1. FDA Medical Device Enforcement and Quality System Update
Kimberly Trautman
FDA’s Medical Device Quality Systems Expert
Office of Compliance, CDRH

2. FDA Enforcement Update
Remarks by:
Margaret Hamburg, M.D. Commissioner of Food and Drugs
"Effective Enforcement and Benefits to Public Health“ August 6, 2009
FDA must be vigilant, strategic, quick and visible

3. FDA Enforcement Update
Post Inspection deadlines – 15 day Warning Letter Response deadline
Decrease time between the inspection and issuance of a Warning Letter
Increase collaboration with regulatory partners such as local, state and international partners

4. FDA Enforcement Update
Prioritize enforcement follow-up
Act swiftly and aggressively to protect the public health
Warning Letter “Close Out” process

5. QS Regulation Cites by Subsystem
P&PC
CAPA
MGMT DC
DOC
820.90
820.5
820.20
820.22
820.25
820.30
820.40

6. Warning Letter Cites by QS Subsystem - 2008
P&PC = 241
CAPA = 237
DESIGN = 155
MGMT = 130
DOC = 82
Total = 845

7. Warning Letter Cites by QS Subsystem - 2008

8. Top Ten Warning Letter Cites - 2008
21 CFR
21 CFR (g) 28
21 CFR (a) 28
21 CFR (a) 27
21 CFR (a) 25
21 CFR (i) 21
21 CFR
21 CFR (a) 20
21 CFR (d) 19
21 CFR (c) 19

9. Warning Letters with CAPA Subsystem Cites 2008
January – December 2008
FDA issued 98 Warning Letters to medical device firms for QS/GMP deficiencies
86/98 or 88% contained cites for CAPA system deficiencies
How many inspections were conducted?

10. Warning Letters CAPA Subsystem Data
Year
# WLs
# w/ CAPA cite %
2008 98 86 88
2007 74 62 84
2006 79 69 87
2005 97 85
2004
113 89
2003 61

11. Warning Letters with P&PC Subsystem Cites 2008
January – December 2008
FDA issued 98 Warning Letters to medical device firms for QS/GMP deficiencies
80/98 or 82% contained cites for P&PC subsystem deficiencies
How many inspections were conducted?

12. Warning Letters with Design Control Cites 2008
January – December 2008
FDA issued 98 Warning Letters to medical device firms for QS/GMP deficiencies
54/98 or 55% contained cites for Design Control deficiencies

13. Warning Letters Design Control Subsystem Data
Year
# WLs
# w/ DC cite %
2008 98 54 55
2007 74 42 57
2006 79 47 60
2005 97 49 51
2004
113 50
2003 69 39

14. Quality System Hot Topics
Supplier Controls
Corrective and Preventive Actions

15. What is unique about medical devices?
Medical Devices utilize a wide range of supplied products and services
Supplied products:
Finished medical devices or accessories in the case of kits or device systems
Electronic parts to include anything from individual resistors, capacitors, etc. to completed hybrid boards

16. What is unique about medical devices?
Supplied products:
Raw materials such as chemicals, polymers, metals, etc.
Software packages
Antibodies, antigens, etc. for in-vitro diagnostic products
Finished drugs or APIs in the case of combination products

17. What is unique about medical devices?
Supplied services:
Contract manufacturers
Contract laboratories
Contract sterilizers
Calibration test houses
Contract installers and service providers
Auditors
Consultants

18. What is unique about medical devices?
Further the supplied products and services cover the entire range from a risk perspective.
Same supplied product or service for one manufacturer may not have the same risks depending upon multiple factors.

19. What is unique about medical devices?
Same supplier for one product or service may have different risks for a different supplied product or service.
Be wary of utilization of supplier audits without understanding the scope of the previous supplier audit.

20. Quality System (QS) Regulation 21 CFR 820.50 Purchasing Controls
Each manufacturer shall establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements.

