Filter posts by category

CAPA

Corrective Action and Preventive Action

Packaging Complaint Investigation – Case Study

3 Comments / CAPA / By

This is part one of a case study on how to perform a packaging complaint investigation when packaging is found open by a customer.

Screenshot 2015 11 08 at 11.58.18 AM Packaging Complaint Investigation Case Study

Overview of Packaging Complaint Investigation

This case study example involves a flexible, peelable pouch made of Tyvek and a clear plastic film. This is one of the most common types of packaging used for sterile medical devices. In parallel with the complaint investigation, containment measures and corrections are implemented immediately to prevent the complaint from becoming a more widespread problem. The investigation process utilizes a “Fishbone Diagram” to identify the root cause of the packaging malfunction. This is just one of several root cause analysis tools that you can use for complaint investigations, but it works particularly well for examples where something has gone wrong in production process controls, but we are not sure which process control has failed.

Description of the packaging malfunction

The first step of the complaint handling process (see SYS-018, Customer Feedback and Complaint Handling) is to record a description of the alleged quality issue. A distributor reported the incident that was reported. The distributor told customer service that two pouches in a box containing 24 sterile devices were found to have a seal that appeared to be delaminating. Unfortunately, the distributor was unable to provide a sample of the delaminated pouches or the lot number of the units. Packaging issues and labeling issues are typically two of the most common complaint categories for medical devices. Often the labeling issues are operator errors or a result of labeling mixups, while the packaging errors may be due to customers who accidentally ordered or opened the wrong size of the product. Therefore they may complain about packaging when there is nothing wrong. It is essential to be diligent in the investigation of each packaging complaint because if there is a legitimate packaging quality issue, then there may be a need for a product recall as part of your corrective action plan.

Initiation of the packaging complaint investigation

In your complaint record, you need to assign a person to investigate the complaint. The only acceptable reason for not initiating an investigation is when a similar incident was already investigated for another device in the same lot or a related lot (i.e., packaging raw material lot is the same and the problem is related to the material). If the complaint was already investigated, then the complaint record should cross-reference the previous complaint record.

The person assigned to investigate the complaint must be trained in complaint investigations and should be technically qualified to investigate the processes related to the complaint (e.g., packaging process validation). The investigator must record which records were reviewed as part of the investigation, and the investigation should be completed promptly in case regulatory reporting is required or remedial actions are needed. It is also necessary to demonstrate that complaints are processed in a consistent and timely manner (e.g., average days to complaint closure may be a quality objective). 

Regulatory reporting of packaging failures

We know everyone wants to avoid regulatory reporting because we are afraid that other customers will lose confidence in our product and bad publicity may impact sales. However, the consequences of failing to file medical device reports with the FDA are much worse. Even if an injury or death did not occur with a sterile medical device, the quality issue should still be reported as an MDR under 21 CFR 803 (see SYS-029, Medical Device Reporting) because a repeat incident could cause an infection that could result in sepsis and death. If you think that this is an extremely conservative approach, you might be surprised to learn that 251 MDRs were reported to the FDA in Q4 of 2023 for packaging issues. Of these reports, only one involved an actual injury, and the other 250 involved a device malfunction but no death or injury. The following event description and manufacturer’s narrative is an example:

Event Description

“It was reported by the sales rep in japan that during an unspecified surgical procedure on (b)(6) 2023 the rgdloop adjustable stnd device sterile package was not sealed and was unclean.Another like device was used to complete the procedure.There was an unknown delay in the procedure reported.There were no adverse patient consequences reported.No additional information was provided.”

Manufacturers Narrative

“This report is being submitted in pursuant to the provisions of 21 cfr, part 803.This report may be based on information which has not been able to investigate or verify prior to the required reporting date.This report does not reflect a conclusion by mitek or its employees that the report constitutes an admission that the device, mitek, or its employees caused or contributed to the potential event described in this report.If information is obtained that was not available for the initial medwatch, a follow-up medwatch will be filed as appropriate.Device was used for treatment, not diagnosis.If information is obtained that was not available for the initial medwatch, a follow-up medwatch will be filed as appropriate.H10 additional narrative: e3: reporter is a j&j sales representative.H4: the device manufacture date is unknown.Udi: (b)(4).”

Packaging complaint investigation when product IS NOT returned

What the narrative above does not elaborate on is what was the specific investigation details for “lot history reviewed.” One of the most useful tools for performing a packaging complaint investigation is the “Fishbone Diagram.” Other names include, “Ishikawa Diagram” and “Cause and Effect Diagram.” There are six parts (i.e., “6Ms”) to the diagram:

  1. materials,
  2. method,
  3. machine,
  4. “mother nature” or environment,
  5. “manpower” or people, and
  6. measurement.

What records can be investigated without the return of the product?

The following records could be reviewed and evaluated for potential root causes even if the customer does not return the packaging with the alleged malfunction:

  1. review the complaint log for other complaints with the same lot number and/or from a similar period, lot of raw materials, or packaging machine
  2. review the device history record for the lot to make sure that the number of units rejected as part of normal in-process and final inspection did not exceed pre-established thresholds for monitoring the sealing process
  3. if retains of the lot are available, these might be retested to verify that the testing results after real-time aging remain acceptable
  4. the maintenance and calibration records of the equipment for manufacture and testing may be reviewed to verify that no repairs were required and no equipment was identified as out-of-calibration

If all of the above fail to identify a potential cause for a packaging failure, then you might have a problem related to people or the environment. People include the people sealing the product package and the users. The environment consists of the temperature and humidity for storage of packaging raw materials, packaged products, sterilization conditions, storage conditions after sterilization, and shipping conditions–including any temporary extremes that might occur during transit.

In our case study, the product was not returned, and we did not have the lot numbers. Therefore, we may need to review distribution records to that distributor and/or the customer to narrow down the possible lots to one or more lots. Then we would need to perform the same type of review of lot history records for each potential lot. The best approach is to request a photo of the package labeling, including the UDI bar code, because that information will facilitate lot identification. Even if the product was discarded, often the UDI will be scanned into the patient’s electronic medical record (EMR) during surgery.

Conducting investigations when product IS returned

Sometimes you are fortunate enough to receive returned products. The product should be immediately segregated from your other products to prevent mixups and/or contamination. Normally the returned products are identified as non-conforming products and quarantined. After the quarantined product is evaluated for safety, the assigned investigator may inspect the packaging in a segregated area. Packaging investigations begin with visual inspection following ASTM F1886. If multiple packaging samples are available, or the packaging is large enough, the investigator may destructively test (i.e., ASTM F88) a 1” strip cut from the packaging seal to verify that the returned packaging meets the original specifications. If you kept retains of packaging with the same lot of flexible packaging, you may visually inspect and destructively test retains as well.

Next steps of the packaging complaint investigation

Once the root cause is identified for a packaging complaint, then you need to implement corrective actions to prevent a recurrence. Also, FDA Clause 21 CFR 820.100 and ISO 13485, Clause 8.5.3, require that you implement preventive actions to detect situations that might result in a potential packaging failure in the future and implement preventive measures so that similar packaging failures are not able to occur. If you are interested in learning more about conducting a root cause analysis, please read our blog on this topic: Effective Root Cause Analysis – Learn 4 Tools.

This article is the first half of the packaging complaint investigation case study. The second half of the two-part case study explains the necessary containment measures, corrections, corrective actions, and preventive actions to address the root cause of the packaging failure.

Additional packaging validation resources

There are many articles on the topic of package testing and package design for sterile medical devices. If you want to learn more, please register for our free webinar on packaging validation by Jan Gates.

Packaging Complaint Investigation – Case Study Read More »

Complaints handling mistakes – Why?

2 Comments / CAPA / By / , , , , , ,

Complaints handling mistakes, medical device reporting, and CAPA are the most common reasons for FDA 483 inspection observations, but why?complaints Complaints handling mistakes Why?

Reasons for FDA 483s related to the CAPA process

You should already be well aware that deficiencies in the CAPA process, complaints handling, and medical device reporting are the three most common reasons why the FDA issues 483 inspection observations and Warning Letters in 2023. The most common reason for an FDA 483 inspection observation is related to the CAPA process (i.e., 336 observations citing 21 CFR 820.100). For the CAPA process, all 336 observations cited problems with inadequate procedures or inadequate records.

