Blog

Archive for FDA

Usability Engineering and Human Factors Testing for Devices

Yesterday, February 3, the FDA released a new guidance document on the subject of “Applying Human Factors and Usability Engineering to Medical Devices.” This is a final guidance document that replaces the previous version that was released in 2000 and the draft that was released in 2011. The diagram below is Figure 3 from this new FDA guidance, and it includes references to sections 5 through 9 of the guidance document.

Screenshot 2016 02 04 at 1.24.04 PM Usability Engineering and Human Factors Testing for Devices

Applying Human factors engineering and usability engineering to medical devices

What’s in the new FDA Guidance on Usability Engineering?

The organization of the guidance is similar to an ISO standard. Section 1 is the introduction. Section 2 is the scope of the guidance. Section 3 includes definitions, and Section 4 provides an overview of human factors engineering and usability engineering as these concepts apply to medical devices. Sections 5 through 9 of the guidance explain the details of the process for applying these concepts to medical devices and risk management. The guidance document includes six references to national and international standards that include human factors engineering or usability engineering, and there are 19 references to articles about human factors engineering and usability engineering at the end of the guidance document.

Adding Usability to Your Risk Management Procedure

The steps in the process for human factors engineering and usability engineering mirror the risk management process as defined in ISO 14971 except this guidance does not specify developing a risk management plan or the need to create a risk management file. Identification of hazards related to use errors is the first step. Then risk controls are implemented in order to reduce risk of harm due to use errors. The risk controls are verified and validated, typically through simulated use studies or clinical studies. Therefore, you should be able to integrate usability engineering into your risk management process by specifying that hazards should include use errors, environment of use and the device/user interface. The risk controls section does not need to be revised, but the verification and validation of risk controls needs to include simulated use and/or clinical studies in order to verify that risk controls specifically reduce the risk of use errors. It might also be useful to specify that the environment for use should be included in simulated use studies.

Creating a Usability Engineering Report Template

Clients often ask me what they need to do with regard to human factors engineering and usability engineering for documentation in their technical file and design history file. I recommend that they create a usability engineering report based upon ANSI/AAMI/IEC 62366. However, companies often do not want to purchase the standard, and they seldom have time to read and understand what the standard is recommending. Now we have a free guidance document that is available from the FDA. Therefore, I recommend that you create a template for your usability engineering report based upon this new guidance. If your company makes many types of products with multiple hazard types, then you will need a somewhat generic report template. However, companies with only one or two device families should be able to pre-populate a report template with the sections for specific categories of hazards that are applicable to their device family. Once you have a template, this can be used to create a usability engineering report during the design process for any new medical device you are developing.

Updating Your Risk Management File to Include Usability

For products that are already on the market, you should already have human factors engineering and usability engineering incorporated into your risk management file. If you don’t, I recommend updating your risk management file in the following ways:

  1. update your post-market surveillance plan / risk management plan to specifically gather information about use errors related to the use environment, the user and the device/user interface

  2. update your hazard identification report to include hazards related to use errors

  3. update your risk analysis to include risk controls that you have implemented to reduce the risk of harm related to use errors

  4. perform and document verification and validation of any new risk controls that you may implement related to use errors

  5. update you instructions for use to include warnings and precautions about use errors

  6. develop training tools, such as videos, to demonstrate possible use errors and how to avoid them

The bulk of human factors engineering and usability engineering is documented in the risk management file. Risk management documentation is only required for FDA submissions that include: 1) software of moderate level of concern or higher, 2) De Novo Classification Requests, and 3) PMA submission. If you have a non-software device for which you are submitting a 510(k), then you do not include a risk analysis with your submission. Therefore, the only way that the usability factors are addressed is by reviewing the simulated use validation of the device and the instructions for use. It is still critical that design teams address usability engineering, however, because identifying use errors and implementing risk controls to eliminate use errors will prevent product complaints and adverse events. If these issues are not addressed during the design of a new product, corrective actions and possibly recalls will be needed after product launch. FDA inspectors will also identify weaknesses in your risk management activities when they identify complaints that are not addressed in your risk analysis.

Additional Training Resources for Usability Engineering

Our human factors testing webinar was recently updated by Research Collective–a consulting firm specializing in usability engineering. SYS-048, Medical Device Academy’s Usability Procedure, is compliant with IEC/ISO 62366-1 (2015). The procedure includes a template for conducting summative (validation) usability testing. We have also updated our design plan template to include usability testing elements.

Posted in: FDA

Leave a Comment (1) →

How to handle FDA inspector with incompetencies and ego

Handle FDA inspector egos and incompetencies during an audit of your facility–including requests for exempt quality system records.

p31653 p v7 aa e1449491882329 298x300 How to handle FDA inspector with incompetencies and ego

This is not how to handle FDA inspectors or auditors!

This topic was submitted to my suggestion box from a colleague in Australia. Originally I posted this as an announcement for my LinkedIn Group, but the post was limited to ISO certification body auditors and excluded FDA inspectors. The basic approach is the same, but there are some important nuances regarding how to handle FDA inspector incompetencies and ego that I include in this article.

Handle FDA Inspector Distrust

In general, anyone that works for the FDA is genuinely concerned about public health and welfare. They also have a very low tolerance for unethical behavior. This has not always been the case at the FDA, and the agency has fought hard over the past twenty years to eliminate anyone from their ranks that is not ethical. Therefore, if an FDA inspector thinks that you have something to hide, the best approach to handle FDA inspector concerns is to give them anything they ask for–and quickly.

Unlike ISO auditors, FDA inspectors are not allowed to review three types of records:

  1. Management Review Meeting Minutes
  2. Internal Audit Reports
  3. Supplier Audit Reports

The FDA can learn almost everything they want to know by reviewing CAPAs that resulted from Management Reviews, internal audits, and supplier audits. However, some FDA inspectors will still ask to see records that are part of the quality system record exceptions (i.e., 21 CFR 820.180c). Some quality system managers design cover sheets for these three records to specifically show FDA inspectors only the information that they are entitled to. If I am faced with this situation, I handle FDA inspector requests for restricted quality system records in the following way.

“Here is a copy of the quality system record you requested. This is one of the records that are exempt from the requirements in 21 CFR 820.180. However, we have nothing to hide. Therefore, you can take as many notes as you like about the content of this record, but you may not take a copy of the record with you.”

