We desperately need to find a way to get more customer feedback and suggestions for product improvement, but what is the best way to do that?
Surveys rarely have a high response rate, but we need to gather customer feedback. Therefore, we created this blog posting as a living document of how we are trying to gather customer feedback. Specifically, we are looking for more customer feedback and better engagement with us. We don’t just want YouTube subscribers to like our videos, we want you to share our videos with other people in your company so they can learn about quality and regulatory too. We don’t just want you to register for a free webinar and watch the recording when you get a chance. We want to you to add a question when you register and please interrupt us during our live webinars to clarify anything you don’t understand. Finally, we want you to give us suggestions for improving our procedures, writing new blogs, and recording new training webinars and videos. Tell us what you want.
Using the headline analyzer to attract more customer feedback
We have a page on our website for a “suggestion box” where we are asking people to provide suggestions for new and improved procedures, blogs, webinars, and videos. But the last time someone filled in the form on that page is October 16, 2019. We desperately need to find a way to get more engagement from you in the form of suggestions. The first approach to gathering feedback is to send out email notification to our current 1,057 blog subscribers by posting this blog. To improve our chances for you to open an email about this blog, we optimized the headline using the CoSchedule Headline Analyzer. The first version of the headline scored a 75, while 70 is the minimum threshold for a worthy title. Our second attempt included the emotional word “exciting” and the new result scored an 83 (see below). Normally it requires 20+ tries before we achieve a headline score higher than 80, but today was a good day. We decided to stop at 83 and focus on other elements of this posting.
How can you encourage more customer feedback? (75)
How can you encourage more customer feedback and exciting engagement? (83)
A picture says 1,000 words
A great thumbnail or featured picture often helps improve click through rates for video, but pictures also communicate more information than words alone. Pictures can communicate the temperature, directions, speed you are moving, and even emotions. Ideally, a combination of a picture with a short caption does the most. The layout of your picture matters too. For example, the featured image above originally had just 6 images grouped together. To communicate that we were trying to decide which icon best communicated the concept of a suggestion box, we separated each icon image with a blue border. To help people identify the different images, we used letters under each icon image. We could have used numbers, but then people might have replied with phrases like “#2 was my 1st choice,” instead of “B was my 1st choice.” To make it clear that the far right icon image was our current icon, we used the word “current” instead of a letter. Finally, we used a bright yello text box at the top of the featured image to communicate instructions for polling of the various icon images.
In the end, we didn’t feel that the suggestion box icons were very attractive. In fact, icons in general are boring. Therefore, we hired an artist to create some concept sketches for other ideas that would communicate “please take the opportunity to give us your suggestion.” The three concepts we liked most were a wishing well, a coffee filter, and an open door with a suggestion doormat that opens into space. We selected the door as our favorite and added some details to create the final image you see now on our webpage. Specifically, we wanted the doormat to appear more three-dimensional, we wanted to incorporate Medical Device Academy’s logo, and we wanted a better focal point in the space beyond the door. Therefore, the artist created three different versions of a moon (crescent, partial, and full). The partial moon was our final choice.
A video is 1,000+ pictures
Full-frame video typically ranges from 24-60 frames per second (FPS). Therefore, there are at least 1,000 pictures in 42 seconds of video. Therefore, the five-and-half-minute video below is giving you much more information than you read above in a lot less time. The video walks you through the evolution of our suggestion box (all 24 versions). This is why we recommend recording a training video to every single medical device company we work with. This is also why our website has steadily been increasing the number of videos we procedure and publish on our YouTube channel.
A call to action increases customer feedback and engagement
Gathering customer feedback requires just as much marketing as selling a medical device. Typically, near the end of your presentation you will include a call to action. The call to action is intended to persuade customers to take immediate action. The call to action will create a sense of urgency. Sometimes a series of small calls to action will precede a final larger call to action. In our case, we are just trying to get suggestions from you regarding what quality and regulatory training materials we should develop next. We are asking you for advice on what our customers want to learn. In return we will develop the training materials you want. The better your questions are, the better our training materials will become. This strategy of offering valuable information to customers develops trust, and this has been our company’s primary marketing strategy since the beginning.
Click on the button above.
Try using a call-to-action button
If you want more engagement, you need to increase your click-through rate (CTR) first. Campaign Monitor conducted a test to which call-to-action performs best. They found a call-to-action button helped increase the CTR by 28%. We took this concept one step further, we used the headline analyzer tool to optimize the wording of the call-to-action button. The wording we used in the call-to-action button above scored an 86, while “click here” scored a dismal 28 and “click the button” only scored 31. We are also trying a contrarion approach to the design of the button. Instead of using bright colors that modern advertisers have trained us to ignore, we used a light grey background with Palatino Linotype font to optimize readability. We also used a small caption to make sure your subconscious knows what to do.
How much does a 510k cost is the most common question I receive from customers, and there are three parts to the cost of a 510k.
There are three parts to the 510k cost of submission:
Testing
Submission Preparation
FDA User Fees
The highest cost is testing
The testing cost is the biggest cost, but I think the average is around $100K for our clients. For devices that only consist of software (i.e. software as a medical device or SaMD), the testing costs are less, but the cost of documenting your software validation and cybersecurity will be more extensive than the cost of preparing your 510k and the FDA user fee. The more you can do in-house, the lower the testing costs will be. Biocompatibility testing for a non-invasive device might be only $13,000, but a long-term implant can cost as much as $100,000 for the implantation studies. Sterilization validation testing depends upon the method of sterilization and whether you are doing a single-lot method or a full validation. Typical costs for EO sterilization validation are around $15,000, and then you should add several thousand more for the shelf-life testing.
For devices that are powered and/or have software, you will need to perform software validation in accordance with IEC 62304 ed 1.1 (2015). There are also five FDA guidance documents that apply:
You can do all of the software validation in-house, but some firms choose to outsource the validation of software. In the long-term, you need to learn this, and it pays to hire an expert in IEC 62304 to help your team learn how to document software validation if you have not done this before. Typically, software validation documentation will be between 300 and 1,000 pages in length.
Electrical safety and EMC testing are often the most expensive part of the testing process for our customers. EMC testing should always be done first to make sure that you can pass the immunity and emissions testing. If you have to modify the device to pass the EMC testing, then you will need to repeat any electrical safety testing. The total cost of this testing is typically $50-60K.
Performance testing is the last part of the testing process. Performance testing should be performed on sterile and aged products if your product requires sterility and you are claiming a shelf-life. Most of the testing is benchtop testing only to demonstrate performance. This includes simulated use testing (e.g. summative usability testing), cadaver testing, and computer modeling. Benchtop performance testing is typically tens of thousands of dollars to complete, but you might be able to do the testing in-house. If animal testing is required, this typically costs around $100K. Finally, if a human clinical study is required (i.e. ~10% of 510k submissions). Then you should expect to spend between $250K and $2.5 million. Some simple clinical studies (e.g. IR thermometers) cost less than $100K, but these resemble benchtop performance testing in many ways.
The second highest cost is the cost of submission preparation
Medical Device Academy has two different options for preparation consulting fees. Your first option is hourly consulting fees. The second option is a flat fee. As of October 2022, we are charging $3,500 for pre-submission preparation and $17,500 for 510(k) submission preparation.
510k cost #3 is the cost of the FDA user fee
You have three options for your FDA user fees:
Third-party review
FDA review (standard user fee)
FDA review (small business user fee)
The first option is to avoid the FDA altogether and submit to a third-party reviewer. We only recommend one third-party reviewer (i.e., Regulatory Technology Services), because the other companies do not have sufficient experience to have predictable review times and positive outcomes. The typical cost for a third-party review by RTS is 6% more than the FDA Standard fee (i.e., ~$21,000).
The second option is to submit directly to the FDA. The standard user fee for FDA review of a 510k is $19,870 for FY 2023.
The third option is to apply for small business status. For companies that have annual revenues of less than $100 million USD, the FDA will grant you small business status. For companies with small business qualifications, the FDA user fee is reduced to $4,967.
Reduce 510k cost by applying for small business status
Any medical device company with revenues of less than $100 million annually can apply, but you must apply each year. There is no application fee, but you must complete FDA Form 3602 if you are a US firm. The form must be completed for each subsidiary too. FDA Form 3602A must be completed for foreign firms, and the national tax authority must verify the accuracy of your income statement on the form to submit it to the FDA. If your national tax authority refuses to sign the form, you can justify it, but I don’t know anyone that has successfully done this yet. The qualification review by the FDA requires 60 days. Therefore, you should apply every year in August for the next fiscal year (October 1, 2021 – September 30, 2022, is FY 2022). The form will request that you include your Organization ID #. A Dun & Bradstreet Number (DUNS #) is also required if your firm is located outside the USA. Finally, you need to attach a copy of your tax return. Therefore, you must file your tax return–even if your firm had a loss or had no revenues. You can also take advantage of R&D tax credits in the USA or Canada if you are a start-up device company developing a new device.
About the Author
Rob Packard is a regulatory consultant with 25+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Robert was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certifications. From 2009 to 2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Robert’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510(k) submissions. The most favorite part of his job is training others. He can be reached via phone at 802.258.1881 or by email. You can also follow him on Google+, LinkedIn, or Twitter.
Maybe you need an FDA inspection plan. Does everyone in your company know what they need to do when FDA inspectors arrive at your facility?
Be proactive and don’t just let FDA inspections happen. You need to have an FDA inspection plan, and that plan needs to cover the roles and responsbilities for everyone. Below we have a list of 15 items that are in our FDA inspection work instruction (WI-009). If you already have a plan, try using the following checklist to assess your readiness for the next next inspection:
What will you ask and do when your FDA inspector calls the Friday before the inspection?
Who should be contacted by the FDA inspector if you are on vacation?
How will you communicate to the rest of your company that an FDA inspection is planned for Monday morning?
Who will greet the FDA inspector upon arrival, and what should they do?
Which conference room will the FDA inspector spend most of their time in?
