Blog

Author Archive

Benefit-Risk Analysis – Deviation #4 in ISO 14971

Review of ISO 14971 Deviation #4 specific to the requirement for benefit-risk analysis. This blog is the fourth in a seven-part series.

%name Benefit Risk Analysis   Deviation #4 in ISO 14971

This blog is the fourth installment in our seven-part series, which reviews each of the content deviations between the three device directives for Europe and international risk management standard (ISO 14971:2007). The deviations were identified in the new European National version of the Standard released in 2012. There was no change to the content of Clauses 1 through 9 in ISO 14971, but then there were seven deviations from the directives identified by the European Commission.

Discretion as to Whether a Benefit-Risk Analysis Needs to Take Place

The fourth deviation is specific to the requirement for risk-benefit analysis. Clauses 6.5 and 7 of the 14971 Standard both imply that a risk/benefit analysis is only required if risks exceed a threshold of acceptability, and Annex D.6.1 indicates that “This International Standard does not require a benefit-risk analysis for every risk.” However, essential requirements 1 and 2 require that you perform a risk/benefit analysis for each risk and overall residual risk. Essential requirement 6a also requires a risk-benefit analysis as part of the conclusion in your Clinical Evaluation Report (http://bit.ly/ER6aMEDDEV).

Your company may have created a risk management procedure, which includes a matrix for severity and probability. The matrix is probably color-coded to identify red cells as unacceptable risks that require a benefit-risk analysis, yellow cells that are ALARP, and green cells that are acceptable. Based upon the guidance provided in ISO 14971, your company probably identified that a benefit-risk analysis is only required for a risk that falls in the red zone of the matrix where the risk is “unacceptable.”

Deviation 4 Benefit Risk Analysis   Deviation #4 in ISO 14971

Unfortunately, this approach is not compliant with the European Directives, because the Directives require that a benefit-risk analysis be performed for each risk and all residual risks—not just the risks you identify as unacceptable. The fourth deviation between the ISO 14971 Standard and the Essential Requirements of the European Directives is relatively simple to address with a change to your risk management process. To comply with EN ISO 14971:2012, the “red zone” should not be labeled as a benefit-risk analysis, because even risks in the “green zone” require benefit-risk analysis.

Impact of this Deviation

In a previous blog about deviation #2, we determined that the implementation of risk controls must reduce all risks. In this blog, we established that after the implementation of risk controls, all residual risks must be subject to a benefit-risk analysis. Your company will need to eliminate the use of a risk evaluation matrix like the one shown above. Instead of relying on a risk management policy for evaluating the acceptability of risk, your company should be performing a benefit-risk analysis to determine the acceptability of risks.

The best way to integrate benefit-risk analysis for the evaluation of the acceptability of all risks is to integrate this with the clinical evaluation process. In addition to using clinical literature, clinical study data, and post-market surveillance as inputs for your clinical evaluation, your company should also be using residual risks as inputs to the evaluation. The clinical evaluation should be used to assess the significance of these residual risks, and verify that there are not any risks identified in the clinical evaluation that were not considered in the risk analysis.

In order to document that your company has performed a benefit-risk analysis for each residual risk, you will need to reference the risk management report in the clinical evaluation and vice-versa. Both documents will need to provide traceability to each risk identified in the risk analysis, and conclusions of risk acceptability will need to be based upon the conclusions of the clinical evaluation.

Once the product is launched, you will need to update the clinical evaluation with adverse events and other post-market surveillance information. As part of updating clinical evaluations, you will need to determine the acceptability of the risk when weighed against the clinical benefits. These conclusions will then need to be updated in the risk management report—including any new or revised risks.

If you are interested in ISO 14971 training, we were conducting a risk management training webinar on October 19, 2018.

Posted in: ISO 14971:2019 (Risk Management)

Leave a Comment (7) →

CE Marking Routes to Regulatory Approval

ce marking routes CE Marking Routes to Regulatory ApprovalThe author reviews the conformity assessment process contained in Annexes VII, II, V, and III related to a company seeking CE Marking regulatory approval.

CE Marking of medical devices requires technical documentation (i.e., – a Technical File or Design Dossier)—regardless of the device classification. However, the classification of the device has a significant impact on the regulatory approval pathways available to your company. Therefore, the first step in the process of CE Marking of medical devices is to determine the risk classification (http://bit.ly/riskclass). There are four device classifications: Class I, IIa, IIb, and III.

Once your company has determined the risk classification of the device, then you must determine which conformity assessment procedure you will follow to receive CE Marking approval. The conformity assessment procedures available for each classification are identified in Article 11 of the Medical Device Directive (http://bit.ly/M5MDD), and additional detail is provided in the various Annexes (i.e., – Annex II, III, IV, V, VI, and VII). The following table below summarizes the options for each classification:

ce marking chart CE Marking Routes to Regulatory Approval

If your product is a Class I device that is non-sterile and non-measuring, then you will not require a Notified Body (NB). However, all other products will require your company to select a NB (http://bit.ly/SelectingRegistrar).

Annex VII – Declaration of Conformity

If your company does not require NB involvement, then you will be able to issue a Declaration of Conformity In accordance with Annex VII. You will also need to register your product with one of the Competent Authorities (CA) in Europe. CAs are the U.S. FDA equivalent in each EU member state. The following is a list of contact information for all the CAs: http://bit.ly/ContactPoints. If your company does not have a physical presence in Europe, you will also need to select a European Authorized Representative (AR). My recommendation is to select an AR that is one of the 15 members of the European Association of Authorized Representatives (http://bit.ly/EAARMembers).

Annex II – Full Quality Assurance

Most companies use the Annex II conformity assessment process to achieve CE Marking. In this process, the NB reviews your Technical File for conformity and also reviews your quality system for conformity with regulatory requirements in the applicable directives. As part of the Annex II process, the NB will audit your design process to ensure that you have adequate design controls and that your process for establishing and maintaining a Technical File is adequate. Once your company has adequately addressed any findings from the audit, the NB will issue your company a Full Quality Assurance (FQA) CE Certificate in accordance with Annex II.3. Once you have the Certificate, your company will be able to launch new products without prior approval from the NB. The only requirement is that the new products are within the scope of the Annex II.3 certificate.

