In a perfect world, there would never be a need to handle non-conformances from your supplier base. However, the world of medical device manufacturing is far from perfect (please do not tell the regulators). You may call it fate, destiny, or bad luck, but Dr. D. calls it problem suppliers. Rest assured some of your suppliers will eventually deliver nonconforming product and at some point in the not-so-distant future, I will address managing nonconforming products as a whole.

Warning letter violation
Violation of 21 CFR – 820.90 is one of the more prevalent problems documented in FDA issued warning letters, Form 483s, notified body deviations, etc., and I find this fact and trend disturbing. As you will see in the two warning letter excerpts posted this week, the entire process of managing nonconforming product commences with a procedure.

Two salient points mentioned in the warning letter extractions are; (a) segregation, and (b) failure to investigate. Additionally, there has been a clear violation of Devine Guidance Rule # 6 – All procedures, work instructions, drawings, specifications, etc. must be written, well-documented, and controlled with in a defined document control system.

Warning Letter One (December 09): Failure to establish and maintain adequate procedures to control product that does not conform to specified requirements, as required by 21 C.F.R. 820.90(a). For example, you identified a higher incidence of nonconforming product in November 2008 through complaints filed for ovalizing and kinking of the Neuron 070 Delivery Catheter. On November 29, 2008, you advised Sales Representatives to “contact all Physicians” on your decision to stop distributing these catheters. This swap-out/action did not take effect until April 23, 2009. Your distribution records show that you still continued to distribute these nonconforming catheters from November 2008 until April 15, 2009. You did not adequately document, evaluate, segregate and dispose of the nonconforming Neuron 070 Delivery Catheter that you had at your facility.

Warning Letter Two (December 09): Failure to establish and maintain procedures to control product which does not conform to specified requirements, as required by 21 CFR 820.90(a). For example, your firm failed to establish procedures for handling and controlling nonconforming product. The only Management official on site explained he was not aware of the requirements. We reviewed the “Control of Non-Conforming Material” section of the ” Policy and Procedures Manual”, included in your response, and note it fails to require an evaluation of the nonconformance including a determination of the need for an investigation and notification to the persons or organizations responsible for the nonconformance. Additionally, there is no evidence the Manual has been reviewed, approved and implemented.

Regulations and requirements
When it comes to defining the requirements for nonconforming products, the QSR and ISO 13485 are very prescriptive. From FDA’s vantage point, identification, documentation, segregation, investigation, and disposition of nonconforming product is mandatory. Additionally, rework activities shall be documented in writing, including subsequent testing and evaluation. The results of all rework activities shall be placed into the DHR. The same salient concepts hold true for EN ISO 13485:2003. One thing I found particularly interesting is the number of times “nonconforming product” is depicted in the QSR and ISO requirements.

1. QSR – Subpart I – Nonconforming Product

• Section 820.90

a) Control of nonconforming product. Each manufacturer shall establish and maintain procedures to control product that does not conform to specified requirements. The procedures shall address the identification, documentation, evaluation, segregation, and disposition of nonconforming product. The evaluation of nonconformance shall include a determination of the need for an investigation and notification of the persons or organizations responsible for the nonconformance. The evaluation and any investigation shall be documented.

b) Nonconformity review and disposition. 

(1) Each manufacturer shall establish and maintain procedures that define the responsibility for review and the authority for the disposition of nonconforming product. The procedures shall set forth the review and disposition process. Disposition of nonconforming product shall be documented. Documentation shall include the justification for use of nonconforming product and the signature of the individual(s) authorizing the use.

(2) Each manufacturer shall establish and maintain procedures for rework, to include retesting and reevaluation of the nonconforming product after rework, to ensure that the product meets its current approved specifications. Rework and reevaluation activities, including a determination of any adverse effect from the rework upon the product, shall be documented in the DHR.

2. MDD (Please note the MDD references EN ISO 13485, the Harmonized Standard for Medical Device Quality Management Systems)

• Article 3 – Essential Requirements: The devices must meet the essential requirements set out in Annex I, which apply to them, taking account of the intended purpose of the devices concerned.

