1. Quality System Regulation IMDMC FDA Regulatory 102 May 19, 2016

3. A Brief History & Comparison The QSR Big Picture The Four Major QSR Subsystems Documents & Records (Back-up slides) 3 Agenda This will be an overview presentation This won’t be a verbatim recitation of the regulation

4. QSR – A Little History 1976 – Food, Drug, and Cosmetic Act (“The Act”) expanded to include medical devices –1978 – Part 820 – Good Manufacturing Practice (GMP) regulation for medical devices issued 1990 – Safe Medical Devices Act (SMDA) passed –1996 – Part 820 becomes the Quality System Regulation (QSR) with expanded requirements for medical devices 4

5. Part 820 - 1978 ~5000 Words 159 “Shall” statements “Establish” –used 7 times (all tenses) Design Controls - silent ~7000 words 218 “Shall” statements “Establish” –used 71 times (all tenses) Design Controls – major subpart Old QSR vs. “New” QSR Part 820- 1996

6. Complaint Files - 1978 (a) Written and oral complaints relative to the identity quality, durability, reliability, safety, effectiveness or performance of a device shall be reviewed, evaluated and maintained by a formally designated unit. This unit shall determine whether or not an investigation is necessary. When no investigation is made, the unit shall maintain a record that includes the reason and the name of the individual responsible for the decision not to investigate. (b) Any complaint involving the possible failure of a device to meet any of its performance specifications shall be reviewed evaluated, and investigated. Any complaint pertaining to injury, death, or any hazard to safety shall be immediately reviewed, evaluated, and investigated by a designated individual(s) and shall be maintained in a separate portion of the complaint file. (c) When an investigation is made, a written record of each investigation shall be maintained by the formally designated unit identified in paragraph (a) of this section. The record of investigation shall include the name of the device, any control number used, name of complainant, nature of complaint, and reply to complainant. (d) Where the formally designated unit is located at a site separate from the actual manufacturing establishment, a duplicate copy of the record of investigation of any complaint shall be transmitted to and maintained at the actual manufacturing establishment in a file designated for device complaints. (a) Each manufacturer shall maintain complaint files. Each manufacturer shall establish and maintain procedures for receiving, reviewing, and evaluating complaints by a formally designated unit. Such procedures shall ensure that: (1) All complaints are processed in a uniform and timely manner; (2) Oral complaints are documented upon receipt; and (3) Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA under part 803 of this chapter, Medical Device Reporting. (b) Each manufacturer shall review and evaluate all complaints to determine whether an investigation is necessary. When no investigation is made, the manufacturer shall maintain a record that includes the reason no investigation was made and the name of the individual responsible for the decision not to investigate. (c) Any complaint involving the possible failure of a device, labeling, or packaging to meet any of its specifications shall be reviewed, evaluated, and investigated, unless such investigation has already been performed for a similar complaint and another investigation is not necessary. (d) Any complaint that represents an event which must be reported to FDA under part 803 of this chapter shall be promptly reviewed, evaluated, and investigated by a designated individual(s) and shall be maintained in a separate portion of the complaint files or otherwise clearly identified. In addition to the information required by 820.198(e), records of investigation under this paragraph shall include a determination of: (1) Whether the device failed to meet specifications; (2) Whether the device was being used for treatment or diagnosis; and (3) The relationship, if any, of the device to the reported incident or adverse event. (e) When an investigation is made under this section, a record of the investigation shall be maintained by the formally designated unit identified in paragraph (a) of this section. The record of investigation shall include: (1) The name of the device; (2) The date the complaint was received; (3) Any device identification(s) and control number(s) used; (4) The name, address, and phone number of the complainant; (5) The nature and details of the complaint; (6) The dates and results of the investigation; (7) Any corrective action taken; and (8) Any reply to the complainant. (f) When the manufacturer's formally designated complaint unit is located at a site separate from the manufacturing establishment, the investigated complaint(s) and the record(s) of investigation shall be reasonably accessible to the manufacturing establishment. (g) If a manufacturer's formally designated complaint unit is located outside of the United States, records required by this section shall be reasonably accessible in the United States at either: (1) A location in the United States where the manufacturer's records are regularly kept; or (2) The location of the initial distributor. Old QSR vs. “New” QSR Complaint Files - 1996

7. Medical Devices and the CFR’s Premarket Part 812 (IDE) with Parts 50 &56 Part 820.20 (Management Responsibility) Part 820.30 (Design Controls) Commercialization Part 814 (PMA) Part 807 (Premarket Notification/510(k)) Part 820 (Multiple) Postmarket Part 803 (MDR) Part 806 (Corrections & Removals) & Part 7 (Enforcement) Part 820.100 (CAPA), 820.198 (Complaints), and 820.200 (Servicing)

