ALARP vs As far as possible – Deviation #3

This third blog in a seven-part series reviews deviation #3, ALARP vs. “As far as possible,” with regard to risk reduction.

In 2012, the European National (EN) version of the Medical Device Risk Management Standard was revised, but there was no change to the content of Clauses 1 through 9. Instead, the European Commission identified seven content deviations between the 14971 Standard and the requirements of three device directives for Europe. This seven-part blog series reviews each of these changes individually and recommends changes to be made to your current risk management policies and procedure.

Note: This is 2013 blog that will be updated in the near future, but the following link is for our current risk management training.

Risk reduction: “As Far As Possible” (AFAP) vs. “As Low As Reasonably Practicable” (ALARP)

The third deviation is specific to the reduction of risk. Design solutions cannot always eliminate risk. This is why medical devices use protective measures (i.e., – alarms) and inform users of residual risks (i.e., – warnings and contraindications in an Instructions For Use (IFU). However, Essential Requirement 2 requires that risks be reduced “as far as possible.” Therefore, it is not acceptable to only reduce risks with cost-effective solutions. The “ALARP” concept has a legal interpretation, which implies financial considerations. However, the European Directives will not allow financial considerations to override the Essential Requirements for the safety and performance of medical devices. If risk controls are not implemented, the justification for this must be on another basis other than financial.

There are two acceptable reasons for not implementing certain risk controls. First, risk control will not reduce additional risk. For example, if your device already has one alarm to identify a battery failure, a second alarm for the same failure will not reduce further risk. The redundant alarms are often distracting, and too many alarms will result in users ignoring them.

The second acceptable reason for not implementing a risk control is that there is a more effective risk control that cannot be simultaneously implemented. For example, there are multiple ways to anchor orthopedic implants to bone. However, there is only enough real estate to have one fixation element at each location. If a femoral knee implant is already being anchored to the femur with metal posts and bone cement, you cannot also use bone screws at the same location on the femur to anchor the implants in place.

ALARP does not reduce risk “As far as possible”

Annex D.8 in ISO 14971, recommends the ALARP concept in Clause 3.4 of the 14971 Standard. Therefore, the risk management standard is contradicting the MDD. This contradiction is the primary reason why medical device companies should discontinue the use of phthalates and latex for most medical devices. Even though these materials are inexpensive solutions to many engineering challenges presented by medical devices, these materials present risks that can be avoided by using more expensive materials that are not hazardous and do not pose allergic reactions to a large percentage of the population. The use of safer materials is considered “state-of-the-art,” and these materials should be implemented if the residual risks, after implementation of the risk control (i.e., – use of a safer material) are not equal to, or greater than, the risk of the cheaper material.

Recommendation for eliminating ALARP

Your company may have created a risk management procedure that includes a matrix for severity and probability. The matrix is probably color-coded to identify red cells as unacceptable risks, yellow cells that are ALARP, and green cells that are acceptable. To comply with EN ISO 14971:2012, the “yellow zone” should not be labeled as ALARP. A short-term solution is to simply re-label these as high, medium, and low risks. Unfortunately, renaming the categories of risk high, medium, and low will not provide guidance as to whether the residual risk is reduced “as far as possible.”

Resolution to this deviation

As companies become aware of this deviation between the 14971 Standard and the Essential Requirements of the device directives, teams that are working on risk analysis, and people that are performing a gap analysis of their procedures will need to stop using a matrix, like the example above. Instead of claiming that the residual risks are ALARP, your company will need to demonstrate that risks are reduced AFAP, by showing objective evidence that all possible risk control options were considered and implemented. Your procedure or work instruction for performing a risk control option analysis may currently state that you will apply your risk management policy to determine if additional risk controls need to be applied, or if the residual risks are ALARP.

This procedure or work instruction needs to be revised to specify that all risk control options will be implemented unless the risk controls would not reduce risks further, or the risk controls are incompatible with other risk controls. Risk control options should never be ruled out due to cost.

ALARP vs As far as possible – Deviation #3 Read More »

Aug 29 2013

Effective Management Solutions for 10 CAPA Program Blunders

3 Comments / CAPA / By Robert Packard / CAPA, Corrective and preventive action, Management

The author provides effective management solutions for ten real-life CAPA program blunders., (i.e., procedures, root cause analysis, closing CAPAs, etc.)

%name Effective Management Solutions for 10 CAPA Program Blunders — Effective Management Solutions for 10 CAPA Program Blunders

I am always looking for new and creative ways to help people understand the importance of maintaining an effective Corrective and Preventive Action (CAPA) program. If my last dozen CAPA blogs were not convincing enough, maybe this list of suggestions will help.

1. If someone doesn’t follow procedures, just fire them. The employee in question is obviously the root cause. Management cannot be held responsible for the actions of employees. Once, I read a corrective action plan that indicated termination was the correction for a missing training record. The QA Manager clarified this statement by saying that the employee resigned for personal reasons, and there was no opportunity to train the employee. The CAPA record also indicated that 100% of the training records for manufacturing employees were reviewed for completion. There were a few records identified as incomplete, and those employees were trained—not terminated. The company also implemented a tracking tool to monitor training records. As a general rule, termination is not an acceptable corrective action or correction.

2. If CAPAs are open longer than your procedure allows, close the existing CAPAs the day before the CAPAs become overdue, and open new CAPAs. CAPAs are not “closed” until all nonconformities have been corrected, corrective and preventive actions are implemented, and effectiveness checks are done. If the corrective and preventive actions were not completely effective, some companies chose to reopen the record and expand the plan of corrective and/or preventive actions. Other companies chose to open a new CAPA record, and reference the new record in the effectiveness check section of the previous CAPA record. Either approach works, but you cannot close an incomplete record and remain compliant.