The above approach is intended to convince an FDA inspector that you have nothing to hide. Still, it also requires that you review and edit your records before approval and archiving to make sure that statements made in the records are appropriate–regardless of the audience reading the record.

Handle FDA Inspector and auditor personality

100% of auditors are a little weird (yep, takes one to know one). You travel for a living and tell people what’s wrong with their quality system. If you don’t start drinking scotch, you probably will eventually. However, a little patience, understanding, and communication helps. For example, provide directions (that are accurate). Recommend a hotel (middle of the road, not the Ritz or a fleabag). Tell them about the corporate discount. Ask them in advance if they have food allergies (I’m gluten-free, and not by choice), and then try to remember not to serve only the things they are allergic to (yes, Panera Bread is a crappy choice, but a gluten-free pizza is heaven). If Uber makes sense, recommend it because nobody wants to negotiate with Payless Rent-A-Car at 11:59 pm.

FDA inspectors are in the same situation as auditors with regard to being travel weary. However, FDA inspectors will probably not take your recommendation for a hotel. Instead, they will follow FDA guidelines and stay at a hotel chain where they prefer to accumulate membership points, and they can get a government employee discount. In addition, FDA inspectors will not eat at your facility. It seems as though a few companies entertained FDA inspectors at clubs and fancy restaurants in the past. In order to eliminate any possible perception of unethical behavior, FDA inspectors are now instructed to leave your facility for lunch and return to complete the day. They probably won’t even accept a cup of coffee unless you place a carafe on the table for everyone to drink. You can also count on the FDA inspectors driving a rental car if they do not live locally.

Handle FDA Inspector and Auditor Ego

Everyone has an ego. Auditors typically have a big one, and a few FDA inspectors do too. I’m not shy, I’m smart, and I love a good debate. If I’m you’re auditor; you’re lucky because I’ll admit when I’m wrong or make a mistake. Most auditors will not admit mistakes. In fact, the stronger they argue a point, the more likely that they are insecure on the topic or that they have a personal preference that is a result of a bad experience. Unfortunately, FDA inspectors seem to be even more likely to argue a point when they know very little experience.

Don’t ask FDA inspectors and auditors to prove something is in the regulations or the standard. Instead, try reading Habit 5 by Covey (7 Habits of Highly Effective People). You need to be an empathic listener. The FDA inspector or auditor doesn’t hate you. They might even be trying to help you. They also might be wrong, but try restating what the person is saying in your own words and try explaining why it’s important. This shows them that you were listening, you understand what they said, and you understand how they feel about the issue. Pause. Then tell them how you were trying to address this issue.

One of the areas where the above approach is especially important is when an FDA inspector is reviewing complaint records and medical device reports (MDRs). You want to convince the FDA inspector that you are doing everything you can do to investigate the complaint or adverse event, and you want to prevent a recurrence. Remember that someone was hurt by your device or misuse of your device, and FDA inspectors take public safety very seriously. You will not be able to handle an FDA inspector that believes you are doing less than you could be.

Handle FDA Inspector and Auditor Incompetencies

FDA inspectors rarely have industry experience, but they know the regulations. Therefore, arguing the regulations with an FDA inspector is a huge mistake. The only frame of reference for “industry best practice” is what the FDA inspector has seen at other device manufacturers they audit. Therefore, it is very import to know how experienced your FDA inspector is. If they don’t have a lot of experience, they will be defensive, and you might need to “educate” them.

During ISO audits, you have less time to retrain your auditor. Don’t even try. I do this for a living, and we’re a stubborn bunch of orifices. Instead, try the empathic listening first. 99% of the time, one or both of you are not communicating clearly. Either they can’t find what they are looking for, or they misunderstood what you were telling them. It could be a difference of interpretation, but it’s probably not. If it is, then say, “We were interpreting that requirement as…”. Say this once. If they argue, let it drop for now.

Resolution of 483 Observations and Audit Findings

You shouldn’t just take incorrect findings lying down. Do your homework. Send me an email. Get help. If you’re right, then contest it at the closing meeting in a factual and persuasive way. If the auditor holds their ground, ask what the policy is for resolving disputes. This is supposed to be covered as part of the closing meeting of every audit. If your auditor is just lazy, sloppy and incompetent–request a new auditor. You might even disagree in writing, address the finding anyway, and then request the new auditor. That shows the management of the certification body that you’re not lazy, sloppy, or incompetent.

FDA inspection 483 observations are a little different. If you and the inspector disagree, you should state this in the closing meeting when they give you the 483 observation, and you should be clear that you disagree prior to the end of the inspection when they start preparing FDA Form 483. Once a 483 observation is issued, however, your only recourse is to persuade the district office that the 483 observation is undeserved. The FDA district office will have copies of all your procedures and records and a copy of the FDA inspector’s notes. Be careful with complaints to the district office, though. FDA inspectors are far more likely to retaliate than ISO auditors.

Caution

If you make a habit of disputing everything, your auditor or FDA inspector will come prepared for war. You also will have little credibility with the managers at the certification body or the FDA district office. Dispute only justified things and provide a written, factual justification that is devoid of all emotion.

Responding to FDA 483 Observations

If you do receive FDA 483 observations, it is important that you respond with well-conceived corrective action plans. If you need help with responding to an FDA 483 inspection observation, you might be interested in my webinar on this topic.

Posted in: FDA

Leave a Comment (0) →

Strategic planning of a mock FDA inspection

This article shows you how to think strategically when you plan a mock FDA inspection to ensure that you successfully prevent an unpleasant FDA inspection.

strategic planning Strategic planning of a mock FDA inspection

For the past couple of years, several clients have asked me to conduct mock FDA inspections to prepare them for a potential FDA inspection. I am writing from Shanghai, China, where I am conducting a mock FDA inspection for a medical device client with another auditor from the company’s business unit in the USA.

The mock FDA inspections I conduct are internal audits and technically not an inspection because inspectors are looking for nonconformities, and I am looking for conformity with the FDA regulations (i.e., 21 CFR 820, 21 CFR 803 and 21 CFR 806). Inspections are conducted by FDA investigators that are conducting an inspection in accordance with the FDA QSIT manual (http://www.fda.gov/ICECI/Inspections/InspectionGuides/ucm074883.htm). I use the process approach to conduct audits of the four major quality systems that FDA inspectors focus on during an FDA inspection. Still, as an auditor, I have several advantages that an inspector doesn’t.

