The control of documentation is one the fundamental cornerstones supporting the foundation needed for an effective quality system, whether compliance is to EN ISO 13485, EN ISO 9000, the Medical Device Directive, or in the case of this series of Devine Guidance articles, the Quality System Regulation (QSR).

Additionally, the system employed for document controls must be all-encompassing in regards to capability, e.g., document creation, storage, issuance, changes, reviews, approvals, etc. Furthermore, the system employed for document controls must be able to handle all types of documentation, i.e., procedures, forms, reports, drawings, specifications, etc. Moreover, the system needs to efficiently and effectively process change requests, including signatures and dates of approvers. Finally, all aspects of the system employed for document controls must be fully documented, by WRITTEN PROCEDURE, with the ability to ensure only approved documents are released for use.

A final point is record retention, e.g., all documents, must be maintained. FDA will assess the effectiveness of document controls as part of their friendly visit; and verify the adequacy of your system, premised on a review of the records being maintained. Remember, records are evidence and support compliance or potentially, the lack of compliance.

Warning letter violation
As I stated in the introduction to this week’s edition of DG, document control is really the cornerstone and foundation for an effective quality system. In fact, the regulation depicts two salient points; (a) approval signatures are required, and (b) dates of approval are required. In this week’s FDA warning letter extraction, the offending medical device manufacturer was cited for 14 observations documenting the organization’s failure to properly review, approve (signatures), and/or date documentation when document changes occurred. Sometimes Dr. D thinks medical device companies hibernate and take refuge in a hibernaculum (look-up-time) versus living in the real world and addressing regulatory, quality, and compliance issues as they occur. HELLO,  14 OBSERVATIONS ARE JUST ABSURD!

Broken record time again – Dr D emphatically states, “Having a quality system that complies with all aspects of the Quality System Regulation (QSR) is the basic cost of admission into the medical device industry.” From Dr. D’s perspective, if I notice a single occurrence during an audit, I typically treat the violation as an oversight and ask for immediate correction. Fourteen observations is evidence of a complete system failure, or equally as bad, the complete absence of an effective system.

Either way, you should be prepared to ask, “Where do I sign the Form 483?” In the case of this warning letter, there is an abundance of evidence supporting the lack of a documented procedure and subsequent process for effective document controls. I would have loved to see the look of shock on the investigator’s face when he or she descried this organization’s approach, or should I say lack of an approach, to document controls.

Warning Letter (March 2010): Failure to establish and maintain procedures to control all documents that are required by 21 CFR Part 820, as required by 21 CFR 820.40. The procedures should designate an individual(s) to review for adequacy and approve prior to issuance all documents established to meet the requirements of 21 CFR Part 820. For example:

a. When requested, no procedures which address document control were provided.
b. The following unapproved documents are maintained in the Device History File, stored electronically, or are contract/(b)(4) agreements:

1. The 3CPM Company, Inc. (b)(4) with no review or approval signatures.
2. The Design Plan entitled (b)(4) undated with no review or approval signatures.
3. SOP number (b)(4) no approval signature.
4. Document number (b)(4) undated with no approval signature.
5. Document number (b)(4) dated May 14, 2003 with no approval signature.
6. Test Report (b)(4) written by the firm’s independent consultant, but not approved by 3CPM management
7. (b)(4) but does not have a review or approval signature.
8. (b)(4) but does not have a review or approval signature.
9. (b)(4) but does not have a review or approval signature.
10. (b)(4) undated with no approval signature
11. (b)(4) undated with no approval signature
12. (b)(4) undated with no approval signature
13. (b)(4) but updated.
14. “CONTRACT SERVICES AGREEMENT” between 3CPM Company, Inc (b)(4) undated with no signatures.

Quality system regulation—21 CFR, Part 820
QSR – Subpart D – Document Controls Sec. 820.40
Each manufacturer shall establish and maintain procedures to control all documents that are required by this part. The procedures shall provide for the following:

(a) Document approval and distribution. Each manufacturer shall designate an individual(s) to review for adequacy and approve prior to issuance all documents established to meet the requirements of this part. The approval, including the date and signature of the individual(s) approving the document, shall be documented. Documents established to meet the requirements of this part shall be available at all locations for which they are designated, used, or otherwise necessary, and all obsolete documents shall be promptly removed from all points of use or otherwise prevented from unintended use.