3. To verify the effectiveness of corrective actions, just include a copy of your document change order. Documenting changes to procedures meets part of the CAPA requirements, but this verifies implementation—not effectiveness. To verify the efficacy, you need to confirm that a nonconformity, or a potential nonconformity, will not recur. Low-frequency defects are often hard to demonstrate directly. The best approach is to validate the process parameters to demonstrate quantitatively that the process capability has improved. For manual processes, you may need to test the new process to verify that the error will not occur or will be detected.

4. If you can’t finish tasks on schedule, revise your plan. If you still can’t finish tasks on schedule, revise your plan again—and again. It’s appropriate to revise your plan if you discover additional causes that your initial investigation missed. You should not, however, be revising target completion dates—except in rare cases. You also should not need to revise your plan multiple times.

5. When you’re unsure why a problem occurred, identify the root cause as an unclear procedure, and make a minor change to the appropriate SOP. Making changes to procedures is quick and easy to verify. Unfortunately, this approach is seldom effective in preventing recurrence. You need to develop new process controls to make errors impossible. Eliminate variation in raw materials, eliminate subjectivity in inspections, and provide tools and fixtures to make manual processes capable of more consistent results. After you have reduced all three of these sources for process defects, then you are ready to revise your procedures and retrain employees.

6. Whenever an employee fails to follow a procedure, just change the procedure to require another person to verify that they did it right. If one employee fails to follow procedures 100% of the time, a second person manually inspecting will also not be 100% effective. Another method of process control should be used to ensure that your process results in a conforming product. Adding more people provides a false sense of confidence. The use of objective measurement and go/no go fixtures offer a higher degree of certainty.

7. Write a justification for an extension of the implementation timeline if a CAPA is about to become overdue. Justifications for extension provide objective evidence that management is aware that a CAPA plan is not meeting the target completion times. This is necessary on rare occasions, but extensions should never become routine. Also, if the progress of a CAPA is slow, monitoring should be frequent enough that management can release additional resources, or re-prioritize assignments in order to catch-up with the target completion date.

8. Use the “5 Why” technique for root cause analysis to identify a user error to blame for complaints. The “5 Why” technique is effective at investigating the depth of a problem to ensure that the root cause is identified—instead of a symptom. If the reason for a problem is recognized as a supplier, then it is necessary to ask why the supplier’s error was not prevented or detected. Sometimes this requires asking “Why” more than five times, but identifying a cause you have no control over will fix nothing

9. To monitor your CAPA program, conduct weekly CAPA board meetings where a person is asked to explain why the CAPA they were assigned is overdue. Anyone can make an excuse, but excuses will not complete CAPAs. CAPA boards and weekly meetings can be extremely valuable, but your CAPA board should rely on three rules: 1. Managers need to be present to re-allocate resources and re-prioritize tasks. 2. CAPAs that are on schedule or ahead of schedule requires no further discussion. 3. Anyone assigned to a CAPA that is behind schedule should request help and suggest solutions before the CAPA becoming overdue.

10. Do not assign other departments the responsibility for CAPAs, because only QA has the training and competency to conduct an investigation of the root cause, and write a CAPA plan. One of the most effective CAPA management tools I observed was a visual communication board that used color-coded paperclips, which identified resources assigned to CAPAs. By limiting the number of paperclips to equal the number of resources allocated to CAPAs, the company was able to level the workload of CAPA assignments to match the available resources in each department. You can only achieve this level of efficiency and effectiveness if multiple people in multiple departments are trained and competent to investigate the root cause and write CAPA plans. CAPA should be a core competency for every department because it’s the best process for fixing and preventing problems.

Disclaimer: If you missed my sarcasm, these are ten ways to mismanage a CAPA program. The brief paragraph after each numbered example is intended to provide the actual recommendation for effective management of your CAPA program.

If you are interested in learning more about CAPA, please register for the Medical Device Academy’s CAPA Workshop on October 3 in San Diego. Click here to register for the event: http://bit.ly/MDAWorkshops.

Effective Management Solutions for 10 CAPA Program Blunders Read More »

Aug 27 2013

Risk Acceptability – Deviation #2 in EN ISO 14971

6 Comments / ISO 14971:2019 (Risk Management) / By Robert Packard / ISO 14971

This 7-part blog series continues with the author reviewing deviation #2, risk acceptability, in the EN ISO 14971:2012 Standard.

In 2012, the European National (EN) version of the Medical Device Risk Management Standard was revised, but there was no change to the content of Clauses 1 through 9. Instead, the European Commission identified seven content deviations between the 14971 Standard and the requirements of three device directives for Europe. This seven-part blog series reviews each of these changes individually. The second deviation is specific to risk acceptability.

Discretionary power of manufacturers as to Risk Acceptability

The second deviation is specific to determining risk acceptability in the risk evaluation process. The ISO 14971 Standard indicates in Annex D4 that the acceptability of risk is not specified by the Standard and must be determined by the manufacturer. Clause 3.2 of the 14971 Standard, it states that “Top management shall: define and document the policy for determining criteria for risk acceptability.” This risk management policy is intended to indicate a threshold for risk acceptability. In Clause 5 of the 14971 Standard, the manufacturer is instructed to evaluate whether risks are acceptable using the risk management criteria defined in the risk management policy.

Essential requirements 1 and 2 require that risks be reduced as far as possible and that all risks shall be included in a risk-benefit analysis—not just the risks that exceed a certain threshold for risk acceptability. Therefore, the requirement to establish a risk policy for the acceptability of risk directly contradicts the MDD.