  1. I can evaluate auditees and coach them on how to respond to an FDA inspector more effectively.
  2. I can teach my client’s internal auditors and management team how to use internal audits and Notified Body audits as practice for their next FDA inspection.
  3. I can avoid any area that my client wants me to and focus on areas of concern.
  4. I can help my client identify the most likely product or product family to be targeted by the FDA.
  5. I can give my client advice and help them implement corrective actions.
  6. I can teach my client how to respond to potential FDA Form 483s to avoid a Warning Letter.

Opening meeting for a mock FDA inspection

FDA inspections are not planned, but it is important to make sure that the right people are available and present during a mock FDA inspection, or your “inspector(s)” may not be able to review the records or interview the most important people. Therefore, I provide an agenda ahead of time, indicating which processes I will be auditing on which days. My agenda for a mock FDA inspection begins with an opening meeting, but the purpose of this opening meeting is primarily training. I take advantage of having all the senior managers in one room as an opportunity to explain how they can benefit most from the audit, and to remind them of what to expect during a real FDA inspection.

CAPA Sources

After the opening meeting, I take a brief tour—unless I already know the facility well. Before I leave for the tour, I ask my client to be prepared for me to begin auditing nonconformities, complaint handling, MDRs, and recalls when I return to the conference room. I select these areas because the FDA always starts with the CAPA process, but they look closely at the sources of CAPAs at the same time. I believe that inspectors rarely take “random samples.” Instead, most inspectors use the sources of CAPAs to help them bias there sampling of CAPAs.

Production and Process Controls

The next major process in my agenda after CAPAs and sources of CAPAs is production and process controls. The sequence of my process for auditing this area is always the same: 1) request the Device Master Record (DMR) for the target product or product family, 2) request two or more recent Device Master Records (DHRs) that were associated with a complaint record or MDR (remember samples are never random), and 3) I then go to the production areas identified in the DHR, and I try to interview the people that produced the lot identified in the DHR—rather than the people the department manager feels are the most experienced. This process of working backward from complaint records and MDRs to the activities on the production floor often allows me to help companies identify a root cause that they missed when the complaint or MDR was initially investigated.

Design Controls

Auditing a Design History File (DHF) is about as exciting as watching paint dry for most auditors. Still, I am always fascinated with how things work, so I am more engaging with the design team members I interview during a mock FDA inspection. I also like to focus on aspects of the design that have proven to be less than perfect—by reviewing nonconformities, complaints, MDRs, recalls, and CAPAs first. For example, if I see several complaints related to primary packaging failures, I am going to spend more time reviewing the shipping validation and shelf-life testing, than I might normally allocate.

Management Processes

The FDA is somewhat limited in this area because, in accordance with 21 CFR 820.180(e), the records of internal audits, supplier evaluations, and management reviews are exempt from FDA inspections. During a mock FDA inspection, I do not have this constraint. Therefore, I will often look more closely at these three areas than an FDA inspector to make sure my client has effective management processes. While procedures and schedules are the focus of an FDA inspector, I will make sure that the problems I observed in nonconformities, complaints, MDRs, and recalls are being addressed by management. As a quality manager, this is not always easy to do. Still, as an independent consultant, I have the luxury of being blunt when a senior manager needs to hear from someone other than the typical “yes men.” I also can use this part of mock FDA inspections to benchmark best practices I have learned from the hundreds of companies against what my client is currently doing to manage their quality system.

When to schedule a mock FDA inspection

Scheduling a mock FDA inspection immediately after an FDA inspection is pointless, but there is an optimal time for scheduling your mock FDA inspection. The FDA target is to conduct inspections once every two years for Class II device manufacturers. However, some district offices do better or worse than this target. Therefore, it’s important to keep track of the typical frequency in your district and the date of your last inspection. If the FDA is on a two-year cycle, you want to conduct your mock FDA inspection approximately 6-9 months before the next FDA inspection to ensure that you have time to implement corrective actions before the FDA inspector arrives.

Additional Resources

If you are interested in learning more about this topic, I highly recommend watching and listening to my free webinar on how to prepare for an FDA inspection:

http://robertpackard.wpengine.com/how-to-prepare-for-an-fda-medical-device-inspection/

In addition to preparing for an actual inspection, every company must know how to respond effectively to an FDA 483 inspection observation:

http://robertpackard.wpengine.com/7-steps-respond-fda-483-inspection-observation/

In addition to my blog, I also have recorded a webinar on this topic:

http://robertpackard.wpengine.com/7-steps-respond-fda-483-inspection-observation-webinar/

Finally, every manager needs to be reminded that FDA 483s are just another opportunity to write a CAPA and improve their quality system. Therefore, do yourself a favor and watch my new webinar on creating a risk-based CAPA process:

http://robertpackard.wpengine.com/create-a-risk-based-capa-process/.

Posted in: FDA

Leave a Comment (0) →

21 CFR 820.180 – Exceptions to the US FDA’s Record Requirements

21 CFR 820.180 Exceptions to the US FDA’s Record Requirements 21 CFR 820.180   Exceptions to the US FDA’s Record RequirementsThis article provides practical advice for how to deal with records the FDA is not allowed to request during an inspection and FDA inspector tactics specific to 21 CFR 820.180 – exceptions. When I meet with a new consulting client, the phrase I dread hearing is “the FDA can’t see that.” Indeed, the FDA is not supposed to review the content of internal audit reports, supplier audit reports, and management reviews to encourage companies to use these tools to address quality problems without having to worry about the FDA beating them with their reports. This policy is officially stated in subsection C of 21 CFR 820.180–exceptions:

21 CFR 820.180 – Exceptions

“[21 CFR 820.180 – exceptions] does not apply to the reports required by 820.20(c) Management review, 820.22 Quality audits, and supplier audit reports used to meet the requirements of 820.50(a) Evaluation of suppliers, contractors, and consultants, but does apply to procedures established under these provisions. Upon request of a designated employee of FDA, an employee in management with executive responsibility shall certify in writing that the management reviews and quality audits required under this part, and supplier audits where applicable, have been performed and documented, the dates on which they were performed and that any required corrective action has been undertaken.”