Annex V – Production Quality Assurance

The Annex V conformity assessment process is the most common route to CE Marking for companies that outsource product design to a third-party. If your company outsources design, Clause 7.3 is excluded from your ISO 13485 Certification, and you cannot demonstrate “Full Quality Assurance.” Therefore, the NB will issue an Annex V certificate for “Production Quality Assurance.” Annex IV and Annex VI are alternate conformity assessment procedures, but these are used less frequently for medical devices and are outside the scope of this blog.

Annex III – Type Examination

The Annex III conformity assessment process is a type of examination that is performed for higher risk devices where the company does not have an Annex II certificate. This type of examination involves a review of your company’s design dossier, and the NB issues a Type Examination CE Certificate. This Certificate cannot be used alone for CE Marking. Type Examination Certificates must be used in conjunction with another CE Certificate, such as the Annex V certification for Production Quality Assurance. This combination would be used for Class IIb and Class III devices in place of an Annex II CE Certificate.

If your company needs help with CE Marking, including training on the medical device directive, please contact Medical Device Academy at rob@13485cert.com. We are also developing a webinar series for this purpose. If you interested in more services, try viewing the following blog category page: http://bit.ly/CEMarking.

Posted in: CE Marking

Leave a Comment (2) →

Selecting an ISO Certification Body for CE Marking and Health Canada

 

Guest Blogger,  Susan Christie, Regulatory Consultant

Cropped Front of Card Selecting an ISO Certification Body for CE Marking and Health Canada

Which Certification Body should you select?

The author reviews considerations for selecting an ISO Certification Body for CE Marking in Europe and Canadian Medical Device Licensing with Health Canada.
What is a Certification Body?

A certification body is a third-party company who is accredited by an organization like the ANSI-ASQ National Accreditation Board (ANAB) (http://bit.ly/ANABorg), United Kingdom Accreditation Service (UKAS) (http://bit.ly/UKASorg) or Standards Council of Canada (SCC) (http://bit.ly/SCC-org) to perform certification audits against ISO Standards, such as ISO 9001 or ISO 13485. Accreditation bodies verify the conformity of certification audits to the ISO/IEC 17021 Standard (http://bit.ly/IEC-ISO17021). Some certification bodies are not accredited or maybe self-accredited. Still, you will need a certification body that is accredited to meet the regulatory requirements of Health Canada and European Competent Authorities.

Selecting the right certification body for your company is a critical step on the journey towards ISO 13485 certification. When I first joined one of my previous companies, I was assigned the task of implementing ISO 13485 to comply with the Canadian Medical Device Regulations (CMDR, http://bit.ly/FindCMDR) under the Canadian Medical Device Conformity Assessment System (CMDCAS, http://bit.ly/CMDCAS). First, I discovered that the company already had two certification bodies. The company initially received an ISO 9001 certificate from one certification body, and then a few years later, an ISO 13485 certificate was issued by another certification body. Unfortunately, neither certification body was recognized by Health Canada (http://bit.ly/RecognizedRegistrars). Therefore, when I joined the company, and we were seeking a Canadian Medical Device License, we had to find a third certification body. This time, I selected a registrar recognized by Health Canada. Then I was able to transfer our ISO 9001 certificate to the new registrar and eliminate the other two certification bodies.

When searching for a certification body, you will find that there are different names for the term, depending on the country to which you are seeking your certificate. For some of the biggest markets, they are named as follows:

  • Europe – notified bodies
  • Canada – registrars
  • Japan – registered certification bodies
  • Australia – conformity assessment bodies
9 Points to Consider When Selecting a Certification Body
  1. Refer to the official Europa page that helps you identify the complete list of “possible” candidates based upon the product category (http://bit.ly/NBDatabase).
  2. Consider choosing a Notified body that has endorsed the Code of Conduct (COC) v3.0 as your short-list. The COC has set the bar high, and you will want to utilize a notified body that is aligned with this document. The last time I checked, there were only 12, but the expectation is that this will be mandatory (http://bit.ly/CoCNBV3).
  3. The size and reputation of the notified body can have an impact on your customer’s confidence in your QMS. If they are savvy, they know who the key players are, and who has the more credible reputations in the medical device field. Before transitioning to BSI, I experienced “eye-rolling” during customer audits when asked for the name of our notified body.
  4. Consider the level of risk associated with the classification of the medical devices that are currently marketed and those that may be planned for future distribution. The EU Commission and Competent Authorities (US FDA equivalent in European member states) throughout Europe are currently re-evaluating all the Notified Bodies to determine if they will continue to be allowed to issue CE Design Examination Certificates (Annex II.4) and CE Type Examination Certificates (Annex III) for the highest risk devices (i.e., – Class IIb and Class III).
  5. Identify all your regulatory needs unless you want to contract multiple certification bodies (not recommended). Certification bodies are not created equal, and some may not be qualified to provide all the services needed. A certification body qualified to issue a certificate for ISO 13485 may not be able to provide a CE certificate for CE Marking required by the EU, and only 15 certification bodies are recognized by Health Canada as CMDCAS registrars (http://bit.ly/RecognizedRegistrars). To avoid the need for additional certification bodies in the future, you need to identify your long-term certification requirements for the international markets you will be distributed in.
  6. Compare price quotes from each certification body you are considering and make sure that you provide the same criteria to each potential certification body to ensure that you are getting a fair quote. This is also the time to determine ALL costs associated with audits, certificates, and any other fees. Be sure to include any travel costs, as they are part of the fees that will be included in the contract. If you have multiple sites, consider the benefit of utilizing the same auditor for each site for consistency. However, using one auditor can also incur higher travel costs.
  7. Evaluate each certification body’s customer service before the initial certification audits by asking for “360-degree” evaluations by everyone in your organization that will interact with the certification body directly. This includes planners scheduling the certification audits, the accounts receivable department handling invoices for the certification body, and your sales team that may be able to represent a customer’s opinion of the various certification bodies you are considering. Responsiveness is one of the best criteria to evaluate this customer service against. If the certification body is difficult to work with before certification, it won’t get better.
  8. What is your regulatory strategy? Are you looking for a certification body that will conduct an audit that barely meets requirements? Or maybe you want a certification body that will work with you as a partner to build a QMS made up of best practices. I recommend a “picky” certification body. This will ensure that you choose a partner that forces you to improve your QMS and remain competitive with other medical device companies that have embraced the principles of an ISO QMS.
  9. Finally, if your medical devices or the manufacturing process is complex or innovative, you should select a certification body with auditors that have the technical expertise to understand your product and processes. For example, if your company makes special plastic implants that require “gas plasma,” or vapor-hydrogen peroxide sterilization, you want to ensure that the certification body has auditors that understand this sterilization process.
Strategic Decision-Making

