Blog

Posts Tagged medical device management review

Management Review Procedure Case Study Example

This article, “Management Review Procedure Case Study” describes an error-proof method for review and approval of procedures.

Redlined Management Review Procedure Management Review Procedure Case Study Example

The first time I was ever formally trained on how to conduct a document review was during a lead auditor course. I thought the topic seemed out of place, but as I audited more companies, I realized that missing a regulatory requirement in a procedure was quite common. Regardless of who reviews a procedure, or how many times it is reviewed, something is always missed. Unfortunately, a desktop audit of procedures is not an effective corrective action or verification method. Auditing procedures is an ineffective method for reviewing procedures because audits are limited by sampling.

Instead of random sampling, a systematic review of 100% of regulatory requirements is needed to ensure that none of the regulatory requirements are accidentally omitted. Systematically reviewing the requirements for each country your company is selling in is tedious at best. You need a tool to make the reviewing process error-proof and straightforward. You also need each reviewer of the procedure to have a defined function to eliminate the duplication of work.

Procedure Reviewer Roles

Typically, there are 3-5 reviewers of procedures in most companies. Some companies make the mistake of having as many as 8-10 reviewers of procedures, but more is not better in this case. There are four primary roles for review and approval of procedures:

  1. process owner
  2. quality management
  3. regulatory
  4. independent

The process owner may be the author of a procedure, but I don’t recommend it. Editing someone else’s work is much more useful than editing your own work. Therefore, I recommend that department managers delegate the responsibility for writing a draft of a procedure to a subordinate that needs to perform the procedure. Then the department manager, who should also be the process owner, is responsible for reviewing and approving the initial draft.

The quality management person should be responsible for reviewing the procedure for accuracy and interactions with other processes. For example, the management review process has eight required inputs (i.e., ISO 13485, Clause 5.6.2a-h). Each of those inputs comes from another process and procedure. It is essential to ensure that if you are reviewing the complaint handling procedure, somewhere in that procedure, it should state that the monitoring and measuring of complaint trends should be input into the management review process.

The regulatory person is responsible for verifying that the procedure meets 100% of the regulatory requirements. This person should verify that the scope of the procedure identifies the relevant markets. If there are references to documents of external origin, the regulatory person should verify that these references are accurate. It is recommended to eliminate references to revisions of documents of external origin and internal procedure revisions because the inclusion of revisions will increase the frequency of minor revisions to procedures that add no value.

Finally, the independent reviewer is looking for two things:

  1. Does the procedure make sense–to someone that performs the procedure (if that person was not the author); and to an external auditor, such as a certification body (internal auditors can fill this role)?
  2. Are there typos, spelling, or grammar mistakes?

The independent reviewer does not need to be a manager. It needs to be someone that writes well. Copy editing is tedious, but apparent mistakes in spelling or grammar prompt auditors to review procedures more carefully. I recommend asking an internal auditor to be the independent reviewer.

Reviewing Regulatory Requirements

The two most common reasons for audit findings are:

  1. the procedure is not being followed, and
  2. a regulatory requirement is not being met.

The first problem should be addressed by having processing owners review and write procedures instead of asking quality assurance to provide a procedure. If you are purchasing a procedure, it’s important for the person that will be performing the procedure to carefully review the procedure to ensure it matches how they intend to perform that process. If it’s a manufacturing procedure, I like to conduct the training of personnel with a draft procedure and hand out red pens. That also dramatically reduces complaints from the people that do the work.

For regulatory requirements, your regulatory reviewer needs to create a checklist that includes 100% of the requirements for that procedure. The model I like to follow is the Essential Requirements or Essential Principles Checklist used for technical documentation (i.e., for CE Marking). There are 13 Essential Requirements, and most of the requirements have multiple subparts. The regulatory person that completes an Essential Requirements Checklist must indicate the following information next to the applicable requirement in the checklist table:

  • yes, the requirement applicable or justification if it’s not applicable
  • a reference to any applicable standards
  • a cross-reference to the record where evidence of meeting the requirement can be found (e.g., the risk management file)

Regulatory personnel can revise this approach slightly by doing the following for a review of procedures:

  • yes, the requirement applicable or justification if it’s not applicable
  • a reference to the applicable specific sub-clause in a Standard or a regulation
  • a cross-reference to the subsection of the procedure where evidence of meeting the requirement can be found (e.g., section 5.1 of the SYS-003)

Case Study of SYS-003, Management Review Procedure

In the Medical Device Academy Management Review Procedure, Section 8 is the “procedure section.” Sub-section 8.3 of the procedure lists all the required inputs to a Management Review meeting. Next to each input, I have included a cross-reference to the sub-clause in ISO 13485:2003 for the Management Review input. There is also a requirement in 21 CFR 820.20 for conducting Management Reviews as scheduled intervals. This requirement is met by sub-section 8.1 of the Management Review procedure.