Since the 2^nd edition of the 14971 Standard was first issued (i.e., -2007), clients have been asking me how to establish risk acceptability criteria, for new devices, I recommend benchmarking the risks of the new device against existing devices. In other words, if the new device presents equal or lower risks than existing devices, then the risks of the new device are acceptable. For existing devices, I recommend performing a risk-benefit analysis, evaluating adverse events observed with the device against the benefits of using the device. Unfortunately, most companies choose arbitrary thresholds for risk acceptability. Instead of relying upon benchmarking or risk-benefit analysis, companies will establish a policy that all risks must be below a quantitative value. For example, if the range of possible risk scores is from 1 to 1,000, all risks of 100 or less may be acceptable.

What is acceptable?

In order to comply with the EN ISO 14971:2012 version of the risk management standard, you will need to implement risk controls for all risks, regardless of acceptability. However, you will also need to perform a risk-benefit analysis. The risk-benefit analysis should consider not only the benefits to patients and the risks of using the device, but the analysis should also consider the relative benefits of using other devices.

The clinical evaluation report and the risk management report for the device should be based upon clinical evidence of the device for the intended use—including adverse events. For new devices that are evaluated based upon a literature review of equivalent devices, Notified Bodies expect a Post-Market Clinical Follow-up (PMCF) study to be conducted to verify that the actual risk-benefit of the device is consistent with the conclusions of the clinical evaluation. To perform this analysis, a clinical expert is necessary to properly evaluate the risk-benefit ratio of the device and to create a protocol for a PMCF study.

MEDDEV 2.12/2 rev 2, Post Market Clinical Follow-up Studies, indicates that the PMCF study protocol should indicate the study endpoints and the statistical considerations. In order to do this, your company will need to establish quantitative criteria for the acceptability of the identified risks. Therefore, the current 14971 Standard needs to be modified to clarify that risk acceptability criteria should be based upon clinical data, and evaluation of risks should be conducted at a later point in the risk management process (e.g., – as part of the overall risk-benefit analysis).

Impact of Deviation #2

As your company becomes aware of the second deviation between the 14971 Standard and the Essential Requirements of the device directives, your risk management team will need to change the risk management process to clarify when risk acceptability should be evaluated, and the risk management policy should specify how acceptability should be determined.

The risk management process at your company will need to specify that the implementation of risk controls is required for all risks—regardless of acceptability. You should also consider eliminating the evaluation of risk before the implementation of risk controls. Instead, your company should base the acceptability of risk solely upon the clinical risk-benefit analysis and should involve the manufacturer’s medical officer in making this determination.

Finally, your risk management process should specify the need for PMCF studies in order to verify that actual clinical data supports the conclusion that the risk-benefit ratio is acceptable over the lifetime of the device.

If you are interested in ISO 14971 training, we are conducting a risk management training webinar on October 19, 2018.

Risk Acceptability – Deviation #2 in EN ISO 14971 Read More »

Aug 23 2013

QMS Implementation Tasks

3 Comments / ISO Certification / By Robert Packard / implementing 12 important tasks, ISO 13485

Learn 12 QMS implementation tasks you need to include in your quality plan for successfully implementing ISO 13485.

QMS Implementation Tasks

For your ISO 13485 implementation project, use a planning tool that you are comfortable with (e.g., – a spreadsheet or project planning software). Your plan should include the following:

Identification of each task
Target dates for completion of each task
Primary person responsible for each task
Major milestones throughout the project

Regular progress reports to top management and implementation meetings with all process owners are recommended to track your progress to plan. Weekly meetings are also recommended so that no tasks can fall too far behind schedule. Be sure to invite top management to weekly meetings, and communicate the progress toward completion of each task to everyone within your company. The list below identifies 12 of the most important tasks that should be included in your plan.

12 QMS Implementation Tasks to Consider for Implementing ISO 13485

1. Select a certification body and schedule your certification audits (i.e., – Stage 1 and Stage 2). If you want to place devices on the market in the EU, Japan, or Canada, make sure your certification body meets the specific regulatory requirements for that market.
2. Establish a Quality Manual and at least 28 required procedures. If you have purchased a copy of the excellent AAMI Guidance Document, this lists the required procedures for you. There are a few extra procedures or work instructions needed to meet regulatory requirements (e.g., – training, mandatory problem reporting, and post-market surveillance).
3. Document training on the procedures comprising the quality system. A signed form indicating that employees “read and understand” the procedures is not enough. Training records should include evidence of the effectiveness of training, and you should be able to demonstrate the competency of the people performing those procedures.
4. You must complete at least one full quality system internal audit. The timing of your internal audit should be late enough in the quality plan that that most elements of your quality system have been implemented. However, you want to allow enough time to initiate CAPAs in response to internal audit findings before your Stage 1 audit. If your internal auditor(s) have been heavily involved in the implementation of the quality system, you may need to hire an external consultant to perform your first internal audit.
5. You need to complete at least one management review, which can be done just before the Stage 1 audit. My preference, if there is time, is to have at least two management reviews. The first review might occur three months before the Stage 1 audit, just before you plan to perform an internal audit of the management processes. There may be limited data to review at that time, but this first review provides an opportunity to train top management on their roles and responsibilities during a management review.

The second management review must cover all the requirements identified in ISO 13485, Clause 5.6. The second management review is also your last chance to identify any gaps in your quality system, and initiate a CAPA or action items before your certification auditor arrives.

6. Compliance with regulatory requirements must be a commitment stated in your company’s Quality Policy. Specific regulatory requirements should be traceable to a specific procedure(s).

If you are seeking ISO 13485 Certification as part of the Canadian Medical Device Conformity Assessment System (CMDCAS) or the CE Marking process, then these regulatory requirements will be specifically included in your certification audit.

7. Systematically incorporate customer and regulatory requirements into the quality management system. For contract manufacturers, this is especially important, and the Supplier Quality Agreements your company executes are the best source of these customer requirements. If your company is a legal manufacturer (the company named on the product label), this task is probably addressed sufficiently in tasks #1 and 6.
8. You need to implement a supplier quality management process. If you already have a strong supplier quality program, then this may be a small task involving a few changes to your procedure. If you don’t have much of a supplier program yet, then this may involve identifying your suppliers, ranking them all according to type and risk, qualifying or disqualifying them, and executing supplier quality agreements.