Reasons for complaints handling mistakes

The complaints handling process is the second most common reason for FDA 483 inspection observations (i.e., 276 observations citing 21 CFR 820.198). The complaints handling process has nine different reasons for 483 inspection observations (listed from most common to least common):

  1. Procedures for receiving, reviewing, and evaluating complaints by a formally designated unit have not been [adequately] established.  Specifically,*** 
  2. Complaints involving the possible failure of [a device] [labeling] [packaging] to meet any of its specifications were not [reviewed] [evaluated] [investigated] where necessary. Specifically, *** 
  3. Records of complaint investigations do not include required information.  Specifically, *** 
  4. Complaint files are not [adequately] maintained.  Specifically, *** 
  5. Not all complaints have been [adequately] reviewed and evaluated to determine whether an investigation is necessary. Specifically, ***
  6. Records for complaints where no investigation was made do not include required information.  Specifically, *** 
  7. Complaints representing events that are MDR reportable were not [promptly reviewed, evaluated, and investigated by a designated individual] [maintained in a separate portion of the complaint files] [clearly identified]. Specifically, ***
  8. Investigation records of MDR reportable complaints do not include required information.  Specifically, *** 
  9. Records of complaint investigations do not include required information, including any unique device identifier (UDI) or universal product code (UPC).  Specifically, ***

Reasons for FDA 483s related to Medical Device Reporting

There were 106 observations related to medical device reporting (i.e., 21 CFR 803) in 2023 thus far. There are 25 different reasons identified by the FDA for 483 inspection observations related to the Medical Device Reporting regulation. The majority o of the inspection observations were related to an inadequate or missing MDR procedure. However, there were also a number of inspection observations that were related to missing information in the MDR records. Therefore, we updated our Medical Device Reporting Procedure to include all of the required elements of the FDA’s MedWatch Form. We posted a blog about “Where to Focus your Medical Device Complaint Handling Training.” In that blog we answered questions from device manufacturers and consultants regarding the process of complaints handling investigation. The following section is a summary of my responses to those questions.

Complaints handling investigations

What criteria do you think should be used to determine whether a complaint should be investigated or not?

There is only one acceptable rationale for not investigating a complaint. If you don’t investigate complaints when required, then you might receive an FDA Form 483 observation worded like this…

21 CFR 820.198(c) – Complaints involving the possible failure of labeling to meet any of its specifications were not investigated where necessary. Specifically, a missing IFU was reported in customer complaints, but no investigation was conducted. The rationale documented in the complaint record was “the missing IFU presented no patient risk.”

A missing IFU is a “failure of labeling to meet any of its specifications.” Therefore, 21 CFR 820.198(c) requires you to conduct an investigation “unless such investigation has already been performed for a similar complaint, and another investigation is not necessary.” This is the only rationale that is acceptable for skipping your investigation. To ensure that no one forgets to investigate a complaint, make sure you include a space in your complaint handling form that is specifically labeled as “Summary of Complaint Investigation.” This space should also include an option to cross-reference to a previous complaint record where a similar investigation is already documented.

A missing IFU is also considered a misbranded product that requires correction (e.g., sending the customer a replacement IFU) or removal (i.e., recall). The FDA expects a Health and Hazard Evaluation (HHE) form to be included in your recall records, and the HHE should indicate the potential risk of a “delay in treatment.” This is the FDA’s conclusion in their evaluation of risk, and therefore your HHE must identify a delay in treatment as a patient risk too. The FDA also expects a CAPA to be initiated to prevent the recurrence of this type of labeling error. You can make a “risk-based” determination that reporting a specific recall to the FDA is not required as per 21 CFR 806.20. However, you need to maintain records of your determination not to report a recall. If you already received a Warning Letter, you should err on the side of reporting anyway.

Note: References to “recall” in the above paragraph are meant to include field corrections.

Intended Use

If a complaint consists of a medical device being used for something other than its intended use, is an MDR required for this user error?

The answer is yes. If you don’t report adverse events involving “user error,” then you might receive an FDA Form 483 observation worded like this…

21 CFR 803.17(a)(1) – The written MDR procedure does not include an internal system which provides for the timely and effective evaluation of events that may be subject to medical device reporting requirements.  Specifically, several incidents where a death or serious injury occurred were “caused by a user error,” and the procedure did not identify this as an event requiring Medical Device Reporting.

In 21 CFR 803.3, the FDA defines “caused or contributed” to include events occurring as a result of:

  1. Failure
  2. Malfunction
  3. Improper or inadequate design
  4. Manufacture
  5. Labeling, or
  6. User error

It is important to understand that the definition of complaints and the requirement to report adverse events should not be “risk-based.” The need for remediation and the need to report corrections and removals can be “risk-based,” but whether something is a complaint, and whether it is reportable should be “black-and-white.” For example, “Did the death or serious injury occur due to a ‘user error’-including use other than the intended use?” If the answer is yes, then it is a complaint and reportable.

Incidents and Adverse Event Reporting

Do incidents that occurred outside the United States need to be reported to FDA?

The answer is yes. If you don’t report adverse events that occur outside the United States, then you might receive an FDA Form 483 observation worded like this…

21 CFR 820.50(a)(1) – An MDR report was not submitted within 30 days of receiving or otherwise becoming aware of information that reasonably suggests that a marketed device may have caused, or contributed to, a death or severe injury. Specifically, several instances were identified where the device caused or contributed to a death or serious injury, and the event was not reported to the Agency. The rationale documented in the complaint record was that the “event occurred outside the United States.”

This type of mistake is most likely due to a lack of training on 21 CFR 803–Medical Device Reporting. Some manufacturers that distribute products internationally are more familiar with the European Vigilance requirements as defined in Articles 87-89 of Regulation (EU) 2017/745. You can find additional guidance on vigilance reporting in our Vigilance Procedure or the applicable MDCG guidance. The European Medical Device Directive (i.e., MDD) only required vigilance reporting of incidents that occurred outside the Member States of the European Economic Area (EEA), Switzerland, and Turkey if the incident required implementation of field safety corrective actions. The EU MDR now requires reporting of incidents that occur outside of the EU if the device is also made available in the EU.

The FDA Part 803 requirements are worded differently. Part 803 does not indicate that the event had to occur in the United States. The MedWatch form (i.e., FDA Form 3500A) must be filed for events that occur in the United States and events occurring outside the USA if the devices are “similar” to devices marketed in the USA. Unfortunately, most device manufacturers are not aware of this requirement. Therefore, the FDA released a final guidance on Medical Device Reporting requirements on November 8, 2016. If you would like to learn more about Medical Device Reporting requirements, you can purchase our MDR procedure and webinar bundle. We will also be expanding our consulting services in January 2024 to include Medical Device Reporting for our clients.

Additional Resources on Complaints Handling

Medical Device Academy sells a complaints handling procedure, and a webinar on complaints handling. We will be updating the procedure during the holidays and hosting a new live complaints handling webinar on January 4, 2024. If you purchase the webinar, or you purchased the webinar in the past, you will receive an invitation to participate in the live webinar in January. If you purchase the complaints handling procedure, or you purchased the procedure in the past, you will receive the updated procedure, updated complaints handling form, and updated complaints log. You will also receive an invitation to the live webinar because we will be bundling the webinar with an updated procedure. We will also provide a discount code during the live webinar for people to upgrade their purchase of the webinar to include the purchase of the procedure. Customers who purchased one of our turnkey quality systems will also receive access to the live webinar.

Complaints handling mistakes – Why? Read More »

CAPA – Corrective/Preventative Action

8 Comments / CAPA / By / ,

What is a CAPA? How do you evaluate the need to open a new CAPA, and who should be assigned to work on it when you do?

What is a CAPA?

“CAPA” is the acronym for corrective action and preventive action. It’s a systematic process for identifying the root cause of quality problems and identifying actions for containment, correction, and corrective action. In the special case of preventive actions, the actions taken prevent quality problems from ever happening, while the corrective actions prevent quality problems from happening again. The US FDA requires a CAPA procedure, and an inadequate CAPA process is the most common reason for FDA 483 inspection observations and warning letters. When I teach courses on the CAPA process, 100% of the people can tell me what the acronym CAPA stands for. If everyone understands what a CAPA is, why is the CAPA process the most common source of FDA 483 inspection observations and auditor nonconformities?

Most of the 483 inspection observations identify one of the following seven problems:

  1. the procedure is inadequate
  2. records are incomplete
  3. actions planned did not include corrections
  4. actions planned did not include corrective actions
  5. actions planned were not taken or delayed
  6. training is inadequate
  7. actions taken were not effective

CAPA Resources – Procedures, Forms, and Training

Medical device companies are required to have a CAPA procedure. Medical Device Academy offers a CAPA procedure for sale as an individual procedure or as part of our turnkey quality systems. Purchase of the procedure includes a form for your CAPA records and a CAPA log for monitoring and measuring the CAPA process effectiveness. You can also purchase our risk-based CAPA webinar, which the turnkey quality system includes.

What’s special about preventive action?

I completed hundreds of audits of CAPA processes over the years. Surprisingly, this seems to be a process with more variation from company to company than almost any other process I review. This also seems to be a significant source of non-conformities. In the ISO 13485 Standard, clauses 8.5.2 (Corrective Action) and 8.5.3 (Preventive Action) have almost identical requirements. Third-party auditors, however, emphasize that these are two separate clauses. I like to refer to certification body auditors as purists. Although certification body auditors acknowledge that companies may implement preventive actions as an extension of corrective action, they also expect to see examples of strictly preventive actions.