Who will be in the conference room with you and the FDA inspector?
How will you track document and records requests, and how will you communicate that information to others?
How will you retrieve documents and records requested by the FDA inspector?
Who will conduct a tour of the facility with the FDA inspector and how will the tour be managed?
When quality issues are identified, how will you respond?
What will you do for lunches during the inspection?
Who will attend the closing meeting with the FDA inspector?
Should you “promise to correct” 483 inspection observations identified by the FDA?
How and when will you repsond to the inspector with corrective action plans?
If your company is outside of the USA, what should you do differently to prepare?
What will you ask and do when your FDA inspector calls the Friday before the inspection?
Most people begin their FDA inspection plan with the arrival of the inspector. However, you should consider including earlier events in your plan. Such as closure of previous 483 inspection observations, scheduling of mock-FDA inspections in your annual audit schedule, and details of how to interact with the inspector when they contact you just before an inspection. Most inspections will be conducted by a single inspector, but occasionally inspectors will be training another inspector. In this situation you can count on them following the QSIT manual more carefully, and you are more likely to receive an FDA 483 inspection observation. In the worst-case scenario, the lead inspector will split up from the trainee, and they will “tag-team” your company. This is not proper FDA procedure, but you should be prepared for that possibility. Therefore, make sure you ask the inspector if they are going to be alone or with another inspector when you speak with them on the phone. You should also get their name and phone number. You may even want to consider reviewing FDAZilla Store for details about your FDA inspector’s past inspection 483s and warning letters. Immediately after the call with the inspector, you should reserve a conference room(s) for the inspection and cancel your other meetings for the week. You should also verify that the person that contacted you is really from the FDA. You can do this by looking up their contact information on the Health and Human Services Directory. Your inspector should have a phone number and email you can verify on that directory.
Who should be contacted by the FDA inspector if you are on vacation?
You should always have a back-up designated for speaking with FDA inspectors, handling MDR reporting, and initiating recalls when you are on vacation. These are critical tasks that require timely actions. You can’t expect inspectors, MDRs, or recalls to wait you to get back in the office. It doesn’t matter what the reason is. Weddings, funerals, and ski trips should not be rescheduled. You need a back-up, and often that person is the CEO or President of your company. Make sure you have a strong systems in place (i.e. an FDA inspection plan, an MDR procedure, and a recall procedure). Whomever is your back-up needs to be trained and ready for action. This is also the purpose of conducting a mock-FDA inspection, including examples of MDRs in your medical device reporting procedure, and conducting mock recalls. This ensures you and your back-up are trained effectively.
How will you communicate to the rest of your company that an FDA inspection is planned for Monday morning?
Most companies have an emergeny call list as part of their business continuity planning, and after the past 18 months of living with a Covid-19 pandemic your firm should certainly have a business continuity plan. Your FDA inspection plan should leverage that process. Contact the same people and notify them of when the FDA inspector is coming. If you are unable to find a conference room available for the inspection (i.e. see below), then ask the manager(s) that reserved the designated room for FDA inspections to relocate to another conference room for the week. Make sure you tell them who the inspector will be, and you might even be able to provide a photo of the inspector (try seraching LinkedIn). Make sure that you remind everyone to smile, and to listen carefully to the question asked. Everyone should be trained to answer only the questions asked, and nobody should run and hide. There should also be no need to stop your operations just because an inspector is visiting. You might even include the name of the inspector on a “Welcome Board” if your company has one at the entryway or in public areas. The more an FDA inspection appears as “routine” the better your outcome will be.
Who will greet the FDA inspector upon arrival, and what should they do?
By the time an FDA inspector(s) actually arrives at your company, all of the managers in your company should already been notified of the inspection and a conference room should be reserved for the inspection. Therefore, when the person that is greeting people in the lobby comes to work on Monday morning, you (or their supervisor) need to communicate with them and make sure that they are prepared for arrival. There are four things that should be communicated:
the name of the inspector(s) that are arriving
the list of managers that should be notified when the inspector(s) arrives (possibly identical to the buisness continuity call list)
the conference room that is reserved for the inspection
If the person greeting the inspector(s) is also going to escort them to the conference room and help them get set-up, then they will need additional instructions. If that escorting inspectors to the conference room and helping them get set-up is delegated to a different person, then the following considerations should be included in that person’s instructions:
the location of bathrooms and emergency exit instructions in case of a fire
the information for wireless connectivity
recommendations for seating in the conference room based upon the expected participants (see below)
It is important that an escort for the inspectors is able to bring the inspector(s) to the conference room as quickly as possible. They should not be expected to wait more than a few minutes for an escort.
Does your FDA inspection plan identify a specific room for the inspector? Is there a back-up?
Some companies have a specific room that is designated for inspections and 3rd party certification audits. If your comapny can do that, it will be very helpful because it reduces the decision making that is required immediatley prior to the inspection. Having a specific room for the inspection also eliminates the need to tell everyone else in the company where the inspector will be. Instead the location of the inspection can be in the work instruction or written FDA inspection plan. You shouldn’t need a back-up plan if there is a specific room designated for an FDA inspection, but our firm has a client that will be hosting three notified body auditors simultaneouly for three days. In that situation, you might need more than one room.
Does your FDA inspection plan have assigned seating?
You might think that it really doesn’t matter where people sit in a conference room, but you will probably want consider the layout of charging cords and the flow of interviewees requested by the inspector. In your conference room, you will need room for at least the following people:
the inspector(s)
the management representative (i.e. you)
a scribe
an interviewee
If there is an inspector and a trainee, you will probably want to seat them together to facilitate them working together. You as the Management Representative also need to be in the room, and it may help for you to sit next to the scribe to facilitate communication between you and to make it easier for them to hand you documents after the scribe logs the documents into their notes. The scribe should probably sit closest to the door, because they will be receiving documents, logs, and records that are brought to the room. You will also need one more seat next to you, and probaby accross from the inspector(s), for interviewees. This person will rotate as different processes are reviewed. I also recommend having a location in the middle of the table for an “in box” where documents, logs, and records for the inspector are placed after being logged in. A second location in the middle of the table can be used for a “discard pile” as you finish using your copy of each document, log, and record. You may refer back to these copies later. The “discard pile” should be 100% copies rather than originals. Originals should never be brought into the room with the inspector.
Who is the scribe in your FDA inspection plan?
The perfect scribe would know the quality system well and they would have the typing skills of a professional stenographer. You might have someone that is an executive assistant in your company or a paralegal that could do this job, but you might also have a document control specialist that fits this requirement. Some companies will even hire a temp for the duration of the inspection that has this type of skill, but a temp is unlikely to know the jargon and quality system requirements well. I have taken on the role of scribe many times for my clients, because I type fast and know their quality system. I also don’t want to interferre with the inspection process. As scribe I can answer questions and offer suggestions when appropriate, but most of my time is spent taking notes and communicating by instant messenger with company members that are outside of the inspection room.
You should seriously consider using an application such as Slack as a tool for communication during the inspection. Then anyone in your company that needs to know the status of the inspection can be provided access to the Slack channel for the inspection. This can also act as your record of requests from the inspector. It’s even possible for people on the Slack channel to share pictures of documents to confirm that they have identified the document being requested. You could even invite someone to speak remotely with the inspector via Slack with Zoom integration. All the scribe needs to do is share the Zoom app with a larger display in the same conference room so the inspector can see it too.
Does your FDA inspection plan include provisions for document and record retrieval?
The most important part of document and record retrieval during an FDA inspection is to remember that inspectors should never receive the original document. Ideally, a copier would be located immediately outside of the conference room and three copies would be made of every document before it enters the inspection room. The originals can be stored next to the copier until someone has time to return them to the proper storage location. The three copies should all be stamped “uncontrolled documents” to differentiate them from the originals. When the three copies are brought into the room, they should be handed to the scribe. The scribe should log the time the copies were delivered in the Slack channel. Then the copies should be handed to you, the Management Representative. You should skim the document to make sure that the correct document was received. Then one copy would be given to the inspector and another copy would be made available to the interviewee. If only two copies are needed, the extra copy can be placed in the “discard pile.” Even if your system is 100% electronic, I recommend printing copies for the inspection. The paper copies are easier for inspectors to review, and it eliminates the ability for the inspector to hunt around your electronic document system. In this situation, the scribe may do all of the printing.
Does your FDA inspection plan indicate who will conduct a tour of the facility with the FDA inspector and how will the tour be managed?
I’m surprised by the number of companies that don’t seem to have a map of their facility. Medical device manufacturing facilities should have two kinds of facility maps. One should identify where pest control monitoring stations are located, and the second should indicate your evacuation route to exit the building. All guests should be shown the evacuation route map, probably within the first 30 minutes of arrival. The second map will be requested by the inspector eventually if you conduct manufacturing at your facility. Therefore, it would be helpful to use one or both of these facility maps as a starting point for creating a map of the route that inspectors should be taken on during a tour. I prefer to start with where raw materials enter the facility, and then I follow the process flow of material until we reach finished goods storage and shipping. If you can do this without back-tracking multiple times, then that will probalby be the preferred route. The purpose of planning the route out in advance is to help estimate how long the tour will take, and to make sure there is consistency. If someone starts the tour, and then another person takes over the tour, the new person should be aware of what the next location is and what areas have not been observed yet. There may also be safety reasons for avoiding certain areas during a tour and asking the inspector to observe those areas from a distance. Welding processes, for example, often fall into this safety category.
When quality issues (i.e. FDA 483 inspection observations) are identified, is this covered by your FDA inspection plan?