To evaluate each certification body, a spreadsheet may help keep track of information. However, the best practice for making this type of strategic supplier decision is a “Proposal A3 Report”. This special type of A3 Report is explained in Dan Matthew’s workbook (http://bit.ly/A3Workbook). Rob Packard, the founder of the Medical Device Academy, used this approach for the selection of a new Notified Body to transfer to for a recent client.

If you need assistance with ISO 13485 Certification or are interested in training on medical device regulations for the United States, Europe, or Canada, please email the Medical Device Academy at rob@13485cert.com, or contact Rob Packard by phone @ +1.802.258.1881. For other blogs on the topic of “ISO Certification,” please view the following blog category page: http://robertpackard.wpengine.com/category/iso-certification/.

Posted in: ISO Certification

Leave a Comment (3) →

Medical Device CE Marking: Writing a Classification Rationale

%name Medical Device CE Marking: Writing a Classification RationaleThe author reviews considerations in “how to” write a classification rationale for medical device CE marking (i.e., questions for applying classification rules).

 CE Marking of medical devices requires technical documentation (i.e., – a Technical File or Design Dossier). One of the requirements of this technical documentation is to establish the risk class of a device in accordance with the classification rules in Annex IX. The requirement to include this classification rationale in the Technical File is not well defined in Article 9, Classification, of the Medical Device Directive (http://bit.ly/M5MDD), but the guidance document for Technical Documentation (http://bit.ly/NBMED251Rec5) clearly defines this requirement in Section 3.2 (viii). Establishing a classification rationale is the first step to establishing the regulatory pathway that will be required to CE Mark your medical device.

What are the Classifications?

There are four different classifications of medical devices in Europe: Class I, Class IIa, Class IIb and Class III. These four classifications are also referred to as “risk class.” The lowest risk classification is Class I, and the highest risk classification is Class III. Class IIa is considered a “medium risk,” while Class IIb is considered a “high risk” medical device. Notified Body involvement and a CE Certificate from the Notified Body is required for almost all medical devices distributed in Europe, however, Class I devices that are non-sterile and do not perform a measurement function do not require Notified Body involvement. Class I devices that are sterile are often referred to as “Class I-S,”but this is not a term used in the Directive. The same is true of “Class I-M” for Class I devices with a measurement function.

Applying the Rules for Medical Device CE Marking

In order to apply the classification rules as defined in Annex IX of the MDD, the following questions must be answered for the device or device family:

  1. Is the device invasive? –  Invasiveness of a device is an important criterion, because non-invasive devices are generally Class I, and there is typically no Notified Body involvement required for these devices.
  2. Is the device surgically invasive, or invasive with respect to body orifices?  If a device is surgically invasive with respect to a body orifice, Rule 5 is the most likely classification rule. For all other devices that are surgically invasive, the duration of use is important
  3. How long is the device used inside the body? The primary difference between Rules 6, 7 and 8 is the duration of use. In general, permanent implants are subject to Rule 8, and are Class IIb devices. The other surgically invasive devices are generally Class IIa devices. Devices under Rule 6 are for “transient” use (i.e., – intended for continuous use for less than 60 minutes). Devices under Rule 7 are for “short-term” use (i.e., – intended for continuous use for between 60 minutes and 30 days.). There are multiple exceptions to each rule, and these exceptions should all be considered.
  4. Is the device electrically powered (i.e., – an active device)? Active devices are subject to rules 9, 10, 11 and 12.
  5. Do any of the “Special Rules” apply? It is recommended to actually start with Rules 13-18 to ensure that one of the special rules do not apply. For example, if you are making blood bags, there is no need to read anything in Annex IX except Rule 18.
Guidance Document for Classification

Annex IX defines the classification rules for Europe, but there is also a guidance document (http://bit.ly/EUClassification) published that helps to explain the classification rules with examples. This guidance document is extremely important, because it provides clarification of rules based upon interpretations that have been made by Competent Authorities with Notified Bodies and companies. For example, critical anatomical locations are defined in Section 3.1.3: “For the purposes of the Directive 93/42/EEC, ‘central circulatory systemmeans the following vessels:…”.

When you write a classification rationale for your technical documentation, it is important to reference this document—as well as Annex IX of the MDD. Your rationale should address each of the questions above for applying the classification rules. In addition, your rationale should indicate that none of the “Special Rules” (Rules 13-18) are applicable to your device or device family.

Mixed Classifications

It is possible to have a device family, contained within one Technical File or Design Dossier, that has more than one Classification. For example, you could choose to group a family of vascular grafts together in one Technical File that are permanent implants and non-absorbable. Normally, these devices would be Class IIb in accordance with Rule 8. However, if one or more of the grafts is intended for vessels included in the central circulatory system, then these grafts would be Class III devices. If a graft can be used for either indication, then the higher classification should be applied.

Proposed EU Regulations

On September 26, 2012, the European Commission released a draft proposal for a new medical device regulation. The expected implementation transition period for these proposed regulations is 2015-2017. In Annex II of the proposed regulations (http://bit.ly/EUProposal), it specifies that the risk class and applicable classification rationale shall be documented in the technical documentation. This appears as item 1.1e) under the heading of “Device description and specification.”