  Where a relevant hazard exists, devices, which are also machinery within the meaning of Article 2(a) of Directive 2006/42/EC of the European Parliament and of the Council of 17 May 2006 on machinery shall also meet the essential health and safety requirements set out in Annex I to that Directive to the extent to which those essential health and safety requirements are more specific than the essential requirements set out in Annex I to this Directive.

• Annex II.3 EC Declaration of Conformity – Full Quality Assurance System: The manufacturer must ensure application of the quality system approved for the design, manufacture and final inspection of the products concerned, as specified in Section 3 and is subject to audit as laid down in Section 3.3 and 4 and to Conformity surveillance as specified in Section 5.

 

3. EN ISO 13485 – 8.3 Control of Nonconforming Product

• The organization shall ensure that product which does not conform to product requirements is identified and controlled to prevent its unintended use or delivery. The controls and related responsibilities and authorities for dealing with nonconforming product shall be defined in a documented procedure.

 

• The organization shall deal with nonconforming product by one or more of the following ways:

 

1. by taking action to eliminate the detected nonconformity;
2. by authorizing its use, release or acceptance under concession; or
3. by taking action to preclude its original intended use or application.

 

• The organization shall ensure that nonconforming product is accepted by concession only if regulatory requirements are met. Records of the identity of the person(s) authorizing the concession shall be maintained.

• Records of the nature of nonconformities and any subsequent actions taken, including concessions obtained, shall be maintained.

• When nonconforming product is corrected it shall be subject to re-verification to demonstrate conformity to the requirements.

• When nonconforming product is detected after delivery or use has started, the organization shall take action appropriate to the effects, or potential effects, of the nonconformity.

• If product needs to be reworked (one or more times), the organization shall document the rework process in a work instruction that has undergone the same authorization and approval procedure as the original work instruction. Prior to authorization and approval of the work instruction, a determination of any adverse effect of the rework upon product shall be made and documented.

Nonconforming material
Believe me when I say and I repeat, “It is inevitable, at some point in time your organization will need to handle nonconforming product received from a supplier.” FDA, MHLW, Health Canada, the notified bodies, etc. will scrutinize the entire management and execution of the nonconforming product process during one of their ‘friendly’ visits. Once the nonconforming product has been identified, it needs to be documented; and remember it is not enough to document the event has occurred. In fact, the review of the nonconforming product should be premised on a 360-degree approach. As a minimum, an organization must:

1. Ascertain if the nonconforming product permeated the supply chain and if so, take steps to recover suspect medical devices (recall);
2. Tag, clearly label, and quarantine the nonconforming product;
3. Complete a thorough failure investigation (root cause);
4. Dispose the nonconforming product;
5. Arrange for an expeditious return shipment back to the supplier;
6. Issue corrective action to the supplier (see supplier corrective action report or SCAR);
7. Ensure all actions pursued are appropriate;
8. Verify the effectiveness of all corrective action pursued at some point in the future; and
9. Ensure all activities are documented and approved by the appropriate level of oversight and authority.

 

 

The best way to document nonconforming product is on a well-designed Non-Conforming Product Report (NCPR), or you can make up your own acronym, NCR, NCMR, NSMR, NCE, FBI, CIA, etc. (ok, just kidding on the FBI and CIA). Most organizations employ electronic systems and associated databases to assist in the management of NCPRs. The NCPR form should have multiple sheets (carbons) so copies can be routed to the appropriate stakeholders, i.e., supplier quality, purchasing, manufacturing, accounting (very important as you do not want to pay for nonconforming product), engineering, supplier, etc.

Additionally, ensure the form has adequate room for documenting activities, signatures, SCAR numbers, disposition of the nonconforming product, dates, and other information deemed relevant (part number, lot number, quantity, etc.). Furthermore, place the nonconforming product under lock and key in a tightly-controlled location. I also recommend convening a formal Material Review Board (MRB) to facilitate the handling and documenting of all supplier-based non-conformances.