8. QSR – Subparts as Issued Subpart A--General Provisions Subpart B--Quality System Requirements Subpart C--Design Controls Subpart D--Document Controls Subpart E--Purchasing Controls Subpart F--Identification and Traceability Subpart G--Production and Process Controls Subpart H--Acceptance Activities Subpart I--Nonconforming Product Subpart J--Corrective and Preventive Action Subpart K--Labeling and Packaging Control Subpart L--Handling, Storage, Distribution, and Installation Subpart M--Records Subpart N--Servicing Subpart O--Statistical Techniques 8

9. QSR – Major Subsystems Management Responsibility Design Control Production and Process Controls Corrective and Preventive Action 9 http://balancedscorecard.org

10. MANAGEMENT RESPONSIBILITY

11. Management Responsibility Subsystem Management Responsibility Training.25 Audit.22 Management Responsibility.20 11 Quality System Record.186

12. MANAGEMENT RESPONSIBILITY Direction –Quality Policy –Implemented at all levels Empowerment –Resources – adequately trained – “Management Representative” Evaluation –Review –Audit

13. Management Responsibility - I (a)Quality policy...policy and objectives for, and commitment to, quality…understood, implemented, and maintained at all levels of the organization. (b)Organization...adequate organizational structure to ensure that devices are designed and produced in accordance with the requirements of this part. –(1)Responsibility and authority. … responsibility, authority, and interrelation … independence and authority necessary to perform these tasks. 13

14. Management Responsibility - II Organization, cont. –(2)Resources...adequate resources, including the assignment of trained personnel, for management, performance of work, and assessment activities, including internal quality audits, to meet the requirements of this part. –(3)Management representative. …shall have established authority over and responsibility for: (i) Ensuring that quality system requirements are effectively established and effectively maintained in accordance with this part; and (ii) Reporting on the performance of the quality system to management with executive responsibility for review. 14

15. Management Responsibility - III (c)Management review...review the suitability and effectiveness of the quality system … to ensure that the quality system satisfies the requirements of this part and the manufacturer's established quality policy and objectives. (d)Quality planning. … defines the quality practices, resources, and activities relevant to devices that are designed and manufactured. The manufacturer shall establish how the requirements for quality will be met. (e)Quality system procedures. …establish quality system procedures and instructions. An outline of the structure of the documentation used in the quality system shall be established where appropriate. 15

16. Quality Audit. (.22) Each manufacturer shall establish procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system. Quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited. Corrective action(s), including a reaudit of deficient matters, shall be taken when necessary. A report of the results of each quality audit, and reaudit(s) where taken, shall be made –and such reports shall be reviewed by management having responsibility for the matters audited. –The dates and results of quality audits and reaudits shall be documented. 16

17. Training (.25) ( a)General. Each manufacturer shall have sufficient personnel with the necessary education, background, training, and experience to assure that all activities required by this part are correctly performed. (b)Training. Each manufacturer shall establish procedures for identifying training needs and ensure that all personnel are trained to adequately perform their assigned responsibilities. Training shall be documented. –(1) As part of their training, personnel shall be made aware of device defects which may occur from the improper performance of their specific jobs. –(2) Personnel who perform verification and validation activities shall be made aware of defects and errors that may be encountered as part of their job functions. 17

18. Another Way To Think About It 18 Medical Device CompanyYou Management Responsibility (.20) Direction Empowerment Evaluation Your Physician or Primary Care Provider Audits (.22)Health Screening Annual Physical Training (.25)Fitness Program Diet, Exercise, & Lifestyle Coaching

19. Acme Manufacturing Management Responsibility 19 Which of these statements about Acme may be indicative of Management Responsibility issues? “The project team is also working hard to address some audit findings that were the result of ISO 13485 audit conducted 6 months ago when a new product iteration was being introduced in the EU. (Your group has asked for a copy of the audit report and expect to have it in the next several days.)” “The initial clinical support for the HAO device came from a 2 year clinical study done 8 years ago on a population of 200 adult ischemic stroke victims...The division hopes to use this data to support this new (pediatric use) product.” “A patient in Alabama has sued the company claiming that she has a HAO device, the device malfunctioned and she has suffered neurological damage and a worsening of her pre-existing diabetes...This is the first the company has heard of this situation.”

