Process Validation
This week, the doctor completes his guidance for 21 CFR, Part 820 – Subpart G (Production and Process Controls) with a review of, and guidance for, compliance with section 820.75, process validation.
Medical device manufacturers must ensure all processes are either verified or validated. The first of two salient points to remember are that processes that cannot be verified through the employment of inspection or testing shall be validated; henceforth, the name process validation. Pretty simple, right? The second salient point is that process verification is simply the verification that process outputs meet requirements delineated through market and product specifications (a.k.a., inputs). In short, the assembly line must employ processes capable of manufacturing devices that meet their requirements, including intended use, while ensuring device safety and efficacy are sustained.
As discussed in previous editions of Devine Guidance (DG), the key components of process validation are Installation Qualification (IQ); Operational Qualification (OQ); and Performance Qualification (PQ). One final comment, Dr. D strongly recommends a visit to the Global Harmonization Task Force (GHTF) website, where visitors can download the guidance provided for process validation.
Warning letter violation
Process validation continues to be an increasing and pressing concern for the agency; and this concern is reflected in increased enforcement actions pursued. There has been a significant increase in the issuance of warning letters depicting process validation compliance violations premised on Form 483 observations noted during the friendly visits by FDA, formally and appropriately named “investigations.”
In this edition of DG, the warning-letter extraction depicts a device manufacturer that has failed to adequately validate a process that could not be verified by subsequent test or inspection; with a high degree of accuracy, I might add. On the positive side, the warning letter recipient had an established procedure for performing process validation. Unfortunately, they deviated from their established procedure. In an effort to further irritate FDA, the initial response to this observation was deemed unacceptable. Why? The formal investigation, as part of the CAPA process, was not complete.
Dr. D is quite serious in stating; “the Barmecidal (look-it up if you must) amount of warning letters presented each week, in DG, is not just a facade, they really exist in significant volume.” As I have recommended earlier, I strongly recommend a visit to FDA’s website and spend some time traversing the enforcement action page, specifically, warning letters. Remember, warning letters do not just appear out of thin air. They are a direct result of the issuance of Form 483(s), premised on observations noted, during FDA investigations. Trust Dr. D when I say, “A warning letter opens an entirely new world of hurt and pain for organizations on the receiving end of this enforcement action.”
Warning Letter (July 2010): Observation 1 of 4 – Failure to adequately validate with a high degree of assurance and approve according to established procedures, a process that cannot be fully verified by subsequent inspection and test as required by 21 CFR 820.75(a). For example, section (b)(4) of Document (b)(4), (b)(4), requires a (b)(4) sample for quality control testing and inspection. Section (b)(4) of this document describes (b)(4) for each of the (b)(4) on the (b)(4). For lot #s 0804427, 0804521 and 0804624 the (b)(4) sample for quality control testing and inspection was not performed as required by section (b)(4). For lot #s 0811405 and 0811433 the (b)(4) were not performed as required by section (b)(4).
FDA’s Response to Observation 1 of 4 – We have reviewed your response dated March 26, 2010, and have concluded that its adequacy cannot be determined at this time. You have initiated a CAPA investigation to determine the failure to follow the protocol and have acknowledged that the failure did occur. However, you have not completed the investigation and have not provided documentation of the investigation or the corrective action.
Quality system regulation – 21 CFR, Part 820
QSR – Subpart G – Production and Process Controls Section 820.75 Process Validation
a) Where the results of a process cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance and approved according to established procedures. The validation activities and results, including the date and signature of the individual(s) approving the validation and where appropriate the major equipment validated, shall be documented.
(b) Each manufacturer shall establish and maintain procedures for monitoring and control of process parameters for validated processes to ensure that the specified requirements continue to be met.
- Each manufacturer shall ensure that validated processes are performed by qualified individual(s).
- For validated processes, the monitoring and control methods and data, the date performed, and, where appropriate, the individual(s) performing the process or the major equipment used shall be documented.
(c) When changes or process deviations occur, the manufacturer shall review and evaluate the process and perform revalidation where appropriate. These activities shall be documented.
Process validation
The Doctor cannot fathom device manufacturers not having robust procedures and processes in support of process validation. In fact, Dr. D has worked for an organization that has been on the receiving end of the agency’s wrath because of a less-than stellar approach to validating processes. According to the GHTF guidance on process validation (page 3), “the validation of a process is the mechanism or system used by the manufacturer to plan, obtain data, record data, and interpret data.” Additionally, the GHTF approach to process validation reinforces the generally accepted practice of employing IQ, OQ, and PQ as part of a robust approach to process validation.
Broken-record time again by Dr. D – written procedures, a.k.a. DG Rule # 6 – All procedures, work instructions, drawings, specifications, etc. must be written, well-documented, and controlled within a defined document control system, are mandatory in support of QSR requirements. Once again, deferring to the GHTF guidance, there are multiple inputs into establishing a world-class approach for process validation. For starters, organizations really need to understand what processes require validation versus processes requiring verification only. For example, in the medical device industry, specifically sterile products, the approach to sterilization—EO, Gamma, steam, etc—must be validated. The visual inspection of a catheter handle, to ascertain correct color, e.g., green versus white, will probably require a simple verification. Regardless, the approach chosen by device manufacturers must be documented and defendable.
