Quality in the Medical Device Industry And Beyond

Quality in the Medical Device Industry – And Beyond Presented to: American Society for Quality (ASQ) Madison, WI Section 1217 September 13, 2016 Presented by: Dale Thanig Principal Consultant Quality & Compliance Services (608) 469 -4406 djthanig@yahoo. com Page 1

Outline Thank You Exercise for Tables Some History, What I Do and Don’t Do Disclaimers Trends I See QMS Tour Questions and Answers Page 2

Table Assignment Each Table assign a Spokesperson - the one who has been ASQ member the longest - Each person at the Table share: Who is the most impressive person you have had at least 5 min to talk to One-on-One? Share your choice with others Vote/debate to Pick ONE for your Table Can’t pick someone in your family Write the impressive name on your Table’s “Sticky”. Page 3

Some History Page 4

What I Do Lately None of Your Business Training and Building Quality Systems Staying Connected / Family & Friends QMS Auditing for Manufacturers and their Suppliers / FDA Inspection Prep. Page 5

Quality Management System Standards & Regulations Quality System Regulation (QSR) U. S. FDA - 21 CFR 820 Customers’ Needs Canadian Medical Device Regulations SOR/98 -282 + Other FDA CFR’s 11 803 806 812 814 Electronic Records Labeling MDRs Recalls IDEs 510(k)/PMA + Other Countries e. g. China, Japan, Australia, Italy. . . ISO 9001: 2008 Quality Systems – Generic Std ISO 13485 Standard Quality Systems – Medical Devices (ISO 9001: 2008 + add-ons) IEC 62304: 2006 Medical Device Software Life Cycle Processes Risk Management ISO 14971 ISO 14000 Environmental Std European Law Medical Device Directive (MDD, 93/42/EEC) Page 6

D. Thanig, June 2009

Quality Management System Standards & Regulations Changes Coming Soon+ Canadian Medical Device Regulations Customers’ Needs Always evolving Other Countries MDSAP Process ISO 9001: 2015 ISO 13485: 2016 Quality Systems – Generic Std (not just ISO 9001+ add-ons) Medical Device Directive MDr released at end of 2016 Page 8

What I Don’t Do ᴓ 510(k)s to FDA ᴓ Class 3 devices/PMAs ᴓ UDI/UPC ᴓ Pharma ᴓ Endorse particular Data System Tools ᴓ Look for work – It finds me, no website, no employees ᴓ Fancy Power. Points Page 9

Some Trends I See – Affecting Quality Systems Mobile / Remote device applications Transition from Hardcopy to e-Docs or Webbased QMSs Contract Manufacturing & Outsourcing “Virtual” companies Acquisitions driving changes FDA Inspection Process - QSIT & MDSAP Page 10

What is a “Quality” ? The degree to which a set of inherent characteristics fulfills requirements. ISO 9000: 2005 Requirements may vary by product(s), customers and geography: Feature Set Safety Product Technology Ease of Use Product Compatibility Compliance Profile RELIABILITY $ Cost of Ownership $ Serviceability Page 11

What is a “Quality Management System? ” (QMS) “The organizational structure, responsibilities, procedures, processes and resources for implementing quality management. ” “Management” emphasizes that the scope of a quality system spans the entire organization, not just the Quality and Regulatory departments. Strong support by management is needed to ensure that the QMS is effective and successful in supporting the business. Think of the QMS as your company’s ‘Rule Book’. Page 12

Quality Management Principles Customer Focus – Regulators are Customers too Leadership Involvement Responsibility defined at all Org. Levels Process Approach: Inputs ⇨ Outputs ⇨ Measures Ongoing Improvement of QMS and Product Quality Data Driven: Measure ⇨ Analyze ⇨ Improve ⇨ Repeat Mutually Beneficial Supplier and Customer Relationships Page 13

Quality Management Principles Page 14

Quality Management Principles Page 15

Relationship Between the Requirements and your QMS External Quality System Requirements [QSR & ISO] Your QMS • Establishes requirements • Establishes your processes • The Law or Expectation • Rules for The Way you work, Defines “WHAT” you need to do Defines “HOW” you do it Page 16