Third party certificaton body auditors will typically make you aware of nonconformities as they are identified, but FDA inspectors often will hold off on identifying 483 inspection observations until the end of the inspection in a closing meeting. However, you can typically identify several areas that may result in a 483 inspection observation during the inspection. You and the manager of that area may want to consider initiating a draft CAPA plan for each of these quality issues before the closing meeting. This would give you an opportunity to demonstrate making immediate corrections and you might be able to get feedback from the inspector on your root cause analysis and corrective action plan before the closing meeting. Sometimes this will result in an inspector identifying low-risk quality issues verbally instead of writing them out on FDA Form 483. I find the best way to make sure CAPA plans are initiated early is to have a debrief each day after the inspector leaves. All of the managers involved in the inspection should participate, and the debrief can be done virtually or in person. Virtually may be necessary, because often managers need to leave work before the inspector ends for the day. You should consider including this in your FDA inspection plan as well.
Does your FDA inspection plan include plans for daily lunches?
If your facility is located outside the USA, skip this paragraph and go to the section below about companies located outside the USA. If your company is locagted inside the USA, you can be certain that the FDA inspector will not eat lunch at your facility. They will leave for lunch on their own, and then they will return after lunch. Therefore, you may not have control of the timing of a lunch break but you will have time to take one. Most managers use the lunch break as a time to catch-up on emails. However, I think it makes more sense to change your email settings to “out of office.” You can indicate that you are hosting an audit and you will answer questions as a batch that evening or then next morning. You might use the lunch break to take a walk and relax, you might have short debrief meeting with other managers, and you might spend some time preparing documents, logs, and records that the inspector may have requested before they left. Most inspectors use this strategy of asking for a list of documents and records in advance. This is also a good strategy to learn as an internal auditor or supplier auditor. If you have a back-room team that is supporting you, don’t make them wait for a break. Have someone in your company take their lunch orders or arrange for a catered buffet lunch. This will keep your support team happy, and you should definitely remember to include lunch for the team and changing your email settings to “out of office” in your FDA inspection plan.
Does your FDA inspection plan state who will attend the closing meeting?
Most companies have every manager that was in the opening meeting attend the closing meeting. This is ok, but it is important for anyone that might need to initiate a CAPA to be present in the meeting so that they can ask the inspector for clarification if needed. Scheduling a closing meeting should be part of your FDA inpsection plan. However, the past 18 months of the Covid-19 pandemic has taught us that we can attend this type of meeting remotely via Zoom. Therefore, we recommend letting the managers go home early if they are no longer needed as auditees. Instead, ask them to call in for a Zoom meeting at the time the FDA inspector estimates for review of the 483 inspection observations with the company.
Should you “promise to correct” 483 inspection observations identified by the FDA?
During the closing meeting the FDA inspector will review 483 inspection observations with you and any of the other managers present at the closing meeting. The inspector will ask if you promise to correct the 483 inspection observations that were identified. You should confirm that you will, and the FDA inspector will add this to the Annotations in the Observations section of FDA Form 483 that you will recive at the closing meeting. By stating this, you are agreeing to create a corrective action plan for each of the 483 inspection observations. You could change you mind later, but the better approach is to perform a thorough investigation of the 483 inspection observation first. If you determine that corrective action is not required, you can explain this in your CAPA plan and provide data to support it. The only likely reason for not correcting an observation is that you determined the incorrect information was provided to the inspector. In that case, you may need to do some retraining or organize your records better as a corrective action to prevent recurrence in a future inspection. You might even make modifications to your work instruction for “Conducting an FDA Inspection” (i.e. FDA inspection plan).
How and when will you repsond to the inspector with corrective action plans?
Your FDA inspection plan should include details on how respond to FDA 483 inspection observations and when the response must be submitted by. The FDA inspector will give you instructions for submission of your corrective action plans by email to the applicable email address for your region of the country. This email address and contact information should be added to your work instruction as an update after the first inspection if you are not sure in advance. You should respond with a copy of your CAPAs with 15 business days. Regardless of what the inspector told you, there is always a possibility that the outcome of your inspection could be “Official Action Indicated.” This is because the inspector’s supervisor makes the final decision on whether a Warning Letter will be issued and regarding the approval of the final inspection report. You should also confirm what the 15-day deadline is, because your state’s holidays may be different from the US Federal holidays.
If your company is outside of the USA, what should you do differently to prepare?
The US FDA only has jurisdiction over companies that are located in the USA. Therefore, if your company is registered with the FDA, you can only be inspected if you agree to host the FDA inspector when they contact you. FDA inspectors will contact foreign firms 6-8 weeks in advance, and they will typically give you a couple of weeks to choose from. After you confirm the dates for the inspection, then they will make their travel plans. Therefore, you will know exactly when the FDA inspection is schedulea and you will have more than month to prepare. Therefore, you should do four things differently:
You should send the FDA inspector directions from the airport to your facility and provide recommendations for potential hotels to stay at. Ideally the hotels you recommend will provide transportation from the airport and managers that are speak passable English). The hotels should be appropriate for business travel–not royalty. If it is convenient, you may even offer to pick-up the inspector at the hotel each day to ensure they have no problems with local transportation.
You should offer to provide lunches for the inspector during the inspection. This should not be considered entertainment. The purpose is make sure the inspector has lunch (i.e. a light meal or snacks) and drinks (i.e. water and coffee) during the inspection so that they do not have to negotiate local traffic, struggle with ordering food in a language they don’t know, and to eliminate delays associate with having lunch off-site. Make sure you remember to ask about food allergies and dietary restrictions. You might even follow-up with a draft menu to obtain confirmation that your proposed menu is appropriate.
You should schedule a mock-FDA inspection immediately to verify that everyone is prepared and to identify any CAPAs that need to initiated before the FDA inspector finds the problems.
During the first day of the inspection, you may consider asking the inspector if they would like to go out for dinner one of the evenings with a couple of people from your company or if they would like any recommendations for restaurants to eat at. If you are not familiar with US customs and international travel, ask the hotel concierge for advice. When you are out to dinner, the conversation should remain professional and if you normally drink alcohol at dinner you may want to consider the “BOB” compaign in the Netherlands as a role model.
How are you going to train everyone in your company?
You need an easy way to train everyone in your company. Why not give them a video to watch? Next Monday, July 26, 2021 @ Noon EDT, we are hosting a webinar on how to prepare for an FDA inspection. It is a live webinar where you will be able to ask questions, and we are bundling the webinar with our new work instruction for “Conducting an FDA Inspection” (WI-009). If you register for the webinar, you will receive access to the live webinar, you will receive the native slide deck, and you will receive a copy of the work instruction. You can use the work instruction as an FDA inspection plan template for your company. The webinar will be recorded for anyone that is unable to attend the live session. You will be sent a link to download the recording to watch it as many times as you wish, and we recommend that you use the webinar as training for the rest of your company.
If you have a surprise FDA inspector visit, you should never be scared because there is no difference between the best and worst-case outcome.
Why are you scared of an FDA inspector?
There are a number of reasons why you might be scared of an FDA inspector, but if you keep reading you will learn why 95% of your fear is self-induced. A small percentage of device manufacturers evaluate the performance of quality managers based upon the outcome of FDA inspections, but you have no control over whom the FDA Office of Regulatory Affairs (ORA) assigns to perform your inspection. If your company belongs to this 5% minority, you need to change top management’s approach to regulators or you need to find a new employer. For the majority of us, we are scared of embarrassment, failure, or being “shut down.”
There are rare examples of where the FDA has taken action to stop the distribution of medical devices, but this is only done as a last resort. Usually companies cooperate with the FDA with the hope of being able to resolve quality issues and resume distribution after corrective actions are implemented. Not only is this type of action rare, there will be a prior visit to your facility and prior written communication from ORA before you receive a warning letter–let alone removal of your company’s device(s) from the market. You can’t pass or fail an FDA inspection. The FDA inspector is verifying compliance with the FDA Quality System Regulation (i.e. 21 CFR 820) as well as the requirements for medical device reporting (i.e. 21 CFR 803), reports of corrections and removals (i.e. 21 CFR 806), investigational device exemptions (i.e. 21 CFR 812), and unique device identification (UDI). FDA inspectors only have time to sample your records, and with any sampling plan there is always uncertainty. When you do receive an FDA 483 inspection observation you should not consider it to be a condemnation of your company. Likewise, an absence of 483 observations is not a reason to celebrate.
Why you should not be embarrassed when you receive a 483 from an FDA inspector
The most irrational response to an FDA 483 inspection oberservation is embarrassment. Our firm specializes in helping start-up medical device companies get their first product to market. This includes providing training and helping them to implement a quality system. When our clients have their first FDA inspection, it is not uncommon to receive an FDA Form 483 inspection observation. Start-ups have limited resources, limited experience, and most of the employees have never participated in an FDA inspection before. Experience matters, and immature quality systems have only a limited number of records to sample. Any mistakes are easy for an inspector to find.
Instead of feeling embarrassed, acknowledge and embrace your inexperience. For example, during the opening meeting with an FDA inspector you might say, “We are a new company, and this is our first FDA inspection. I am also a first-time quality manager. If you find anything that we are doing incorrectly, please let us know and we will make immediate corrections and start working on our CAPA plan.” You can say this with a smile :), and you can genuinely mean what you said because it’s true.
Anticipation is always worse than reality
Another reason you are scared of an FDA inspection is because you don’t know exactly when the inspection will be. Only Class III PMA devices, and a few Class II De Novo devices with novel manufacturing processes, require a pre-approval inspection. For the rest of the Class II devices, ORA prioritizes inspections based upon risk. There are a few companies prioritized for inspection within the first six months of registration, such as reprocessors of single-use devices and contract sterilizers. For the rest of the Class II device manufacturers, your first inspection should be approximately two years after your company registers with the FDA. If you are located outside the USA (OUS), your first inspection might take three years to schedule. Finally, for Class I device manufacturers and contract manufacturers, you are unlikely to ever be inspected by the FDA. If you didn’t know what the typical timeline was for ORA to schedule your first inspection, you probably just breathed a HUGE sigh of relief when you read this paragraph.