Note: If you need training on Supplier Quality Management, you might consider participating in Medical Device Academy’s webinars.

9. If product design is within the scope of your QMS, which is typical of legal manufacturers, but not for contract manufacturers, then you must establish a design control procedure(s). Product development projects often operate in a timeframe that is longer than your implementation project, and you may need ISO 13485 certification as part of the regulatory approval process.

Therefore, the minimum expectation is to initiate at least one development project before the certification audits. For records of implementation, you should have a design project plan, an initial risk management plan, reviewed and approved design inputs for your first product, and conduct at least one design review.

10. Document what your Certification Body expects (e.g., – notifying them of significant changes). These expectations are likely to be stated in your contract with the Certification Body.
11. Appoint the management representative and a deputy. Ideally, this is formally documented with a letter of appointment signed by the CEO and the management representative. This letter should be maintained in the management representative’s personnel file, along with a copy of the job description explaining the job responsibilities of the management representative. This may also be achieved by identifying the management representative and a deputy in your company’s organizational chart.
12. After the certification audit, your last task should be to “Create Quality Plan #2”—another PDCA loop through the system. The reason for a new quality plan is to implement improvements based on what you learned while you were building the quality system for the initial certification audit.

If your company wants to achieve ISO 13485 certification, you may be interested in YouTube video on this topic.

QMS Implementation Tasks Read More »

Aug 22 2013

Implementing ISO 13485: Planning the Project

1 Comment / ISO Certification / By Robert Packard / ISO 13485

In this article, you will learn five reasons why implementing ISO 13485 takes longer than you expect and tips to help avoid pitfalls

Implementing ISO 13485

Your company wants to achieve ISO 13485 certification. How are you going to get there? In a recent blog, I reviewed setting objectives for implementing an ISO 13485 certification project. Once you’re clear on those, then you’re ready to create your first quality plan. The basic elements of any strategy will be:

Task breakdown (which I will cover in a separate blog)
Timeline
Resources (skills and hours available)

Timeframes and Trade-offs of ISO 13485 Certification Planning

The endpoint of planning for the certification project is the certification audit. The earlier you choose your registrar or Notified Body and book the audit, the more choice you will have regarding the date. This should be one of the earliest tasks in the task breakdown. To be able to do that, you need a timeframe as to when you will be ready for the certification audit. How long it takes to implement ISO 13485 and be ready for a certification audit depends upon your starting point and your available resources. If you have no QMS in place, it will take you longer than if you already have a strong, documented QMS that complies with 21 CFR Part 820.

It May Take More Work

If you already have ISO 9001 certification, though you already have a structure in place, the upgrade to ISO 13485 is likely to take more work than you expect because:

There are fewer procedures required by ISO 9001
Most of your existing procedures will require revision
Your employees will need training on the new procedures
You will need time to generate records using new procedures
You will need to complete a full quality system audit of the new procedures

Many companies also underestimate the required resources for ISO 13485 certification. If you have a knowledgeable consultant, and people available to write procedures, then ISO 13485 implementation will progress faster than an organization that has little expertise and little time available, so plan accordingly. Ideally, you will determine the length of time each task will take and decide on an endpoint for the project based on that information and available resources. This approach works well if you already have a well-documented, regulated QMS.

6 Months-Reasonable Timeframe?

Six months is my rule of thumb for the time needed to implement a quality system compliant with ISO 13485. If the implementation schedule is longer, organizational enthusiasm may wane. If the timeframe is shorter than six months, it’s difficult to complete all the required tasks. No matter how carefully you plan, you still need to write procedures, train personnel, and implement procedures, so there is adequate time to generate records. Six months is aggressive for most companies, but the objective of achieving certification in six months is reasonable.

You may find it interesting that in Rob Packard’s white paper on ISO 13485 implementation. He also recommends that you allocate six months of one Full-Time Equivalent (FTE). This is a reasonable starting point, but you may want to adjust your resource allocation up or down depending on the level of experience within the implementation team. Experience has taught me that smaller organizations are more successful at building an effective quality system when effectiveness is achieved in reiterative steps (i.e., – revision 1, revision 2, etc.). This is also the basis of the Deming/Shewhart Plan-Do-Check-Act (PDCA) cycle. This is also what I meant in a recent blog, where I suggested that you should “throw perfectionism out the window.”

Your understanding of how the quality system links together will grow as you implement each process in your implementation plan. As knowledge grows, you may reconsider some of your procedures. Instead of delaying the certification process (i.e., – revision 1), you may want to implement improvements as a second revision to procedures after the Stage 2 certification audit (i.e., – revision 2). During your Stage 1 and Stage 2 certification audits, your understanding of how the standard is interpreted and audited will build. After you achieve the initial ISO 13485 certification, you will have a much greater understanding of how all the elements of the quality system need to work together. You will also understand what parts of your quality system are easy for an outsider to audit.

After the ISO 13485 Certification Audit

During the initial planning stage, you should also imagine your future state after the certification audit. Your boss may assume that once the audit has been and gone, then everything will settle back to “normal” again. The reality is that after you deal with any nonconformities, and you take off a few days like you promised your family, you will have a long list of improvement ideas waiting for you. You will also need to prepare for next year’s surveillance audit. Therefore, I recommend that you manage expectations by adding “Create Quality Plan #2” as the last step of your ISO 13485 certification plan.

Implementing ISO 13485: Planning the Project Read More »

Aug 19 2013

Implementing ISO 13485: Dealing with Delays

1 Comment / ISO Certification / By Robert Packard / ISO, ISO 13485

By Guest Blogger, Brigid Glass

The author provides tips, practical examples, and six steps to follow if your ISO 13485 implementation project falls behind schedule.