The Problem with Hiding Records

The problem with the mentality of hiding things from the FDA is that it fails every time. The FDA can get to issues in your management reviews and your internal audits by asking, “Can I please see all the CAPAs resulting from audits and management reviews.” One client I spoke with said that they purposely don’t open any CAPAs from audits or management reviews for that reason. I was in complete shock, but I managed to keep my poker face and asked the client, “So what do you think the FDA will do when you say that you don’t have any CAPAs resulting from audits or management reviews?” Management responsibility is a frequent FDA inspection target. Most companies are subjected to a Level 2, QSIT inspection on a biannual basis. During these comprehensive inspections, the inspector reviews the four major subsystems: 1) management controls, 2) design controls, 3) CAPA, and 4) production and process controls. The FDA will ask open-ended questions to determine the effectiveness of the QMS. If the inspector is not going to look at the actual meeting minutes from the management review, you can expect them to look at the following apparent targets:

  1. “May I see your procedure for Management Reviews?”
  2. “May I please have a copy of your organization chart?”
  3. “Could I see the agenda and attendees list from your last management review?”

The inspector could also ask for copies of inputs that are identified in the Management Review procedure, such as: “Could I have a copy of the most recent scrap trend analysis for production?” or “What is your threshold for taking corrective actions for rejects found in receiving inspection?” One Quality Manager told me a fascinating story about his local inspector. During a previous inspection, the inspector requested a copy of the management review. The Quality Manager showed him the cover page that indicated the agenda and the attendees. The Quality Manager refused to let the inspector see the rest of the meeting minutes. The inspector then proceeded to conduct a brutal 3-day inspection where a myriad of 483’s was written. Twelve months later, the inspector returned to perform a “Compliance Follow-up.” This time when the inspector asked to see the management review, the Quality Manager agreed to let the inspector see the entire meeting minutes. From that point onward, each time the inspector got close to identifying a new 483’s, the inspector would stop following the audit trail at the last moment before the nonconformity was identified. The Quality Manager said it was almost like the inspector was showing him that he could find all kinds of problems to write-up if he wanted to. Still, he was taking it easy on the company because the Quality Manager was cooperative. My philosophy is to create a QMS that is open for review by any customer, auditor, and even the FDA. No matter what they find, it’s just another opportunity to improve. This has worked well for me, but you need to follow a few basic rules when writing audit reports and management review meeting minutes.

Rules for Writing Audit Reports & Management Reviews

  1. DO NOT write anything inflammatory or opinionated in your documents. My motto is, “Stick to the facts, Jack (or Jill).”
  2. I ask other people in the management team to read and review the meeting minutes before they are finalized. The variety of perspectives in top management helps to make sure that the final document is well written and clear—especially to FDA inspectors.
  3. I structure the documents as per a standard template that is a controlled document. This ensures that each report or management review was conducted as per the procedure. I typically reference the applicable clauses and sub-clauses throughout the document. For example, I will reference ISO 13485:2003, Section 5.6.2h) for the slide titled “New and Revised Regulatory Requirements.” I put the reference next to the slide title just to make it clear what requirement this slide is addressing.
  4. If there is an area that I covered, but there was nothing to discuss, I write, “There was no further discussion on this topic.”
  5. If there is an area that I did not cover, I make sure I do the following:
  6. write a justification for not covering the area,
  7. indicate the last time the area was covered (and the result at that time), and
  8. document when the area will be covered in the future.

You can continue to listen to the advice of consultants that think of creative ways to hide things from the FDA, or you can follow the above advice. If you follow my advice, then you can spend the rest of your time working on the CAPAs for each area where you identified a weakness—instead of spending your time trying to hide your problems. If you need help preparing for an FDA inspection or responding to FDA 483 inspection observations or warning letters, please email Rob Packard. We have two people on our team that used to work for the agency.

Posted in: FDA

Leave a Comment (1) →

FDA QSIT Inspection of Design Validation: Part 2-Software

qsit FDA QSIT Inspection of Design Validation: Part 2 SoftwareThis article reviews FDA QSIT inspection requirements of design validation and is specific to devices containing software.

If the product selected has software, then the investigator is instructed by the FDA QSIT Inspection Manual (http://bit.ly/QSITManual) to consider reviewing software validation. Since inadequate software validation causes many quality problems with devices, you should be shocked if an investigator doesn’t review software validation of a device containing software. Software-containing devices are also the only devices that manufacturers are required to submit a risk analysis for when submitting premarket notifications (i.e., 510k submissions).

Software Validation

Validation confirms that a device meets the user needs. Software validation is no different. In the case of software validation, the “device” is the final complete software program in the operating environment in which it is intended to be used (i.e., operating system and hardware), and the “” is the “software design requirements” document.

To facilitate the validation of software, a traceability matrix is typically used to facilitate the construction of validation protocols. The traceability matrix will identify each requirement in the left-hand column of the matrix. The columns to the right of the requirements should include the following:

  1. hazard identification
  2. the potential severity of harm
  3. P1 – the probability of occurrence
  4. P2 – the probability of occurrence resulting in harm
  5. risk controls
  6. design outputs or references to the code modules that are responsible for each requirement
  7. references to verification and validation testing for each risk control
  8. estimation of residual risks
  9. risk/benefit analysis of each risk and overall risk
  10. traceability to information disclosed to users and patients or residual risks

Since the failure of each module can easily result in multiple failure modes, the above approach to documenting design requirements and risk analysis is generally more effective than using an FMEA. This approach also has the benefit of lending itself to assessing risk each time new complaints, service reports, and other post-market surveillance information is gathered.

The use of a traceability matrix also lends itself to the early stages of debugging software modules and unit validation. Each software design requirement will typically have a section of code (i.e., a software module) that is associated with it. That module will be validated initially as a standalone unit operation to verify that it performs the intended function. In addition to verifying the correct function, the software validation protocol should also verify that the embedded risk controls catch incorrect inputs to the module for that module. The correct error code should be generated, and applicable alarms should be triggered.

Finally, after each requirement has been verified, the entire software program must be validated as well. When changes are made, the module and program as the whole must be re-validated. Inspectors and auditors will specifically review changes made in recent versions to verify that revalidation of the entire program was performed–not just unit testing. You must also comply with IEC 62304, medical device software – software lifecycle processes. This is required for CE Marking as a harmonized standard and recognized by the US FDA (http://bit.ly/Recognized-Consensus-Standards). One of the implications of applying IEC 62304 is that you must consider the risk of using software of unknown pedigree or provenance (SOUP).