So what requirements need to be considered when developing an approach to process validation and the subsequent delineation of the approach within a written procedure or procedures? Recommendations from the GHTF and additional recommendations from Dr. D, deserving of consideration for inclusion into written procedures and protocols, are:
- Identifying organizational members for inclusion on the validation team;
- Deciding to pursue validation versus verification (recommend using the GHTF flow chart – page 6);
- Defining process inputs, outputs, data, and outcomes;
- Creating Master Validation Plan (MVP);
- Generating validation protocols;
- Selecting tools, measuring, inspection, and test equipment;
- Ensuring employed test methods, measuring, inspection, and test equipment is validated and calibrated;
- Defining organizational requirements for IQ, OQ, and PQ (i.e., what, how, how many, and when to verify or measure);
- Determining sample size requirements;
- Identifying statistical techniques to be employed for data analysis and normality testing, i.e., Anderson-Darling; ANOVA, Ppk, etc.
- Determining challenge versus limit testing;
- Defining content, including review and approval requirements for Master Validation Reports (MVR);
- Ensuring pass and fail criteria is clearly defined in procedures and protocols;
- Defining documentation, retention, and storage of Protocols and MVRs (e.g., DHF);
- Defining requirements for ongoing monitoring and control of processes;
- Establishing requirements for when revalidation is required (e.g. relocating a production line);
- Defining when the employment of historical data is acceptable; and
- Defining the requirement for Gauge Repeatability and Reproducibility (R & R) Studies.
Performance of validated processes
As depicted in the list above, the personnel responsible for providing input into the protocols, writing the protocols, reviewing and approving the protocols, and reviewing and approving the reports, need to be identified. The requirement is very specific in that Section 820.75 (1) requires validations to be executed by qualified individuals. Additionally, these qualified individuals will need to be trained to the released process-validation procedures employed by the device manufacturer. Furthermore, qualified individuals executing the protocols (operators, technicians, and engineers) also need to be trained. The training should encompass execution of protocols, data collection, data analysis, etc.
Finally, all test anomalies identified during protocol execution require evaluation. The analysis must be to root-cause, with all actions, corrective, preventive, or otherwise; documented and retained. Dr. D strongly recommends installing a section for addressing deviations into the MVR, including pointers to requests for CAPA and relevant non-conformance reports (NCR’s).
Monitoring and control of validated processes
From a monitoring perspective, the QSR requires that the methods employed for the testing and subsequent collection of data must be controlled, including the validation of all test methods employed. As part of the control methods employed, the date executed, the name and signature of the person or persons performing the testing, a list of the equipment used, and all relevant data associated with protocol execution should be captured and retained. Remember, the execution and results of the validated processes “shall be documented.” Why? Because according to DG Rule # 3 – Document the results of all events in writing, because if it is not documented in writing, the event did not occur. Broken record time – remember documented evidence is always your best defense, when sitting across from an FDA Investigator. As Deming would say; “In God we trust, all others bring data.”
Process changes and deviations
Dr. D would like to share a little industry insight that is extremely important to FDA. If changes to a process are made or deviations to a process noted, device manufacturers shall perform revalidation activities, where appropriate. Additionally, depending upon the device classification, you will need to notify the agency. Can you say 30-day PMA Supplement? Regardless, all changes need to be assessed and a path of revalidation considered, where appropriate. Finally, all activities associated with process changes, deviations, and associated revalidation activities shall be documented.
Takeaways
The key takeaways from this week’s edition of DG are: (a) download and read GHTF/SG3/N99-10:2004; (b) employ the GHTF as a guide for creating a robust procedure for process validation; (c) clearly define when validation will be pursued versus verification; (d) ensure all personnel associated with the process validation process are trained (including operators, technicians, and engineers; (e) evaluate all process changes and deviations and revalidate as appropriate; and (f) document the results. Treat process validation as a mission-critical activity. Your manufacturing folks will appreciate receiving processes that are fully validated and robust, as will the physicians using these devices to treat their patients.
In closing, thank you again for joining Dr. D and I hope you find value in the guidance provided. Until the next installment of DG, when I begin evaluating Subpart – H, Acceptance Activities, and specifically (820.80), receiving, in-process, and finished device acceptance – cheers from Dr. D. and best wishes for continued professional success.
References:
- Code of Federal Regulation. (2009, April). Title 21 Part 820: Quality system regulation. Washington, D.C.: U. S. Government Printing Office.
- Devine. C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ.
- FDA – U.S. Food and Drug Administration Website. (2010). Warning letters. Retrieved July 23, 2010, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/
- GHTF/SG3/N99-10:2004. (2004, January). Quality management systems-process validation guidance. Global Harmonization Task Force. Retrieved July 26, from http://www.ghtf.org/documents/sg3/sg3_fd_n99-10_edition2.pdf
Related Articles
-
The new guidance is intended to establish confidence in automation used for production or quality assurance systems and describe various methods and testing activities that may be applied to establish computer software assurance and meet regulatory software validation requirements.
-
The guidance is intended to clarify the FDA’s approach for referencing the terms “device” and “counterfeit device” in FDA documents, as well as how the agency intends to interpret existing references to section 201(h) of the FD&C Act in guidance,…
-
On August 11, the FDA released a Final Guidance on Off-the-Shelf Software Use in Medical Devices, which supersedes Off-The-Shelf Software Use in Medical Devices issued September 27, 2019.
-
The FDA has updated its guidance, Use of International Standard ISO 10993-1, “Biological evaluation of medical devices - Part 1: Evaluation and testing within a risk management process,” to provide further clarification and updated information on the use of International…