In the best-planned project, with plentiful, skilled resources and diligent monitoring, things can still go awry. We need to be watchful for signs of our plans falling behind schedule, and develop contingency plans to prevent delays.

Walk Around the Mountains

Identify major obstacles early and develop a plan to deal with them. The major obstacles are usually the tasks that take the longest—such as process validation. Specifically, name these tasks in your pitch to management for resources before you start. This approach will ensure that everyone is focused on the biggest challenges.

If your plan to climb over those mountains is failing, work out a route around them. Maybe your R&D Manager can’t yet accept that there will now be design controls. In this case, an alternate path might be to leave design controls for last purposely. If you write a concise procedure and release it as your last procedure, then you have a built-in excuse for why you have very few records to demonstrate an implementation of design controls. You will still need at least one design project plan and training records to demonstrate that the process is implemented.

If this plan is successful, your auditor will write in the report that “design controls are implemented, but there are limited records to demonstrate implementation at this time.” If this plan is unsuccessful, you will need to provide additional design control records before you can be recommended for ISO certification—typically within 90 days.

Another approach is to initiate a CAPA and implement some of the tasks after the audit. For example, you have more suppliers than you can audit before certification. In this case, qualify all your suppliers, and use a risk-based approach to help you prioritize which suppliers need to be audited first. In your plan, identify that you will start by auditing the three highest-risk suppliers. Lower risk suppliers can be scheduled for audits after certification.

Be Watchful

Keep a close eye on your project plan. One of the most critical factors for success is keeping the plan and progress against the plan in front of the key players and senior management. Do this in such a way that progress, or the lack of it, is very clearly visible. It’s a basic maxim of Quality that we act on what we measure.

ISO 13485 Implementation: If Your Project Falls Behind Schedule

If you find yourself lagging seriously behind in your project, the following steps will assist you in recovering sufficiently to still be able to attain certification.

Enlist management support when you need it, especially if you need them to free up resources.
Prioritize. Before the Stage 1 audit, ensure that those procedures which are required by ISO 13485 are released (there are 19). There’s always room for improvement, but leave some of it for the second revision, instead of delaying certification.
Ensure that you have at least a few examples of all the required records. Your auditor will be unable to tick off his checklist if a record is absent. Make it easy for the auditor.
If there is a sizeable gap that you won’t be able to close before certification (i.e., – you have a validation procedure, but validations have not been completed), write a CAPA outlining your action plan to address the gap. During the audit, act confidently when you are questioned about the gap. Many auditors will give you credit for identifying the problem yourself.
Don’t panic. The worst the auditor can do is to identify a nonconformity you will have to address with a CAPA plan before you can be recommended for certification. At most, this will result in a delay of a few weeks.
Throughout your certification preparations and during the certification audits, you will identify issues you may not have time to resolve before the certification process is complete. If you are planning to revise procedures and make other corrections, make sure you track these issues as CAPAs or with some other tool (e.g., – an action item list). You want to address each issue prior to the first surveillance audit (no more than 12 months from the date of the Stage 2 audit).

Best wishes for your project. Success is the result of good planning, good communication, and good monitoring.

This blog is part of a series of blogs that leads up to our Roadmap to Iso 13485 Certification Courses

Implementing ISO 13485: Dealing with Delays Read More »

Aug 17 2013

Quality objectives for achieving your goals

2 Comments / ISO Certification / By Robert Packard / Quality, Quality Objectives

This article, updated in 2020, describes two different approaches to establishing quality objectives to achieve your business goals.
Goal setting and communicating a vision of the future is not just the responsibility of the company President. Every manager should be setting goals for the teams they manage, and you can set yourself apart from your peers by building a vision with clear benefits to employees, customers, and the bottom line. Establishing quality objectives, and monitoring the progress toward those objectives is one of the greatest tools you can use to achieve your business goals. There are two different approaches to setting quality objectives, and you should use both.

Two Types of Quality Objectives

The most popular type of quality objective is a visionary goal. The phrase that I think captures this idea is the “Big Hairy Audacious Goal” (BHAG). Jim Collins and Jerry Porras coined this phrase in Built to Last. Visionary goals are long-term quality objectives that will require many smaller, coordinated changes intended to “level up” your business.

The second type of quality objective is a short-term goal. Short-term goals are not nearly as “sexy,” but achieving short-term goals builds momentum and creates long-term habits that are crucial to success. The two books that capture this concept best are The Compound Effect by Darren Hardy and The Slight Edge by Jeff Olsen. Both books emphasize the importance of consistency and small improvements to achieve success. The secret to establishing short-term goals is to make sure that your short-term goals are aligned toward helping you achieve long-term goals.

In our quality system procedures, we include a section for monitoring, measurement, and data analysis. For every process in your quality system, you should have at least one defined quality metric that you consistently measure. Everyone involved in that process should be aware of the metric, and data analysis should be shared with everyone in the company. Some of those quality metrics will be more important than others, but everyone must expect to achieve the goals that are set. You can pick anything you want to measure for a process, but for the metric to be used as a quality objective, it must be measurable and consistent with your quality policy. I like to define measurable by saying, “You must be able to graph it.”

6 Steps to Achieving Big Hairy Audacious Goals (BHAG)

Not all quality objectives have to be small, dull, or easy. You are required to establish quality objectives. Both the QSR (21 CFR 820.20, management responsibility) and the ISO Standard (ISO 13485:2016, Clause 5.4.1, require that top management establish quality objectives. These objectives must also be reviewed during management reviews, and they should be established at all levels throughout your company. Some of these objectives will be small, but you should make at least one of your quality objectives big, exciting, and hard to achieve. If you want to set your first BHAG for your team, try following these six steps.