The MDD defines the classification rules for medical devices in Annex IX, while in the proposed EU regulations classification, rules are now in Annex VII. The MDD also has 18 rules, while the proposed regulations have 21 rules. In order to download a Gap Analysis of the Classification Rules for CE Marking, please visit the following page on this website: http://bit.ly/gapanalysiscmda.

If you need assistance with medical device CE Marking, or you are interested in training on CE Marking, please contact Medical Device Academy at: rob@13485cert.com. Medical Device Academy is developing a webinar series specifically for this purpose. You can also call Rob Packard by phone @ 802.258.1881. For other blogs on the topic of “CE Marking,”please view the following blog category page: http://robertpackard.wpengine.com/category/ce-marking/

Posted in: CE Marking

Leave a Comment (0) →

ALARP vs As far as possible – Deviation #3

This third blog in a seven-part series reviews deviation #3, ALARP vs. “As far as possible,” with regard to risk reduction.

chart dev 3 ALARP vs As far as possible   Deviation #3In 2012, the European National (EN) version of the Medical Device Risk Management Standard was revised, but there was no change to the content of Clauses 1 through 9. Instead, the European Commission identified seven content deviations between the 14971 Standard and the requirements of three device directives for Europe. This seven-part blog series reviews each of these changes individually and recommends changes to be made to your current risk management policies and procedure.

Note: This is 2013 blog that will be updated in the near future, but the following link is for our current risk management training.

Risk reduction: “As Far As Possible” (AFAP) vs. “As Low As Reasonably Practicable” (ALARP)

The third deviation is specific to the reduction of risk. Design solutions cannot always eliminate risk. This is why medical devices use protective measures (i.e., – alarms) and inform users of residual risks (i.e., – warnings and contraindications in an Instructions For Use (IFU). However, Essential Requirement 2 requires that risks be reduced “as far as possible.” Therefore, it is not acceptable to only reduce risks with cost-effective solutions. The “ALARP” concept has a legal interpretation, which implies financial considerations. However, the European Directives will not allow financial considerations to override the Essential Requirements for the safety and performance of medical devices. If risk controls are not implemented, the justification for this must be on another basis other than financial.

There are two acceptable reasons for not implementing certain risk controls. First, risk control will not reduce additional risk. For example, if your device already has one alarm to identify a battery failure, a second alarm for the same failure will not reduce further risk. The redundant alarms are often distracting, and too many alarms will result in users ignoring them.

The second acceptable reason for not implementing a risk control is that there is a more effective risk control that cannot be simultaneously implemented. For example, there are multiple ways to anchor orthopedic implants to bone. However, there is only enough real estate to have one fixation element at each location. If a femoral knee implant is already being anchored to the femur with metal posts and bone cement, you cannot also use bone screws at the same location on the femur to anchor the implants in place.

ALARP does not reduce risk “As far as possible”

Annex D.8 in ISO 14971, recommends the ALARP concept in Clause 3.4 of the 14971 Standard. Therefore, the risk management standard is contradicting the MDD. This contradiction is the primary reason why medical device companies should discontinue the use of phthalates and latex for most medical devices. Even though these materials are inexpensive solutions to many engineering challenges presented by medical devices, these materials present risks that can be avoided by using more expensive materials that are not hazardous and do not pose allergic reactions to a large percentage of the population. The use of safer materials is considered “state-of-the-art,” and these materials should be implemented if the residual risks, after implementation of the risk control (i.e., – use of a safer material) are not equal to, or greater than, the risk of the cheaper material.

Recommendation for eliminating ALARP

Your company may have created a risk management procedure that includes a matrix for severity and probability. The matrix is probably color-coded to identify red cells as unacceptable risks, yellow cells that are ALARP, and green cells that are acceptable. To comply with EN ISO 14971:2012, the “yellow zone” should not be labeled as ALARP. A short-term solution is to simply re-label these as high, medium, and low risks. Unfortunately, renaming the categories of risk high, medium, and low will not provide guidance as to whether the residual risk is reduced “as far as possible.”

Resolution to this deviation

As companies become aware of this deviation between the 14971 Standard and the Essential Requirements of the device directives, teams that are working on risk analysis, and people that are performing a gap analysis of their procedures will need to stop using a matrix, like the example above. Instead of claiming that the residual risks are ALARP, your company will need to demonstrate that risks are reduced AFAP, by showing objective evidence that all possible risk control options were considered and implemented. Your procedure or work instruction for performing a risk control option analysis may currently state that you will apply your risk management policy to determine if additional risk controls need to be applied, or if the residual risks are ALARP.

This procedure or work instruction needs to be revised to specify that all risk control options will be implemented unless the risk controls would not reduce risks further, or the risk controls are incompatible with other risk controls. Risk control options should never be ruled out due to cost.

Posted in: ISO 14971:2019 (Risk Management)

Leave a Comment (3) →

Why the FDA 510k Process Needs to Change Now: A Proposed Solution

The author says three factors are accelerating the need for change to the current FDA 510k process and offers a proposed solution.

%name Why the FDA 510k Process Needs to Change Now: A Proposed SolutionWhen a company’s marketing literature tells you how a new device is different from competitor products, and the 510k summary for the same new device states that it is “substantially equivalent,” you can understand why the FDA may not fully support the 510k process for innovative, medium-risk devices.

There are many things wrong with the FDA 510k process, but the concept of using a predicate device and demonstrating equivalence is inherently a wrong approach for innovative devices. A preliminary report about the 510k process was released in 2010 (http://bit.ly/510kreport). The report states, “While the concept of ‘substantial equivalence to a predicate’ is generally reasonable, CDRH’s application of this standard has, in some instances, raised concerns.” Specifically, the use of predicate devices that were withdrawn from the market due to issues of safety or effectiveness, and the use of so-called “split predicates” may not ensure patient safety or device efficacy.

