Failure to Establish and Maintain
As Dr. D mentioned in last week’s guidance, the doctor was going to revisit a warning letter issued on May 8th, 2014, which contained eight observations. It should be duly noted, two of the observations were directly related to purchasing controls, with the observations starting with that familiar FDA text; “failure to establish and maintain.”
For this week’s journey, Dr. D will attempt to provide a simplified approach for complying with 21 CFR, Part 820.50. Simply stated; “there is no such thing as minimum compliance and no such thing as maximum compliance; there is just compliance.” For those of you (Dr. D included) with an “eidetic” (Look-it-up) memory, all it takes is one really bad inspection and subsequent warning letter to learn a very hard lesson in regards to what FDA is capable of unleashing from a regulatory standpoint. Enjoy!
FDA Warning Letter – 08 May 2014
“1. Failure to establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements, as required by 21 CFR 820.50. During the inspection you provided the ART Control of Suppliers Policy as your firm’s procedure covering the control of suppliers; however, you have not adequately implemented and documented this procedure. For example:
a. Your procedure states that, “Frequent communication with any currently approved contract manufacturer (CM) will be maintained to determine that all production is going according to specifications.” However, your firm does not maintain documentation of communication with your contract manufacturers.
b. Your procedure states that you will review all Establishment Inspection Reports issued by FDA for your contract manufacturers. However, your firm has not maintained documentation of these reviews.
c. Your procedure states that you will make inspection visits every (b)(4) years to your contract manufacturers and perform quality audit functions. However, you stated that it has been five years since you inspected (b)(4), and that you have not performed an inspection at (b)(4).
2. Failure to establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants, as required by 21 CFR 820.50(a). For example, you indicated that your firm does not have an established procedure that defines the quality requirements that must be met by your contract manufacturers. Additionally, your firm does not maintain documentation of your evaluation and selection of the contractors it uses to conduct the manufacturing and distribution of Citrasate.”
21 CFR, Part 820 Section 820.50 – Purchasing Controls
“Each manufacturer shall establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements. (a) Evaluation of suppliers, contractors, and consultants. Each manufacturer shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants. Each manufacturer shall:
- Evaluate and select potential suppliers, contractors, and consultants on the basis of their ability to meet specified requirements, including quality requirements. The evaluation shall be documented.
- Define the type and extent of control to be exercised over the product, services, suppliers, contractors, and consultants, based on the evaluation results.
- Establish and maintain records of acceptable suppliers, contractors, and consultants.
(b) Purchasing data. Each manufacturer shall establish and maintain data that clearly describe or reference the specified requirements, including quality requirements, for purchased or otherwise received product and services. Purchasing documents shall include, where possible, an agreement that the suppliers, contractors, and consultants agree to notify the manufacturer of changes in the product or service so that manufacturers may determine whether the changes may affect the quality of a finished device. Purchasing data shall be approved in accordance with 820.40.”
Compliance for Dummies
One of the beautiful things about §820.50 is the simplicity of its application. The agency does not dictate to device establishments how they must comply with the requirements, only that they shall:
- Establish requirements for suppliers;
- Evaluate and select suppliers that are capable of meeting the requirements;
- Define the necessary supplier controls;
- Have signed “no-change” agreements in place with suppliers (preferably supplier quality agreements/contracts); and
- Retain actual evidence of compliance.
So how does an organization comply with the requirement? Believe it or not, the answer is eloquently simple, even though the offending device establishment mentioned in this week’s guidance, failed to understand the requirement. As the doctor has previously mentioned, in the eyes of FDA, establish means to “define, document (in writing or electronically), and implement.” For those of you that do not speak FDA, it means to: (a) script; (b) release; (c) implement; and (d) actually adhere to written procedures. If you have a well-written procedure, then you are at least a ¼ of a way closer to complying with §820.50.
Secondly, there is no requirement to perform on-site evaluations of all of your suppliers; nada, zip, N/A, no, nyet, nine, etc. The requirement is implement an effective approach to evaluate and select your suppliers. If the process consists of collecting supplier questionnaires, quality management system certificates, reviewing the D & B reports, and monitoring the performance of your suppliers; and the process is effective, this approach is defendable to FDA. However, Dr. D always recommends visiting your critical suppliers annually such as, sterilization facilities and contract manufacturers. The risk is just too high not to visit these important suppliers.
Thirdly, FDA does not like surprises and neither should you. That is why having a signed “no-change” agreement in place or supplier quality contract/agreement is more than a nice-to-have, it is essential to have. It is inevitable that suppliers may need to make changes to processes, materials, or even their critical supplier base; however, when such changes impact form, fit, and function, device manufacturers need to know well in advance so the proper testing and validation can occur. Additionally, depending on the changes, FDA review and approval may also be warranted. Can you say 30-day PMA supplement?
Fourthly, documentation, documentation, and more documentation is needed to ensure the Chief Jailable Officer (CJO) has ample documented evidence to defend their establishments during a friendly FDA visit for a cup of coffee and an inspection. No documented evidence equates to no claims of compliance, which will result in a Form 483 observation.
Finally, the good news is that FDA does not retain the authority to review the results of your organization’s supplier audits. However, device establishments must provide objective evidence that audits (if audits are the tools being used to drive the supplier evaluation process) are being performed. Objective evidence can be in the form of: (a) an audit schedule; (b) audit agenda; and (c) audit sign-in sheet.
Takeaways
For this week’s guidance, the doctor will leave the readers with four takeaways: One – procedure(s) shall be established to support purchasing controls. This is not optional. Two – the agency does not define how organizations must select and evaluate their suppliers. The process is entirely incumbent upon the device manufacturer; however, the process better be effective. Three – the no-change agreement is mandated by the regulation. Four – without adequate documentation/records the CJO does not stand a prayer’s chance of establishing evidence of compliance with the FDA investigator.
In closing, thank you again for joining Dr. D and I hope you find value in the guidance provided. Until the next installment of DG – cheers from Dr. D. and best wishes for continued professional success.
References:
- Code of Federal Regulation. (2013, April) Title 21 Part 820: Quality system regulation. Washington, D.C.: U.S. Government Printing Office.
- Devine, C. (2011). Devine guidance for complying with the FDA’s quality system regulation – 21 CFR, Part 820. Charleston, SC: Amazon.
- FDA’s enforcement page. (2014, May). FDA.gov Website. Retrieved May 9, 2014, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2014/ucm397732.htm.
Related Articles
-
The new guidance is intended to establish confidence in automation used for production or quality assurance systems and describe various methods and testing activities that may be applied to establish computer software assurance and meet regulatory software validation requirements.
-
On August 11, the FDA released a Final Guidance on Off-the-Shelf Software Use in Medical Devices, which supersedes Off-The-Shelf Software Use in Medical Devices issued September 27, 2019.
-
The FDA has updated its guidance, Use of International Standard ISO 10993-1, “Biological evaluation of medical devices - Part 1: Evaluation and testing within a risk management process,” to provide further clarification and updated information on the use of International…
-
The updated guidance document clarifies what constitutes a statement of the basis for the deficiency and includes examples of well-constructed deficiencies and industry responses to facilitate a more efficient review process.