Even if you already knew the approximate timeline and priorities for FDA inspections, it’s normal to feel a little anxiety when the date of your first visit is unknown. Your boss and the rest of top management are probably feeling just as much anxiety as you are, or even more if they have no idea what the timeline and priorities are. You should make sure that everyone in your company understands what they are supposed to do during an FDA inspection, and if you forget to tell them you might cause a lot of unneeded drama when they find out an FDA inspector is in the front lobby. Preparing for an FDA inspection is no different from conducting a firedrill. Everyone should know the procedure, and you should practice (i.e. conduct a mock-FDA inspection). Practice ensures that everyone knows what to do during the first 30 minutes of an FDA inspection, and nobody in your company will panic when an FDA inspector actually arrives.
Let’s define “surprise” visits by an FDA inspector
A surprise visit from an FDA inspector is extremely rare, but in the USA inspectors will call on Friday to confirm that your company will be open the following Monday for an inspection. The FDA has jurisdiction over medical device manufacturers located in the USA, and they are not required to give advanced notice. However, inspectors need time to prepare in advance for their inspection–just like a ISO 13485 auditor. Therefore, before an inspector will arrive on-site for a routine (Level 2) inspection, the inspector will first make a courtesy call to the official correspondent identified in your establishment registration.
What happens when an FDA inspector travels outside the USA
In the case of OUS medical device manufacturers, the FDA inspector does not have jurisdiction. Therefore, they will contact the official correspondent 6-8 weeks in advance to schedule an inspection. Inspectors will typically make contact via email, and you may be given a couple of weeks to choose from for the FDA inspection. The duration off your inspection should be 4.5 days. The inspector will arrive on Sunday, and the inspection will begin on Monday morning. The inspector has four major process areas to cover, and Friday morning will be focused on generating a preliminary report of 483 inspection observations. The reason why you can predict this OUS routine with a degree of certainty is two-fold: 1) these are government workers following a procedure, and 2) the FDA inspector needs time to get to the airport for their flight home.
What is the outcome of a FDA inspection?
FDA inspections have three possible outcomes:
No action indicated – there were no FDA 483 inspection observations identified by the FDA inspector
Voluntary action indicated – there was at least one FDA 483 inspection observation identified by the FDA inspector, and the FDA inspector requests submission of a CAPA plan to prevent recurrence
Official action indicated – there was at least one FDA 483 inspection observation identified by the FDA inspector, and the FDA inspector requires submission of a CAPA plan to prevent recurrence; if a plan is not received in 15 business days, a warning letter will automatically be generated on the 16 day
Even in the rare instances with there is “no action indicated” (i.e. best case scenario), I have always noticed one or more things during and FDA inspection that were overlooked and we needed to be initiate a new corrective action plan(s). In the other two possible scenarios, the FDA inspector identified the need for one or more corrective action plans. Therefore, regardless of whether you FDA inspection results in the best-case scenario or the worst-case, you will always need to initiate a new corrective action plan(s).
If the outcome is always a CAPA, what should you do?
Give your FDA inspector a big smile and say, “We are a new company, and this is our first FDA inspection. I am also a first-time quality manager. If you find anything that we are doing incorrectly, please let us know and we will make immediate corrections and start working on our CAPA plan.” Making sure that you have a genuine smile is just as important as what you say. Smiling will relax you and the anxiety and stress you are feeling will gradually melt away. Smiling will encourage the FDA inspector to trust you. Maybe your smile will even be contagious.
If you need help responding to an FDA 483 inspection observation, or you want to conduct a mock-FDA inspection, please use our calendly app to schedule a call with a member of our team. We are also hosting a live webinar on FDA inspections on July 26, 2021 @ Noon EDT.
About the Author
Robert Packard is a regulatory consultant with 25+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Robert was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certification. From 2009-2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Robert’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510(k) submissions. The most favorite part of his job is training others. He can be reached via phone 802.258.1881 or email. You can also follow him on Google+, LinkedIn or Twitter.
A poor RTA response will cause a two-week delay, but an additional information request only gets one chance to avoid the dreaded NSE letter.
An Additional Information Request (i.e. AI Request) is typically received just before the 60th day in a 90-day 510k review, while a Refusal to Accept (RTA) Hold is typically received on the 15th day. If your response to your first RTA Hold (i.e. RTA1) is inadequate, the reviewer will issue another RTA Hold letter (i.e. RTA2) and your 510(k) review clock will be reset to 0 days. You will have another 180-days to respond to RTA2, and issues identified in an RTA Hold are usually easy to address. Most RTA Hold issues also have one or more guidance documents that are available to help you to obtain an RTA Accept letter. You can always request a submission-in-review (SIR) meeting to clarify what information the reviewer needs to address the RTA deficiencies too. If you want to learn more about responding to an RTA Hold, please read last week’s blog. The rest of this article is specific to responding to requests for additional information.
What happens after 60 days during a 510k review?
On the 60th day of the 510k review clock, or a few days prior to the 60th day, the lead reviewer must determine if they need to issue an Additional Information (AI) Request. The alternative to an AI Request is for the lead reviewer to issue a letter indicating that you have entered the Interactive Review Phase. This only happens if the reviewer believes they can make a decision regarding substantial equivalence in the next 30 days. If the decision is to issue an Interactive Review Letter, then the lead reviewer believes that only minor issues remain and there is only the need for interactive email responses between the lead reviewer and the submitter. An interactive review is the ideal outcome of the substantive review process but it rarely happens.
If you receive an Additional Information Request, what are your options?
The AI letter will indicate that you have 10 days to request a clarification meeting with the reviewer. The wording of this section of the AI letter is provided below:
“FDA is offering a teleconference within 10 calendar days from the date on this letter to address any clarification questions you may have to pertain to the deficiencies. If you are interested in a teleconference, please provide (1) proposed dates and (2) a list of your clarification questions via email at least 48 hours before the teleconference to the lead reviewer assigned to your submission. We would like to emphasize that the purpose of the meeting is to address specific clarification questions. The teleconference is not intended for the review of new information, test methods, or data; these types of questions could be better addressed via a Submission Issue Q-Submission (Q-Sub). For additional information regarding Q-Subs, please refer to the Guidance for Industry and FDA Staff on Medical Devices: Requests for Feedback and Meetings for Medical Device Submissions at https://www.fda.gov/media/114034/download.”
If you wait too long to request the teleconference, then FDA will require you to submit a formal pre-sub meeting request or “Submission in Review” (SIR) meeting request. If you request a SIR meeting within 60 days of receiving an AI Request, the FDA will schedule a SIR meeting with you within three weeks of receiving the request–assuming resources are available. If you wait longer than 60 days to request the SIR meeting, then the FDA will default to their normal target of 60-75 days for scheduling a pre-sub meeting. For example, if you submit your SIR meeting request on day 75, and the FDA takes 75 days to schedule the meeting, you will be granted your SIR meeting at 150 days and you will only have 30 days remaining to respond to the AI Request before your submission is automatically withdrawn.
Therefore, it is important to request a clarification meeting immediately after you receive the AI Request. While you are waiting for your clarification meeting, you should immediately begin preparing any draft testing protocols that you want the FDA to provide feedback on during a SIR meeting. Then after you have the clarification meeting, you should submit your SIR meeting request and include any draft testing protocols you have prepared. This may include a statistical sampling rationale, a proposed statistical analysis method, a summative usability testing protocol, or a draft protocol for some additional benchtop performance testing. The FDA can review examples of preliminary data, a protocol, or a proposed method of analysis. The FDA cannot, however, provide a determination of substantial equivalence.
The Most Common Mistakes in Responding to an Additional Information Request
Most companies make the mistake of asking the lead review if they provide specific additional information, “Will this be sufficient to obtain 510(k) clearance?” Unfortunately, the FDA is not able to provide that answer until the company has submitted the additional information and the FDA review team has had time to review it thoroughly. This is done only when the submitter delivers an FDA eCopy to the Document Control Center at CDRH, and the review team is able to review the information. This new information is assigned a supplement number (e.g. S001), and it will typically require three weeks to review the information. Then the lead reviewer may request minor modifications to the labeling, instructions for use, or the 510k summary. This request is an interactive request, and the submitter must respond within a very short period (e.g. 48 hours), and the wording of the request may be “Please provide the above information by no later than COB tomorrow.”
FYI: “COB” means “close of business.” Wow. The FDA loves acronyms.
Best Practices in Responding to an Additional Information Request
If you receive an AI request on a Friday afternoon, 58 days after your initial submission, you should immediately request a clarification teleconference with the FDA reviewer for the following week. The only exception is if you only have minor deficiencies that you feel are completely understood. During the days leading up to the clarification teleconference, your team should send a list of clarification questions to the lead reviewer and begin drafting a response memo with a planned response to each deficiency. After the clarification meeting, you will have approximately 6-7 weeks to submit a SIR meeting request. However, you should not wait that long. Your team should make every effort to submit your SIR meeting request within 2-3 weeks. If the FDA takes 3 weeks to schedule your meeting, then you will have used approximately 6 weeks of your 26 weeks to respond to the AI Request.
In your SIR meeting request, you should always try to provide examples or sample calculations to make sure the FDA review team understands what you are proposing to submit in your supplement. For example, the FDA reviewers do not have enough time to review your entire use-related risk analysis (URRA) in a SIR meeting request. However, you can provide an example of how you plan to document a couple of use-related risks. Then you can show how these risks would translate into critical tasks. Finally, you could provide a draft summative usability testing protocol for FDA feedback. The FDA review team doesn’t have enough time available to review much more. You will only have one hour for your SIR meeting.
How to Prepare Your Response
In section “V” of the FDA guidance on deficiency responses, the FDA recommends that you restate the issue identified by the reviewer in your response. Next, your response should include one of the following:
the information or data requested, or
an explanation of why the issue is not relevant, or
alternate information with an explanation of why the information you are providing addresses the issue.
Before you respond to an AI Request, you should look up any FDA guidance documents referenced in the AI Hold letter to make sure that you address each requirement in the applicable FDA guidance document(s).