The FDA attempted to address issues identified in the report by issuing a draft guidance document for 510k submissions, but the industry hated it. The FDA has also gradually requested more clinical study data to demonstrate that the new device is substantially equivalent to the predicate device. This practice results in unexpected delays and much higher costs of regulatory approval. The FDA’s published guidance for 510k content (http://bit.ly/510kContent) indicates that “Clinical data is not needed for most devices cleared by the 510(k) process.” However, more than 10% of 510k submissions now require clinical data because the 510k for predicate devices included clinical data to demonstrate safety and effectiveness.

More recently, the FDA issued a draft guidance document for the De Novo process (http://bit.ly/DeNovoGuidance). The De Novo process allows the FDA to reset the submission requirements for devices that are not substantially equivalent and specify new requirements. The process has been used most for new In Vitro Diagnostic (IVD) products, and it is quite similar to the concept of Common Technical Specifications (CTS) introduced for IVD products in Europe.

Why the FDA 510k Process Needs to Change Now

The simultaneous confluence of three factors is accelerating the need for change in the 510k process. First, the cost of healthcare is skyrocketing. Therefore, patients and healthcare providers are desperately searching for less expensive treatment solutions. Second, insurance providers are demanding clinical evidence that new products are more effective than existing products that cost less. Third, evidence-based medicine is becoming mainstream. Physicians are no longer accepting the word of salespeople and marketing literature. Instead, physicians demand clinical data demonstrating that products are safe and effective. Users also want detailed information regarding patient selection criteria.

The collision of these three factors has exponentially increased the value and importance of clinical data. Still, only 10%+ of the 510k cleared devices to have clinical data at the time of product launch. Regulatory clearance to market a product is nearly useless if the product is not reimbursed, and users will not adopt its use. The modular Premarket Approval (PMA) process supports (http://bit.ly/PMAmethods) the need for preliminary safety data before clinical use, followed by a clinical study to demonstrate efficacy. However, 510k products are lower in risk and efficacy and can often be demonstrated with simulated use, animal testing, and cadavers.

As medical devices become more complex and innovative, bench-top testing and pre-clinical testing is not always adequate to demonstrate safety and efficacy for 510k products. Complex and innovative devices are extremely difficult to predict how the devices will interact with a broader population of users and patients, and it is difficult to predict the long-term effects of the devices—beyond the duration of a premarket, clinical study.

The PMA process requires premarket clinical data, but PMAs requires exponentially greater amounts of data than a 510k submission, and the FDA requires supplemental approval of almost every minor change (e.g., – changing a component supplier, or changing a test method). If the PMA process is too burdensome for most devices, and the 510k process is not adequate, what is the right process for the next generation of devices?

The De Novo process offers one solution, but it is still a premarket notification process. For the De Novo process to be useful for innovative devices, a Special Controls Guidance Document needs to include a requirement for both premarket clinical studies and Post-Market Surveillance (PMS).

Pilot Parallel FDA-CMS Review Process

In 2011, the FDA initiated a pilot program to allow companies to have PMA and CMS (http://bit.ly/Medicare-Medicaid) review processes occur in parallel (http://bit.ly/ParallelReview). The concept behind this pilot program is that the same clinical data must be reviewed for PMA approval and CMS reimbursement. If the pilot program is effective, products will be approved and reimbursed at the same time. However, this pilot program is only applicable to PMA products at this time. This program could be expanded to 510k products, where clinical data is presented as part of the application, but most 510k products do not warrant a clinical study.

Another Solution

The best tool to measure the safety of a new device is a clinical study, but U.S. clinical studies focus on demonstrating efficacy. Therefore, the FDA should consider using smaller clinical studies, without comparisons to predicate devices, to demonstrate safety rather than efficacy. This is the approach used by European Notified Bodies for medium and high-risk, innovative devices. This approach can also be integrated with a Special Controls Guidance Document for De Novo products.

For complex, innovative devices, the efficacy of the device is not reliably measured by clinical studies, because outcomes are highly dependent upon users. Premarket clinical studies can only estimate efficacy due to the small number of users. The lack of accurate efficacy predictability is why the FDA requires PMS for many PMA products. The best tool to measure efficacy is Post-Market Clinical Follow-up (PMCF) studies—not the premarket clinical studies the FDA uses to evaluate PMA applications. This is also the type of data that is required for CMS reimbursement and physician adoption.

Innovative devices are forcing regulations to evolve. The goal of regulators should be to produce a best-in-class method of evaluating which devices should be approved, reimbursed, and adopted as the standard of care.

Posted in: 510(k)

Leave a Comment (0) →

Effective Management Solutions for 10 CAPA Program Blunders

The author provides effective management solutions for ten real-life CAPA program blunders., (i.e., procedures, root cause analysis, closing CAPAs, etc.)

%name Effective Management Solutions for 10 CAPA Program Blunders

Effective Management Solutions for 10 CAPA Program Blunders

I am always looking for new and creative ways to help people understand the importance of maintaining an effective Corrective and Preventive Action (CAPA) program. If my last dozen CAPA blogs were not convincing enough, maybe this list of suggestions will help.