Teaching Auditors to Review Regulatory Requirements

Now, when I teach my version of the Lead Auditor Course, I ask attendees to split into small groups and review one of their procedures. In the last company I did this, each of the four teams found a regulatory requirement missing in the procedure they were reviewing. All four procedures the teams selected were reviewed, approved, and currently in use.

Management Review Procedure – Free Download

[convertkit form=4961282]

Posted in: ISO Certification

Leave a Comment (1) →

Management Review Meetings: 3 Compliance Issues

Three (3) compliance issues are discussed regarding management review meetings, including procedural requirements, forms and records, and attendance.

poor management review meetings Management Review Meetings: 3 Compliance Issues

Has your company ever received an audit finding or FDA 483 observation for the failure to provide objective evidence of management with executive responsibility attending the management review?

This type of finding is typically followed by a sentence that begins with “Specifically,” and ends with a quotation from the company’s management review procedure. There are three reasons why this finding is so common:

  1. Procedural requirements for attending the management review meeting do not match the actual practice
  2. Forms and records used to document the management review meetings are inadequate
  3. One or more members of the management team just didn’t show up

There are no prescriptive requirements in ISO 13485 or 21 CFR 820 that specify who must attend a management review meeting. Therefore, let’s investigate each of the possible reasons for this finding.

Procedural Requirements

One of the auditors I worked with for several years used to say, “You need to make sure your procedures give you ‘wiggle room.’” He knew from practical experience that managers are busy, and sometimes they can’t attend meetings. He also knew that sometimes job titles change, but your company’s organizational chart and procedures will lag behind these changes. In one of my previous blogs, I indicated that your management review procedure should allow some flexibility. The following are three probable events related to management review attendance:

  1. Management review requires rescheduling,
  2. Some of the management team is unable to attend
  3. Some of the management team can only participate by conference call

Rescheduling Management Review Meetings

Most companies document the requirement for when reviews must be conducted in the management review procedure. For example, “The management review shall be conducted during the first month of each quarter to review quality metrics from the previous quarter.” Instead, I recommend stating that at least two management reviews shall be conducted each year, and the date of the next management review shall be scheduled as part of the action items during each management review. Your procedure should also state that additional management reviews should be scheduled during periods of significant change to ensure the continued effectiveness of the quality system.

Even if you follow my advice for scheduling management reviews, you still need a mechanism for rescheduling the management review if an emergency comes up. I recommend allowing only the most senior manager on-site and the management representative to have the authority to reschedule the meeting. You can use Microsoft Outlook as a tool for communicating the rescheduled date to top management, but action items from the previous management review should reflect the change. Action items in your management review are quality system records, while printouts of your calendar are not. You should also consider placing a time limit on how far in the future, a management review can be rescheduled.

Delegating Attendance of Management Review Meetings & Conference Calls

To address #2 in the possible scenarios listed above, I recommend that your procedure allows for management to send a delegate in their place to a management review. I also recommend that your procedure allow managers to attend meetings remotely (i.e., via conference call, Webex, etc.) to address #3 listed above. However, management should be making every effort to attend the management review live, and everyone should be able to review the review inputs (i.e., Clause 5.6.2a-h) before the meeting.

Forms & Records of the Management Review Meetings

Management review meeting minutes are records that must indicate who was in attendance. If your procedure indicates that a specific job function should be represented at the Management Review, you need a form that is designed specifically to provide objective evidence that this person attended. Therefore, instead of listing job titles on the attendance sheet, or just using blanks for attendees to sign, you should have a form that lists the job titles. If a delegate is sent, they should indicate that they are the delegate authorized to sign for the absent member of top management.

Skipping the Management Review Meetings

Management review meetings are regulatory requirements and are intended to improve your quality system. If you can’t attend, you need to review the review inputs before the meeting and provide feedback. You should also assign a delegate who is supposed to take notes and represent the function of the manager that is not present. If you have been assigned the responsibility of preparing an input slide to the review, then you still need to provide this even if you are not present. If you are the management representative, and someone fails to provide slides for the management review, I recommend asking the assigned person to provide hard copies for each of the attendees. If the person doesn’t do this, indicate in the meeting minutes that inputs in one area were not available, and add an action item to the meeting conclusions regarding the need to address this gap.

FREE Webinar

If you are interested in a free management review webinar on this topic, please sign-up for our webinar. The webinar will also be available as a free recording for anyone that is registered. Registrants will also receive a copy of the webinar slide deck and a copy of the Medical Device Academy’s Management Review template.

Posted in: ISO Certification

Leave a Comment (0) →

Medical Device Management Review Procedure Improvements

management review Medical Device Management Review Procedure ImprovementsThe author provides suggestions for improving the writing of your medical device management review, scheduling meetings, and engaging top management. 