Funny but scary DG Story: Once upon a time, in a small medical device company in Silicon Valley, Dr. D was the plant quality manager. Dr. D’s former boss had moved to the dark side of the medical device industry by accepting a marketing position, while abandoning the role of quality director. One stormy evening, this newly ordained marketing pundit needed some samples of nonconforming product locked snuggly away in the MRB cage. Since this individual was no longer a member of the quality organization, he had relinquished his rights to MRB access. Thus, this individual did the unthinkable and made the 10’ climb up and over the cage to retrieve samples! Within 24 hours of the incident, the cage had a new steel-mesh roof and the offending individual was banished to a far away land, somewhere in Europe. The moral of the story is simple; ensure unauthorized personnel cannot access the MRB area, at all costs. If you have a cage, I recommend electrifying the fence (just kidding—I think OSHA would frown down upon the practice).

A couple of more points that need to be made are in regards to returning the material to the offending supplier and the actual disposition process. My recommendation is to pursue an eclectic approach incorporating best practices when developing an effective process for handling nonconforming product. For example, once the Return-to-Vendor (RTV) disposition has been made, expedite the return. Why? For starters, depending on the sophistication of your organization’s MRP system, holding nonconforming product may influence inventory demand or the Kan Ban.

Additionally, until the nonconforming product is returned, regardless of location, it is inventory, and inventory has a value associated with it. Dr. D can speak with first-hand knowledge as to the look of shock on a VP-Operation’s face when informed there was $2.5 million worth of nonconforming product in the MRB cage. If your purchasing organization is slow in returning the nonconforming product, I recommend bringing the offending buyer to the MRB area and handcuffing this individual to the cage. (However, since procurement is a valued stakeholder in the nonconforming product process and supplier management as a whole, make sure you feed them during this brief period of imprisonment). Seriously, I would like to believe the procurement organization could obtain a returned material authorization (RMA), from a supplier, within 72-hours of the final disposition for nonconforming product being made.

As for the disposition of nonconforming product, Dr. D recognizes only three options: one, RTV; two, rework to print, and three, scrap. What? No use-as-is (UAI)? It is my professional opinion that the UAI disposition equates to a design change, regardless of how benign the nonconformance appears to be; and for PMA devices, design changes require FDA review and approval. Can you say, “30-day PMA supplement?”

Additionally, the abuse of options such as UAI will raise the eyebrows of regulators, regardless of product classification. It is always easier to defend the RTV disposition, while forcing your suppliers to get it right, preferably the first time.

Conclusion: Unless planning a design change, don’t use UAI disposition
In closing, Dr. D cannot emphasize enough the importance of the identification, segregation, analysis, disposal, and overall management of the nonconforming product process. Since the ineffective handling of nonconforming product is one of FDA’s most documented warning letter and Form 483 occurrences, it should motivate medical device manufacturers to focus on this key area.

I quote previous excerpts from the article, “Poor Supplier Control Causing Recalls, FDA Says; Contract is Key to Success” on multiple occasions, with good reason. If nonconforming product, received from a supplier, makes its way into a finished medical device, that ugly six-letter word “RECALL” will come into play for your organization. Trust Dr. D when I state first hand, “processing recalls are no fun, in fact they are extremely painful!”

Additionally, never use the UAI disposition unless you plan to treat the nonconformance as a design change; otherwise, you are steering your organization into perilous waters. In closing, thank you again for joining Dr. D and I hope you find value in the guidance provided.

Beginning in the next and subsequent editions of Devine Guidance, I will commence breaking down 21 CFR Part 820 (the QSR) and highlight salient points requiring attention to detail (next installment will discuss Management Responsibility). Until then, cheers from Dr. D. and best wishes for continued professional success.

References:

1. Code of Federal Regulation. (2008, April). Title 21 Part 820: Quality system regulation.  Washington, D.C.: U. S. Government Printing Office
2. Devine. C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ. 
3. FDA – U.S. Food and Drug Administration Website. (2010). Warning letters. Retrieved February 12, 2010, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/
4. Medical Device Directive. (1993). Council Directive 93/42/EEC. Medical Device Safety Service. Retrieved January 11, 2010, from http://www.mdss.com/MDEV/93_42_EEC.htm
5. Medical devices – quality management systems – requirements for regulatory purposes. (2007). EN ISO 13485:2003/AC:2007.
6. Poor supplier control causing recalls, FDA says; contract is key to success. (2007, May). The Sheet – Medical Device Quality Control, 11(6). Danvers, MA