ISO 13485: 2003 Documented Procedure(s) Page 17

QSR/ISO - Roadmap Page 18

Enforcement of QSR vs. ISO FDA - QSR INSPECTIONS Notified Body – ISO 13485: 2003 AUDITS Document Type Regulation Standard Scope of enforcement Processes creating product destined for US Market Path to compliance with European Medical Device Directive, accepted by many other countries Certification Process Inspection by authorized enforcers of the Law Audits by certification services; limited consulting allowed Form of Results Form 483 itemizing Violations of Regulation; Establishment Inspection Report available Audit report lists Non-conformities Terminology in your QMS Some specific terms required/expected e. g. DMR, DHF, MDR Fewer terminology requirements Nature of response Letter itemizing actions CAPA response to Nonconformities Worst case scenario Fines, Court Injunctions, other legal actions Lose certification temporarily, Improve QMS Re-audit Page 19

FDA “QSIT” view of a QMS § QSIT = Quality System Inspection Technique § FDA’s process-based method to inspect a manufacturer’s QMS § QSIT identifies four high-priority subsystems to look at: Corrective and Preventive Action (CAPA) Management Controls Design Controls Production and Process Controls The subsystems inspected depends on the “Level” of the inspection. . Page 20

FDA “QSIT” view of a QMS Page 21

FDA / QSR Inspection Process & FDA usually gives a few days notice prior to inspection. & Inspections usually cover CAPA and Management Controls plus one or more of Production/Process and/or Design Controls. & Inspections usually last 3 -5 days with one inspector – if you are in good shape and the inspector has no interruptions. & Prepare for inspections by reviewing QSIT inspection protocol. & Your QMS needs to reflect current practice and cover all of the regulations. & Possible Results: No issues No Form 483 Some issues Findings documented on Form 483 If deemed serious or firm is non-responsive Warning Letter & Follow-up Response by Manufacturer: Be prompt and complete. Get to root cause(s). Go the “extra mile”. Page 22

QSR / ISO - Roadmap Page 23

Quality System and Management Responsibility Quality Manual, System and Culture ü Create a Table of how QMS procedures Map to external requirements ü Make the Quality Manual/Policy relevant for setting MEASURABLE ü OBJECTIVES. Don’t just reword the requirements in your Quality Manual. Culture must allow anyone to “stand in front of the truck” when necessary “The hard stuff is easy, the soft stuff is hard” – Roger Milliken Management Reviews Not a review of the Quality Dept. but of the Quality SYSTEM Strive to make “Quality” a topic for all Management Mechanisms. ü Integrate meetings with Strategy Deployment (Hoshin) and Company Planning ü Take Credit for ALL related activities. Can be conducted in “pieces” to avoid ‘Death by Power. Point’ Page 24

Quality “Intelligence” – Management Behavior Maturity Spectrum 1 2 Minimum 3 Acceptable Activity/Behaviors (Scale 1 -10) 4 5 6 7 Best in Class 8 9 10 “Forget the Regs, get the product out” No EOQ/EOY “Winks” Support Improvements to Compliance and QMS Lead Quality Culture Development Daily Activities Don’t bring any Bad News. “I don’t look good in stripes. ” Engaged in Management Reviews Participate in audits and Analysis of Findings Use Quality Metrics to drive decisions on Biz Quality Knowledge The Regulations are Roadblocks Aware of FDA and Int’l Requirements Standards and Regs are useful tools Realize Competitive advantage through Compliance Fix the Big Problems Continuous Improvement via effective CAPA Drive Growth through Quality Mindset Skill, Expertise or Topic Unacceptable Quality Measures “Can’t Measure Quality? It’s too subjective. ” Quality Resources Turn to QA/RA only when you’re in trouble. Quality System Everyone is on the QA/RA has a Integrated with “Quality” Team seat “at the Business Processes Table” * Adjust arrow ends to indicate your honest assessment of our business You impact the Quality Culture with your decisions every day Page 25