STEP 1: Involve your team in setting quality objectives

Weak managers dictate goals, but leaders get teams involved in the goal-setting process. Getting your team involved gives them ownership of the goal. If you’re unsure of how to get your team involved, you might try a brainstorming session. A good brainstorming session is relatively short (i.e., – < 1 hour). Everyone needs to understand the goal of the brainstorming session: to generate many ideas for a possible BHAG. Everyone needs to understand what a BHAG is. These examples might help:

Reduce average monthly scrap by 80% with a Pareto Chart
Reduce the average number of nonconforming material reports by 50%
Increase the ratio of preventive actions to corrective actions to > 1.00

Finally, negative comments should not be tolerated. Bad, good, and silly ideas should all be encouraged because the purpose of brainstorming is to generate many ideas. After you have 100+ ideas, you and your team can schedule another meeting to select the best goal(s).

STEP 2: Predict the bottom-line impact of quality objectives

Top management’s perception of a BHAG will be directly proportional to the impact on the bottom line. If the impact is small, the “B” in BHAG is a “b.” You and your team should use the potential impact on the bottom line as the first selection criteria for picking the best BHAG from the brainstorming list. The accuracy of these estimates doesn’t matter initially. Still, once you choose the goal, you will need to verify the accuracy of the financial impact and define how that impact will be measured.

STEP 3: Look to the future, but focus on the next milestone

Picking a five and ten-year goals is appropriate for discussions with Human Resources about your career, but companies are measured on quarterly financials. Therefore, you will need to focus on the goals you can achieve in three to six quarters. The number of milestones you set should also be few, and you should focus on one at a time. If the goal is only three quarters away, you might have monthly targets, while longer projects need interim milestones.

STEP 4: Milestone momentum

Longer projects often become delayed because people will procrastinate, and teams will lose momentum. When you break your long-term goals into smaller chunks, everyone can focus on the next milestone and see the progress. Each piece should be a sound stage of the project, and completion of the stage must be clearly defined. To create momentum, you must achieve each milestone–always. The pattern of consistent milestone achievement builds confidence, and your team will gradually develop the habits needed to sustain your progress.

STEP 5: Assign the Skeptic to Report on Quality Objectives

A good statistician can make the numbers look any way you want, but skeptics in other departments (and within your team) will criticize your claims of success. One way to silence the skeptics on your team is to make them responsible for measuring and reporting the team’s progress. This approach ensures that progress reports are conservative and accurate, rather than inflated or unbelievable. Progress should also be reported publicly because public victories are something your team can be proud of.

STEP 6: Promise a Reward for Achieving Quality Objectives

Some managers believe that the reward for hard work should be a paycheck. That’s sort of like telling your children that they get to eat for doing something you’re proud of. Employees are not children, but you are responsible for developing them into more valuable employees so that they can be promoted. If there is no incentive, your team will not be engaged. Therefore, pick a reward that is proportional to the bottom-line impact. Five percent of the bottom-line impact is what I like to target, but you would be amazed at how effective a few small rewards at each milestone can be. If you have trouble getting management approval for rewards, remind your boss of the bottom-line impact and link the rewards closely to the impact.

Quality objectives for achieving your goals Read More »

Aug 15 2013

How to Utilize CAPA Training To Avoid FDA 483 Citations

1 Comment / CAPA, FDA / By Robert Packard / CAPA, CAPA training, FDA 483

The author discusses how formal CAPA training can help solve the four most common CAPA deficiencies and help avoid FDA 483 citations.

Corrective And Preventive Action (CAPA) is considered to be one of the most critical processes in a Quality Management System (QMS). CAPAs prevent nonconformities from recurring, as well as identify potential problems that may occur within the QMS.

Both the Code of Federal Regulations (21 CFR 820.100) and the ISO 13485 Standard (8.5.2 and 8.5.3, respectively) include similar requirements for establishing and maintaining a compliant CAPA process. The concept seems pretty straightforward, right?

Then why do so many companies struggle with this process and go into panic mode during FDA inspections and Notified Body audits?

CAPA process deficiencies have long been the number one Good Manufacturing Practice (GMP) violation cited in FDA Warning Letters. Therefore, providing trained experts to teach the CAPA process is well worth the investment to provide your employees with the expertise needed to implement a sustainable, effective, and compliant process. Support from top management is a must for success.

7 Reasons Why There is LIttle Support for the CAPA Process

Managers view CAPA as a necessary evil and apply minimum effort and resources to complete the required paperwork.
All complaints, audit findings, shop floor nonconformities, etc., go straight into the CAPA system, resulting in what is known as “Death by CAPA.” There are hundreds of CAPAs to be dealt with, but the CAPAs languish and quickly become a mountain of overdue records.
The lack of ability to conduct effective root cause analysis results in, at best, a band-aid solution, and recurrence of the same issues time and again.
There is no risk-based or prioritization process that provides a triage for determining when a CAPA is appropriate, and how to classify its criticality.
CAPA forms are either too restrictive, such as using “yes/no” questions, thereby stemming the creative flow of process thinking or, too open-ended, leaving the CAPA owner with little guidance for getting to the exact root cause.
Trending and metrics that would highlight quality issues before they become complaints are lacking, so most CAPAs are last-minute reactions to a crisis, instead of proactive improvement projects.
Senior management has not allocated sufficient time and resources to CAPA owners to develop expertise, and clearly do not understand the nuances of FDA compliance, the ISO Standard, and the responsibilities of CAPA ownership.

Consequences of an Ineffective CAPA System: FDA 483 Citations Are Possible

FDA 483 observations, Warning Letters, and loss of your ISO 13485 certification are possible consequences of failing to manage your CAPA process. Imagine explaining to your customers why you lost your certification, and why they should keep you as a trusted supplier. That is not a conversation you want to have.