The most important technique to learn when you are responding to regulators is to organize your response in a tabular format that is numbered in exactly the same order that the request was made. Typically there will also be sub-parts to certain issues. In that case, you should duplicate the numbers and/or letters of each sub-part and segregate each sub-part in a different row of the table. Personally, I like to alternate the color of the font I use in the table to make it even more obvious which information is a restatement of the reviewer’s comment and which information is the company’s response to the AI Request.
Why you don’t get a second chance to respond to an AI Request
Once you respond to an AI Request, and the DCC receives your FDA eCopy, the FDA review clock will then resume the countdown to 90 days. In our example above, you received the AIR Request on the 58th day. The FDA must review everything you submitted and make a final substantial equivalence decision before the 83rd day because they still need to submit their recommendations to senior management in their branch. If any changes to the labeling, instructions for use, or the 510k are required, you should receive those requests several days before (i.e. 76-83 days). You can respond to interactive requests via email, and then the final SE decision will be made. If you do not respond to all of the deficiencies in the AI Request, the FDA reviewer will not have enough time to request that you address the remaining gaps and finish their review. Therefore, an incomplete AI Response will certainly result in a non-substantial equivalence (NSE) letter.
If you need to respond to an additional information request from the FDA reviewer, we can review your planned response to identify potential gaps. If you need help please use our calendly app to schedule a call with a member of our team.
About the Author
Robert Packard is a regulatory consultant with 25+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Robert was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certification. From 2009-2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Robert’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510(k) submissions. The most favorite part of his job is training others. He can be reached via phone 802.258.1881 or email. You can also follow him on Google+, LinkedIn or Twitter.
When an FDA reviewer places your 510k on RTA Hold, there are secrets you can learn to improve your chances of a successful response.
Test your knowledge about the FDA RTA Hold process
Did you know that approximately 50% of 510(k) submissions are placed on RTA Hold? Did you know that you can be placed on RTA Hold multiple times for the same submission? Did you know that the 90-day review clock is reset to “0” when you submit your response? Do you know how to respond to the FDA when the reviewer is incorrect? Did you know that you can avoid the RTA screening process for any 510(k) submission if you use the correct template? Every year there are more than 1,000 submissions placed on RTA Hold, but did you know there is an FDA guidance specifically telling you how to respond to deficiencies? You can learn the secrets to responding to an FDA RTA Hold just by reading this article.
What is an FDA RTA Hold?
When the FDA receives a Traditional 510k submission FDA eCopy, the eCopy is uploaded to the FDA system within hours of the submission being received. If the eCopy does not meet the eCopy format requirements, then the submission will be placed upon eCopy Hold. The official correspondent will receive an automated email indicating that the submission is on eCopy Hold, and the submitter will be asked to correct the submission format to meet the eCopy submission requirements and provide a replacement eCopy. If the FDA user fee has not cleared, then the submission will be placed on User Fee Hold. It is possible to be placed on eCopy Hold and User Fee Hold at the same time.
If your eCopy is accepted, then a reviewer is assigned to screen your submission for compliance with the FDA Refusal to Accept (RTA) policy. The reviewer has 14 days to complete this review, and on the 15th day the reviewer must do one of three things: 1) issue a RTA Hold letter to the submitter, 2) issue an RTA Acceptance letter to the submitter, or 3) issue a letter that states the RTA screening was not completed on-time and the submission was automatically accepted. If your receive an RTA Hold letter, it will be via email from the reviewer and the RTA Checklist will be attached. In the checklist, there will some items highlighted in yellow and deficiencies will be noted in those sections. The reviewer may add additional comments to the checklist, but you are only required to respond to the highlighted sections. The process that the reviewer follows for RTA screening is defined in the FDA guidance for the Refusal to Accept process, and the guidance includes a checklist for traditional, abbreviated, and special 510k submissions. Some companies will fill in these checklists themselves and submit a copy of the checklist with the 510k submission. This is intended to help the reviewer identify where all of the requirements in the RTA checklist can be found. Third-party reviewers require that the company complete the RTA checklist and provide it to them with the eCopy.
How many times can you be placed on hold for the same submission?
Technically there is no limit to the number of times a submission can be placed on RTA Hold, and our firm has seen a few submissions placed on RTA Hold twice in a row. The first RTA Hold is referred to as RTA1, and the response to that RTA Hold is referred to as the first supplement (i.e. K123456/S001). If a second RTA Hold is issued, that hold is RTA2, and the response to that RTA Hold is referred to as the second supplement (i.e. K123456/S002). A response to an eCopy Hold is referred to as an amendment (i.e. K123456/A001).
What happens to the 90-day review clock when you are placed on RTA Hold?
When the FDA reviewer places your submission on RTA Hold, the 90-day review clock is automatically reset. Therefore, even if you respond to an RTA Hold on the same day you receive the RTA Hold, and your submission is received the next day, the “real” review timeline is now 106 days instead of 90. If your submission is placed on RTA Hold twice, then the “real” review timeline is now 122 days instead of 90. If the lead reviewer of your 510k requests additional information, this is referred to as an “AI Request.” We will address this in a future blog, but an AI Request does not reset the review timeline. The AI Request, however, will increase the review timeline. Although we rarely have an RTA Hold, we almost always have an AI Request. This is why our average submission is approximately 125 days (i.e. ~30 days are required to respond to the AI Request.
How should you respond if the FDA reviewer is incorrect?
The average 510(k) submission has grown over time from 300 pages to more than 1,200 pages, but the FDA review “clock” is still 90 days and the RTA screening is limited to 15 days. Therefore, it is not reasonable for you to expect the reviewer to understand and absorb every detail of your submission. If the reviewer can’t find the information they are looking for quickly, the reviewer may state that they could not find the information in the submission or that you did not provide it. If the information is found in the submission, you should provide a reference to the section of the submission, including the document and page number, in your RTA response. You may even choose to quote the information in your response memo if it is brief.
Other times the reviewer may not understand why certain information is not relevant to your submission. In this case, you should restate why the information requested is not relevant. You may want to review relevant FDA guidance documents that explain how to justify why information is not required. For example, if you did not provide biocompatibility testing reports for some of the endpoints that are identified in ISO 10993-1:2018, then you should either provide a detailed biological risk assessment in accordance with the FDA guidance on the use of ISO 10993-1, or you should provide a biocompatibility certification statement.
If you are not sure why the FDA reviewer stated the information you provided is not acceptable, you might try calling or emailing the reviewer to ask for clarification. If you do this, be respectful of their time and be brief. You should identify who you are (you must be the official submission correspondent to speak with the reviewer), you should identify which submission you are contacting the reviewer about (they are working on many simultaneously), you should restate the issue identified by the reviewer (it may have been an issue of another member of the review team), and then you should indicate where the information can be found in the submission. If they believe this addresses the issue, then they will instruct you to provide that information in an RTA response. If the information does not address the issue, usually they will explain why. Your chances of receiving an email response are also better than speaking to the person on the phone–especially during the Covid-19 pandemic.
FDA eSTAR submissions are not subjected to the RTA screening process
When you use the FDA eSTAR submission instead of creating an eCopy, your submission should already meet all of the RTA screening requirements. The eSTAR includes automation to validate that the submission is administratively complete and therefore the reviewer does not need to do an RTA screening of an eSTAR submission. Therefore, most companies should realize a shorter overall 510k clearance timelines, because they will only have an AI Request and the review clock will not be reset.
Does the FDA offer any guidance on how to respond to deficiencies?
When the FDA writes deficiencies, the reviewer is supposed to follow the FDA guidance for deficiency content and format. However, the RTA checklist deficiencies typically are shorter and may not be as clear as a deficiency in additional information (AI) requests or non-substantial equivalence (NSE) letters. The first part of the deficiency is a reference to the information that was provided by the submitter (i.e. section, page number, or table). In an RTA checklist, each deficiency is provided in the comments section at the end of the section of the checklist. Therefore, if you have a deficiency related to your device description, the deficiency will be written at the end of the device description section of the RTA checklist. The comment will be highlighted in yellow, and there will be a checkbox next to the specific checklist item indicating that the requirement was not met. In the far-right column of the checklist, there will be a reference to the page of the submission where the deficiency can be found.
In the comment there reviewer should explain why the current information does not meet the requirement of the RTA checklist. The reviewer should also clarify the relevance of the deficiency with regard to the substantial equivalence determination. For the example of a deficiency related to your device description, usually, the issue is that your submission has inconsistencies between the various submissions or there is insufficient detail about your device. At the end of the comment, the reviewer should provide an explicit request for the information needed to address the RTA Hold.
In section “V” of the FDA guidance on deficiency responses, the FDA recommends that you restate the issue identified by the reviewer in your response. Next, your response should include one of the following:
the information or data requested, or
an explanation of why the issue is not relevant, or
alternate information with an explanation of why the information you are providing addresses the issue.
Before you respond to an RTA Hold, you should look up any FDA guidance documents referenced in the RTA Checklist to make sure that you address each requirement in the applicable FDA guidance document(s).
The most important technique to learn when you are responding to regulators is to organize your response in a tabular format that is numbered in exactly the same order that the request was made. Typically there will also be sub-parts to certain issues. In that case, you should duplicate the numbers and/or letters of each sub-part and segregate each sub-part in a different row of the table. Personally, I like to alternate the color of the font I use in the table to make it even more obvious which information is a restatement of the reviewer’s comment and which information is the company’s response to the RTA Hold.
Regardless of how well your response is organized, you must respond within 180 days. On the 181st day, your submission will be automatically withdrawn. The agency has granted extensions of an additional 180 days during the Covid-19 pandemic, but that will end and you should verify if you can obtain an extension from the reviewer rather than assume that this will happen. If the 180th day is on a weekend or US holiday, the Document Control Center (DCC) at the FDA will not receive your submission until the next business day. Therefore, you will need to ship your submission earlier to ensure the delivery is received on time. Since most companies are shipping their RTA response via FedEx or UPS to the FDA, you also will want to make sure you take into account customs clearance for international shipments and local holidays where you are. If you are shipping from the UK, for example, you can’t expect FedEx to ship on a British holiday. If you need help with printing and shipping your RTA response, Medical Device Academy offers an eCopy print and ship service for $99/eCopy (including the overnight FedEx fee).