You may be confused between corrective actions and preventive actions, but there is an easy way to avoid confusion. Ask yourself one question: “Why did you initiate the CAPA?” If the reason was: 1) a complaint, 2) audit non-conformity, or 3) rejected components—then your actions are corrective. You can always extend your actions to include other products, equipment, or suppliers that were not involved if they triggered the CAPA. However, for a CAPA to be purely preventive in nature, you need to initiate the CAPA before complaints, non-conformities and rejects occur.

How do you evaluate the need to open a CAPA?

If the estimated risk is low and the probability of occurrence is known, then alert limits and action limits can be statistically derived. These quality issues are candidates for continued trend analysis—although the alert or action limits may be modified in response to an investigation. If the trend analysis results in identifying events that require action, then that is the time when a formal CAPA should be opened. No formal CAPA is needed if the trend remains below your alert limit.

If the estimated risk is moderate or the probability of occurrence is unknown, then a formal CAPA should be considered. Ideally, you can establish a baseline for the occurrence and demonstrate that frequency decreases upon implementing corrective actions. If you can demonstrate a significant drop in frequency, this verifies the effectiveness of actions taken. If you need statistics to show a difference, then your actions are not effective.

A quality improvement plan may be more appropriate if the estimated risk is high or multiple causes require multiple corrective actions. Two clauses in the Standard apply. Clause 5.4.2 addresses the planning of changes to the Quality Management System. For example, if you correct problems with your incoming inspection process—this addresses 5.4.2. Clause 7.1 addresses the planning of product realization. For example, if you correct problems with a component specification where the incoming inspection process is not effective, this addresses 7.1. The plan could be longer or shorter Depending on the number of contributing causes and the complexity of implementing solutions. If implementing corrective action takes more than 90 days, you might consider the following approach.

Step 1 – open a CAPA

Step 2 – identify the initiation of a quality plan as one of your corrective actions

Step 3 – close the CAPA when your quality plan is initiated (i.e., – documented and approved)

Step 4 –verify effectiveness by reviewing the progress of the quality plan in management reviews and other meeting forums…you can cross-reference the CAPA with the appropriate management review meeting minutes in your effectiveness section

If the corrective action required is installing and validating new equipment, the CAPA can be closed as soon as a validation plan is created. The effectiveness of the CAPA is verified when the validation protocol is successfully implemented, and a positive conclusion is reached. The same approach also works for implementing software solutions to manage processes better. The basic strategy is to start long-term improvement projects with the CAPA system but monitor the status of these projects outside the CAPA system.

Best practices would be implementing six-sigma projects with formal charters for each long-term improvement project.

NOTE: I recommend closing CAPAs when actions are implemented and tracking the effectiveness checks for CAPAs as a separate quality system metric. If closure takes over 90 days, the CAPA should probably be converted to a Quality Plan. This is NOT intended to be a “workaround” to give companies a way to extend CAPAs that are not making progress on time.

Who should be assigned to work on a CAPA?

Personnel in quality assurance are usually assigned to CAPAs, while managers in other departments are less frequently assigned to CAPAs.  This is a mistake. Each process should have a process owner, who should be assigned to the root cause investigation, develop a CAPA plan, and manage the planned actions. If the manager is not adequately trained, someone from the quality assurance department should use this as an opportunity to conduct on-the-job training to help them with the CAPA–not do the work for them. This will increase the number of people in the company with CAPA competency. This will also ensure that the process owner takes a leadership role in revising and updating procedures and training on the processes that need improvement. Finally, the process will teach the process owner the importance of using monitoring and measuring the process to identify when the process is out of control or needs improvement. The best practice is to establish a CAPA Board to monitor the CAPA process, expedite actions when needed, and ensure that adequate resources are made available.

What is a root cause investigation?

If you are investigating the root cause of a complaint, people will sample additional records to estimate the frequency of the quality issue. I describe this as investigating the depth of a problem. The FDA emphasizes the need to review other product lines, or processes, to determine if a similar problem exists. I describe this as investigating the breadth of a problem. Most companies describe actions taken on other product lines and/or processes as “preventive actions.” This is not always accurate. If a problem is found elsewhere, actions taken are corrective. If potential problems are found elsewhere, actions taken are preventive. You could have both types of actions, but most people incorrectly identify corrective actions as preventive actions.

Another common mistake is to characterize corrections as corrective actions.

The most striking difference between companies seems to be the number of CAPAs they initiate. There are many reasons, but the primary reason is the failure to use a risk-based approach to CAPAs. Not every quality issue should result in the initiation of a formal CAPA. The first step is to investigate the root cause of a quality issue. The FDA requires that the root cause investigation is documented, but if you already have an open CAPA for the same root cause…DO NOT OPEN A NEW CAPA!!!

What should you do if you do not have a CAPA open for the root cause you identify?

The image below gives you my basic philosophy.

death by capa CAPA Corrective/Preventative ActionMost CAPA investigations document the estimated probability of occurrence of a quality issue. This is only half of the necessary risk analysis I describe below. Another aspect of an investigation is documenting the severity of potential harm resulting from the quality issue. If a quality issue affects customer satisfaction, safety, or efficacy, the severity is significant. Risk is the product of severity and probability of occurrence.

How much detail is needed in your CAPAs?

One of the most common reasons for an FDA 483 inspection observation related to CAPAs is the lack of detail. You may be doing all the planned tasks but must document your activity. Investigations will often include a lot of detail identifying how the root cause was identified, but you need an equal level of detail for planned containment, corrections, corrective actions, and effectiveness checks. Who is responsible, when will it be completed, how will it be done, what will the records be, and how will you monitor progress? Make sure you include copies of records in the CAPA file as well because this eliminates the need for inspectors and auditors to request additional records that are related to the CAPA. Ideally, the person reviewing the CAPA file will not need to request any additional records. For example, a copy of the revised process procedure, a copy of training records, and a copy of graphed metrics for the process are frequently missing from a CAPA file, but auditors will request this information to verify all actions were completed and that the CAPA is effective.

What is the difference between corrections and corrective actions?

Every nonconformity identified in the original finding requires correction. By reviewing records, FDA inspectors and auditors will verify that each correction was completed. In addition, several new nonconformities may be identified during the investigation of the root cause. Corrections must be documented for the newly found nonconformities as well. Corrective actions are actions you take to prevent new nonconformities from occurring. Examples of the most common corrective actions include: revising procedures, revising forms, retraining personnel, and creating new process metrics to monitor and measure the effectiveness of a process. Firing someone who did not follow a procedure is not a corrective action. Better employee recruiting, onboarding, and management oversight should prevent employees from making serious mistakes. The goal is to have a near-perfect process that identifies human error rather than a near-perfect employee that has to compensate for weak processes.

Implementing timely corrective actions

Every correction and corrective action in your CAPA plan should include a target completion date, and a specific person should be assigned to each task. Once your plan is approved, you need a mechanism for monitoring the on-time completion of each task. There should be top management or a CAPA board this is responsible for reviewing and expediting CAPAs. If CAPAs are being completed on-schedule, regular meetings are short. If CAPAs are behind schedule, management or the CAPA board needs authority and responsibility to expedite actions and make additional resources available when needed. Identifying lead and lag metrics is essential to manage the CAPA process successfully–and all other quality system processes.

What is an effectiveness check?

Implementation of actions and effectiveness of actions is frequently confused. An action was implemented when the action you planned was completed. Usually, this is documented with the approval of revised documents and training records. The effectiveness of actions is more challenging to demonstrate, and therefore it is critical to identify lead and lag metrics for each process. The lead metrics are metrics that measure the routine activities that are necessary for a process, while the lag metrics measure the results of activities. For example, monitoring the frequency of cleaning in a controlled environment is a lead metric, while monitoring the bioburden and particulates is a lag metric. Therefore, effectiveness checks should be quantitative whenever possible. Your effectiveness is weak if you need to use statistics to show a statistical difference before and after implementing your CAPA plan. If a graph of the process metrics is noticeably improved after implementing your CAPA plan, then the effectiveness is strong.

About Your Instructor

Winter in VT 2024 150x150 CAPA Corrective/Preventative Action

Rob Packard is a regulatory consultant with ~25 years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Rob was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certifications. From 2009 to 2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Rob’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510(k) submissions. The most favorite part of his job is training others. He can be reached via phone at 802.281.4381 or by email. You can also follow him on YouTube, LinkedIn, or Twitter.

CAPA – Corrective/Preventative Action Read More »

What is a CAPA Board? and Do you need one?

1 Comment / CAPA / By

A CAPA Board is a team responsible for making sure that all CAPAs are completed on time and the actions taken are effective.