  • 1. If someone doesn’t follow procedures, just fire them. The employee in question is obviously the root cause. Management cannot be held responsible for the actions of employees. Once, I read a corrective action plan that indicated termination was the correction for a missing training record. The QA Manager clarified this statement by saying that the employee resigned for personal reasons, and there was no opportunity to train the employee. The CAPA record also indicated that 100% of the training records for manufacturing employees were reviewed for completion. There were a few records identified as incomplete, and those employees were trained—not terminated. The company also implemented a tracking tool to monitor training records. As a general rule, termination is not an acceptable corrective action or correction.
  • 2. If CAPAs are open longer than your procedure allows, close the existing CAPAs the day before the CAPAs become overdue, and open new CAPAs. CAPAs are not “closed” until all nonconformities have been corrected, corrective and preventive actions are implemented, and effectiveness checks are done. If the corrective and preventive actions were not completely effective, some companies chose to reopen the record and expand the plan of corrective and/or preventive actions. Other companies chose to open a new CAPA record, and reference the new record in the effectiveness check section of the previous CAPA record. Either approach works, but you cannot close an incomplete record and remain compliant.
  • 3. To verify the effectiveness of corrective actions, just include a copy of your document change order. Documenting changes to procedures meets part of the CAPA requirements, but this verifies implementation—not effectiveness. To verify the efficacy, you need to confirm that a nonconformity, or a potential nonconformity, will not recur. Low-frequency defects are often hard to demonstrate directly. The best approach is to validate the process parameters to demonstrate quantitatively that the process capability has improved. For manual processes, you may need to test the new process to verify that the error will not occur or will be detected.
  • 4. If you can’t finish tasks on schedule, revise your plan. If you still can’t finish tasks on schedule, revise your plan again—and again. It’s appropriate to revise your plan if you discover additional causes that your initial investigation missed. You should not, however, be revising target completion dates—except in rare cases. You also should not need to revise your plan multiple times.
  • 5. When you’re unsure why a problem occurred, identify the root cause as an unclear procedure, and make a minor change to the appropriate SOP. Making changes to procedures is quick and easy to verify. Unfortunately, this approach is seldom effective in preventing recurrence. You need to develop new process controls to make errors impossible. Eliminate variation in raw materials, eliminate subjectivity in inspections, and provide tools and fixtures to make manual processes capable of more consistent results. After you have reduced all three of these sources for process defects, then you are ready to revise your procedures and retrain employees.
  • 6. Whenever an employee fails to follow a procedure, just change the procedure to require another person to verify that they did it right. If one employee fails to follow procedures 100% of the time, a second person manually inspecting will also not be 100% effective. Another method of process control should be used to ensure that your process results in a conforming product. Adding more people provides a false sense of confidence. The use of objective measurement and go/no go fixtures offer a higher degree of certainty.
  • 7. Write a justification for an extension of the implementation timeline if a CAPA is about to become overdue. Justifications for extension provide objective evidence that management is aware that a CAPA plan is not meeting the target completion times. This is necessary on rare occasions, but extensions should never become routine. Also, if the progress of a CAPA is slow, monitoring should be frequent enough that management can release additional resources, or re-prioritize assignments in order to catch-up with the target completion date.
  • 8. Use the “5 Why” technique for root cause analysis to identify a user error to blame for complaints. The “5 Why” technique is effective at investigating the depth of a problem to ensure that the root cause is identified—instead of a symptom. If the reason for a problem is recognized as a supplier, then it is necessary to ask why the supplier’s error was not prevented or detected. Sometimes this requires asking “Why” more than five times, but identifying a cause you have no control over will fix nothing
  • 9. To monitor your CAPA program, conduct weekly CAPA board meetings where a person is asked to explain why the CAPA they were assigned is overdue. Anyone can make an excuse, but excuses will not complete CAPAs. CAPA boards and weekly meetings can be extremely valuable, but your CAPA board should rely on three rules: 1. Managers need to be present to re-allocate resources and re-prioritize tasks. 2. CAPAs that are on schedule or ahead of schedule requires no further discussion. 3. Anyone assigned to a CAPA that is behind schedule should request help and suggest solutions before the CAPA becoming overdue.
  • 10. Do not assign other departments the responsibility for CAPAs, because only QA has the training and competency to conduct an investigation of the root cause, and write a CAPA plan.  One of the most effective CAPA management tools I observed was a visual communication board that used color-coded paperclips, which identified resources assigned to CAPAs. By limiting the number of paperclips to equal the number of resources allocated to CAPAs, the company was able to level the workload of CAPA assignments to match the available resources in each department. You can only achieve this level of efficiency and effectiveness if multiple people in multiple departments are trained and competent to investigate the root cause and write CAPA plans. CAPA should be a core competency for every department because it’s the best process for fixing and preventing problems.

Disclaimer: If you missed my sarcasm, these are ten ways to mismanage a CAPA program. The brief paragraph after each numbered example is intended to provide the actual recommendation for effective management of your CAPA program.

%name Effective Management Solutions for 10 CAPA Program BlundersIf you are interested in learning more about CAPA, please register for the Medical Device Academy’s CAPA Workshop on October 3 in San Diego. Click here to register for the event: http://bit.ly/MDAWorkshops.

Posted in: CAPA

Leave a Comment (2) →

Risk Acceptability – Deviation #2 in EN ISO 14971

This 7-part blog series continues with the author reviewing deviation #2, risk acceptability, in the EN ISO 14971:2012 Standard.
%name Risk Acceptability   Deviation #2 in EN ISO 14971

In 2012, the European National (EN) version of the Medical Device Risk Management Standard was revised, but there was no change to the content of Clauses 1 through 9. Instead, the European Commission identified seven content deviations between the 14971 Standard and the requirements of three device directives for Europe. This seven-part blog series reviews each of these changes individually. The second deviation is specific to risk acceptability.

Discretionary power of manufacturers as to Risk Acceptability

The second deviation is specific to determining risk acceptability in the risk evaluation process. The ISO 14971 Standard indicates in Annex D4 that the acceptability of risk is not specified by the Standard and must be determined by the manufacturer. Clause 3.2 of the 14971 Standard, it states that “Top management  shall: define and document the policy for determining criteria for risk acceptability.” This risk management policy is intended to indicate a threshold for risk acceptability. In Clause 5 of the 14971 Standard, the manufacturer is instructed to evaluate whether risks are acceptable using the risk management criteria defined in the risk management policy.

Essential requirements 1 and 2 require that risks be reduced as far as possible and that all risks shall be included in a risk-benefit analysis—not just the risks that exceed a certain threshold for risk acceptability. Therefore, the requirement to establish a risk policy for the acceptability of risk directly contradicts the MDD.

Since the 2nd edition of the 14971 Standard was first issued (i.e., -2007), clients have been asking me how to establish risk acceptability criteria, for new devices, I recommend benchmarking the risks of the new device against existing devices. In other words, if the new device presents equal or lower risks than existing devices, then the risks of the new device are acceptable. For existing devices, I recommend performing a risk-benefit analysis, evaluating adverse events observed with the device against the benefits of using the device. Unfortunately, most companies choose arbitrary thresholds for risk acceptability. Instead of relying upon benchmarking or risk-benefit analysis, companies will establish a policy that all risks must be below a quantitative value. For example, if the range of possible risk scores is from 1 to 1,000, all risks of 100 or less may be acceptable.