Software Risk Analysis

Each requirement of the software design requirements document will typically have a risk associated with it if the software fails to perform that requirement. These risks are quantified concerning the severity of harm and the probability of occurrence of harm. The likelihood of occurrence of harm has two factors: P1 and P2, as defined in Annex E of ISO 14971:2007 (http://bit.ly/14971-Webinar).

P1 is the probability of occurrence, and for software, we have two factors. First, the situation must occur that will trigger a failure of the software. Second, does the software have a design risk control that prevents harm or provides a warning of the potential for harm? P2 is the probability that occurrence will result in harm; P2 has one factor. P2 is determined by evaluating the likelihood that failure will result in harm if the risk control is not 100% effective.

An investigator reviewing the risk assessment should verify that risk has been estimated for each software design requirement. There should be harm identified for each software design requirement, or the traceability matrix should indicate that no harm can result from failure to meet the software design requirement. Next, the risk assessment should indicate what the risk controls are for each requirement identified with the potential for harm. In accordance with ISO 14971, design risk controls should be implemented first to eliminate the possibility of harm. Wherever it is impossible to eliminate the possibility of harm, a protective measure (i.e., alarm) should be used.

Each risk control must be verified for effectiveness as part of the software validation. Also, the residual risk for each potential harm is subject to a risk/benefit analysis in accordance with EN ISO 14971:2012, Annex ZA Deviation #4 (http://bit.ly/14971dev4). The international version, ISO 14971:2007 (which is recognized by the US FDA and Health Canada), allows companies to limit a risk/benefit analysis to only unacceptable risks. Therefore, the European requirement (i.e., EN ISO 14971:2012) is more stringent. Companies that intend to CE Mark medical devices should comply with the EN version of the risk management standard instead of the international version for risk management.

Posted in: FDA

Leave a Comment (2) →

FDA QSIT Inspection of Design Validation: Part I-Non-Software

qsit FDA QSIT Inspection of Design Validation: Part I Non SoftwareThis article reviews FDA QSIT inspection requirements of design validation and is specific to devices that do not contain software.

In the FDA QSIT Manual (http://bit.ly/QSITManual), the word “validation” appears in the QSR 78 times. This exceeds the frequency of the name “verification,” “production,” “corrective” and the acronym “CAPA.” The word “validation” is almost as frequent as the word “management”–which appears 80 times in the QSIT Manual. The section of the QSIT Manual specific to design validation is pages 35-40.

The FDA selects only one product or product family when they are inspecting design controls. Therefore, if you keep track of which products have already been inspected by the agency, you can often predict the most likely product for the investigator to select during the next inspection. The number of MDRs and recalls reported will have an impact on the investigator’s selection. Class, I devices are not selected.

The QSIT Manual instructs inspectors to verify that acceptance criteria were specified before conducting design validation activities and that the validation meets the user needs and intended uses. There should also be no remaining discrepancies from the design validation. Inspectors must verify that all validation activities were performed using initial production devices or production equivalents. The last item to verify is that design changes were controlled–including performing design validation of the changes.

Risk Analysis

Risk analysis is seldom reviewed in great detail–except software risk analysis. However, when a nonconforming product is reworked, it is required to review the adverse effects of rework. QSIT inspectors will expect you to document this review of risks. Investigators will also expect risks to be reviewed and updated in accordance with trend analysis of complaints, service reports, and nonconformities. Finally, when companies assess the need to report recalls, the FDA expects to see a health hazard evaluation to be completed (http://bit.ly/HHE-Form). A detailed review of risk analysis is uncommon in QSIT inspections but receives greater emphasis in the review of CE marking applications.

Predetermined Acceptance Criteria

Investigators reviewing your design validation protocols will specifically look at the acceptance criteria for testing you perform. Investigators are looking for two things. First, were the acceptance criteria met without deviation? Second, was the protocol approved before knowing the results (i.e., was this a prospective design validation protocol?). In certain areas, there are also known risks associated with products that the investigators will look for. For example, in sterilization validation, the investigator will verify that the validation was performed to the most current version of the standard and that the validation has addressed the most common pitfalls of sterilization. For example:

  • Have the most challenging devices been identified?
  • Has performance been validated at the maximum sterilization dose?

User Needs & Intended Uses are Met

In the area of user needs and intended uses, there are few problems with the initial launch of devices for the intended use. Problems typically arise when companies expand the intended use to new patient populations and new intended uses. When this occurs, there may be unique user needs and risks that need to be evaluated. Therefore, the FDA periodically reviews claims made by companies in marketing communications to ensure that claims do not stray beyond the cleared intended use of the device. This will sometimes be identified as a 483 inspection observation. In some instances, the FDA will issue a warning letter to a company that continues to market a device for uncleared indications.

Initial Production Devices or Production Equivalents

When investigators review validation protocols and reports, the documentation must include traceability to the production lot(s) of the device. Investigators may even request a copy of the Device History Record (DHR) for the production lot used for validation. If a production lot is not used, then the design validation documentation must disclose how the product differs from production lots, and why the results are acceptable. The samples used should be subjected to the final test/inspection requirements. If final test/inspection requirements are not yet established, samples should be retained, so that they can be inspected at a later date. Without this traceability, you may have to repeat your design validation with a production lot.

Validation of Design Changes

Far too many hours are wasted writing justifications for why re-validation is not required. I recommend that re-validation of design be performed for any design change if all three of the following criterion are not met:

  1. a sound scientific rationale can be provided with references
  2. the logic does not require a subject matter expert to understand it
  3. quantitative analysis is possible to analyze the risk impact

Many design validations require simulated use with a physician. Companies should obtain as much user feedback as possible before launching a device. Therefore, any re-validation that requires simulated use and user feedback should be a priority over writing a rationale for not conducting re-validation.

Posted in: FDA

Leave a Comment (0) →

Obtaining an FDA Certificate to Foreign Government for Medical Devices

certificate to foreign gov Obtaining an FDA Certificate to Foreign Government for Medical DevicesThis article explains how to obtain an FDA Certificate to Foreign Government when you are trying to submit an application for registration of a medical device to a regulatory body outside the United States (e.g., COFEPRIS approval for exports to Mexico).

What is an FDA Certificate to Foreign Government?