Many of the medical device companies we work with have to open a CAPA for their CAPA process because they fail to implement all the actions that were planned, they fail to implement corrective actions as scheduled, or the actions implemented fail to be effective. When we investigate any process, we typically see one of five common root causes:

  1. top management is not committed to the CAPA process (we can’t fix this)
  2. procedures and/or forms are inadequate
  3. people responsible do not have sufficient training
  4. management oversight of the process is neglected
  5. there are not enough resources to do the work

Creating a CAPA Board can address four of these potential root causes, but the CAPA Board needs to understand how to work effectively.

Creating a CAPA Board shows a commitment to quality

Sometimes top management only pays lip service to quality. Top management’s actions demonstrate that quality is a cost-center, and they do not view quality as contributing to the revenue of the company. Instead, quality is viewed as a “necessary evil” like death and taxes. If this describes your company, sharpen your resume and find a new job. Quality is essential to selling medical devices and quality is the responsibility of everyone in the company. The Management Representative is responsible for “ensuring promotion and awareness” (see Clause 5.5.2c of ISO 13485) of regulatory and quality system requirements. This person should be training others on how to implement best practices in quality system management. One person or one department should never be expected to do most of the work related to the quality system.

A CAPA Board should be a cross-functional team of managers that help each other maintain an effective CAPA process. This means: 1) corrections are completed on time, 2) corrective and preventive actions are completed on time, and 3) each CAPA is effective. In order to do this consistently, the CAPA Board needs to work together as a team on the CAPA process. The CAPA Board doesn’t look for someone to blame. Instead, the CAPA Board rotates their responsibilities regularly, everyone is cross-trained on the roles within the CAPA Board, and the team passes tasks from one person or department that is overloaded to another person or department that has the resources to complete the tasks effectively and on time. A professional team must anticipate holes in task coverage, and someone on the team needs to communicate to the rest of the team which hole they are addressing. You can’t wait until the coverage gap is obvious and then have everyone jump into action. If you do this, your effectiveness will resemble a soccer team of 9-year-olds. 

Is your CAPA procedure the root cause?

In most companies, the problem is not the CAPA procedure. Clauses 8.5.2 and 8.5.3 of ISO 13485 are quite specific about each step of the CAPA process, and therefore it is easy to write a procedure that includes all of the required elements. The CAPA procedure is also one of the first procedures that auditors and inspectors review, and therefore any deficiencies in your procedure are usually addressed after one or two audits. If you feel that your CAPA procedure needs improvement, the above link explains how to write a better CAPA procedure. You might also consider asking everyone that is responsible for the CAPA process to provide suggestions on how to improve your procedure to streamline the process and clarify the instructions. The best approach is to have a small group (i.e. 3 to 5 people) of middle-level managers, from different departments, assigned to a CAPA Board with the responsibility of improving the CAPA process and procedure. If you have a large company, you might consider rotating people through the CAPA Board each quarter instead of having a larger group.

Does your CAPA Board have sufficient training?

Everyone can benefit from more training–even instructors will periodically engage in refresher training. Before someone is assigned to work on a CAPA, that person needs to be trained. Nobody should be assigned to a CAPA Board unless they are prepared to become an expert in the CAPA process. Some companies will only require people to sign a training record that states they read and understood the CAPA procedure. However, you must also demonstrate that your training was effective and the person is competent at the task assigned. Therefore, we recommend training people on CAPAs by training them with a CAPA training webinar and evaluating the effectiveness of the training by having each person complete a quiz. The use of a training webinar will ensure that each employee receives the same training, and the quiz will provide objective evidence that they understood the training (i.e. it was effective). If you have a CAPA Board, each person on the board should be involved in your CAPA training, and it is their responsibility to make sure people in their department have been trained effectively.

Competency is the hardest thing to demonstrate for any task. You can do this by verifying that the person has performed this task in one or more prior jobs (e.g. resume). If the person does not have evidence of working on CAPAs in their previous employment, then you will need someone that is already competent in the CAPA process to observe each person completing CAPAs and providing feedback. Once each person has demonstrated successful completion of multiple CAPAs, then the expert can attest to their competency in a training record with references to each of the successful CAPAs that were completed. If you are the person assigning a CAPA or individual tasks to people, do not assign the role of investigation, or writing the CAPA, to anyone that has not already demonstrated competency unless you are assessing them for competency. Everyone on the CAPA Board should either already be competent in the CAPA process or another expert on the CAPA Board should be in the process of training them to become a CAPA expert.

Average CAPA Aging Graph What is a CAPA Board? and Do you need one?

CAPA Boards are responsible for management oversight of the CAPA process

The most common method for management oversight of the CAPA process is to discuss the status of CAPAs at a Management Review. This information can be presented by the Management Representative, but assigning the presentation of CAPA status to another person on your CAPA Board will delegate some of the Management Review tasks and gives other people practice at presenting to a group. Some companies only conduct a Management Review once per year, but this makes it impossible to review CAPAs that were initiated immediately after a Management Review unless the CAPA takes more than a year to implement. Even if your company conducts quarterly Management Reviews, the review of CAPA status during a Management Review should focus on the most important issues rather than discuss every CAPA in detail. The impact on safety, the impact on product performance, and the economic impact of a specific CAPA are all criteria for deciding which CAPAs to discuss during a Management Review.

The CAPA Board needs a metric or metrics for monitoring the effectiveness of the CAPA process. The simplest metric is to monitor the average aging of CAPAs. If that average is steadily rising week after week, then new CAPAs are not being initiated, and existing CAPAs are not being closed. You can also measure the time to write a CAPA plan and the time to perform an investigation or monitor the on-time completion of tasks. The most important thing is for someone to take action when these metrics are not aligned with your quality objectives for the CAPA process. Taking action after 90 days of neglect is not good enough. You need to be monitoring the CAPA process weekly, and you need to take action proactively. Therefore, your CAPA Board needs to meet weekly and you need to show evidence in your CAPA records of what actions were taken by the CAPA Board.

Who should be assigned to the CAPA Board?

Top management does not need to be directly involved in the CAPA Board. Top management already reviews the status of CAPAs during Management Reviews. In a small company (i.e. < 20 people) you might have no choice but to have the same people that are assigned to your CAPA Board also be members of top management. As your company gets larger, you should assign middle-level managers and people that are new to management as members of the CAPA Board. Participating in the CAPA Board will teach those managers to work together as a team to achieve shared company goals and to persuade their peers to help them. The experience of working on a CAPA Board will also expose less experienced managers to other departments outside of their expertise. Ideally, participation in the CAPA Board will build friendships between peers that might not speak to one another. Each CAPA represents a team-building opportunity. The team needs to find a way to pool its resources to complete CAPAs on time and effectively. It is also important to rotate the assignment to the CAPA Board so that eventually all of your middle-level managers are trained in the CAPA process and each of them has been evaluated on their demonstration of team leadership and effectiveness in working with peers cooperatively. In large companies, it is common to assign one member of top management to the CAPA Board to show that top management is supportive of the CAPA process and to provide authorization for additional resources and funding for actions when needed. The top management representative should also be rotated to make sure that all of the top management remains competent in the CAPA process.

How does the CAPA Board manage the CAPA process?

The CAPA Board should never be blaming an individual or department for the lack of CAPA success. The CAPA Board should be anticipating when a CAPA is falling behind schedule or might not be as effective as it should be. Nobody on the team should be afraid to voice their opinion or to make a suggestion. Each member of the team has the responsibility of asking for help when they need it and asking for help as early as possible. The CAPA assignments should be shared between the team members, and one person should be responsible for chairing the meetings. If everyone is experienced in participating in CAPA Boards, then the role of the chairperson can be rotated each week. If one or more team members are inexperienced, the person on the CAPA Board assigned to training them should be teaching them how to participate in the meetings and prepare them for acting as chairperson.

Every CAPA Board meeting should have a planned agenda and meeting minutes. Every open CAPA should be discussed during the meeting, but the amount of time devoted to each CAPA should be adjusted for the risk of the CAPA failing to be completed on time or failing to be effective. If a CAPA is going smoothly, the discussion might only last seconds. Any discussion or actions planned that are specific to a CAPA should be documented in the individual CAPA record as well as the meeting minutes. This will ensure that the CAPA records are maintained as required by the ISO 13485 standard and the regulations.

What is a CAPA Board? and Do you need one? Read More »

Are you a little curious, or fascinated by competitive warning letters?

1 Comment / CAPA, FDA / By

Did you know you can download competitor inspectional observations to learn which quality issues are likely to result in warning letters?

Wheel of misfortune cropped 1 Are you a little curious, or fascinated by competitive warning letters?

Not long ago the FDA published their Inspectional Observation Data Sets. They are Excel spreadsheets of the dreaded 483 inspection observations and warning letters that the FDA issues after performing inspection of manufacturers. There is a spreadsheet for each of the following topic areas, and we will take a look at the ‘Devices’ observations. A post-mortem data analysis or speculative data autopsy if you will… What can we learn when examining an FDA inspection observation?