Quality “Intelligence” - Business Indicators Skill, Expertise or Topic Maturity Spectrum Unacceptable 1 2 Minimum 3 Acceptable Activity/Behaviors (Scale 1 -10) 4 5 6 7 Best in Class 8 9 10 Management Quality is not measured Fix the BIG Problems only Continuous Improvement results seen Drive Growth Through Quality Employees Every “Man” for himself Ad hoc Team Efforts Continuous Improvement Teams and Tools Recognized as partners in Growth Processes Inspection and Sorting only Complying with Regulations is enough Best Practices Implemented Other Companies Benchmark Us Suppliers Squeezed for Price only Monitored for Quality Improvement Partner in Product Development Stakeholder in Success Customers Who are They? Respond only to their complaints Partner in Product Development Loyal – Delighted with New Products * Adjust arrow ends to indicate your honest assessment of our business Most Everything We DO is Covered by our QMS. Results are Driven by our Quality “Intelligence”. Page 26

! Internal Audits L Map Plans/Checklists to show all Requirements covered. L Invest audit time consistent with your Process Profile. L Do some Product Audits L Adjust Plans to changes in product, processes and org. L Use the QSIT checklist to practice for FDA L Small Company? – Find a Partner Company L Recruit Auditors outside of QA/RA and from other facilities. FDA cannot review internal audit reports Page 27

More on Auditing What they May Not Tell you in Auditor Class Techniques þ Follow “trails” early and often þ Start at the end of a Process and go backwards þ Get out of the Conference Room þ Early ‘warning’ of Findings – Velvet Hammer þ Ask for key copies as you go along þ Shorthand helps Page 28

Even More on Auditing What they May Not Tell you in Auditor Class Style / Attitude ∆ Be a Human Being ∆ Tell people Why you are there ∆ Give them a little space, but get to the Point ∆ No “Hotel Room” Findings Auditee: “Tell me something I don’t know. ” Think about what you’re leaving behind for the: next audit team and the CAPA System Page 29

Resources / Training Hire good People Document Training Requirements When documenting Changes (ECNs) - capture whether training is needed Define your methods of Training “effectiveness” Job Descriptions can help reduce record keeping Keep Performance Eval’s Confidential Page 30

Design Controls Can be used as methodology for developing a PROCESS, e. g PFMEA Matrix-out the various records Design History File (DHF), Technical File (‘design doss’ier’ from MDD) Device Master Record (DMR) leads to Device History Record (DHR) Invest in DESIGN INPUT documents (specifications) that have customer input for ‘usability’. Page 31

Design Controls Do Risk Management Planning early (ISO 14971) using a full tool box, FMEA / HA / Risk Assessment / etc. Identify and protect access to Confidential health information Include learnings from complaint history on similar products. Bring in key suppliers as development partners. Project Reviews may not be legitimate Design Reviews; Document “Design Reviews” for Process Changes Page 32

Design Controls (cont. ) Verifications and Validations. Trace all Hardware and Software DESIGN OUTPUTS to their appropriate DESIGN INPUT (traceability matrices) Verification – we made the product right - INTERNAL view Validation – we made the right product. - EXTERNAL view Control the “transfer“ of new designs into Production to ensure that processes will be stable and produce consistently conforming products. Design changes need to be assessed for changes in risk, effect on product in the field and V&V’d. Page 33

Design Controls – Project Effort NEW Cumulative Man Hours Old Early Phase Product Release Page 34

Acceptance Activities Inspection has to happen only when you require it. 100% Inspection ISN’T. Tailor your activities to the criticality of the parts. (risk-based) Page 35

Non-Conforming Material 4 Material rejects provide data for the start of CAPA efforts 4 Use-As-Is decisions need additional “regulatory” review Do you really need “The Cage”? Page 36