If you have a medical device that is registered and listed with the US FDA, then you can obtain a Certificate to Foreign Government from the US FDA. A Certificate to Foreign Government is a certificate issued by the US FDA verifying that your company may legally export the device, and the device may be distributed in the United States. Regulatory bodies in some countries request a “Certificate of Free Sale.” Still, these are issued by the US FDA for foods, while the agency issues Certificates to Foreign Governments for medical devices. The name of the certificate is not the same for all countries, and regulators use the terminology most familiar to their country. The US FDA has more information about the different types of certificates on the following FDA webpage: http://bit.ly/FDA-Export-Certificates.

How do you obtain a Certificate to Foreign Government?

The following page on the FDA website answers common questions about exporting medical devices. http://bit.ly/Exporting-Medical-Devices. One of the most common requirements of foreign registrations is providing a Certificate to Foreign Government. If your product is currently registered and listed with the US FDA, you are managing your registration and listing using an FDA Unified Registration and Listings System (FURLS) account (http://bit.ly/registration-listing-blog). Through this account, you can access the new CDRH Export Certification and Tracking System (CECATS). CECATS allows manufacturers to request export documents, including Certificates to Foreign Governments, online versus paper submissions. CECATS reduces certificate processing time and will enable you to validate firm-specific data in real-time. You can also obtain a status update for your certificate request. If you have additional questions about CECATS or export certificates, the FDA also created an Exporting FAQs page: http://bit.ly/Exporting-FAQs.

How much does a Certificate to Foreign Government Cost?

Certificates to Foreign Government are product specific and cost $175 for the original certificate. Each additional copy (official copies from the FDA are usually required) costs $15 per copy. Up to 50 pages (including the certificate, manufacturer page, and attachment pages) may be submitted for the same product. Each time an increment of 50 pages is exceeded, an additional fee of $175 will be charged.

If the original is three pages long and you request an original and ten copies (33 total pages), then your charge will be $175 for the original and $150 for the ten copies–a combined total of $325. However, an original and 20 copies (63 pages) would exceed the 50-page limit, and you would be charged $175 for the first original and $225 for the first 15 copies. You would then be charged $175 for a second original and another $60 for four more copies.

Don’t wait until the last minute to request Certificates to Foreign Governments. I recommend ordering 5-10 copies when you first register a product in the FURLS database, instead of waiting until you need it. The same is true of other types of certificates, such as CE Marking certificates from your Notified Body.

Posted in: FDA

Leave a Comment (2) →

FDA Establishment Registration and Listing for Medical Devices

Do you need help with completing your initial FDA establishment registration and listing for a medical device? Watch our video to learn how.

The two most common situations for when a company needs to register their establishment with the FDA is 1) when the company is a contract manufacturer and producing a finished device for the first time, and 2) when the company is a specifications developer that recently received a 510(k) and is about to begin distribution of the newly cleared product. If your company is a specification developer, and you have not yet submitted your first 510(k), then you need to complete your Medical Device User Fee Cover Sheet first. If you have already received 510(k) clearance, or your device is exempt from 510(k) clearance, this article and the associated video will help you complete your FDA establishment registration and listing.

Small Business Status does not apply to FDA establishment registration

Most first-time 510(k) submissions are from small companies. If your company has gross receipts of less than $100 million, then you should apply for status as a small business by completing FDA Form 3602A–along with your company’s tax return for the previous year. You should apply every year on August 1, 2021. The qualification process takes 60 days, and you never know when you might need to submit a 510k for a device modification. Qualifying for small business status saves substantially on FDA submission fees. The FDA’s review and decision regarding your application for small business status require 60 days, and the status expires each year on September 30. Click on this link for a guidance document explaining the process for requesting small business status in detail.

Medical Device User Fee Amendment (MDUFA)

A few weeks before you submit your first 510(k) to the FDA, it is recommended that you create a new account for the user fee website and make your Device Facility User Fee (DFUF) payment. This is the website you must access to pay the 510(k) submission fee. If you are taking advantage of small business status, you will need the Small Business Decision Number that you received in the FDA decision letter in response to FDA Form 3602A. Small and large businesses should follow the directions in the guidance document to set-up a new MDUFA account.

DFUF Website FDA Establishment Registration and Listing for Medical Devices

Once the user fee account has been created, you need to complete a 510(k) user fee cover sheet. The FDA provides instructions on how to complete the cover sheet. Payment must be submitted to the FDA as well, and the FDA offers multiple ways to pay the user fee for FDA establishment registration.

After you submit your 510(k) and receive your 510(k) clearance letter, you now may begin the marketing and distribution of a product. Once a company starts the distribution of a new product, the company has 30 days to register the facility and list each device with the FDA. Before registering with the FDA, you must also make a second DFUF payment for the establishment registration fee of $5,546 (FY 2021 fee, increases every year). There is no discount available for small business status when you are paying the FDA establishment registration fee. Discounts are only available for submission fees (e.g. the 510k user fee). The FDA establishment registration fee must be paid for each facility being registered between October 1 and December 31. If renewal fees are not paid on-time, your registration will become inactive.

FDA Establishment Registration and Listings System (FURLS) Database

The FURLS database is a separate database where companies register facilities and list devices with the FDA. The FURLS account ID and password used for FDA establishment registration of your facility is separate from the user name and password for the user fee website used for the DFUF payment. After you pay the annual registration user fee, you will receive the following information via email: Payment Identification Number (PIN), and Payment Confirmation Number (PCN). You will need this information to complete the registration in the FURLS database.

FURLS Website FDA Establishment Registration and Listing for Medical Devices

To create a new FURLS account, you access the following website. This new account should only be created if your company does not already have an account, and the person creating the account should be a trusted manager with authority to designate sub-accounts when needed. The process of creating a new account will result in the issuance of an account ID, and you will need to select a password during the process. You need this information for logging into the system in the future. If you already have an FDA establishment registration and listing account, and need help managing it or making changes, the FDA also has an account management page.

FDA Establishment Registration and Listing – Additional Resources

The FDA created a webpage explaining medical device FDA establishment registration and listing, but the following page is the place I recommend that most companies begin reading. If you want Medical Device Academy to help you with FDA establishment registration, we offer this free of charge to our 510k submission clients and turnkey quality system clients. New clients, and clients that have not hired us for a 510k or quality system, can hire us as a US Agent and/or to help with registration and listing by using our calendly link for registration and listing assistance.

If you want additional training on how to register and list your facility with the FDA, please visit the updated CDRH Learn webpage: (Click on “Start Here/The Basics”). The FDA offers a “post-test” and certificate for anyone completing the post-test. I recommend completing this training before setting up a new account, and anyone that will be responsible for updating the FDA establishment registration and listing information.