20. DESIGN CONTROLS

21. Design Controls (.30) Design Development and Planning Design Inputs Design Outputs Design Review Design Verification Design Validation Design Transfer Design Changes Design History File (DHF) 21 Bolded = Defined in section 820.3 Most Class I Devices excluded from these requirements

22. Design Process 22

23. DVV (Design Verification and Validation) Design VerificationDesign Validation Outputs = Inputs Do Design Outputs fulfill Design Inputs? Does the design of the device fulfill the user needs and intended uses? “Did you design the thing right?” “Did you design the right thing?” 23

24. Acme Manufacturing Design 24 How would design controls be applicable to this situation? The marketing group also has prepared a new marketing program for your review. Marketing believes that it can substantially increase HAO sales by a two prong strategy focusing on cardiac patients in general and also comparing the cost and patient outcomes with current pharmaceutical therapies. A key basis for this cardiac focused marketing program is a peer reviewed scientific article recently published in the New England Journal of Medicine. This article discusses some positive results when using the HAO device for ischemic cardiac events.

25. What Phase/Element of Design Process? “Capable of implantation into the neurological vascular system” Bench test to challenge the corrosion resistance of a titanium mesh Treat ischemic strokes by reopening otherwise blocked or collapsed arteries in the brain “The stents shall be constructed of shape memory alloys” A consortium meeting with surgeons to identify potentially unmet clinical needs of current arterial blockage systems An pre-market clinical study to establish comparative effectiveness of an anti-infective coating. 25

26. PRODUCTION AND PROCESS CONTROLS

27. Process Control Subsystem P&PC and Process Validation.70 and.75 Purchasing.50 HSDI.140,.150,.160, &.170 ID & Trace.60 and.65 IMTE.72 Acceptance.80 and.86 Labeling Packaging.120 and.130 27

28. Production and Process Controls (.70) General Process Changes Environmental PersonnelContaminationBuildings Equipment Manufacturing material Automated processes 28

29. Process Validation (.75) “Where the results of a process cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance and approved according to established procedures.” Monitoring and control procedures –Qualified individuals –Records – monitoring methods and data Changes and revalidation 29

30. Purchasing Controls (.50) “Each manufacturer shall establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements.” Supplier Evaluation –Ability based selection –Extent of control –Records Purchasing Data 30

31. Identification and Traceability Identification (.60) –Procedures to identify throughout lifecycle –“…to prevent mix-ups” Traceability (.65) –Risk based additional requirements –Batch numbers –Facilitate corrective action –Captured in DHR 31

32. Inspection, Measuring, and Test Equipment (.72) IMTE Control –Suitable and capable –Control procedures with records Calibration –Precision and accuracy limits. –Remediation process –Calibration standards –Calibration records 32

33. Acceptance Activities and Status Acceptance Activities (.80) Receiving Acceptance In-process Acceptance Final Acceptance (4 requirements for release) Records Acceptance Status (.86) –Conformance/Nonconformance status throughout product lifecycle 33

34. Labeling and Packaging Labeling (.120) –Label integrity –Label Inspection –Label Storage –Labeling operations –Control Number Packaging (.130) –Product preservation to point of use –Requirement touches on design and “execution” 34

35. Handling, Storage, Distribution, & Installation Handling (.140) and Storage (.150) –Prevent mix-ups and deterioration Distribution (.160) –Ensure only approved, non-deteriorated devices are shipped –Shipment records to initial consignee Installation (.170) –Accessible, adequate instructions for installation and test –Records to demonstrate proper installation 35

36. Acme Manufacturing P&PC – Mobility Division 36 What Production and Process Controls would need to be in place for this type of wheel chair? The Patient Mobility Group, is using technology developed by the Product Handling Division to create a powered wheelchair with built-in weight, blood pressure, temperature and body fluid level monitors. These monitors collect and wirelessly transmit to the patient’s health care provider data from these monitors…In addition, monitoring factors such as weight, blood pressure, temperature and body fluid levels help the health care profession quickly identify patients with deteriorating cardiac function or worsening heart failure.

37. What Process Control Subsections? A set of micrometers Argon used in high pressure furnaces Injection molding equipment Soap used for final cleaning Anodizing titanium to various colors Clean room where final packaging occurs Source for IV tubing Polyethylene pouches for maintaining sterility 37

38. CORRECTIVE & PREVENTIVE ACTION

39. CAPA Subsystem CAPA (Multiple inputs) Nonconforming Material Complaints Servicing 39

40. Corrective and Preventive Action Definitions (ISO 9000) –Not defined in the QSR (820.3) Corrective action - action to eliminate the cause of a detected nonconformity or other undesirable situation. Preventive action - action to eliminate the cause of a potential nonconformity or other undesirable potential situation 40