If your 510k submission was placed on RTA Hold by the FDA, we can help you respond to the deficiencies identified by the FDA reviewer. We can also review your planned response to identify potential gaps. If you need help please use our calendly app to schedule a call with a member of our team.
About the Author
Robert Packard is a regulatory consultant with 25+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Robert was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certification. From 2009-2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Robert’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510(k) submissions. The most favorite part of his job is training others. He can be reached via phone 802.258.1881 or email. You can also follow him on Google+, LinkedIn or Twitter.
Did you forget any of the MDR labeling procedure requirements when you were updating your device labeling for CE Marking?
Don’t forget to subscribe to our YouTube channel for more medical device quality and regulatory training. The topic of this article is how to create an MDR labeling procedure for compliance with Regulation (EU) 2017/745 (MDR) for CE Marking of medical devices. The MDR does not actually include a requirement for a labeling procedure. In fact, the MDR doesn’t even specifically require that you have ISO 13485:2016 certification. ISO 13485:2016, clause 7.5.1 states that you shall implement “defined operations for labeling and packaging,” but the standard doesn’t specifically say that “the organization shall document procedures” for labeling. In 21 CFR 820.120, the FDA states that “each manufacturer shall establish and maintain procedures to control labeling activities.” But there is no similar requirement in the MDR.
MDR Quality System Requirements
Article 10 is the section of the MDR that defines the obligations for device manufacturers to create quality system procedures, but a labeling procedure is not specifically mentioned. Article 10(9)(a) states that your quality system shall include “a strategy for regulatory compliance, including…procedures for management of modifications to the devices covered by the system,” and this would include label changes. The next paragraph states that your quality system shall include, “identification of applicable general safety and performance requirements.” The general safety and performance requirements (GSPRs) are found in Annex I of the MDR, and the very last GSPR (i.e. GSPR 23) is for your label and instructions for use.
Then, which changes do you need to make for the MDR labeling procedure?
The GSPRs in Annex I of the MDR are longer than the Essential Requirements that were in the MDD. In addition to the new requirements for UDI compliance (which you should address in a UDI Requirements Procedure), GSPR 23 has new general requirements (i.e. 23.1) and new requirements for information on the sterile packaging (i.e. 23.3). There is also a more detailed specification for the information on the label (i.e. 23.2) and the information in the instructions for use (i.e. 23.4). The approach for demonstrating compliance with the GSPRs suggested in the MDR is to provide a checklist. Therefore, most manufacturers of CE Marked devices have replaced their Essential Requirements Checklist (ERC) with a GSPR checklist. However, if you are reviewing a draft label for approval, you don’t want to review and update your entire 22-page, GSPR checklist for every label.
The more efficient approach is to create one or more labeling checklists that are specific to the requirements in GSPR 23. If you create a separate checklist for the label, the information on the sterile packaging, and for the information in the instructions for use, then you would have three shorter checklists to complete. The label checklist and the checklist of the information on the sterile packaging would be only one page each, while the checklist for the instructions for use would be approximately four pages. There may be additional labeling requirements for specific countries and types of devices. Electrical medical equipment also has specific labeling requirements in IEC 60601-1 and IEC 60601-1-2. You will also need to create a user needs specification that can be used as criteria for summative usability testing (i.e. validation that the design and risk controls implemented meet the user needs specification). You should also document a use-related risk analysis (URRA), and perform formative testing, in order to identify critical tasks which need to be in the instructions for use to prevent use errors.
Are there any other MDR requirements that you should address in a labeling procedure?
There are two other requirements that should be addressed in your labeling procedure. The first is the general labeling requirements in GSPR 23.1. Withing GSPR 23.1, there are actually nine “sub-requirements.” The first “sub-requirement” in GSPR 23.1 is to provide the identity of the device, your company, and any safety and performance information needed by the user on the packaging or the instructions for use, and on your website. Many manufacturers do not want to make this information available on their website, because it makes it easier for competitors to copy the instructions for use, but this is not optional. This requirement and the other eight requirements in GSPR 23.1 could be included in your procedure or as part of a fourth labeling checklist associated with your MDR labeling procedure.
The second requirement is the requirement to translate your instructions for use into an official Union language(s) determined by the member state where your device will be made available to the intended user or patient. Creating these translations, and verifying the accuracy of the translations, can be expensive and burdensome–especially if your device is sold in most of the member states.
You might also consider implant cards as labeling requirements and try to add them to your MDR labeling procedure. However, if the requirement for implant cards (see Article 18 of the MDR) is applicable to your company you should create an implant card procedure instead because this is a detailed and critical requirement that will not apply to most of the other labels in your company. You should make sure that the implant card procedure is compliant with MDCG 2021-11 released in May 2021 and MDCG 20201-8 v2 release in March 2020. These guidance documents also have great examples of how to design your implant cards.
Other changes in labeling requirements
The ISO 15223-1:2016 standard has been revised and was expected for release at the end of 2020. However, only draft versions are currently available (i.e. ISO/DIS 15223-1:2020). This new version of the standard for symbols to be used with labeling will also need to be updated shortly in your MDR labeling procedure. This new version is already referenced in the medical device standard for information provided by the manufacturer (i.e. EN ISO 20417:2021)–which supersedes EN 1041:2008. Consultants and chat rooms have argued over whether the requirement for identifying the importer must be on the label or if it could be presented in other documents. EN ISO 20417:2021 resolves this dispute in section 7.1: “Where necessary, the label of a medical device or accessory shall include the name or trade name and full address of the importer to which the responsible organization can refer.” In the note following that clause, it clarifies that “This can be required by the authority having jurisdiction.” There is even a new symbol referenced for importers (i.e. Symbol 5.1.8 in ISO 15223-1).
If you have specific questions about device labeling or MDR compliance, please use our calendly app to schedule a call with a member of our team. You can also purchase our labeling and translation procedure (SYS-030) to save yourself the time and effort of making your own versions of the labeling checklist described above.
About the Author
Robert Packard is a regulatory consultant with 25+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Robert was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certification. From 2009-2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Robert’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510(k) submissions. The most favorite part of his job is training others. He can be reached via phone 802.258.1881 or email. You can also follow him on Google+,LinkedIn or Twitter.
Can you combine the software development lifecycle with design controls when you are developing software as a medical device (SaMD)?
Don’t forget to subscribe to our YouTube channel for more medical device quality and regulatory training. There has been a remarkable increase in the number of medical devices developed in the past few years that consist of only software. The medical device industry refers to these products as software as a medical device (SaMD). Along with the increase in the number of SaMDs on the market, there has also been an increase in the number of companies that are developing these SaMDs without any prior medical device industry experience. Medical Device Academy specializes in helping start-up medical device companies, and we see common characteristics shared by these MedTech start-ups. First, they are usually successful in demonstrating proof of concept for their software device within months. Second, the development team is typically virtual (i.e. everyone lives in a different state or even in different countries). Third, the development team does not include anyone with quality or regulatory responsibility. Fourth, the company has not implemented software design controls or started a design history file (DHF). Fifth, the company is not even aware of the existence of IEC 62304 (less expensive than other websites) –the international standard that defines the life cycle requirements for medical device software.
The above situation is quite common, but it is not a serious problem. These Medtech start-ups just need guidance on how to comply with medical device regulations without creating an overly burdensome quality system and excessive documentation. At the same time, these companies need to stay small, agile, and thrifty. Most people believe that the quality system and software documentation process slows down the development process, but the intent is to prevent mistakes and to help you plan the design and development of your SaMD so that the resulting software is safe and performs as you intended (i.e. efficacious). In order to create a quality system and software documentation process that is lean and efficient, there are some common pitfalls you should avoid.
When do you need to implement a quality system for software as a medical device (SaMD)?
When a quality system is required depends upon which market you are launching your product in first. If you are launching your product in Canada, you need a special kind of quality system certificate before you can apply for a Canadian Medical Device License(i.e. MDSAP Certificate for ISO 13485:2016). MDSAP stands for “medical device single audit program,” and there are only 16 organizationsthat can issue this type of certificate. If you are launching your product in Europe, you will go through your ISO 13485 quality system certification in parallel with obtaining the CE Certification of your SaMD. If you are launching your product in the USA, you do not need your quality system to be complete until after you obtain 510(k) clearance and you are ready to register and list with the FDA. You also do not need ISO certification for the US market. If your SaMD is a Class 1 device in any of these three markets, you may have fewer quality systems and regulatory requirements.
Regardless of which market you are planning to launch your product in, you should not invest in a complete quality system and then develop your SaMD. You should either develop both in parallel, or you should develop your SaMD first. The only processes that are really important to implement at the beginning of product development are 1) design controls, 2) software development, 3) risk management, and 4) usability engineering or human factors testing. You can wait to implement the other 20+ procedures until you are entering the design transfer phase of your design and development project.
Do you need separate procedures for design controls, change control, and software development?
If you are developing a complex system that includes hardware and software you should probably have three separate procedures. The reason for this is that there are different quality systems and regulatory requirements for changes to hardware and software. If you are only developing SaMD, then you can easily combine these three processes into one procedure. The video at the beginning of this blog describes how to combine these three into one procedure, but the following outlines the software documentation that should be covered in each stage of your design process:
Phase 1 – Design planning requires identification of the software risk classification (i.e. A, B, or C) in accordance with IEC 62304, and the Level of Concern (LoC) for your software in accordance with the FDA guidance for software documentation. Regardless of what the LoC is for your SaMD, you will still need to develop the documentation required for the risk classification in IEC 62304–even if the FDA does not want to review all of that documentation in your 510(k) submission. You will also need to identify the regulatory pathway for your SaMD. Your design plan will identify the team members and each person’s role and responsibility. This phase is when you should document your software development environment, create a draft software description, and create a draft software architecture diagram.