Posted in: FDA

Leave a Comment (0) →

5 Classic blunders that result in an fda warning letter from CDRH

FDA Warning 5 Classic blunders that result in an fda warning letter from CDRHThis blog reviews 5 of the most common reasons for why CDRH issues FDA warning letters, and preventive actions are suggested for each of the five reasons.

The following is a quote from an interview I conducted with a former FDA inspector:

“You’re in deep trouble if the [FDA 483] response is excellent, and the corrective actions are excellent, but when the FDA comes back, you never bothered to implement those corrective actions. Now you know that you have that warning letter coming at you.”

#1 – No actions implemented for CAPAs

The former inspector is describing one of the most common reasons for FDA warning letters. If an FDA investigator issues an FDA 483, you are required to respond with a corrective action plan (http://bit.ly/FDA-483). However, you must implement your plan to close the FDA 483 inspection observation(s) during the next FDA inspection. CDRH’s QSIT inspection manual (http://bit.ly/QSITManual) requires that the CAPA process be evaluated during every inspection–even during abbreviated inspections, where only two of the four major quality subsystems are sampled (i.e., “CAPA + 1”). Therefore, the FDA investigator will notice if no actions have been taken for CAPAs that were initiated since the last inspection. If the CAPAs are specific to the FDA 483–CDRH requires the FDA investigator to review those records first. To ensure that corrective actions are being implemented and documented, I recommend three ways of controlling the process:

  1. monitor the “aging” of CAPAs and establish a quality objective for average days aging
  2. have an independent expert perform a desktop audit of your CAPA process
  3. ensure that you carefully review each CAPA that is behind schedule during Management Reviews (which should be at least quarterly)

#2 – FDA 483 response submitted late

A second common reason for receiving an FDA warning letter is a failure to submit an FDA 483 response to the district office within 15 business days. The FDA has always involuntarily required a medical device firm to respond to an FDA 483 within 15 business days, but in 2009, a post-inspection review program (http://bit.ly/15Dayresponse) was initiated where it became mandatory that response from any FDA 483 must be received by the Agency within 15 business days, or FDA warning letters are automatically issued. This is an automatic issuance that results in a very quick response from your CDRH district office. Therefore, you need to respond aggressively to FDA 483s with corrective actions and submit your response early.

Note: The FDA warning letters are only issued when inspection observations result in “Official Action Indicated” (OAI). However, inspectors will not tell you if the outcome is OAI or Voluntary Action Indicated (VAI). This determination is made by the District Office of the FDA. Therefore, all device manufacturers should assume that the outcome may be OAI. 

#3 – Submitting a response without evidence of implementing changes

This past Saturday, I recorded a webinar on the “7 Steps to Respond to an FDA 483 Inspection Observation” (http://bit.ly/FDA-483-response-webinar). The title of the third slide in that presentation is “The FDA may be late…”. I mentioned that it is not uncommon for FDA warning letters to be issued six months after the actual inspection occurred. The following warning letter is an example (http://bit.ly/fda-warning-letters-example1).

I don’t personally know this firm, but I found this example by searching through the FDA warning letters database: http://bit.ly/fda-warning-letter-search. The company received an FDA 483 with multiple inspection observations on November 4, 2010. The company was non-compliant in the following areas: CAPA (21 CFR 820.100), complaint handling (21 CFR 820.198), and design controls (21 CFR 820.30). The company responded to CDRH on November 23. This was 13 business days after the FDA 483 was received, and with FedEx shipping, it probably arrived at the FDA barely in time–November 29 (the Monday after Thanksgiving).

Unfortunately, the response did not include evidence of correcting the existing procedure deficiencies. The plan indicated changes were going to be made, but the FDA expects you to revise procedure deficiencies quickly (i.e., before you mail the response to the FDA 483). If it is not possible to make corrections in this timeframe, a risk-based approach is recommended. For example, the complaint handling process is the most critical of the three processes identified as deficient in the warning letter. Therefore, the company should have enclosed a revised complaint handling procedure and promised to revise the CAPA and design control procedures within a few weeks.

The FDA warning letter was not issued for this example until April 6, 2011–almost exactly six (6) months from the date of the FDA 483 issuance. CDRH offices are ghost towns in December. Therefore, it was important for the company to contact CHRH early in November and identify an email address and contact to send documentation regarding the implementation of corrective actions. The company could have revised the other two procedures in December and implemented all three procedures in December. Evidence of thorough implementation of corrections and corrective actions by email is often adequate to prevent FDA warning letters.

For international firms, this is extremely important because a second warning letter for an international firm results in a warning letter with automatic detention (i.e., the company cannot import a product into the USA). In this example, the second warning letter was issued on November 26, 2012 (http://bit.ly/fda-warning-letters-example2).

#4 – Failure to remove objectionable marketing communications

The FDA does not routinely visit companies that only manufacture Class 1 (i.e., low-risk) devices. However, they routinely visit companies that manufacture medium-risk, Class 2 devices. The FDA reviews websites and other marketing communications for marketing claims that are not within the scope of an issued 510k. Typically, the claims that are allowed are almost verbatim from 21 CFR (i.e., Title 21 Code of Federal Regulations). Therefore, many companies receive an FDA 483 indicating that they are claiming an indication for the use of which the device does not have clearance (i.e., a 510k) for. In these cases, the company is expected to remove the claims and/or submit a 510k. In these cases, often CDRH will wait a year or more before taking additional action to give the firm ample time to obtain clearance for the indications. Here is a link to an example of a warning letter of this type: http://bit.ly/fda-warning-letters-example3.

#5 – Design controls are not implemented at all

Design controls are the most common reason for the issuance of an FDA 483 (http://bit.ly/FY2013-483-Data-Analysis). If you read the blog, Medical Device Academy wrote on the data analysis of FDA 483 inspection observations issued in FY2013 by CDRH, and you may have wondered how design controls are the #1 most common FDA 483. Still, the highest individual clause reference is #8 [i.e., 21 CFR 820.30(i)]. If you review this next warning letter example (http://bit.ly/fda-warning-letters-example4), it should become clear that some companies do not have a design control process implemented at all. In this situation, the FDA investigator is likely to issue a separate FDA 483 against each of the required elements:

  1. 21 CFR 820.30(e) – design reviews
  2. 21 CFR 820.30(f) – design verification
  3. 21 CFR 820.30(g) – design validation
  4. 21 CFR 820.30(h) – design transfer
  5. 21 CFR 820.30(i) – design changes

In this specific example, the FDA investigator issued the FDA 483 on August 16, 2012, and the warning letter was issued immediately after the FDA returned from the holidays–January 4, 2013. This firm had a narrow window of time between August and November to submit an FDA 483 response and then follow-up with documentation of completing the CAPA plan. The warning letter indicates that the corrective action plan was not adequate, but the FDA still took several months to issue the warning letter.

