You Can’t Outsource Your Quality and Regulatory Responsibilities
Dr. D is starting to see a whole bunch of virtual device companies hanging out their shingles and jumping feet first into the medical device industry. In fact, the doctor really enjoys the opportunities associated with providing consulting services to these new companies. In some cases, these new virtual organizations may be “acephalous” (look-it-up), with the collective powers of the organization being shared. However, there are regulatory and quality risks associated with starting a virtual company. It is acceptable to outsource quality and regulatory activities, not unlike outsourcing manufacturing operations to a contract manufacturer. But companies cannot outsource their quality and regulatory responsibilities, which are considered statutory by FDA and regulators outside of the United States.
Simply stated, if the product label contains your organization’s name and your organization owns the regulatory filing, your organization owns the quality and regulatory responsibilities associated with the design, development, manufacturing, regulatory approvals prior to entering the product into commerce, and post-market surveillance activities (i.e., MDRs, Vigilance Reporting, etc.). If you don’t believe Dr. D, just ask the FDA or your notified body about the ownership of these critical responsibilities.
Outsourcing
The outsourcing of manufacturing, metrology services, product sterilization, and supplier audits have been considered common practice in the device industry for years. In recent years, the outsourcing of internal audits, the preparation of 510(k)s, PMAs, Technical Files, and Design Dossiers, and the management of product recalls have become common practice.
Question – Can you guess what all of these outsourcing activities have in common?
- Outsourcing of salient processes can save organizations time and money.
- If an organization outsources a product or service, they are not responsible for the outcome.
- Organizations own the quality and regulatory responsibility, regardless of outsourcing.
- None of the above.
- A and C.
If you answered ‘e’, you would be correct. However, select the wrong supplier or fail to qualify a supplier, contractor, or consultant; and instead of saving money, cash will start flowing out the organization at a rapid pace. The phrase, “Throwing good money after bad,” comes to mind.
FDA Warning Letter – Dated 11 December 2013
The doctor was able to find a recent agency warning letter that highlights the reliance on the outsourcing of services deemed critical by FDA and depicted in the QSR. Remember, outsourcing is not the problem. The lack of oversight and the need to own the quality and regulatory responsibilities is the problem.
Failure to establish and maintain procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system. These quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited, as required by 21 CFR 820.22. For example, your firm’s Quality System Manual, Version 2.0, dated July 19, 2013, Section 9.2, “Internal Auditing,” describes performance of audits conducted across all functional business groups. However, the procedure does not specify that audits cannot be conducted by individuals who have direct responsibility for the area being audited. Specifically, the chart, included in the procedure, states that audits should be conducted by managers or supervisors from each audited area.
The adequacy of your firm’s response cannot be determined at this time. Your firm noted that it will revise its “Internal Auditing” procedure in order to assure the independence of internal audits. “The revised procedure will include annual audits conducted by independent outside QSR consultants.” However, your firm did not include documentation of the corrections and/or corrective actions and your firm did not provide evidence of implementation. Therefore, FDA cannot make an assessment with respect to adequacy.
Failure to use calibration standards for inspection, measuring, and test equipment that are traceable to national or international standards, or if national or international standards are not practical or available, to independently reproducible standards or established and maintained in-house standards, as required by 21 CFR 820.72(b)(1). For example, your firm’s calibration certificates, “Center Thickness Gauge, Digital Gauge S/N (b)(4),” and “Combination Lens Thickness Gage, S/N (b)(4),” did not document that the measurement equipment were calibrated with equipment, instruments, or standards that are traceable to a national or international standard.
We reviewed your firm’s response and conclude that is not adequate. “Your firm noted that it has contacted the calibration service provider, (b)(4), to recalibrate our firm’s equipment to an appropriate and current national or international standard. Also, your firm noted that it will ensure that all outside calibration houses used by your firm are qualified to the appropriate standard as part of your firm’s supplier qualification process.” However, your firm did not provide a corrective action plan or evidence of implementation.
Failure to designate an individual(s) to review for adequacy and approve prior to issuance all documents established to meet the requirements of this part, as required by 21 CFR 820.40(a). Your firm’s standard operating procedure for the “(b)(4),” 0-21-10-00, dated February 09, 2004, is not signed or dated to indicate approval.
The adequacy of your response cannot be determined at this time. “Your firm noted that it will revise its document control system to ensure that third party SOPs are current and approved before integrating them into your firm’s document control system.” However, your firm did not include documentation of the corrective actions. Therefore, FDA cannot make an assessment with respect to adequacy.
Takeaways
For this week’s guidance, the doctor will leave the readers with just one takeaway. It is acceptable to outsource just about every conceivable activity associated with medical device manufacturing. However, organizations can never outsource their quality and regulatory responsibilities. Failure to recognize and assume ownership and the wrath of our friends from the agency will be swift and painful.
In closing, thank you, thank you, and thank you again for joining Dr. D and I hope you find value in the guidance provided. Until the next installment of DG – cheers from Dr. D. and best wishes for continued professional success.
References:
- Code of Federal Regulation. (2013, April). Title 21 Part 820: Quality system regulation. Washington, D.C.: U. S. Government Printing Office.
- Devine, C. (2011). Devine guidance for complying with the FDA’s quality system regulation – 21 CFR, Part 820. Charleston, SC: Amazon.
- Warning Letters – Inspections, Compliance, Enforcement, and Criminal Investigations. (2013, December). Retrieved January 26, 2014, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2013/ucm379529.htm
Related Articles
-
The guidance defines SLA and non-SLA laser products and provides information on how to request a variance or exemption from SLA class limits.
-
Jordi labs and its team of Ph.D. analytical chemists developed a proprietary, multi-detector approach to ensure that all extractables are accurately characterized to comply with global materials testing regulatory requirements.
-
The guidance seeks to balance the need to obtain data on the safety and effectiveness of drugs, biological products and medical devices in the pediatric population with risks associated with exposure to such products and the reality that children cannot…
-
The updated guidance document clarifies what constitutes a statement of the basis for the deficiency and includes examples of well-constructed deficiencies and industry responses to facilitate a more efficient review process.