21. Quality System (QS) Regulation 21 CFR 820.50(a)
(a) Evaluation of suppliers, contractors, and consultants. Each manufacturer shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants. Each manufacturer shall:

22. 21 CFR 820.50(a) Purchasing Controls
(1) Evaluate and select potential suppliers, contractors, and consultants on the basis of their ability to meet specified requirements, including quality requirements. The evaluation shall be documented.

23. 21 CFR 820.50(a) Purchasing Controls
(2) Define the type and extent of control to be exercised over the product, services, suppliers, contractors, and consultants, based on the evaluation results.
(3) Establish and maintain records of acceptable suppliers, contractors, and consultants.

24. 21 CFR 820.50(b) Purchasing Data
(b) Purchasing data. Each manufacturer shall establish and maintain data that clearly describe or reference the specified requirements, including quality requirements, for purchased
or otherwise received product and services.

25. 21 CFR 820.50(b) Purchasing Data
Purchasing documents shall include, where possible, an agreement that the suppliers, contractors, and consultants agree to notify the manufacturer of changes in the product or service so that manufacturers may determine whether the changes may affect the quality of a finished device. Purchasing data shall be approved in accordance with Sec

26. Preamble to the 1996 QS Regulation Comment #99
Since FDA is not regulating component suppliers, FDA believes that the explicit addition to CGMP requirements of the purchasing controls of ISO 9001:1994 is necessary…

27. Preamble to the 1996 QS Regulation Comment #99
To ensure purchased or otherwise received product or services conform to specifications, purchasing must be carried out under adequate controls, including the assessment and selection of suppliers, contractors, and consultants,

28. Preamble to the 1996 QS Regulation Comment #99
the clear and unambiguous specification of requirements, and the performance of suitable acceptance activities. Each manufacturer must establish an appropriate mix of assessment and receiving acceptance to ensure products and services are acceptable for their intended uses. ..

29. Preamble to the 1996 QS Regulation Comment #99
FDA generally believes that an appropriate mix of supplier and manufacturer quality controls are necessary. However, finished device manufacturers who conduct product quality control solely in-house must also assess the capability of suppliers to provide acceptable product. Where audits are not practical, this may be done through, among other means, reviewing historical data, monitoring and trending, and inspection and testing.

30. Preamble to the 1996 QS Regulation Comment #99
Thus the degree of supplier control necessary to establish compliance may vary with the type and significance of the product or service purchased and the impact of that product or service on the quality of the finished device.

31. Preamble to the 1996 QS Regulation Comment #100
Thus, a manufacturer must comply with these provisions when it receives product or services from its ``sister facility'' or some other corporate or financial affiliate. ``Otherwise received product'' would include ``customer supplied product'' as in ISO 9001:1994, section 4.7, but would not apply to ``returned product'' from the customer.

32. Preamble to the 1996 QS Regulation Comment #102
…FDA believes that all suppliers of such services must be assessed and evaluated, just like a supplier of a product. As always, the degree of control necessary is related to the product or service purchased…

33. Preamble to the 1996 QS Regulation Comment #103
…certification may play a role in evaluating suppliers, but cautions manufacturers against relying solely on certification by third parties as evidence that suppliers have the capability to provide quality products or services. FDA has found during inspections that some manufacturers who have been certified to the ISO standards have not had acceptable problem identification and corrective action programs.

34. Preamble to the 1996 QS Regulation Comment #103
Therefore, the initial assessment or evaluation, depending on the type and potential effect on device quality of the product or service, should be a combination of assessment methods, to possibly include third party or product certification.

35. Preamble to the 1996 QS Regulation Comment #103
However, third party certification should not be relied on exclusively in initially evaluating a supplier. If a device manufacturer has established confidence in the supplier's ability to provide acceptable products or services, certification with test data may be acceptable.