41. Corrective and Preventive Action “(a) Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action. The procedures shall include requirements for: –(1) Analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems. Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems; –(2) Investigating the cause of nonconformities relating to product, processes, and the quality system; –(3) Identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems; 41

42. Corrective and Preventive Action –“(4) Verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device; –(5) Implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems; –(6) Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems; and –(7) Submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review. (b) All activities required under this section, and their results, shall be documented.” 42

43. CAPA Verbs – 820.100 1.Analyzing 2.Investigating 3.Identifying 4.Verifying or validating 5.Implementing and recording 6.Ensuring …disseminated 7.Submitting…for review 43 Initiate Investigate Implement V & V

44. Sources of Quality Data - Analysis processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data… …to identify existing and potential causes of nonconforming product, or other quality problems. Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems 44 “You can’t (and won’t) fix what you don’t measure”

45. Acme Manufacturing - Neuro CAPA – Only As Good As Your RCA The Neuro division is working through some HAO related product questions. Recently, they have noticed an increased frequency of bleeding in the brain. 2 lots of product manufactured 18 months ago have a reported incidence rate of 5%. Several deaths have been reported. All reports of deaths have been filed as MDRs. The bulk of the patients seem to be over 65 years old with a history of diabetes. The initial review of this situation, completed just days ago, indicated that anatomical pressures may have caused the part of the device to collapse. What other part of our company hypothetical relates to this? 45

46. Nonconforming Product (.90) Control –Procedures address identification, documentation, evaluation, segregation, and disposition –Evaluation, investigation, and notification Review and Disposition –Procedures establish responsibility and authority for disposition –Justification for use of nonconforming product –Rework control Retesting and re-evaluation Determination of adverse effects 46

47. Complaint files (.198) …Receiving, reviewing, and evaluating complaints by a formally designated unit. Such procedures shall ensure that: –(1) All complaints are processed in a uniform and timely manner; –(2) Oral complaints are documented upon receipt; –(3) Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA under part 803 of this chapter, Medical Device Reporting.

48. Complaint files, cont. Review and evaluate all complaints to determine whether an investigation is necessary. Required investigations – allegations of failure to meet specifications. Additional requirements for MDR’s Investigation records requirements Record accessibility –Remote FDU –Foreign establishments

49. A Brief Digression… If CAPA is the central subsystem and fed by Complaint Handling, why is the CFR section twice as long for one as the other?? By specifying the resultant work product (files), FDA defines a process and carves an “inspectional path”

50. Servicing (.200) “Where servicing is a specified requirement, each manufacturer shall establish and maintain instructions and procedures for performing and verifying that the servicing meets the specified requirements.” –Statistical analysis –MDR (Part 803) Connection –Service report records 50

51. Documents and Records Document Control (.40) –Approval and distribution –Change management Records – Subpart M –General (.180) –Device Master Record (.181) –Device History Record (.184) –Quality System Record (.186) –Complaint Files (.198) 51 Procedures Records

52. Documents and Records Shall – 218 Times –Shall establish – 54 times Shall establish and maintain – 47 times Shall establish and maintain procedures – 34 times Shall establish procedures – 2 times 52

53. “Establish” defined in Part 820.3(k) (k)Establish means define, document (in writing or electronically), and implement. Establish Define “Say What You Do” Subpart D Document “Do What You Say” Subpart M Implement “Show Me The Data” Objective Evidence Records

54. Why Is Objective Evidence So Important? Quality is not explained, it is demonstrated Records

55. BACKUP SLIDES Resources, Links, etc.

56. Triple-D DHF The development of the “recipe” DMR The definitive recipe DHR The records of each batch 56 Records

57. Complaint/AE Investigation and Resolution Three Basic Questions 1.Were the specifications of the product fully executed for the complaint device? 2.Are the device specifications adequate for intended or reasonable uses? 3.What is required to restore the relationship with the customer?

58. Some Good Links Full Text of the QSR –http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfCFR/CFRSearch.cfm?CF RPart=820&showFR=1http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfCFR/CFRSearch.cfm?CF RPart=820&showFR=1 Search page for other CFR Sections –http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfCFR/CFRSearch.cfmhttp://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfCFR/CFRSearch.cfm CDRH Learn Course List –http://www.fda.gov/training/cdrhlearn/default.htmhttp://www.fda.gov/training/cdrhlearn/default.htm –Note: the QSR overview developed by CDRH is stored under the “Postmarket” section 58

59. Embedded Document 59 QSR Preamble - Published when the new Part 820 was released in 1996. Records the FDA’s deliberations in releasing this rule