  • Biologics
  • Drugs
  • Devices
  • Human Tissue for Transplantation
  • Radiological Health
  • Parts 1240 and 1250
  • Foods (includes Dietary Supplements)
  • Veterinary Medicine
  • Bioresearch Monitoring
  • Special Requirements
  • Total number of inspections and 483s

These are nonconformities written by the FDA to the Code of Federal Regulations, so there won’t be any statistics for ISO 13485:2016 or Regulation (EU) 2017/745. There will be lots of findings under the ‘QSR’ or 21 CFR 820. The good news, unlike an ISO Standard, is that the Code of Federal Regulations is publicly available online for free. It isn’t a pay-to-play game and we can share the full text of the requirement without violating any copyright licensing agreements. 

The top 10 areas for inspection observations and warning letters are: 

  1. CAPA procedures
  2. Complaint procedures
  3. Medical Device Reporting
  4. Purchasing Controls
  5. Nonconforming Product
  6. Process Validation
  7. Quality Audits
  8. Documentation of CAPA actions and results
  9. Training
  10. Device Master Record

Corrective and preventive action is the most common reason for warning letters

The winning quality system requirement that resulted in the most 483 inspection observations and warning letters was for Corrective and Preventive Actions under 21 CFR 820.100(a). This finding is listed when a manufacturer fails to establish a CAPA procedure or the procedure is inadequate. This finding was cited 165 times. In addition, CAPA activities or their results were not documented or were not documented adequately a total of 32 times under 21 CFR 820.100(b). This gives us a grand total of 197 observations for the CAPA process.

Corrective and preventive actions are either fixing an identified problem and making sure it doesn’t happen again, or stopping a potential problem from happening in the first place. It is both the reactive and proactive response for quality issues and product non-conformance. The text of the requirement is:

Ҥ820.100 Corrective and preventive action.
(a) Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action. The procedures shall include requirements for:
(1) Analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems. Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems;
(2) Investigating the cause of nonconformities relating to product, processes, and the quality system;
(3) Identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems;
(4) Verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device;
(5) Implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems;
(6) Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems; and
(7) Submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review.
(b) All activities required under this section, and their results, shall be documented.“

We can see that under section (a) the requirement is that there is an established and maintained process control with a numerical list of required inputs and outputs of that process. The process control is easy, use a procedure. You have to establish a procedure and you have to maintain it. That is one part of the first 165 observations.

The second part is that the procedure needs to be ‘adequate’. That means that bullets (1)-(7) need to be addressed within that procedure. For example number (2) is “Investigating the cause of nonconformities relating to product, processes, and the quality system;”. This means that the procedure should be explaining not only that your quality system will be doing that investigation, but who will be doing it and how they will be doing it. 

“The cause of nonconformities shall be investigated”, may not be an adequate process control. Yes, it addressed the need for a root cause evaluation, but does it do that adequately? 

“The RA/QA Manager will complete or assign a staff member to complete the root cause evaluation of Corrective Actions utilizing methods such as a ‘5-Why Analysis’ by filling in section 2. Of the CAPA report form.” This wording is much closer to what is needed in a procedure. It explains who is doing what, roughly how they might do it, where that activity gets documented and identifies the record that the activity produces.

Which brings us to the extra 32 findings where the activities and their results either weren’t documented or were done so poorly. This is why identifying the input (Root Cause Analysis) and the output (Section 2. of the CAPA report) are important. It allows you, the inspector or an auditor to trace from the procedure to the record that part of the process produces to demonstrate conformity. 

As the age old saying goes, “if it isn’t documented, it didn’t happen”. That record should show that yes you did a root cause analysis (the activity) and what the conclusion of that analysis was (the results of that activity). These types of records are so vital to your quality system that there is an entire process dedicated to the control of records. I’ll give you a hint, it is Subpart-M of the QSR. 

This is also a great segway to show how the processes go hand in hand and CAPA is interrelated to Document Control, Record Control, and your Quality System Record. Your system processes will continually wrap back around to each other in this manner. For example, CAPAs are a required input into your Management Review process so if you don’t have a CAPA procedure you aren’t performing adequate management reviews. 

A note on other systems

If your quality system is also ISO 13485:2016 compliant, Corrective Actions and Preventive Actions are separate items under separate sub-clauses. Corrective Actions are in 8.5.2., and Preventive Actions are in 8.5.3. Meaning if you have a mature quality system that has never had a preventive action, then your CA might be fine, but the PA of that process may be inadequate.

An industry standard for CAPAs is applying a risk based approach, and we have an entire webinar dedicated to the subject! How to create a risk-based CAPA process

Complaints are the second most common reason for warning letters

%name Are you a little curious, or fascinated by competitive warning letters?

The silver medal goes to complaints. Much like CAPA the biggest issue is no, or inadequate complaint handling procedures. This specific finding was cited 139 times (overall complaint handling has more but this specific issue was the most cited). Not to sound like a broken record but again, complaint handling is a specific process that requires an ‘established and maintained procedure”.

As a procedure it has to exist, it has to be maintained, and each process has requirements for inputs and outputs that must be outlined. Complaint handling is a little bit different in the QSR in that there isn’t a ‘complaint’ sub-part. Complaints are under Sub-Part M- Records, specifically 21 CFR 820.198 Complaint Files. 

To compare, Complaints in accordance with ISO 13485:2016 are under Measurement Analysis and Improvement, specifically Sub-clause 8.2.2. Complaint Handling. It is sandwiched in between Feedback and Reporting to Regulatory Authorities. That had to have been done on purpose because those processes are inherently intertwined and their inputs and outputs directly feed into each other:

Ҥ820.198 Complaint files.
(a) Each manufacturer shall maintain complaint files. Each manufacturer shall establish and maintain procedures for receiving, reviewing, and evaluating complaints by a formally designated unit. Such procedures shall ensure that:
(1) All complaints are processed in a uniform and timely manner;
(2) Oral complaints are documented upon receipt; and
(3) Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA under part 803 of this chapter, Medical Device Reporting.”

This sub-section of ‘Records’ may be less intuitive than what we saw under CA/PA. We can see that we have to maintain complaint files. We also need a procedure that covers receipt, review, and evaluation of complaints. Then we have to name a formally designated complaint handling unit to do all of that. 

Further we need to make sure that complaints are handled uniformly and efficiently. It should be a cookie cutter process with a known timeline. Every complaint goes through the same review and evaluation within a specific time period. If it takes six months to review a complaint, that definitely is not a ‘timely manner’. 

Not every complaint will be sent to you via certified mail with ‘Complaint’ written across the top in big BOLD letters. Sometimes people will simply tell you about a complaint they have verbally and your process needs to define how it is addressing these verbal communications. Otherwise your FDA inspection observation will be written, and you run the risk of receiving warning letters.

This of course begs the question, what is a complaint? How will I know if I received one? Fortunately 21 CFR 820.3 provides us with definitions, one of them being what exactly a complaint is “(b) Complaint means any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution.”.

There is no quiz at the end of this but I would caution you that this will probably be on the test. Anytime you ask a question like that and the regulation provides a definition for it, then it’s a good idea to include that definition within your procedure. This is a way to make sure that there is uniformity in the understanding of a procedure. If you miss a complaint because you didn’t realize that it was a complaint then your process is not effective. Eventually an auditor will pick up on the deficiencies in the process, document a finding and you will be doing a CAPA to fix it.   

Every complaint needs to be reviewed, but not every complaint needs to be investigated. This was a much less cited issue (5). You are allowed to decide that an investigation isn’t needed. However, if you do then you must keep a record of why you decided that and name the person responsible for that decision. 

That isn’t carte’ blanche to just write off investigations whenever you want. There are some things that require an investigation and there is no accepted rationale for not performing one. An example is when there is a possible failure of a device, it’s labeling or packaging to meet any of their specifications. Those need to be investigated without exception. What your system is allowed to do though is if you have already done an investigation and you received related similar complaints, there is no need to repeat the same investigation for every complaint. 

An important concept of complaint handling is that you should be triaging your complaints as you receive them. There are certain types of complaints that must be reported to the FDA. More information is actually found under 21 CFR 803, not the 820 that we have been examining. These special complaints need to be identifiably separate from your normal run of the mill complaints. These complaints specifically need a determination of; 

  • Whether the device failed to meet specifications;
  • Whether the device was being used for treatment or diagnosis; and
  • The relationship, if any, of the device to the reported incident or adverse event.

Outside of those special reportable complaints, all investigations have certain required outputs. By addressing every complaint in a uniform repeatable manner, this can be boiled down to a form. In fact creating a specific complaint form makes sure that all of the required information has been documented. Each record of an investigation by your formally designated complaint handling unit has to be include;

  • The name of the device;
  • The date the complaint was received;
  • Any unique device identifier (UDI) or universal product code (UPC), and any other device identification(s) and control number(s) used;
  • The name, address, and phone number of the complainant;
  • The nature and details of the complaint;
  • The dates and results of the investigation;
  • Any corrective action taken; and
  • Any reply to the complainant.

