I begin this edition of Devine Guidance (DG) by reinforcing the importance of DG Rule #1 – Compliance to regulations is not optional, compliance is mandatory and dictated by law. In my belief, management responsibility is what the doctor likes to call the “catch-all requirement.” What does that mean Dr. D? Simply put, if your organization fails to comply with any part of the QSR, rest assured, the reward will be in the form of a Form 483 for the specific transgression, by the agency.

Additionally, if the transgression can be linked back to insufficient management oversight, a second observation will be issued for ineffective management responsibility. For example, if an organization is not performing internal audits due to a lack of available resources, it is the responsibility of the management to rectify the problem by ensuring that adequate resources are available. This installment of Devine Guidance dives into management responsibility.

Warning letter violation
Management responsibility or the lack there of is one of the more popular Form 483 citations issued by FDA. Additionally, the management review process is, without a doubt, an area FDA is spending some serious time reviewing during their visits. Furthermore, it is one of the key failings of the three medical device manufacturers awarded the warning letters highlighted in this week’s edition of Devine Guidance. Remember, management reviews shall be documented, IN WRITING, and the entire management review process documented by procedure. A key take-away from this is that you do not have to share the contents of management review with FDA! However, you must provide sufficient proof the reviews are being held and the process is effective.

Warning Letter One (February 2010): Failure to implement your management review procedure, as required by 21 CFR 820.20(c). Specifically, your “Management Review” procedure, dated 8/6/07 states that management review meetings are held quarterly. Your firm has not documented a management review meeting since December 15, 2004. Failure to establish and maintain an organizational structure to ensure that devices are designed and produced to meet the requirements of 21 CFR part 820, as required by 21 CFR 820.20(b).

Warning Letter Two (January 2010): Management with executive responsibility has failed to ensure that an adequate quality system, as defined in 21 CFR 820.3(v), has been fully implemented and maintained at all levels of your organization, as required by 21 CFR 820.20 as is evidenced by the observations below. In addition, your firm has not designated a management representative, as required by C.F.R. 820.20(b)(3), and you have not established management review procedures, as required by 21 C.F.R. 820.20(c), nor conducted management reviews since 2004.

Warning Letter Three (December 2009): Failure of management with executive responsibility to review the suitability of the quality system at defined intervals and with sufficient frequency according to established procedures to ensure the quality system satisfies the requirements of this part, as required by 21 CFR 820.20(c). For example, your firm failed to establish and implement written management review procedures. The only management official on site explained he was not aware of the requirements.

Quality System Regulation 21 CFR, Part 820
The QSR – Subpart B – Quality System Requirements, Section 820.20 Management Responsibility states the following:

(a) Quality policy. Management with executive responsibility shall establish its policy and objectives for, and commitment to, quality. Management with executive responsibility shall ensure that the quality policy is understood, implemented, and maintained at all levels of the organization.

(b) Organization. Each manufacturer shall establish and maintain an adequate organizational structure to ensure that devices are designed and produced in accordance with the requirements of this part.

1. Responsibility and authority. Each manufacturer shall establish the appropriate responsibility, authority, and interrelation of all personnel who manage, perform, and assess work affecting quality, and provide the independence and authority necessary to perform these tasks.
2. Resources. Each manufacturer shall provide adequate resources, including the assignment of trained personnel, for management, performance of work, and assessment activities, including internal quality audits, to meet the requirements of this part.
3. Management representative. Management with executive responsibility shall appoint, and document such appointment of, a member of management who, irrespective of other responsibilities, shall have established authority over and responsibility for:

(i) Ensuring that quality system requirements are effectively established and effectively maintained in accordance with this part; and
(ii) Reporting on the performance of the quality system to management with executive responsibility for review.

(c) Management review. Management with executive responsibility shall review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency according to established procedures to ensure that the quality system satisfies the requirements of this part and the manufacturer’s established quality policy and objectives. The dates and results of quality system reviews shall be documented.

(d) Quality planning. Each manufacturer shall establish a quality plan which defines the quality practices, resources, and activities relevant to devices that are designed and manufactured. The manufacturer shall establish how the requirements for quality will be met.

(e) Quality system procedures. Each manufacturer shall establish quality system procedures and instructions. An outline of the structure of the documentation used in the quality system shall be established where appropriate

Management responsibility
The key components of an effective management responsibility process are; quality policy, organization structure, responsibility and authority, resources, management representative, management review, quality planning, and quality system procedures.

Let me begin with the quality policy. This aspect of the regulation is simple. Develop a quality policy (in writing) and ensure all employees are trained to understand the contents of the policy. I recommend strict adherence to DG Rule # 6 – All procedures, work instructions, drawings, specifications, etc. must be written, well-documented, and controlled within a defined document control system.

The organization structure is also a relatively benign concept. To meet the requirement, an organization must be adequately staffed and structured to meet all of the QSR, and other FDA requirements, in support of designing and manufacturing medical devices that are safe and effective. Additionally, an organizational chart is required with evidence of an independent quality function reporting into executive management. Furthermore, the reporting structure should result in no conflicts of interest between manufacturing, quality, regulatory, and other operational functions. In short, having quality report into manufacturing is not acceptable.