If the US FDA is not allowed to see Management Review meeting minutes, why were there one-hundred and seven 483 inspection observations against the Management Review process in FY 2012?

The US FDA is also not allowed to view records for internal audits and supplier audits, but there are 483 observations for these processes too. The FDA will assess the effectiveness of these processes by reviewing your procedures by verifying that you have a schedule, and you’re sticking to it. The ultimate test is to look for CAPAs initiated from these processes.

To avoid a 483 inspection observation against your Management Review process, you need four things:

  1. Procedure for Management Reviews
  2. Schedule for your Management Reviews
  3. Template to prevent errors
  4. The top management team that is trained

Writing a Medical Device Management Review Procedure

There is no requirement for a Management Review procedure in ISO 13485, but 21 CFR 820.20c states that the quality system shall be reviewed “at defined intervals and with sufficient frequency according to established procedure.” This frequency may be documented in the Quality Manual, or a Management Review procedure.

If you choose to write a procedure, keep it simple and reference a controlled template that includes each of the requirements listed above. Your procedure should also allow flexibility for each of the following probable events:

  1. Management Review requires rescheduling
  2. Some of the Management Team is unable to attend
  3. Some of the Management Team can only attend by conference call
  4. An action item from a previous review is left incomplete
  5. An action item is changed after the Management Review
  6. There is insufficient time available to review all the inputs during a single Review

Your Schedule for a Medical Device Management Review

The most common procedural requirements for the frequency of Management Reviews are:

  1. At least once per year
  2. Semi-annually
  3. Quarterly

Most companies choose to require a schedule of “at least once per year,” but what’s the point of reviewing quality system data from last February in January?

13485 Plus is a guidance document for the implementation of ISO 13485. Section 5.6.1 of the guidance document states, “If changes are planned or being implemented, more frequent reviews are normally needed.” Some companies even include this statement in their Management Review procedure. Unfortunately, most companies do not remember to change their schedule when they plan significant changes to their quality management system—such as mergers, new product launches, or an employee lay-off.

Every Management Review should include an action item scheduling the next Management Review. The timing of the next Management Review should reflect changes planned for the quality system and improvements needed to maintain effectiveness.

Conducting more than one Management Review also gives you the flexibility, assuming your procedure allows it, to review only some of the required inputs during a single Management Review. If you are short of time during your next management review, you could intentionally skip a required element. However, this approach also requires that you track which elements have been covered during your annual schedule and which elements were not. Any skipped elements must be covered at least once during the annual schedule for Management Reviews.

A Template for Medical Device Management Review

One of the most common nonconformities during an ISO audit is a finding that one of the required inputs or outputs was not included in the Management Review. The best way to ensure you don’t forget something is to use a template that is maintained by your document control process. This template should include the following:

  1. Eight Inputs (ISO 13485, Clause 5.6.2)
  2. Three Outputs (ISO 13485, Clause 5.6.3)
  3. Review of the Quality Policy (ISO 13485, Clause 5.3)
  4. Review of the Quality Objectives (ISO 13485, Clause 5.4.1)
  5. Review of the QMS effectiveness (ISO 13485, Clause 5.6.1)

The last item should be a conclusion in your management review meeting minutes. Often, the conclusions are worded in the following way, “The Quality Management System remains suitable, adequate and effective—with the exception of the areas that have been identified as requiring corrective actions in this management review.”

Engaging Top Management

Roles and responsibilities for the Management Review must be assigned. Some leaders choose to assign 100% of the Management Review to the Management Representative, and then the same executives complain that reviews are boring and take too long. To get the management team engaged, the responsibility for preparing reviews must be assigned to all members of the team. The Management Representative is responsible for “reporting to top management on the performance of the quality management system and any need for improvement.” Still, the ISO Standard does not imply that the representative cannot seek help from the rest of the team.

Each member of top management should be assigned responsibility for preparing and reporting on the part of the Management Review. This approach will ensure that all members of the management team are involved and engaged in the process. Your team may be assigned to work in pairs or smaller teams. Your team’s responsibilities may also be rotated to ensure that each member of the team is cross-trained and understands the importance of each Management Review requirement.

Before you can expect your management team to accept responsibility for preparing and reporting on the performance of the quality management system and improvement needs, Top Management needs the training to understand each of the requirements.

Free Webinar Training

Medical Device Academy also offers free webinar training on the Management Review process. If you are interested in training your top management team, please register for this management review webinar. It will also be available as a free recording for anyone that is registered. Registrants will also receive a copy of the webinar slide deck and a copy of the Medical Device Academy’s Management Review template.

 

Posted in: ISO Certification

Leave a Comment (3) →