Some companies and corporations sprawl across the globe and have many sites all over the place. Not every manufacturer is limited to containing all of their operations within a single building. There are times where the formally designated complaint handling unit may be somewhere other than where the manufacturing is taking place. That is acceptable as long as communication between the two is reasonably acceptable. The manufacturer needs access to the records of the complaint investigations performed. Just as everything must be documented, all of that documentation must be producible as well. If not, your inspector will produce FDA 483 inpsection observations and warning letters.  

If the complaint handling unit is outside of the United States the records have to be accessible in the United states from either the place where the manufacturers records are normally kept or at the initial distributor. 

Complaint Handling and vigilance reporting are topics that we often find stuck together like velcro. We find them so interelated that we have a combined Complaint Handling and Vigilance Reporting Webinar.

Medical Device Reporting is the third most common reason for warning letters

The bronze medal recipient shows a drop in sheer numbers of FDA inspection observations. A total of 68 were written for the fiscal year of 2020, and these findings have a high likelihood of resulting in warning letters because these incidents may involve serious injuries and death. We are slowing down, but this is still a topic that gets an FDA inspection observation almost every week.

But again part of the issue is no, or bad procedures to control this process. Not to be confused with the (EU) MDR since as an industry we love acronyms so much, Medical Device Reporting is referenced within the Quality System Requirements of 21 CFR 820. We took a peek above in Complaint Handling. What makes this unique is that MDR actually lives in 21 CFR 803 Medical Device Reporting. What makes it even more special is that Part 803 is further broken down into sub-parts. 

We will take a look at Sub-part E which is the reporting requirements for manufacturers. Medical Device Reporting is a process and as such needs a procedure to control it and that procedure must be maintained. 

Some key points to capture is that there are reporting timelines that are measured in calendar days from when you become aware of information that reasonably suggests that one of your devices;

“(1) May have caused or contributed to a death or serious injury or
(2) Has malfunctioned and this device or a similar device that you market would be likely to cause or contribute to a death or serious injury, if the malfunction were to recur.”

There are some crucial takeaways. First, the clock starts ticking down calendar days, not work days, and holidays count. You can’t hold off reporting that your device killed someone because it’s around the holidays and over a few weekends. 

Second, is that reporting timelines vary, generally between 5 and 30 calendar days. That means it is important to know the specific timeline for the type of report you are making and what the authority having jurisdiction requires for a timeline. The FDA may differ from Health Canada which in turn may differ from the EU, etc. 

Third is that the bar to meet is what would be ‘reasonably known’, and that is somewhat of an ambiguous requirement open to interpretation.

They help clarify this with,

“(i) Any information that you can obtain by contacting a user facility, importer, or other initial reporter;
(ii) Any information in your possession; or
(iii) Any information that you can obtain by analysis, testing, or other evaluation of the device.”

The first two are usually not an issue, but the one that tends to get less attention is deeper analysis, testing or evaluation of the device. Due diligence is required here to make sure that you actually do know the information that should be ‘reasonably known’ to you. 

The burden of investigation and root cause determination is placed squarely on the shoulders of the manufacturers and that is a process that can take some time. What happens when the reporting timely is fast approaching but your investigation won’t be finished before the clock runs out? The short answer is to report it anyway.

The longer answer is to report what information you do have with an explanation of why the report doesn’t have all of the required information. Then explain what you did to try to get all of the information, and file a supplemental or follow-up report later to fill in the gaps. Only having a partial report ready is not an excuse to miss the reporting deadline. It is however, the perfect excuse to get an FDA inpsection observation or warning letters.

Are you a little curious, or fascinated by competitive warning letters? Read More »

NSE letter: A CAPA plan for your 510k process

1 Comment / 510(k), CAPA, Design Control / By

Cry, complain, call the reviewer…you might feel a little better, but you received an NSE letter, and tomorrow you still can’t sell your device.

NSE Letter NSE letter: A CAPA plan for your 510k process

Instead, try approaching an NSE letter like a CAPA investigation. What is the issue? The FDA determined that your device is not substantially equivalent to the predicate you selected. What is the root cause? There are four (4) possible root causes.

NSE Letter Cause #1: You failed to verify that the predicate is a legally marketed device.

If your predicate device is not legally marketed, you need to select a new predicate and resubmit. However, it is doubtful that your device would pass the refusal to accept the (RTA) screening process if the predicate was not legally marketed. If your predicate was not registered and listed with the FDA (check using this link), then you should have submitted a pre-sub request to determine if the agency has any problem with using the device you chose as a predicate. This is an essential question if the manufacturer is no longer in business, and the product is no longer for sale.

NSE Letter Cause #2: You failed to evaluate the substantial equivalence of your device’s intended use with the predicate.

The intended use of your predicate device is documented for every potential predicate since February 1992 on FDA Form 3881–which you can download along with the 510k clearance letter for the predicate. There is also an intended use documented for every device category in the applicable regulation for that device. This intended use is more generic than FDA Form 3881, but both are applicable. The FDA Form 3881 you submit for your device must be equivalent. I recommend a point-by-point comparison with regard to the following elements: 1) OTC vs. prescription use, 2) user, 3) patient population, 4) illness or medical condition, 5) duration of use, 6) environment of use and 7) target part of the body. Any difference can raise new issues of risk and may result in an NSE decision. However, the FDA typically will work with the company to modify the wording of FDA Form 3881 to ensure the intended use is equivalent or to make sure you provide clinical evidence to address the differences. In my pre-submission requests, I include a comparison document for the intended use to ensure that the FDA is aware of any differences in the intended use.

Cause #3: You failed to convince the FDA that technological differences do not raise different questions of safety and effectiveness.

Unless your device is identical in every way to the predicate device, you will have to persuade the FDA that differences do not raise questions of safety and effectiveness. At the beginning of the 510(k) process, it is helpful to document technological differences systematically. Specifically, this should include: 1) materials, 2) design, 3) energy source, and 4) other features. For each difference, you must justify why the difference does not raise different issues, or you must provide data to prove it. It is also possible that you were not aware of questions of safety and performance raised by technological differences. To avoid this problem, you can submit a detailed device description and draft labeling to the FDA in a pre-sub meeting request. If you ask questions about differences in a pre-sub meeting, you can avoid an NSE letter.

Cause #4: You failed to provide data demonstrating equivalence.

For each difference, you should determine an objective method for demonstrating that the difference is equivalent in safety and performance to the predicate. Your test method can be proposed to the FDA in a pre-sub request before testing. The FDA sees more than 3,000 companies propose testing methods to demonstrate equivalence each year. They have more experience than you do. Ask them in a pre-sub before you test anything. There may be a better test method, or you might need to adjust your test method. Sometimes results are unclear, but there might be another test you can perform to demonstrate equivalence, and then you can resubmit your 510k. Possibly you were unaware of the need to perform a test, and you were unable to complete a test within the 180 days the FDA allowed for submitting additional information. The good news is you now have all the time you need.

What is similar between all four causes of the NSE letter?

In all four root causes identified above, you could benefit greatly from the pre-sub meeting. Now you have an NSE letter, and you know which of the four reasons why your submission did not result in 510(k) clearance. However, the correction to your NSE letter may not be clear. Therefore, you should consider requesting a pre-sub meeting as quickly as you can. Most companies choose not to submit a pre-sub meeting request because they don’t want to wait 60-75 days. However, sometimes pre-sub meetings are scheduled sooner. In addition, 60-75 days is not as costly as receiving a second NSE letter.

Prevent a future NSE letter by requesting a pre-sub meeting

Regardless of your corrections for the current NSE letter, you should prevent future occurrences by planning to submit a pre-sub meeting request for every submission. I try to help clients gather all the information they need without a pre-sub meeting, but each new 510k reminds me why a pre-sub meeting is so valuable. You always learn something that helps you with the preparation of your 510k.

Help with Pre-sub meeting requests

The FDA published a guidance document for pre-sub meeting requests. If you need additional help, there is a webinar on this topic.

NSE letter: A CAPA plan for your 510k process Read More »

Minimum Data Points Constituting a Trend Is 3?

1 Comment / CAPA / By

This article explains why three is never the right answer, and this article explains why asking how many minimum data points are needed to identify a trend is the wrong question.

Minimum Data Points for CAPA Minimum Data Points Constituting a Trend Is 3?

Recently a client sent me an email asking the same question about data analysis in two different ways. The first question asked, “How many of the same situation need to occur before it is considered a trend?” The second question asked, “How many nonconformities can occur before a CAPA should be opened?” This question can be asked a hundred different ways, but it’s the wrong question.