If you recently had an FDA inspection and received an FDA 483, make sure you don’t make any of the mistakes above. You might also want to take the webinar on this topic: http://bit.ly/FDA-483-response-webinar.

If it’s been a year since you received an FDA inspection, you might want to watch the video on this webpage: http://bit.ly/regulatory-compliance-services

Posted in: FDA

Leave a Comment (1) →

7 Steps to writing an FDA 483 response

Responding in 15 business days is one of 7 steps on how to write an FDA 483 response, but do you know what should be in your response?7 steps fda 483 blog 7 Steps to writing an FDA 483 responseWhen an FDA investigator has an inspection observation, the investigator issues an FDA 483. “Form 483” is the FDA form number. If your company receives an FDA 483, it is critical to understand how to write your FDA 483 response in order to avoid a Warning Letter. In the words of a former FDA investigator, “Many, many times I have seen an [Official Action Indicated (OAI)] classified inspection that had been recommended for a Warning Letter by the compliance branch be set aside based upon the response of the firm.”

The best way for your company to write a FDA 483 response is to provide a brief cover letter and to use your CAPA process. Every 483 inspection observation needs to be addressed in the FDA 483 response as a separate CAPA. Make sure that your response includes the following seven steps below:

  1. respond within 15 business days (earlier is better)
  2. use your CAPA form and a cover letter–instead of a memo
  3. document the investigation that was conducted with a concisely stated root cause
  4. identify containment measures and corrections to address each specific observation by the FDA inspector
  5. identify corrective actions planned and the date(s) you expect to complete implementation
  6. Include documentation of containment, corrections and corrective actions that are completed at the time you submit the response
  7. follow-up with a memo confirming that all the corrective actions are complete and include all related documentation–including training for any new procedures or any new corrective actions that warranted training

Your FDA 483 response is required in less than 15 business days

The FDA has always involuntarily required a medical device firm, or any firm under FDA jurisdiction that received an FDA 483, to provide a written FDA 483 response to the District Office within 15 business days. As of two years ago (http://www.gpo.gov/fdsys/pkg/FR-2009-08-11/pdf/E9-19107.pdf), it became mandatory that the Agency must receive a FDA 483 response within 15 business days, or an automatic Warning Letter is issued. You need to respond aggressively to FDA 483s with corrective actions, and submit your response early. The FDA has also modified the format of the response to require email responses.

Use your CAPA forms instead of a memo.

I have asked several former FDA investigators whether they would prefer to see firms submit responses in memo format, or by using their CAPA forms and a cover letter. Some told me that they prefer to see firms use their CAPA forms, while others don’t seem to have a preference. Nobody from the FDA has ever indicated a preference for a memo. I see no point in doubling your work and risking transcription errors. If you have an electronic system that does not have an easy-to-follow output format, go ahead and copy-and-paste the information from your electronic database to your memo. If the CAPA system output is easy to follow, just use a cover letter and copies of the forms.

Document the investigation and root cause

This is definitely my pet-peeve, but a one-sentence “root cause” is not enough for an FDA 483 response. Regardless of whether I am doing a mock-FDA inspection, an internal audit, or a supplier audit–I expect you to document how you determined the root cause (http://robertpackard.wpengine.com/five-tools-for-conducting-root-cause-analysis/). If it’s trivial and obvious, then it must have been something important, or I would not have written a nonconformity. Therefore, you should be looking beyond the immediate scope of the FDA 483 to ensure that a similar problem cannot occur elsewhere. In the language of the FDA, this is a preventive action, because you are preventing occurrence with another process or product. Most ISO certification auditors are purists, and they won’t accept this as a preventive action. You will have to show the purists something special–maybe from your data analysis.

Don’t forget containment and correction

For every 483 observation, including the subparts, you need to identify if immediate containment is necessary and how you can correct the problem. Whenever possible, you should attempt to implement the containment and corrections during your FDA inspection. It would be fantastic to give the FDA inspector a copy of the new CAPA you initiated during the audit. The new CAPA would identify containment and corrections that have been or will be implemented–including any nonconformity(s) you initiated to quarantine product. You may still get an FDA 483 inspection observation, but you are likely to convert a possible Official Action Indicated (OAI) into a Voluntary Action Indicated (VAI). You can also modify the CAPA wording later in your FDA 483 response to include a cross-reference to the FDA 483 and quote the exact wording the inspector uses.

Explain the corrective action plans and timelines

Clarity, brevity, and realistic plans are critical in this section of your response. I prefer a table that looks like the example shown below.

7 steps 483 chart 7 Steps to writing an FDA 483 response

Show the FDA you have already taken action in your FDA 483 response

Whenever possible, you want to show the FDA that you are taking action without delay. If you revised the SOP for MDRs and scheduled a group training for July 15, then you should provide the FDA a copy of the revised procedure and a copy of the agenda for your planned training session. The only caution is to only commit to actions you are certain you will implement. You can always do more, but it will be much harder to explain why you did not implement an action you submitted in your FDA 483 response.

Follow-up with a second FDA 483 response before the FDA asks for it

The FDA’s compliance office will be looking for a response when an FDA 483 is issued, and they will review your response. The investigator will get a copy of the FDA 483 response, and the investigator will comment on the response. The compliance office and the investigator enter their comments into a CDRH database. Still, the comments are only general, as to whether the response is adequate or inadequate and will require additional review.

If you do not hear back from the FDA, do not assume that the compliance office or the investigator was satisfied. You should also follow-up several months later (earlier if possible) with a letter that includes evidence of the completed corrective actions, and your verification of effectiveness. If the verification is compelling and received in less than six months of the inspection, you may convince the compliance office to hold off a planned Warning Letter.

If you are interested in root cause analysis and improving your CAPA process, we have two related webinars:

Posted in: FDA

Leave a Comment (3) →
Page 2 of 4 1234