36. Preamble to the 1996 QS Regulation Comment #106
The intent of Sec is to ensure that device manufacturers select only those suppliers, contractors, and consultants who have the capability to provide quality product and services. As with finished devices, quality cannot be inspected or tested into products or services.

37. Preamble to the 1996 QS Regulation Comment #106
Rather, the quality of a product or service is established during the design of that product or service, and achieved through proper control of the manufacture of that product or the performance of that service…

38. Quality System (QS) Regulation 21 CFR 820.30 Design Controls
820.30(c) Design Input
…ensure that the design requirements relating to a device are appropriate and address the intended use of the device, including the needs of the user and patient…

39. Quality System (QS) Regulation 21 CFR 820.30 Design Controls
820.30(d) Design Output
…shall contain or make reference to acceptance criteria and shall ensure that those design outputs that are essential for the proper functioning of the device are identified…

40. Quality System (QS) Regulation 21 CFR 820.30 Design Controls
820.30(g) Design Validation
Design validation shall ensure that devices conform to defined user needs and intended uses and shall include testing of production units under actual or simulated use conditions. Design validation shall include software validation and risk analysis...

41. Preamble to the 1996 QS Regulation Comment #106
…Section is specific to a device manufacturer's acceptance program. While finished device manufacturers are required to assess the capability of suppliers, contractors, and consultants to provide quality products and services, inspections and tests, and other verification tools, are also an important part of ensuring that components and finished devices conform to approved specifications.

42. Quality System (QS) Regulation 21 CFR 820.80 Acceptance Activities
820.80(a) General
Each manufacturer shall establish and maintain procedures for acceptance activities. Acceptance activities include inspections, tests, or other verification activities….

43. Preamble to the 1996 QS Regulation Comment #106
The extent of incoming acceptance activities can be based, in part, on the degree to which the supplier has demonstrated a capability to provide quality products or services. An appropriate product and services quality assurance program includes a combination of assessment techniques, including inspection and test.

44. Purchasing Controls and Acceptance Activities Commensurate to the Risk

45. Global Harmonization Task Force (GHTF) Guidance document
GHTF Study Group 3 Final Guidance:
Quality Management System – Medical Devices – Guidance on the Control of Products and Services Obtained from Suppliers
Posted Feb. 5, 2009

46. Global Harmonization Task Force (GHTF) Study Group 3
Drafting a guidance document:
Proposed Document for Comment estimated to be published in Dec 2009.
“Quality Management System –Medical Devices – Guidance on corrective action and preventive action and related QMS processes”

47. Key Terms
Correction: repair, rework, or adjustment and relates to the disposition of an existing nonconformity.
Corrective Action: the action taken to eliminate the causes of an existing nonconformity, defect or other undesirable situation in order to prevent recurrence.
Preventative Action: action taken to eliminate the cause of a potential nonconformity, defect, or other undesirable situation in order to prevent occurrence.

48. CAPA Summary

49. Providing Industry Assistance CDRH Resources
CDRH Learn [New]
Modules include various premarket and post-market information
Available 24/7
Certificate generated per topic upon passing post-tests
Suggest Future topics
Device Advice
Self-service website
Searchable by topic
Division of Small Manufacturers, International, and Consumer Assistance (DSMICA)
Technical Assistance for the Medical Device Industry or

50. Providing Industry Assistance CDRH Learn
What is CDRH Learn?
New Online Training tool
Multi-Media Presentation
Available 24/7
Certificate generated per topic upon passing post-tests
Suggest Future topics
Examples of Modules
Overview of Regulatory Requirements: Medical Devices
Quality System Regulation 21 CFR 820 Basic Introduction
Overview of the Premarket Notification Process – 510(k)
How to Get Your Electronic Product on the U.S. Market.
BIMO (under development)
Registration & Listing (under development)

51. FDA’s Medical Device Quality Systems Expert
Thank you!
Kimberly Trautman
FDA’s Medical Device Quality Systems Expert
Office of Compliance