What is acceptable?

In order to comply with the EN ISO 14971:2012 version of the risk management standard, you will need to implement risk controls for all risks, regardless of acceptability. However, you will also need to perform a risk-benefit analysis. The risk-benefit analysis should consider not only the benefits to patients and the risks of using the device, but the analysis should also consider the relative benefits of using other devices.

The clinical evaluation report and the risk management report for the device should be based upon clinical evidence of the device for the intended use—including adverse events. For new devices that are evaluated based upon a literature review of equivalent devices, Notified Bodies expect a Post-Market Clinical Follow-up (PMCF) study to be conducted to verify that the actual risk-benefit of the device is consistent with the conclusions of the clinical evaluation. To perform this analysis, a clinical expert is necessary to properly evaluate the risk-benefit ratio of the device and to create a protocol for a PMCF study.

MEDDEV 2.12/2 rev 2, Post Market Clinical Follow-up Studies, indicates that the PMCF study protocol should indicate the study endpoints and the statistical considerations. In order to do this, your company will need to establish quantitative criteria for the acceptability of the identified risks. Therefore, the current 14971 Standard needs to be modified to clarify that risk acceptability criteria should be based upon clinical data, and evaluation of risks should be conducted at a later point in the risk management process (e.g., – as part of the overall risk-benefit analysis).

Impact of Deviation #2

As your company becomes aware of the second deviation between the 14971 Standard and the Essential Requirements of the device directives, your risk management team will need to change the risk management process to clarify when risk acceptability should be evaluated, and the risk management policy should specify how acceptability should be determined.

The risk management process at your company will need to specify that the implementation of risk controls is required for all risks—regardless of acceptability. You should also consider eliminating the evaluation of risk before the implementation of risk controls. Instead, your company should base the acceptability of risk solely upon the clinical risk-benefit analysis and should involve the manufacturer’s medical officer in making this determination.

Finally, your risk management process should specify the need for PMCF studies in order to verify that actual clinical data supports the conclusion that the risk-benefit ratio is acceptable over the lifetime of the device.

If you are interested in ISO 14971 training, we are conducting a risk management training webinar on October 19, 2018.

Posted in: ISO 14971:2019 (Risk Management)

Leave a Comment (6) →

12 Important Tasks for Implementing ISO 13485

%name 12 Important Tasks for Implementing ISO 13485By Guest Blogger, Brigid Glass

The author describes 12 important tasks (training, auditing, etc.), which should be included in your plan for successfully implementing ISO 13485.

For your ISO 13485 implementation project, use a planning tool that you are comfortable with (e.g., – a spreadsheet or project planning software). Your plan should include the following:

  1. Identification of each task
  2. Target dates for completion of each task
  3. Primary person responsible for each task
  4. Major milestones throughout the project

Regular progress reports to top management and implementation meetings with all process owners are recommended to track your progress to plan. Weekly meetings are also recommended so that no tasks can fall too far behind schedule. Be sure to invite top management to weekly meetings, and communicate the progress toward completion of each task to everyone within your company. The list below identifies 12 of the most important tasks that should be included in your plan.

12 Tasks to Consider for Implementing ISO 13485
  • 1. Select a certification body and schedule your certification audits (i.e., – Stage 1 and Stage 2). If you want to place devices on the market in the EU, Japan, or Canada, make sure your certification body meets the specific regulatory requirements for that market (http://bit.ly/Sept24FX).
  • 2. Establish a Quality Manual and at least 19 required procedures. If you have purchased a copy of the excellent Canadian CSA publication “Plus 13485” (http://bit.ly/13485Plus), this lists required procedures for you. There are a few extra procedures or work instructions needed to meet regulatory requirements (e.g., – training, mandatory problem reporting, and post-market surveillance).
  • 3. Document training on the procedures comprising the quality system. A signed form indicating that employees “read and understand” the procedures is not enough. Training records should include evidence of the effectiveness of training, and you should be able to demonstrate the competency of the people performing those procedures.
  • 4. You must complete at least one full quality system internal audit. The timing of your internal audit should be late enough in the quality plan that that most elements of your quality system have been implemented. However, you want to allow enough time to initiate CAPAs in response to internal audit findings before your Stage 1 audit. If your internal auditor(s) have been heavily involved in the implementation of the quality system, you may need to hire an external consultant to perform your first internal audit.
  • 5. You need to complete at least one management review, which can be done just before the Stage 1 audit. My preference, if there is time, is to have at least two management reviews. The first review might occur three months before the Stage 1 audit, just before you plan to perform an internal audit of the management processes. There may be limited data to review at that time, but this first review provides an opportunity to train top management on their roles and responsibilities during a management review.

The second management review must cover all the requirements identified in ISO 13485, Clause 5.6. The second management review is also your last chance to identify any gaps in your quality system, and initiate a CAPA or action items before your certification auditor arrives.

  • 6. Compliance with regulatory requirements must be a commitment stated in your company’s Quality Policy. Specific regulatory requirements should be traceable to a specific procedure(s).

If you are seeking ISO 13485 Certification as part of the Canadian Medical Device Conformity Assessment System (CMDCAS) or the CE Marking process, then these regulatory requirements will be specifically included in your certification audit.

  • 7. Systematically incorporate customer and regulatory requirements into the quality management system. For contract manufacturers, this is especially important, and the Supplier Quality Agreements your company executes are the best source of these customer requirements. If your company is a legal manufacturer (the company named on the product label), this task is probably addressed sufficiently in tasks #1 and 6.
  • 8. You need to implement a supplier quality management process. If you already have a strong supplier quality program, then this may be a small task involving a few changes to your procedure. If you don’t have much of a supplier program yet, then this may involve identifying your suppliers, ranking them all according to type and risk, qualifying or disqualifying them, and executing supplier quality agreements.

