system managers design cover sheets for these three records to specifically show FDA inspectors only the information that they are entitled to. If I am faced with this situation, I handle FDA inspector requests for restricted quality system records in the following way.

“Here is a copy of the quality system record you requested. This is one of the records that is exempt from the requirements in 21 CFR 820.180. However, we have nothing to hide. Therefore, you can take as many notes as you like about the content of this record, but you may not take a copy of the record with you.”

The above approach is intended to convince an FDA inspector that you have nothing to hide, but it also requires that you review and edit your records prior to approval and archiving to make sure that statements made in the records are appropriate–regardless of the audience reading the record.

Handle FDA Inspector and auditor personality

100% of auditors are a little weird (yep, takes one to know one). You travel for a living and tell people what’s wrong with their quality system. If you don’t start out drinking scotch, you probably will eventually. However, a little patience, understanding and over communication helps. For example, provide directions (that are accurate). Recommend a hotel (middle of the road, not the Ritz or a flea bag). Tell them about the corporate discount. Ask them in advance if they have food allergies (I’m gluten-free, and not by choice), and then try to remember not to serve only the things they are allergic to (yes, Panera Bread is a crappy choice but a gluten-free pizza is heaven). If Uber makes sense recommend it, because nobody wants to negotiate with Payless Rent-A-Car at 11:59pm.

FDA inspectors are in the same situation as auditors with regard to being travel weary. However, FDA inspectors will probably not take your recommendation for a hotel. Instead they will follow FDA guidelines and stay at a hotel chain where they prefer to accumulate membership points and they can get a government employee discount. In addition, FDA inspectors will not eat at your facility. It seems as though a few companies entertained FDA inspectors at clubs and fancy restaurants in the past. In order to eliminate any possible perception of unethical behavior, FDA inspectors are now instructed to leave your facility for lunch and return to complete the day. They probably won’t even accept a cup of coffee unless you place a carafe on the table for everyone to drink. You can also count on the FDA inspectors driving a rental car if they do not live locally.

Handle FDA Inspector and Auditor Ego

Everyone has an ego. Auditors typically have a big one, and a few FDA inspectors do too. I’m not shy, I’m smart and I love a good debate. If I’m you’re auditor, you’re lucky because I’ll admit when I’m wrong or make a mistake. Most auditors will not admit mistakes. In fact, the stronger they argue a point the more likely that they are insecure on the topic or that they have a personal preference that is a result of a bad experience. Unfortunately, FDA inspectors seem to be even more likely to argue a point when they know very little experience.

Don’t ask FDA inspectors and auditors to prove something is in the regulations or the standard. Instead, try reading Habit 5 by Covey (7 Habits of Highly Effective People). You need to be an empathic listener. The FDA inspector or auditor doesn’t hate you. They might even be trying to help you. They also might be wrong, but try restating what the person is saying in your own words and try explaining why it’s important. This shows them that you were listening, you understand what they said and you understand how they feel about the issue. Pause. Then tell them how you were trying to address this issue.

One of the areas where the above approach is especially important is when and FDA inspector is reviewing complaint records and medical device reports (MDRs). You want to convince the FDA inspector that you are doing everything you can do to investigate the complaint or adverse event and you want to prevent recurrence. Remember that someone was hurt by your device or misuse of your device, and FDA inspectors take public safety very seriously. You will not be able to handle an FDA inspector that believes you are doing less than you could be.

Handle FDA Inspector and Auditor Incompetencies

FDA inspectors rarely have industry experience, but they know the regulations. Therefore, arguing the regulations with an FDA inspector is a huge mistake. The only frame of reference for “industry best practice” is what the FDA inspector has seen at other device manufacturers they audit. Therefore, it is very import to know how experienced your FDA inspector is. If they don’t have a lot of experience they will be defensive and you might need to “educate” them.

During ISO audits you have less time to retrain your auditor. Don’t even try. I do this for a living and we’re a stubborn bunch of orifices. Instead, try the empathic listening first. 99% of the time one or both of you is not communicating clearly. Either they can’t find what they are looking for, or they misunderstood what you were telling them. It could be a difference of interpretation, but it’s probably not. If it is, then say “We were interpreting that requirement as…”. Say this once. If they argue, let it drop for now.

Resolution of 483 Observations and Audit Findings

You shouldn’t just take incorrect findings lying down. Do your homework. Send me an email. Get help. If you’re right, then contest it at the closing meeting in a factual and persuasive way. If the auditor holds their ground, ask what the policy is for resolving disputes. This is supposed to be covered as part of the closing meeting of every audit. If your auditor is just lazy, sloppy and incompetent–request a new auditor. You might even disagree in writing, address the finding anyway and then request the new auditor. That shows the management of the certification body that you’re not lazy, sloppy or incompetent.

FDA inspection 483 observations are a little different. If you and the inspector disagree you should state this in the closing meeting when they give you the 483 observation, and you should be clear that you disagree prior to end of the inspection when they start preparing FDA Form 483. Once a 483 observation is issued, however, your only recourse is to persuade the district office that the 483 observation is undeserved. The FDA district office will have copies of all your procedures and records and a copy of the FDA inspector’s notes. Be careful with complaints to the district office though. FDA inspectors are far more likely to retaliate than ISO auditors.

Caution

If you make a habit of disputing everything, your auditor or FDA inspector will come prepared for war. You also will have little credibility with the managers at the certification body or the FDA district office. Dispute only things that are justified and provide a written, factual justification that is devoid of all emotion.

Responding to FDA 483 Observations

If you do receive FDA 483 observations, it is important that you respond with well-conceived corrective action plans. If you need help with responding to an FDA 483 inspection observation, you might be interested in my webinar on this topic.

Posted in: FDA

Leave a Comment (0) →
Page 4 of 23 «...23456...»
Follow

Get every new post on this blog delivered to your Inbox.

Join other followers:

Simple Share Buttons
Simple Share Buttons