Minimum Data Points for Variable Data

In the graph above we have variable data rather than attribute data. When you have variable data, the answer regarding the number of minimum data points is always a quantitative answer that is objective rather than subjective. Typically the new data point lies outside of the upper or lower specification for the element being measured (i.e., >6.6 or <6.1 in the graph above). Even if the new data point remains within specifications, a CAPA may still be issued if the new data indicates that there has been a shift in the normal distribution of data.

In our graph above, on March 13 the newest data point was 6.37. Although this value is within specifications, in fact close to the center of the range, this value represented a shift in the trend that exceeded the normal distribution of data observed for the previous 12 days of the month.  The mean for the first 12 days was 6.54 and the standard deviation was 0.0250. Many people establish alert limits that equal mean +/- 2x standard deviation (i.e., 6.59 and 6.49) and the action limit is often set equal to the mean +/- 3x standard deviation (i.e., 6.62 and 6.47). Therefore, a value of 6.37 is well outside the normal distribution for the first 12 days of the month–but not outside specifications.

The shift in data values for this graph indicates a shift, but the process was capable of remaining within specifications before the shift and process capability actually appears to be slightly better after the shift. In this case, there is no need for a CAPA but if the reason for the shift is unknown an investigation would be recommended. However, if different lower specification were chosen (e.g., 6.4) then the new data point on March 13 would be outside the specification and product would be identified as nonconforming.

Nonconforming results should always trigger in an investigation?

If the process was validated and the mean +/- 2x standard deviations remains within the specifications, then greater than 95% of the product should be conforming. If the the mean +/- 3x standard deviations remains within the specifications, then greater than 99.5% of the product should be conforming. Therefore, based upon the data from the first 12 days of March any data points that are lower than 6.47 should be very rare unless there is a process shift.

An investigation of the data point on March 13 should result in a CAPA unless the outlying data can be explained and a new trend with a lower mean is expected. If the new data point cannot be explained, then only one new data point is needed and the data does not even need to be nonconforming. If no actions are taken the drop in the measured value could continue and nonconforming product could result, while any action taken on March 13 is a preventive action.

Minimum Data Points for Attribute Data

In the case of the first question, the negative customer situation that is reported to a company may be an attribute rather than variable data. For example, “customer unsubscribed” after an email blast went out is a negative customer situation. If you know the % of customers that unsubscribed when email blasts go out, then you have variable data. If you only know that one person unsubscribed, then you only have an attribute (i.e., unsubscribed instead of continued subscription). The first time an unsubscription occurs, you should do an investigation to see if there is an issue other than frequent email blasts that exceed a customer’s expectations in frequency. The action taken could be to establish an alert and action limit for unsubscribed emails based upon industry norms or the % calculated from the first event.

What are the right questions?

Instead of asking how many minimum data points are needed to initiate a CAPA, we should make sure we are measuring the right variables. The % of unsubscribed is a valuable variable data point, but knowing that one person unsubscribed without knowing how many people received that email blast is not nearly as helpful in making future decisions. Another question is to ask, “Why did the person unsubscribe?” If the reason is unknown, you may want to contact the former subscriber and ask them–but probably not by email. If you have a theory why people are unsubscribing you can also perform an experiment to test your hypothesis. If you think the cause is that emails are being sent too frequently, then you can split your list and send the same emails to two halves of a list at different frequencies. If you are correct, then the list that has more frequent emails should also have a higher % of unsubscribers. This type of design of experiment (DOE) is one of the root cause investigation tools I recommend in my Risk-Based CAPA webinar.

Recommendations for Trend Analysis

Whenever you establish a new metric or quality objective, you should also establish a limit for when you intend to investigate and when you intend to take preventive or corrective actions. If you simply start measuring a variable or attribute, you may have difficulty recommending actions to management during your next management review and explaining why actions were not taken during an FDA inspection or an audit.

Additional Related Reading
If you are interested in reading more about how this might be applied to inspection results, please read my blog titled, “21 CFR 820.80: 3 Ways to Record Inspection Results.”

Minimum Data Points Constituting a Trend Is 3? Read More »

Case Study Part 2: Packaging CAPA Preventive Action and Corrective Action

Leave a Comment / CAPA / By

This article explains details of implementing a CAPA preventive action and corrective action for packaging issues. Specifically, containment measures, corrections, corrective actions, and preventive actions to address the root cause identified in part 1 of this case study.

Screenshot 2015 11 08 at 12.34.46 PM 1024x504 Case Study Part 2: Packaging CAPA Preventive Action and Corrective Action
Comparing Incoming Inspection Results as a CAPA Preventive Action

CAPA Step 1: Containment of Product with Defective Packaging

When you learn of a packaging complaint related to a specific lot, you also need to determine if another product associated with the lot is safe to ship to customers. You should not attempt a correction and removal of the product unless you have a reasonably high level of confidence that there is a packaging issue with the lot or a portion of a lot, but you might consider placing product from the same lot in your inventory on hold until your investigation is completed. If you confirm that you have an issue with a specific lot, lots, or portion of a lot, then you should initiate correction and removal of product to prevent potentially, a non-sterile product from being used. This type of problem could result in a Class 1 recall (i.e., the most severe of the three categories). Therefore, you need to act quickly and according to established procedures for corrections and removals.

CAPA Step 2: Correction(s) of Defective Packaging

If you find a problem, there is little you can do to fix the existing defective packaging other than to repackage the product. If the product has only been sterilized once, and you have revalidated the product for resterilization, then you can repackage, relabel and resterilize. To ensure traceability to the lot that has been reworked, you may need to revise the labeling (e.g., add an “R” to the lot number). If you have not revalidated the resterilization of the product, you may want to use this lot for validation of resterilization instead of throwing it out. However, sometimes your best option is to scrap the product.

Additional corrections may involve correcting the calibration of a testing device or performing a repair to sealing equipment. You might modify a specification on a drawing. You might correct a work instruction that did not have the correct, validated sealing parameters. All of these could be corrections.

CAPA Step 4: Corrective Action(s) for Packaging Issues

Investigation of root cause (CAPA Step 3) occurs in parallel with containment (CAPA Step 1) and correction (CAPA Step 2). Corrective actions (CAPA Step 4) prevent the packaging issues from recurring, and they occur after the first three steps because you can only implement corrective actions once you understand the root cause of the quality issue. The best tool for evaluating your current process controls and evaluating the implementation of new corrective actions is a process risk control plan. In order to do this, you need a process flow diagram and a process risk analysis. Each step of the process, from the raw material fabrication of film to the released product, needs to have potential hazards identified, risks evaluated, and risk controls implemented. You should use your process validation to verify the effectiveness of process risk controls quantitatively. If the process capability is greater than 95% for each parameter, and you have addressed every possible source of problems, then you probably won’t gain much from additional risk controls. However, many companies reduce their sampling or rely on certificates of conformity to ensure that the process is controlled adequately.

CAPA Step 5: CAPA Preventive Action for Packaging Issues

You already had a packaging issue with one lot of products, but you could have another issue with a different product or lot for the same reason or a different reason. If the product is the same, and the reason is the same, then the actions taken are corrective actions. If you take action to prevent the occurrence of this issue with a different product, or you prevent other potential causes of packaging issues by initiating more robust monitoring and process controls, then your actions are preventive. Often you will want to implement both types of actions.

In the box plot example provided in this article, Lot D was detected at incoming inspection as having peel test results that were outside the alert limit but acceptable when compared to the specification limit for peel testing. The alert limit was established during validation of the pouches and comparison of lots A, B, C, and D, demonstrate that Lot D is slightly lower in peel strength. The manufacturer may choose to use the lot, but the sampling plan for in-process peel testing may be altered, or the manufacturer may choose to place the new lot in quarantine while an investigation is performed. This is a CAPA preventive action.

Below I have listed six additional potential CAPA preventive actions to consider for your packaging process:

  1. Perform peel testing and/or bubble leak testing of packaging raw materials as part of the receiving inspection process and perform data analysis of the incoming inspection samples to determine if lower or higher alert and action limits should be established for the new lot of raw materials. The limits should be based upon the manufacturer’s seals as well as your seal.
  2. Retain remnants of in-process peel testing, include the remnants with the sterilization load, and then store the remnants for real-time aging.
  3. Consider implementing visual inspection tools that are able to detect sealing imperfections non-destructively.
  4. Increase the number of samples you test (e.g., 1 to 3 or 3 to 5) for each lot of product sealed to increase your confidence that the seals will be within specifications.
  5. Perform statistical analysis of in-process data for seal peel strength in order to identify potential lots with packaging issues prior to release.
  6. Evaluate the performance of the packaging at temperature and humidity extremes that may be higher or lower than the conservative estimates for ambient conditions (e.g., 30C vs. 25C).

Additional Resources

In addition to the previous article that was part 1 of this case study, I have posted ten other blogs specifically on the topic of CAPA. There is also a CAPA procedure you can download from this website.