Document & Records Controls Make quality system documents accessible and readable. Sometimes “less is more”. QMS documents must keep pace with 5 S/Kaizen decisions Conversely, 5 S/Kaizen implementation cannot ignore regulatory or customer requirements Validate new databases/tools for QMS related processes. Define what information must be retained for the Device History Record (DHR). Include checks of Labels and Labeling. Establish record retention and disposal schedules. Control Electronic Records/Signatures per 21 CFR 11. Page 37

Purchasing Controls 4 Quality Agreements in place for contract manufacturers and “critical” suppliers. 4“Critical” Suppliers may be subject to regulatory audits. 4 Supplier evaluations and Change Notification are required. Supplier Quality Issues are usually a 50 / 50 situation 4 Extend change notification and control process to suppliers; particularly OEMs and contract manufacturers. Page 38

Production & Process Controls F Include the work instructions and procedures for assembly, test and inspection as part of design pilot builds/release F Manufacturing equipment needs qualification, maintenance schedules and records F Some processes may need to be validated F All test fixtures, including their software, need to be verified and maintained and/or calibrated F Validate quality system S/W - 21 CFR Part 11 Page 39

Inspection and Test i Inspection and Test results recorded in the DEVICE HISTORY RECORD. Be clear on who has authority to release product for shipment. i Consider which components or assemblies need to be tracked by serial numbers for possible future corrective actions. TRACEABILITY Page 40

Feedback & Complaints i The Customer is Always Right – “But some need more Education than Others. ” i Establish Escalation paths Hold regular cross-functional meetings for tracking i Need “Adverse Event/Incident” and “Advisory Notice/Recall” Procedures to satisfy all regulatory requirements. Page 41

Corrective and Preventive Actions (CAPA) Main area for FDA Inspection 483 Findings Don’t fear documenting issues – can save you in an Inspection Use a CAPA Board Use many sources (Design, Manufacturing, Service, Audits, Suppliers, Management Review meetings, 5 S, etc. ), not just Complaints. Elements of Robust CAPA process: ê Analyze Identify Investigate Determine Root Cause(s) Action Plan Implement Check Effectiveness Update Docs Communicate Progress Cover in Management Review Do it Again ê Similar to Plan-Do-Check-Act and DMAIC cycles Something has to change ! Page 42

Labeling/Packaging/Storage/Installation e Labeling, Packaging, Handling, Storage, Distribution, and Installation requirements need documentation. Part of Transfer e FDA now requires Unique Device Identification (UDI) and/or Universal Product Codes (UPC) Product status identification can be via LOCATION e Identify shelf-life sensitive products and rotate stock to prevent aging. Page 43

Service Servicing @ It’s a process too. (7. 5 of ISO 13485) @ Decide whether “routine” service calls are “complaints”. @ Plug Service and Sales people into the complaint system. @ Analyze the data. Normalize data to your “installed base”. Page 44

Statistics Ë A simple “Run Chart” is a statistical method and is often appropriate. Ë Sampling plans used need solid rationales and can be changed based on analyzed data. Ë Be careful when setting “thresholds” for quality metrics. Page 45

Medical Device Directive Council Directive 93/42/EEC key elements Articles Annexes 1 Essential requirements 1 Definitions 2 -7 Conformity Assessment 9 Classification criteria 10 Vigilance (Incidents and Post market surveillance) 10 Clinical evaluation 11 Conformity assessment 11 Notified Bodies 15 Clinical investigations 12 CE marking Document(s): üTechnical File üDeclaration of Conformity üEU Representative üEssential Requirements üLabels and International Symbols üIncident Reports (Vigilance) üTranslations nnnn

Canadian Medical Device Regulations OVERVIEW Pre-Market – Manufacturer Classification, Safety & Effectiveness, Labeling, QMS, Licence Application Health Canada – Licensing Process Assessment of Manufacturer’s Application CMDR vs. CMDCAS Post-Market – Manufacturer Maintain Records: • Safety & Effectiveness • Distribution records Report Problems: • Mandatory Problem Reports • Recalls Report Changes : • New QMS Certificate • Licence Amendments

Questions / Comments Page 48