A weak CAPA process allows nonconformities to recur, results in manufacturing downtime, requires to rework, and ends with the scrapping of product or lost customers. The consequences of a weak CAPA process negatively impact your company’s financial strategy and goals.

To prevent an increase in the cost of poor quality, your business cannot remain static. You need to improve and adopt best practices. Your CAPA process is a systematic way to make those improvements happen.

Characteristics of an Effective CAPA system?

Easy to follow the procedure
Defined CAPA inputs
Risk assessment and prioritization
Root-cause investigation tools
A well-defined action plan
Metrics to track progress
Communication of information and status
Effectiveness checks
Management support and escalation

What to Expect from Formal CAPA Training

Death by Powerpoint is not training. Effective CAPA training requires hands-on participation in working through root-cause analysis with an expert. One of the best training tools is case studies based upon recent 483 observations. A CAPA training course should teach you how to:

Accurately identify the cause of problems
Prioritize your corrective and preventive actions using a risk-based approach
Implement an appropriate corrective and/or preventive action, and
Verify the effectiveness of your actions

CAPA training should teach you how to reduce the length and number of investigations. Training will also help you master current problem-solving methodologies to identify true root causes, utilizing facts, instead of guesswork or opinion. The proper identification of the exact root cause of a problem is critical because otherwise, your CAPA plan will fail to fix real problems.

Not all formal training needs to be in-person. Face-to-face training can be supplemented with more cost-effective training of concepts using webinars and recorded presentations. Interactive training is needed to supplement this training so that students can practice what they learn.

How Training Solves Common CAPA Deficiencies

The four most common CAPA deficiencies are:

Inadequate procedures
Incomplete investigations
Overdue actions, and
Failure to perform an effectiveness check

Each of these deficiencies is addressed directly by CAPA training. Formal CAPA training reviews each of the requirements for your CAPA process, and trainers will often share samples of CAPA procedures, and CAPA forms that they wrote and found to be effective. Learning multiple root cause investigation techniques, and practicing them using the case study technique, ensure that CAPAs are thoroughly investigated, rather than identifying superficial symptoms.

CAPA metrics are introduced during training to ensure that the CAPA process owner knows best practices for monitoring and analyzing the process. Finally, CAPA training includes specific examples of what is and what is not, a proper technique for performing an effectiveness check.

Results After Formal CAPA Training

The best reason for making formal CAPA training available to the people responsible for CAPAs are the results you will experience after the training. For example:

Elimination of hundreds of overdue CAPAs
Reduction in nonconformities, scrap, rework and customer complaints
Lower overall costs associated with quality problems
Better FDA inspection and Notified Body outcomes, and
Safer products for your customer

If you are interested in learning more about CAPA, click here to register for Medical Device Academy’s Risk-Based CAPA webinar.

How to Utilize CAPA Training To Avoid FDA 483 Citations Read More »

Aug 12 2013

Implementing the ISO 13485 Standard: Objectives

1 Comment / ISO Certification / By Robert Packard / ISO 13485

By Guest Blogger, Brigid Glass

The author discusses implementing the ISO 13485 standard, including seven questions to clarifying your objectives and six considerations in shaping your objectives.

Implementing ISO 13485 is such an enormous undertaking for an organization that it pays to approach the planning strategically to ensure that all objectives are met. Often, some objectives are made explicit, and others are unspoken. It is worth taking the time to ensure that all objectives are clearly stated to achieve the outcomes you want. Begin with the end in mind. Then, ensure that you are taking the organization with you, and you are all headed to the same destination.

7 Questions to Clarify Your Objectives

What are your regulatory drivers for ISO 13485 implementation? Are there dates associated with marketing plans that you need to take into account? Are there other regulatory requirements that need to be built into the QMS and the implementation plan, (e.g., incident reporting for Canada or a Technical File for CE marking?)
What other regulatory requirements must you meet to get into international markets? ISO 13485 requires that you meet applicable regulations for each market, such as a training procedure to address 21 CFR 820.25, a post-market surveillance plan to address CE Marking requirements, and a Mandatory Problem Reporting Procedure for Canada.
If you are a supplier to medical device manufacturers, what do your customers expect of your QMS? If they haven’t made this explicit already, ask them. Meeting their needs and their audits of your system may be as important to you as the certification audit.
Do you want to achieve business improvements by implementing a QMS? If you include this in your stated objectives, and everyone “buys into” the program, then you will build procedures that deliver business improvements, rather than just being regulatory overhead.
Do you have real buy-in from your CEO? You may have buy-in for certification, but if you don’t already have a regulated QMS, does she or he fully understand the cultural change that he or she must lead? If not, make this one of your unwritten objectives and keep it front of mind.
Do you have organizational buy-in? Ensure that it is clear who owns each process, and that those process owners have the ultimate responsibility for the compliance of their process and ownership of documentation that is created for those processes. Keep the project progress visible. Develop a communication plan with its objectives and targets, even if your organization is small.
Do you want to align with other systems? If you already have a QMS, you will want to integrate ISO 13485 compliance with that. Do you also need to implement ISO 14971, the risk management standard? Since you are going to be doing this much work on your QMS, maybe you could take the opportunity to align it with your health and safety or environmental management systems.

Timeframes and Trade-offs

How long it takes to implement ISO 13485 will be covered in another blog soon. Six months is a workable rule of thumb.

So what do you do if you don’t have that long, and have to meet a pressing deadline? Or you don’t have the resources available to implement, as well as you want in the time available? Compromises have to be made, and now it’s necessary to set short-term and long-term objectives.