(b) Document changes. Changes to documents shall be reviewed and approved by an individual(s) in the same function or organization that performed the original review and approval, unless specifically designated otherwise. Approved changes shall be communicated to the appropriate personnel in a timely manner. Each manufacturer shall maintain records of approved changes to documents. Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective.

Document controls
Let me begin by emphatically stating, “detailed written procedures are required that define the entire approach to document controls.” Remember DG Rule # 6: All procedures, work instructions, drawings, specifications, etc. must be written, well-documented, and controlled within a defined document control system. This applies for document controls, as well. Yes, to participate in the medical device industry we need to generate a whole bunch of procedures. Yes, we need to actually train and adhere to these procedures.

Unfortunately, we also kill too many trees in pursuit of our need for procedures. So electronic documentation is the only way to go; it is green and saves trees. Regardless, regulations, procedures, changes to regulations, changes to procedures, etc. is what keeps most of us quality and regulatory professionals gainfully employed.

Document approval and distribution (a)
In breaking down the regulation, you need to start by identifying the appropriate individuals that will be responsible for reviewing and approving documents prior to their release and subsequent use. For many organizations, this activity is performed as part of a Change Control Board (CCB) meeting. The same tasks can be accomplished electronically, with the current state-of-the-art of document management systems. Either way, the intent of the regulation is to ensure qualified individuals are reviewing and approving documents prior to their release. Once again, the review and approval process requires a signature and the date reflecting the approval.

All documents, relevant to ongoing operations, must always be released and available for use at appropriate locations. For example, assembly instructions should be released to the manufacturing floor. In fact, all operators should always have the applicable assembly or work instruction available and opened at their workstation. Not to belabor a point, all inspection instructions should be available at the inspection stations; shipping and receiving procedures at the shipping and receiving workstations, etc. Are you following Dr. D’s drift here?

Additionally, all obsolete documentation must be quickly identified and removed from use. I recommend stamping each document with a bold OBSOLETE stamp and quickly collecting each one. The expectation is that organizations know the exact quantity of documents issued; e.g. let us say seven documents were previously issued, so seven documents need to be stamped as obsolete and collected when new revisions are released. Pretty simple concept, right?

Finally, although not specifically called out in this requirement, training is important. Every-single-time a change occurs to a procedure, work instruction, assembly instruction, inspection instruction, etc. the organization needs to ensure training to the new revision occurs. Trust Dr. D, the FDA will verify training is occurring to the new release of documents. If training is not occurring, can you say, “Where do I sign the Form 483?”

Document changes (b)
Managing changes to documents requires the same diligence in regards to review, approval, and evidence of signatures and dates. When making changes to documents, ensure the same functional areas responsible for reviewing and approving the original document releases are included in the review and approval of subsequent changes. As with the previous section, ensure all changed documents, once approved, are quickly released for implementation and use; and do not forget to collect the obsolete documentation. As stated in the last section, adequate training to the changes must be pursued.

Additionally, please ensure records of all changes are maintained. Once again, you will need to trust Dr. D as I inform you that FDA will review the change history of documents, when warranted, as part of their investigation. As a minimum, the following change request information is required:

1. A detailed description of the change;
2. A list of all documentation affected by the change;
3. The individual or organization requesting the change;
4. A list of change approvers;
5. The actual signature (can be electronic) and approval date of the change;
6. The effective date of the change; and
7. Additional information that may be relevant to supporting the change.

Conclusion: Focus on document controls
In conclusion, medical device manufacturers need to focus on document controls. The control of documents is a cornerstone supporting the foundation for an effective quality system. It is imperative the latest and correct revisions of documentation, e.g., procedures, assembly instructions, inspection instructions, drawing, etc. are released and employed by medical device manufacturers.

Additionally, all changes must receive the appropriate level of oversight in regards to reviews and approvals. Furthermore, similar to all records required in support of QSR compliance, signatures and dates are important. Finally, do not forget to identify and collect all documentation that has been identified as obsolete.

In closing, thank you again for joining Dr. D and I hope you find value in the guidance provided. Until the next installment of DG, when I begin discussing Subpart E (820.50) Purchasing Controls, cheers from Dr. D. and best wishes for continued professional success.

References:

1. Code of Federal Regulation. (2009, April). Title 21 Part 820: Quality system regulation.  Washington, D.C.: U. S. Government Printing Office.

2. Devine. C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ. 

3. FDA – U.S. Food and Drug Administration Website. (2010). Warning letters. Retrieved May 20, 2010, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/