Note: If you need training on Supplier Quality Management, you might consider participating in Medical Device Academy’s October 4th training workshop (http://bit.ly/MDAWorkshops).

  • 9. If product design is within the scope of your QMS, which is typical of legal manufacturers, but not for contract manufacturers, then you must establish a design control procedure(s). Product development projects often operate in a timeframe that is longer than your implementation project, and you may need ISO 13485 certification as part of the regulatory approval process.

Therefore, the minimum expectation is to initiate at least one development project before the certification audits. For records of implementation, you should have a design project plan, an initial risk management plan, reviewed and approved design inputs for your first product, and conduct at least one design review.

  • 10. Document what your Certification Body expects (e.g., – notifying them of significant changes). These expectations are likely to be stated in your contract with the Certification Body.
  • 11. Appoint the management representative and a deputy. Ideally, this is formally documented with a letter of appointment signed by the CEO and the management representative. This letter should be maintained in the management representative’s personnel file, along with a copy of the job description explaining the job responsibilities of the management representative. This may also be achieved by identifying the management representative and a deputy in your company’s organization chart.
  • 12. After the certification audit, your last task should be to “Create Quality Plan #2”—another PDCA (http://bit.ly/PDCAcycle) loop through the system. The reason for a new quality plan is to implement improvements based upon what you learned while you were building the quality system for the initial certification audit.

If your company wants to achieve ISO 13485 certification, you may be interested in our 6-part, “Road to Certification – The Series” (http://bit.ly/roadmapiso) audiocasts beginning on August 28, 2013 (also available as a recording).

Posted in: ISO Certification

Leave a Comment (2) →

Implementing ISO 13485: Planning the Project

By Guest Blogger,  Brigid Glass %name Implementing ISO 13485: Planning the Project

Five reasons why ISO 13485 certification may take longer than you expect, as well as tips and planning advice to help avoid pitfalls, are provided.

Your company wants to achieve ISO 13485 certification. How are you going to get there? In a recent blog, I reviewed setting objectives for implementing an ISO 13485 certification project. Once you’re clear on those, then you’re ready to create your first quality plan. The basic elements of any strategy will be:

  • Task breakdown (which I will cover in a separate blog)
  • Timeline
  • Resources (skills and hours available)
Timeframes and Trade-offs of ISO 13485 Certification Planning 

The endpoint of planning for the certification project is the certification audit. The earlier you choose your registrar or Notified Body and book the audit, the more choice you will have regarding the date. This should be one of the earliest tasks in the task breakdown. To be able to do that, you need a timeframe as to when you will be ready for the certification audit. How long it takes to implement ISO 13485 and be ready for a certification audit depends upon your starting point and your available resources. If you have no QMS in place, it will take you longer than if you already have a strong, documented QMS that complies with 21 CFR Part 820.

It May Take More Work

If you already have ISO 9001:2008 certification, though you already have a structure in place, the upgrade to ISO 13485 is likely to take more work than you expect because:

  1. There are fewer procedures required by ISO 9001
  2. Most of your existing procedures will require revision
  3. Your employees will need training on the new procedures
  4. You will need time to generate records using new procedures
  5. You will need to complete a full quality system audit of the new procedures

Many companies also underestimate the required resources for ISO 13485 certification. If you have a knowledgeable consultant, and people available to write procedures, then ISO 13485 implementation will progress faster than an organization that has little expertise and little time available, so plan accordingly. Ideally, you will determine the length of time each task will take and decide on an endpoint for the project based on that information and available resources. This approach works well if you already have a well-documented, regulated QMS.

6 Months-Reasonable Timeframe?

Six months is my rule of thumb for the time needed to implement a quality system compliant with ISO 13485. If the implementation schedule is longer, organizational enthusiasm may wane. If the timeframe is shorter than six months, it’s difficult to complete all the required tasks. No matter how carefully you plan, you still need to write procedures, train personnel, and implement procedures, so there is adequate time to generate records. Six months is aggressive for most companies, but the objective of achieving certification in six months is reasonable.

You may find it interesting that in Rob Packard’s white paper on ISO 13485 implementation. He also recommends that you allocate six months of one Full-Time Equivalent (FTE). This is a reasonable starting point, but you may want to adjust your resource allocation up or down depending upon the level of experience within the implementation team. Experience has taught me that smaller organizations are more successful at building an effective quality system when effectiveness is achieved in reiterative steps (i.e., – revision 1, revision 2, etc.). This is also the basis of the Deming/Shewhart Plan-Do-Check-Act (PDCA) cycle (http://bit.ly/PDCAcycle). This is also what I meant in a recent blog (http://bit.ly/ImplementationObjectives), where I suggested that you should “throw perfectionism out the window.”

Your understanding of how the quality system links together will grow as you implement each process in your implementation plan. As knowledge grows, you may reconsider some of your procedures. Instead of delaying the certification process (i.e., – revision 1), you may want to implement improvements as a second revision to procedures after the Stage 2 certification audit (i.e., – revision 2). During your Stage 1 and Stage 2 certification audits, your understanding of how the standard is interpreted and audited will build. After you achieve the initial ISO 13485 certification, you will have a much greater understanding of how all the elements of the quality system need to work together. You will also understand what parts of your quality system are easy for an outsider to audit.

After the ISO 13485 Certification Audit

During the initial planning stage, you should also imagine your future state after the certification audit (http://bit.ly/Beginwiththeendinmind). Your boss may assume that once the audit has been and gone, then everything will settle back to “normal” again. The reality is that after you deal with any nonconformities, and you take off a few days like you promised your family, you will have a long list of improvement ideas waiting for you. You will also need to prepare for next year’s surveillance audit. Therefore, I recommend that you manage expectations by adding “Create Quality Plan #2” as the last step of your ISO 13485 certification plan. If your company wants to achieve ISO 13485 certification, you may be interested in our 6-part, “Road to Certification – The Series” (http://bit.ly/roadmapiso) beginning on August 28, 2013 (also available as a recording).

Posted in: ISO Certification

Leave a Comment (0) →
Page 19 of 25 «...101718192021...»