Responsibility and authority are also self-evident. The quality function should have a clearly defined role that supports the organization and results in compliance with the QSR. The personnel assigned to roles within quality shall retain a sufficient level of authority and independence to address quality issues as they arise. For example, at the end of the day, you never want the manufacturing manager trumping quality-related decisions associated with nonconforming product (yes – bad example by Dr. D).

If you want to manufacture and distribute medical devices within the United States, compliance to the QSR is the price of admission. That said, it takes resources to comply with the regulation, and I am not just talking about quality or even quantity. Training for quality personnel performing tasks such as product assessments and internal audits is a given. It is the responsibility of management to ensure every functional area of the business is properly resourced, including janitorial services. Are you kidding me Dr. D? Seriously, it will become readily apparent, through the analysis of organizational metrics during management review, when the overall effectiveness of your organization is impaired due to resource constraints. For example, if there are cleanliness issues on the manufacturing floor, the result may be an increase in contamination counts resulting in actual LAL or bio-burden issues. Remember, organizations must be properly staffed and trained.

The management representative is another no brainer. Select the person you want wearing the orange jump suit, a.k.a. the Chief Jailable Officer (CJO). Just kidding! This individual should be a senior member of the quality organization, preferably the most senior member. This individual is tasked with taking ownership of the quality system and reporting on the overall effectiveness of the quality system to management. Additionally, this position of great importance should be noted on the organizational chart. It is also expected the management representative will be an audit-facing individual, for the friendly FDA visits. Make sure this individual is trained accordingly, as the proverbial “deer in the headlights look” can result in unwanted 483s.

Management review is an often overlooked but mission critical process, as seen in the warning letters. As part of management review, all aspects of a medical device manufacturer’s quality system and business system are analyzed for compliance and effectiveness. The actual review should contain sufficient granularity to ensure executive management understands the quality status of the business and can make intelligent decisions premised on the metrics provided. The key is to ensure all aspects of the quality system are reviewed for performance and ongoing compliance to the QSR. For example, and not all inclusive, critical areas requiring inclusion into the management review process should be CAPA, supplier performance, yields, internal audits, results of external audits, training, yields, complaints, field actions, inventory issues, resources, and other significant quality and performance issues. It is up to your organization to decide what is critical and needs to be included in the review. Additionally, make sure all of the metrics being reviewed, as part of management review, are defined in the management review procedure. Furthermore, schedule and hold management reviews at published intervals. Finally, make sure there is a quorum in regards to attendance; and capture the attendance, issues, action items, etc. in the meeting minutes. Remember, the contents of management review do not have to be shared with the FDA; however, you will need to provide evidence the meetings have occurred and the process is functioning effectively.

Quality planning is a tool that defines how a medical device manufacture will meet quality requirements. The plan should contain sufficient granularity in support of defining required resources, specific activities, test methods, special testing requirements, special processes, quality practices, and similar tools needed to support the design and manufacture of medical devices. Dr. D also recommends that quality-planning documents be reviewed and approved by multiple functional organizations, placed under change control, and tracked to completion.

Lastly, and probably most important, are the quality system procedures. A quality system is only as effective as the written procedures, work instructions, forms, etc designed to support it. Dr. D strongly recommends creating a functional matrix that allows the mapping of all documentation associated with supporting your quality system back to the specific QSR requirement. The FDA references the employment of an outline of the document structure. It is Dr. D’s opinion that the application of a well-designed document map will serve the same purpose. In fact, a document map with hot links is even better. Either way, the key take away for this requirement is written procedures and the organization of the document structure that depicts a cohesive approach to quality.

Conclusion: Actively engage the management
Employing rocket science is not required to comply with the QSR and specifically, management responsibility. The key for complying with Section 820.20 is ensuring the management team is actively engaged in all aspects of the quality system. Consider the three warning letter excerpts presented earlier in this paper. The effectiveness of the management review process will be evaluated by the agency, when they visit.

A well-defined quality policy, a clear organizational structure, adequate quality resources, the identification of the management representative, defining responsibility and authority, adequate quality planning, and well-written procedures are all mission critical. Evidence of effectiveness of management responsibility, including training to the policies and procedures, shall be documented and retained. These types of records will be required to support claims of effectiveness and overall compliance to the QSR.

In conclusion, management responsibility is a well-defined requirement that is often overlooked by medical device manufacturers, while compliance to the QSR is mandatory. Finally, please remember, Dr. D’s diatribes are being presented to enlighten and aggrandize the valued readers of MedicalDeviceSummit. In closing, I thank you again for joining me and hope you find value in the guidance provided. Until the next installment, when I discuss Section 820.22 Quality Audits, cheers from Dr. D. and best wishes for continued professional success.

References:

1. Code of Federal Regulation. (2008, April). Title 21 Part 820: Quality system regulation. Washington, D.C.: U. S. Government Printing Office.
2. Devine. C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ. 
3. FDA – U.S. Food and Drug Administration Website. (2010). Warning letters. Retrieved April 2, 2010, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/
4. Poor supplier control causing recalls, FDA says; contract is key to success. (2007, May). The Sheet – Medical Device Quality Control, 11(6). Danvers, MA.