6 Considerations in Shaping Your ISO 13485 Standard Implementation Objectives

If you are constrained from structuring the implementation project ideally, the following considerations below will assist you in shaping your objectives:

Get a qualified consultant who understands your business. If you have a large company, find someone who spends more of their time working with corporates, and vice versa for a small company.
Throw perfectionism out the window. The goal is not perfect procedures. The essence of a Quality System is documentation to explain the intent, records to capture reality, internal auditing, and monitoring to identify the gaps and CAPA to improve and maintain effectiveness. The Deming Plan-Do-Check-Act cycle assumes that you are never perfect.)
Accept that you then have another round of work to do to improve procedures.
Organizational buy-in is even more critical. Be very careful about setting expectations. Adjusting to the extra requirements of a regulated QMS is already tricky. In these circumstances, you may be asking people to live with procedures that are not as usable as they would like.
Be especially careful to ensure that the auditor can tick off all the essential points, and find how you have fulfilled the requirements without hunting too hard. All the required procedures and records must be in place. It’s more important to address 100% of the requirements than to perfect 80% and skip the last 20%.
Accept that there may be nonconformities that have to be dealt with after the certification audit. Set the organizational expectation around this and build time for it into your schedule. Ask your certification body early to tell you the timeframe for dealing with nonconformities.

Setting Expectations

Objectives need to be communicated clearly to everyone in the organization. For a project (and many other things in life),

Satisfaction (or Disappointment) = Actual Result – Expectation

The certification audit is not the end. You will still need people to align their effort into making the implementation succeed after the pressure and obvious deadline of the certification audit has passed. Setting their expectations appropriately early in the project is essential to keeping their (and your) motivation going. This is especially important if you are building your QMS, short on time or resource, and therefore know that you need to do a lot of work in the year following certification to develop improved workable procedures and generate a recorded history of compliance.

This blog is part of a series of blogs that leads up to our Roadmap to Iso 13485 Certification Courses

Implementing the ISO 13485 Standard: Objectives Read More »

Aug 5 2013

Keeping Design Projects on Schedule: Using the CAPA Process

4 Comments / CAPA / By Robert Packard / CAPA, design projects

The author provides two steps to consider taking now and steps to take in the future that will help keep design projects on schedule using the CAPA process.

The ability to get new, high-quality products to market quickly is the most important core competency for a company to develop. What is your company doing to improve the performance of your design teams? If you have trouble answering the above question, you should consider performing a detailed internal audit of your design control process: http://bit.ly/AuditDesign.

The only significant change I would make to my recommendations from 2012 is to follow the GHTF guidance document for creating technical files using the STED format, instead of using NB-MED 2.5.1/Rec 5: http://bit.ly/GHTFSTEDGuidance. This approach to creating a technical file lends itself to meeting the Canadian Requirements for Medical Device Licensing, and this is the preferred format of Technical Files in Annex II of the proposed EU regulations.

At the end of the blog on how to audit design controls, Step 7 states that you should “Ask the process owner to identify some metrics or quality objectives they are using to monitor and improve the design and development process…If the process owner is tracking no metrics, you might review schedule compliance.” The two most common reasons why design projects are not able to keep pace with the design plan schedule are: 1) there are insufficient resources allocated for the project, and 2) the estimates of the duration for tasks in the schedule are too aggressive.

Step 1: Estimating the Duration of Tasks

Task duration is the easiest quality objective to track performance against. Whether you track design projects with an Excel spreadsheet or Microsoft Project, you can easily compare the actual duration of any project task with the estimated duration that was planned at the beginning of the project. It is important to measure the length of labor hours, rather than using the number of people because most design team members are multi-tasking. You can and should mine the data from previous design projects because this information is available now. As you go through historical data, you will also realize where there are weaknesses in how you capture data regarding labor hours.

Once you have the raw data, I recommend analyzing the data using % deviation and total hours. The % deviation will tell you which estimates were the least accurate, and the total hours will tell you which estimates have the most significant impact on the total project. Ideally, you will collect data from multiple projects, so that you can determine if the deviations are consistent from project-to-project.

This data analysis is important because the data analysis will help identify the root cause for inaccurate task duration estimates. You may also want to perform a Pareto Analysis of the data to prioritize which project tasks would benefit most from more accurate estimates. Once you have identified the root cause for inaccurate estimates, you can initiate Corrective And Preventive Actions (CAPA), where appropriate.

Step 2: Allocation of Resources

You may hear the phrase “Do more with less,” but I like to joke that design teams are expected to “Do everything with nothing.” If your design team is monitoring the accuracy of taking duration estimates for design projects, the accuracy of your project plans should improve. Your management team should also develop greater confidence in your teams’ ability to forecast product launch dates, thereby the estimates for resource needs. Managers frequently challenge you to achieve the impossible.

The most famous example of this is when Steve Jobs challenged Steve Wozniak to design the video game Breakout in just a few days. If you are the next Steve Jobs, and you have Woz on your team, keep aiming for the moon. If your team consists of mere mortals, you might need more resources. Your senior management may not have additional resources to provide, but it is critical to accurately estimate the resources needed for projects. If you can estimate accurately, you will have the following impact on your company:

You will be able to estimate the amount of time to market that can be reduced by adding resources.
You will be able to estimate the cost impact of unrealistic management timelines—instead of saying, “I can’t push it any faster, Captain.” (my favorite Star Trek quote).

Future Steps: Preventive Actions

In one of my previous postings (http://bit.ly/PASources), I stated, “The most fruitful source of preventive actions, however, is data analysis of process control monitoring.” If you are monitoring and measuring your design control process, you can use this approach to:

Identify preventive actions for your design process
Establish specifications for critical path tasks in each project
Calculate your design process capability for successful completion based upon historical data

The answer to the following question may help you identify your next design process improvement. How close are your estimates to achieving a C_pk > 1.33 for completing design verification protocols on-time? If you are interested in learning more about CAPA, please register for the Medical Device Academy’s CAPA Workshop on September 9 in Orlando, or on October 3 in San Diego. Click here to register for the event: http://bit.ly/MDAWorkshops.

Keeping Design Projects on Schedule: Using the CAPA Process Read More »