Phase 2 – Design inputs must be documented and approved in the second phase. These inputs are testing requirements. Therefore, you need to develop a testing plan for your product based upon the regulatory pathway for that product, recognized international standards or common specifications, and any guidance documents that are specific to your type of SaMD. Typically, it is recommended to review your testing plan with a regulator in a pre-submission meeting prior to conducting your verification and validation testing–especially if animal preclinical studies or human clinical studies are required. This phase is when you should conduct a hazard analysis and approve your software requirements specification (SRS). The hazard analysis should include use-related risk analysis (URRA) and cybersecurity risk analysis.
Phase 3 – Design outputs are iteratively developed during the third phase. This is typically the longest phase of your development process, and the “Waterfall Diagram” is not an accurate depiction of most software development processes. The “V-Diagram” presented in IEC 62304 is a better representation of the software development process because you continuously repeat steps as you debug your code and add functionality to your software. Only the simplest firmware is written in a linear fashion without multiple debug and retest cycles, and lean product development methods (i.e. Agile programming) are intended to be iterative. This phase of development is complete when you conduct a “design freeze” and begin your verification and validation testing. Typically, companies that are developing SaMD can complete most of their unit testing and integration testing prior to the design freeze, but system validation may not be conducted until phase 4. Unfortunately, the unit testing and integration testing can only proceed so far if you have an embedded system (i.e. software embedded in hardware). If the SaMD requires human clinical studies, that software validation is performed during Phase 4. Phase 3 is when you should be documenting your software design specifications (SDS), unit testing, and integration testing. Any formative testing required for the user interface would be done during this phase. Formative testing may include: 1) evaluating very software functions, 2) developing directions for use, and 3) developing a training program for users. You should write testing protocols for system validation and summative usability testing during this phase as well. It is important to identify all of the critical tasks related to use-related risks during this phase and document them. These critical tasks determine the summative usability testing required. It is also an excellent idea to start drafting a traceability matrix during this phase to ensure that each hazard and SRS item is being addressed in your verification and validation plan.
Phase 4 – Design verification and validation of your SaMD are completed during this phase. At the end of this phase, you should have a complete traceability matrix, you should create a summary report of your unit testing and integration testing, and you should create a system validation report–including any benchtop, animal, or human performance testing is conducted. You should also create a revision history document and a bug report identifying any known bugs in the software with a justification for why the software is safe to release with these bugs. This phase is also when you should complete your risk management file and your summative usability testing report. Finally, you need to complete a final draft of your user manual for the software that includes directions for use and the indications for use. When all of this documentation is completed, you are ready for your regulatory submission.
Phase 5 – Product release is the last phase of design and development. Once you receive 510k clearance for your SaMD, then you can begin the final release of your product. You will need to update your “splash” or “about” screen for the software to include a Unique Device Identifier (UDI). The information will need to be uploaded to the FDA’s GUDID. You can assign the DI for the UDI anytime, but the GUDID data elements cannot be finalized until you have 510k clearance from the FDA. You will also need to manage revisions of your software for this minor change and revalidate the code. This type of change will not require a new 510k, because it is a minor device modification. However, you will need to review the FDA guidance on software changes for other types of software revisions you make in the future.
Should you outsource software documentation for software as a medical device (SaMD)?
You can outsource all of your software documentation for a SaMD, but the person(s) creating that documentation will still need the documents mentioned in phase 2. If you do not provide any documentation of hazards, a software description, or a crude sketch of your software’s architecture, it will be nearly impossible for anyone to create your software documentation. It is also extremely expensive to outsource software documentation. Even if you do outsource this task, you still will need to review and approve that documentation. Most people outsource tasks because they don’t know how to do it, but it is critical for medical device companies to learn how to document their software development because they will need to maintain that documentation when the software is updated to fix a software bug or to patch cybersecurity weaknesses. Everyone that is developing software for a SaMD should receive basic training on the requirements of IEC 62304 early in your project. Your team does not need to be an expert in IEC 62304, but you need to create draft documents that you can present to experts for feedback. Your team should also review all four of the guidance documents that the FDA released for software documentation:
Creating your documentation is the hard part that your team should be doing while reviewing and editing your documentation is a great task to hire an expert consultant for your first SaMD project. This will ensure your team is writing the software documentation to the correct level of detail, and that you are not missing anything critical. Expert consultants can also provide you with templates for your software documentation.
Does software as a medical device (SaMD) require an electronic quality management system (eQMS)?
There are two types of quality systems: 1) paper-based, and 2) electronic. Most start-up companies chose the paper-based option because they don’t want the extra hassle of having to validate an electronic system. However, if your company is smart enough to validate SaMD, you are smart enough to validate software for your quality system too. The applicable standard for validation of software tools is ISO/TR 80002-2:2017. You can also purchase templates for software tool validation from Medical Device Academy. Companies are always asking for a referral of which eQMS system to purchase. The problem is that every year software has more functionality and costs less. Therefore, my general advice is to never pay more than $10,000 for eQMS as a start-up and consider starting with free database software to organize all of the documentation that is in your traceability matrix. You can migrate the data into an eQMS later by mapping your free database to the new eQMS software database.
Who should be responsible for QA and RA for software as a medical device (SaMD)?
Quality and regulatory are two different functions, and it doesn’t always make sense to have one person be responsible for both requirements. The two primary standards that are applicable to the quality assurance of SaMD are 1) IEC 62304, and 2) ISO 13485. Anyone you are considering for the position of quality manager should be familiar with both standards, and they should be making sure that your development team is documenting the software verification and validation as you proceed through the iterative software development process that is typical of Agile software development teams. The person doesn’t need to be able to code software, but they should be able to help review software documentation and suggest changes. This person’s role is extremely important to make sure that software revisions are managed properly, your software is only released when all of the validation and revalidation are complete. This person should also be able to determine if a new 510(k) is required for software modifications.
The regulatory process is the preparation of the 510k submission and communications with the FDA. This is an activity that you will probably need to perform once every two years. The FDA requirements for a 510k change more frequently than once every two years, and it is extremely difficult to become proficient when you are filling out government forms so rarely. For these reasons, it is recommended to work with an expert regulatory consultant with SaMD experience until your company has enough software products and revisions that you need to file multiple 510k submissions each year. Therefore, a less experienced quality manager can gradually learn the regulatory requirements over time and they will need less help from a regulatory consultant each year.
How do you measure quality for SaMD?
A lot of software developers struggle with identifying quality metrics if they are developing software as a medical device (SaMD). There are many aspects of software development that you can measure. Here’s a list of examples:
customer feedback
the velocity of Agile sprints
coding errors
what is the development lead time?
how fast does the software load?
technical support requests
software configuration errors
duration of software validation
software validation documentation burden
post-market surveillance of use errors
How many software bug remain?
Do you need a corporate office?
Many MedTech companies are virtual companies, but the FDA will require a physical address to visit for an FDA inspection. FDA inspectors have visited the home of the company founder at other companies, but you probably will be more comfortable with an office space for the FDA inspector to visit. The FDA is unlikely to visit your company during the first year after you initially register your product. An inspection is more likely in the second year after initial registration and listing. Therefore, you might consider renting a co-working space where you can reserve a conference room if an FDA inspector visits. If you don’t have the funds to afford rent until after you launch your product, don’t worry. FDA inspectors are unlikely to visit so soon, and if they do–just relax and be honest about the situation. You are not alone.
About the Author
Robert Packard is a regulatory consultant with 25+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Robert was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certifications. From 2009 to 2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Robert’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510(k) submissions. The most favorite part of his job is training others. He can be reached via phone at 802.258.1881 or by email. You can also follow him on Google+,LinkedIn, or Twitter.
This blog discusses why contract manufacturers need to have a strong risk management process, and your company needs to help your contract manufacturers. This article was updated on April 28, 2022, and the original publication was January 05, 2011. Please ignore the date of publication at the top of the post for articles that are more than a year old.
Can contract manufacturers exclude risk management from the scope of their quality system?
Most contract manufacturers in the medical device industry exclude design from their Quality Management Systems. Unfortunately, most of the contract manufacturers also associate risk management with only the design process. Risk Management cannot be “not applicable” in anISO 13485Quality Management System. The requirement of section 7.1 is: “The organization shall establish documented requirements for risk management throughout product realization. Records arising from risk management shall be maintained.” The Standard also referencesISO 14971as a source of guidance on Risk Management.
Have you experienced an audit dialogue at a contract manufacturer similar to this?
The auditor asks, “How do you manage risk throughout the production process?” Then the auditee responds, “That is the responsibility of our customers. We will prepare a risk analysis if customers pay for it, but usually, customers do the risk analysis.”
For a contract manufacturer, compliance with ISO 14971 is not my primary concern as an auditor. My primary concern is to verify that contract manufacturers analyze risks associated with the processes that they perform and do their best to minimize those risks. What I don’t understand is why more companies don’t want to have strong risk management processes. Risk management is how we prevent bad things from happening. Bad stuff like scrap, complaints, and recalls. Should we expect our suppliers to have a strong risk management process?
Duh.
Why your company needs to be involved in the risk management process?
Contract manufacturers should be doing everything they can to get better at risk management. During pre-production planning, they should be asking, “What happens if…” The contract manufacturer knows best HOW things will fail in production, while the customer knows best WHAT happens when things fail in production. To be safe and effective, both companies need to collaborate on risk analysis.
In any risk analysis, you need to estimate the severity of potential harm and the probability of occurrence of that harm. For production defects, the contract manufacturer can estimate the probability of occurrence of defects (i.e., P1 in Annex E of ISO 14971:2007), but the likelihood of occurrence of harm is less. The probability of occurrence of harm is the product of multiplying P1 and P2. The probability that occurrence will result in harm is P2, and P2 is a number that is less than 100% or 1. Your company can gather pre-market clinical data and post-market clinical data to estimate P2, but before launching your product, you can only guess at the value of P2. Your contract manufacturer, however, is not able to estimate P2 at all. It’s ok to estimate risk without P2 during the design phase because this will overestimate risks and result in more conservative decisions.