Risk-based CAPA Webinar

If you are interested in learning more about a risk-based approach to CAPAs, then please click here.

Case Study Part 2: Packaging CAPA Preventive Action and Corrective Action Read More »

Complaint Investigation Case Study (21 CFR 820.198): Part 2

1 Comment / CAPA / By

This article is part 2 of a two-part series specific to complaint investigation requirements as specified in 21 CFR 820.198 (http://bit.ly/21CFR820198) of FDA QSR. This second part explains how to perform a complaint investigation and provides a complaint investigation case study.

complaint part 2 Complaint Investigation Case Study (21 CFR 820.198): Part 2

 

Last week’s blog  reviewed the requirements for a complaint investigation, while this blog includes the following information on how to conduct an investigation:h

  1. How thorough should your investigation be?
  2. Investigation Methods
  3. Verification of the Cause
  4. Documenting Your Investigation
  5. Complaint Investigation Case Study

How thorough should your investigation be?

The depth of investigation should be appropriate to the importance of the complaint. If a previous complaint of similar nature has already been investigated, the investigation may only gather enough information to verify that complaint has the same root cause. However, if a complaint involves an adverse event (i.e., is reportable under 21 CFR 803), then additional information needs to be recorded in the complaint record as per 21 CFR 820.198d:

  1. Does the device fail to meet specifications?
  2. Was the device used for treatment or diagnosis?
  3. What was the relationship, if any, between the device and the reported event?

If the person gathering information from the complainant cannot immediately identify a cause code, or the incident involves a severe injury or death, then it is essential to collect as much information as possible. Typically, the complainant will be asked to return the device to determine if the device malfunctioned.

Investigation Methods

A complaint investigation is not any different from any investigation you perform for a CAPA. The most critical first step is to determine the cause of the complaint. To determine the cause, you need to sample additional records and inspect the device if it is available. If the device is not available, you might also look at other product from the same lot that remains in inventory. The following article I wrote suggests seven ways to investigate a complaint when a device is not returned: http://bit.ly/DeviceNotReturned.

One of the methods described in the article above is an Ishikawa Diagram or “Fishbone Diagram.” This is one of the five root cause analysis tools that I teach in my CAPA webinar (http://bit.ly/enKapCAPAwebinar). Ishikawa Diagrams are an ideal tool for root cause analysis if you have no idea what the cause of the complaint is because this tool provides a systematic process for narrowing down the potential causes, to the narrow few that are most likely. You are not required to use this tool, but you should describe in your complaint record what type of root cause analysis was performed.

Verification of Cause

Once you have identified the root cause, or at least narrowed your list to the most likely causes, you should then verify that the cause will result in the observed malfunction by recreating the scenario if possible. Ideally, you should be able to simulate the event that resulted in the complaint and demonstrate that you can reproduce the problem. This is important because if you cannot verify the cause of a device malfunction, then you will have difficulty verifying the effectiveness of corrective actions for an infrequent complaint.

Documenting Your Investigation

There is no specific format for the way a complaint investigation is documented. Still, most complaint records have a small section on the complaint form that allows them to write a short paragraph summarizing the investigation and the results. Unfortunately, most of the spaces provided on forms are completely inadequate for the amount of information that should be recorded. Therefore, the best approach is often to write, “See attached complaint investigation.” This is especially true if the complaint is reportable (i.e., requires MDR under 21 CFR 803). Good documentation is quantitative and specific. You need to identify which records were sampled as part of the investigation. You should demonstrate that you have expanded your initial search to determine if the problem exists in multiple production lots of the same product code, multiple product codes within the same product family and any other product families that may use similar raw materials, design features, equipment, testing methods or procedures.

Complaint Investigation Case Study

If your company manufactures cast orthopedic implants for the knee and you receive a complaint about an implant that has a small imperfection in the bearing surface of the femoral implant, you may need to perform an investigation–especially if this has not occurred previously. You should request a return of the implant for inspection to verify that the imperfection is nonconforming and not just a cosmetic defect.

Your investigation should include a review of the lot history record for an entire lot of implants–as well as any other parts that they may have been cast at the same time. All the process conditions identified throughout the manufacturing process should be compared to the validated process parameters. Special attention should be given to the inspection results that were recorded for the castings (i.e., radiographic inspection, fluorescent penetrant inspection, and metallurgical inspection). Ideally, these inspection methods should be repeated for 100% of the production lot to ensure that the inspection results meet the acceptance criteria. Documentation of the investigation should include copies of all records that were reviewed and photos if visual inspections were repeated.

If you are interested in learning more about complaint handling, you might be interested in downloading the webinar that Medical Device Academy recorded last year for complaint handling and vigilance reporting (http://bit.ly/Complaint-Webinar-Landing). We can also help you one-on-one with a current complaint investigation you are conducting. Please don’t hesitate to contact me. Mobile: 802.281.4381 or rob@13485cert.com.

Complaint Investigation Case Study (21 CFR 820.198): Part 2 Read More »

FDA Inspections-Complaint Investigation Requirements-Part I

1 Comment / CAPA / By / , , ,

“FDA Inspections-Complaint Investigation Requirements-Part I” is a two-part series that provides an overview of 21 CFR 820.198 requirements.

complaint part 1 FDA Inspections Complaint Investigation Requirements Part I

Last week, I received a message from someone asking for advice on how to perform a complaint investigation. She has a complaint-handling procedure that explains how to determine if complaints are reportable (http://bit.ly/Medical-Device-Reporting) and is the complaint coordinator. Her procedure includes a list of pre-determined cause codes for the most common complaints the company has received in previous years. Her system does not require a complaint investigation if an existing cause code is identified. She would like to know how to perform an investigation if she receives a complaint that does not fit one of the existing cause codes.

Is It a Complaint?

Most discussions about complaint handling begin with the definition of a complaint [i.e., 21 CFR 820.3(b); https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm?fr=820.3]. However, if a complaint is received during an investigation of a device rather than the use of the device, the FDA will still consider this as being “after releasing for distribution.” The reason is that release for distribution occurs at the final inspection. If the device breaks during installation, the device is still distributed.

One last question. Is it correct to consider a complaint only when the device is live and not during the device’s settings and installation process? (The definition states “after it is released for distribution,” what do they mean by this?).

What is Required?

The FDA QSR section specific to complaint handling is 21 CFR 820.198 (https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm?fr=820.198). There are seven subsections (i.e., “A” through “H”) that comprise the regulation.

  1. Manufacturers shall maintain complaint files and establish procedures for complaint handling.
  2. Manufacturers must review and evaluate if an investigation is needed.
  3. Manufacturers must perform an investigation automatically for any complaint involving a device malfunction–unless an investigation has already been performed for a similar complaint.
  4. Separate files shall be maintained for complaints that involve adverse events that are reportable under 21 CFR 803 (21-CFR-803).
  5. The content of a complaint investigation record is specified in this subsection.
  6. When the complaint handling unit is located at another facility, the records of investigations shall be reasonably accessible to the manufacturing establishment.
  7. When the complaint handling unit is located outside the USA, the records must be reasonably accessible at a U.S. manufacturer or the location of an initial distributor.

What Does the FDA Expect to See?

FDA inspectors are guaranteed to sample complaint records and CAPA records during every routine inspection. The complaint records sampled will typically be limited to a specific product family selected as the focus of the investigation. Most companies have an electronic log of the complaints, and the investigator may request a sorted list that only includes complaints specific to that one product family. The investigator will already be aware of all of your reported adverse events associated with the product family, and there may be one or two records they specifically want to investigate. The investigator will also review the complaint log to see if there are any complaints with a description that sounds like it might be reportable–even though the complaint was not reported.

The investigator will verify that each complaint record includes the content specified in subsection “E”:

  1. name of the device;
  2. the date the complaint was received;
  3. any device identification(s) and control number(s) used;
  4. the name, address, and phone number of the complainant;
  5. the nature and details of the complaint;
  6. the dates and results of the investigation;
  7. any corrective action is taken, and
  8. any reply to the complainant.

In my response to the question I received, I also included advice on conducting an investigation. The investigation is no different than an investigation for any CAPA. The first step is to perform a root cause analysis. The second part of this article will explain the investigation process in more detail.

Register to receive email notifications of new blog postings (https://medicaldeviceacademy.com/blog/) so you can read the second part of this article next week. If you are interested in learning more about complaint handling, you might be interested in downloading the webinar that Medical Device Academy recorded last year for complaint handling and vigilance reporting (https://medicaldeviceacademy.com/complaint-handling-vigilance-reporting-webinar/). We can also help you one-on-one with a current complaint investigation you are conducting. Please don’t hesitate to ask me for help: Mobile: 802.281.4381 or rob@fdaestar.com.

FDA Inspections-Complaint Investigation Requirements-Part I Read More »

Scroll to Top