In addition to P2, your contract manufacturer is also not capable of estimating the severity of potential harm. As the designer of the medical device, you will know best how your device is used and what the likely clinical outcomes are when a device malfunctions. There may even be multiple possible clinical outcomes. The contract manufacturer knows what can go wrong during manufacturing, but you will need to define the clinical outcomes due to malfunctions.
Why do contract manufacturers avoid doing risk analysis?
The reason contract manufacturers avoid doing risk analysis is because it’s time-consuming and tedious.
Too bad, so sad.
Balancing my checkbook is time-consuming and tedious too, but I balance my checkbook to prevent an overdraft charge. Not doing a risk analysis can be much more painful. Scrapping out a part can cost tens or hundreds of dollars. Complaints can cost thousands of dollars. Recalls can cost millions of dollars.
If I owned a contract manufacturing company, I would ensure that everyone in the company is involved in risk management. We don’t want scrap, we can’t afford mistakes that lead to complaints, and a recall could put us out of business.
How Medical Device Academy Can Help?
Medical device academy can help both the contract manufacturer and the specification developer utilizing a contract manufacturer as a supplier! We offer training on 14971:2019 as well as procedures on risk management and supplier quality management.
Two-part Risk Management Training Webinar for ISO 14971:2019 – Part 1 of this webinar will be presented live on Tuesday, March 29 @ 9-10:30 am EDT. Part 2 of this webinar series will be presented live on Tuesday, April 5 at 9-10:30 am EDT. Purchase of this webinar series will grant the customer access to both live webinars. They will also receive the native slide decks and recording for the two webinars.
This article discusses how to utilize various strategies for obtaining greater results related to supplier qualification. This article was updated on April 21, 2022, and the original publication was November 17, 2010. Please ignore the date of publication at the top of the post for articles that are more than a year old.
Section 7.4 of EN ISO 13485:2016 states that companies shall “evaluate and select suppliers… based on their ability to supply product in accordance with theorganization’s requirements.”This requirement is quite vague, but the medical device industry has developed a surprisingly limited number of approaches to address the requirement of this clause.
The most common approach is to ask for some combination of the following:
Unfortunately, all four selection criteria are flawed.
ISO Certification
I think the best way to explain why these criteria are flawed is to use an analogy. Let’s compare qualifying a new supplier with recruiting a new employee. ISO certification is sort of like a college degree. You can make some general assumptions about a potential job candidate based upon which school they got their engineering degree from, but the degree is still just a piece of paper on the wall. As the old joke goes:
” What do you call the person that graduated last in their class at medical school?“
Doctor
Some registrars have a better reputation than others. Still, the name of the registrar is only as good as its worst client—who had four major nonconformities during their last audit and is about to lose that certificate. To improve this approach to supplier qualification, a potential customer could ask for a copy of the most recent audit report. This information is dependent upon the quality of the audit, but this would be a significant improvement over requesting a copy of the certificate.
CAUTION: Audits are still just samples—tiny samples.
Again, like degrees, certification must be relevant. ISO 9001:2015 may be a ‘nice-to-have’ quality for potential suppliers. However, it doesn’t hit the mark if you need them to have ISO 13485:2016 certification. Perhaps you need a European Normative version, or A11:2021 as well. For example, sometimes any law degree might be appropriate. Sometimes you specifically need a degree in healthcare law.
This makes it important to establish the criteria for your supplier evaluation early on in the process. Not just because it is required for standard compliance. It is difficult to evaluate a supplier with no guidance on how or what to evaluate them against.
Supplier Quality Manual
The second selection criteria mentioned is The Quality Manual. The Quality Manual is analogous to a resume. The purpose of a resume is two-fold: 1) to provide an interviewer with information, so they can ask the interviewee questions without looking like an idiot, and 2) to provide objective evidence that a company did not illegally discriminate against a candidate that the hiring manager did not like.
I suppose you could argue that the purpose is to help candidates get a job, but in my own experience, less than 10% of resumes submitted result in a job interview—let alone a job offer. The purpose of a Quality Manual isNOT to help a company get new customers. If I am wrong about this, I need to do a much better job of marketing my Quality Manuals in the future.
Some suppliers have the nerve to say that their Quality Manual is proprietary. Humbug! Proprietary information should not be in the Quality Manual. You can copy a manual from another company and edit a few of the details. I will gladly write you a Quality Manual in less than a week that will pass any auditors review. You can even buy a Quality Manual online (In fact, Medical Device Academy sells one… Online! POL-001 Quality Manual). This almighty document just explains the intent of the Quality System—which is to conform to the requirements of the ISO Standard. Several auditors will tell you that this can be done in just four pages.
When you request a Quality Manual from a supplier, your primary intent for supplier qualification should be to use this document for planning a supplier audit. Any other purpose is just a waste of your time—unless you need to write a Quality Manual of your own.
Supplier Qualification Questionnaire
The third selection criteria I mentioned was: a supplier questionnaire or supplier survey. Questionnaires are analogous to employment applications. Coincidently, supplier questionnaires are often required by companies when a Quality Manual or ISO Certificate is not available. Do you find the similarities eerie?
Questionnaires are typically 15-20 page documents that someone has plagiarized from a previous employer. I have seen various versions of this questionnaire, but several of them appear suspiciously similar. Hmmm?
I am not sure what the original intent of this type of document was, but I think it was intended to capture detailed information about potential suppliers for a company in the Fortune 500®.
For most companies, 80% of the information on the questionnaire is meaningless. Customer requirements for a supplier are typically few in number and specific to the product or service being purchased. Therefore, please use your MRP system as a template and ensure that the questionnaire answers all the information you need to add the supplier to your system as an approved supplier. You should also have a product or service specification that gives you some more questions to ask.
Ideally, your questionnaire will be organized in the same order that you enter the information into the MRP system. Then this questionnaire will make the data entry easier for the purchasing agent, adding the supplier to the database. Questionnaires and surveys are great, but brevity is next to Godliness.
Supplier Qualification Audits
Finally, we come to the auditor’s favorite—supplier audits. Audits are similar to job interviews. Ideally, you want a cross-functional audit team, and you might need to visit more than once. Unfortunately, most companies cannot afford to audit every supplier. Some companies suppliment with remote audits. I guess I think of a desktop audit as a “phone interview.” I use phone interviews to prescreen candidates before I pay more money and waste other peoples’ time with on-site interviews. Desktop audits of suppliers should not be used as a replacement to an on-site audit, so your supplier quality engineers do not have to spend so many nights at the Hampton Inn.
If audits are your best selection criteria, how can you make the most of your auditing resources? Also, how can you audits for supplier qualification if you only have enough auditors to audit 5% of the approved supplier list? I have the following suggestion: “Start at the end.”
ISO 13485:2016 Clauses 8.5.2 / 8.5.3 CAPA
What I mean by this cryptic, four-word phrase is that auditors should start at the end of the ISO Standard with sections 8.5.2 & 8.5.3 (Corrective and Preventive Action (CAPA) Process). This is the heart of a Quality System. If you disagree, remember that FDAinspectors are required to look at the CAPA system during every Level 1 inspection. Registrars also look at the CAPA process during every assessment—not just the certification audits. The purpose of the CAPA process is to fix problems, so they don’t come back—ever.
If you think that a new supplier is never going to make a mistake, you might as well quit looking. You want suppliers with strong CAPA systems. If a supplier has a strong CAPA system, problems will be fixed quickly and permanently. To sample the CAPA process, an auditor only needs the following: 1) the CAPA procedure(s), 2) the CAPA log(s), and 3) a handful of completed CAPA records—selected not so randomly from the log(s). This can all be done remotely in a desktop audit. If suppliers are resistant to giving you the log or actual records, ask them to redact any sensitive information. If you have executed a nondisclosure agreement, the supplier should agree with this approach.
Analysis of Data for Supplier Qualification
ISO 13485:2016 Clause 8.4 Analysis of Data
Working from the back of the Standard, the next process to sample is clause 8.4 (Analysis of Data). There are four requirements of this clause. If the company has a requirement for customer satisfaction to be measured (ISO 9001:2008 section 8.4a), this is a great place to focus. There are also requirements to look at the trend of product conformity (8.4b), process metrics (8.4c), and trends in supplier data—such as on-time delivery and raw material nonconformities (8.4d). The quality of the analysis will tell an auditor as much about the company as the data itself. This process audit can also be performed remotely as a desktop audit.
A lot has changed since this article was first written. For example, if your potential supplier isn’t using ISO 9001:2015 you may want to verify that other areas of their quality management system aren’t outdated as well.
ISO 13485:2016 Clause 8.3 Control of Nonconforming Materials
Clause 8.3, Control of Nonconforming Materials, is the third area to look at. To sample this area, you will need the “Holy Trinity” again: 1) procedure, 2) log, and 3) records. In this desktop audit, you want to look very closely at any nonconforming materials that are reworked or accepted “as is” (i.e., UAI). Either of these two dispositions should be ULTRA-RARE. Everything else should be processed efficiently as scrap or Return To Vendor (i.e., – RTV).
If a potential supplier passes all three “tests” described above, you are ready to address clause 8.2.4—Monitoring & Measurement of Product. In this section, there is a requirement to maintain records of product release and to verify that product requirements are met. for supplier qualification, if you think you can effectively audit this by paperwork alone, the supplier is a good candidate for “desktop only.” However, if the lot release paperwork, batch record, or Device History Record (DHR) is a 50-page tome—then you better make your flight plans.
The good news is that very few suppliers will pass the first three tests and implode during the on-site audit. Also, with three process audits complete, you should be able to reduce the duration of your on-site audit. Finally, for low-risk suppliers, you have a strong basis for provisional approval of suppliers to proceed with prototype runs before you schedule an on-site audit.
For more information on supplier controls, quality systems, auditing and regulatory submissions visit ourYoutube Channel!