Dr. D Sees a Trend
The doctor is seeing a trend in citations for lapses in Management Review. Considering how infrequently management review is cited as a problem during friendly visits from FDA for coffee and an inspection, the doctor has come across two Form 483 citations within the past few months. Although Dr. D prefers to limit the amount of times he visits a topic each year, the doctor felt obliged to address management review one more time. Seriously, it is just good business for management to take a good hard look at their operation from time-to-time. In fact, regulators and notified bodies demand it. Considering that all that Chief Jailable Officers (CJO) are required to do is to provide FDA with documented evidence (sign-in sheet) and that the meetings are occurring within establishments, there really is no excuse for receiving a Form 483 observation for management review. The doctor strongly believes that annual training to 21 CFR, Part 820, the FDA’s Quality System Regulation (QSR), will reinforce the need for device establishments to comply with all quality, regulatory, and statutory requirements, including management review. If a device establishment fails to comply with the QSR, Dr. D guarantees the CJO will not be on the receiving end of the “euphony” (look-it-up) of praise coming from an agency investigator at the end of a particularly tough inspection. In fact, the polar opposite will be true as the CJO will be on the receiving end of the “contumely” (look-it-up) coming from the investigator. Enjoy!
Warning Letter – 05 October 2017
The establishment referenced in this week’s guidance was on the receiving end of seven Form 483 Observations and an adulterated product comment as they did not have an approved Pre-Market Approval (PMA) application on file with FDA. Specifically, the investigator noted that several design changes were made and a new 510(k) was never filed with FDA. Now as the doctor has stated on several occasions, there is no magic formula associated with Form 483 observations and the awarding of that prized agency warning letter. However, when the observations noted during an inspection exceed five, and product is deemed to be adulterated, bad things are typically in the future of the offending establishment.
Warning Letter Excerpt
Observation Six (6) “Management with executive responsibility has not reviewed the suitability and effectiveness of the quality system, pursuant to 21 CFR 820.20(c). For example, Management Review had not been performed since January 11, 2016; however, your Management Review Procedure QOP-56, requires a minimum of two meetings per year.”
“We reviewed your firm’s response and conclude that it is not adequate. While your firm provided a timeline for estimated completion of corrective actions including a gap analysis on core procedures, work instructions, and forms/templates, you have not provided any supporting documentation. Your response states that you will create a CAPA and evaluate related management review processes and documents, however, no evidence was provided.”
21 CFR, Part 820.20 – Management Responsibility
(c) Management review. “Management with executive responsibility shall review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency according to established procedures to ensure that the quality system satisfies the requirements of this part and the manufacturer’s established quality policy and objectives. The dates and results of quality system reviews shall be documented.”
Compliance for Dummies
This week’s compliance will be brief. ISO 13485:2016 has clearly defined all of the management review inputs and outputs in sufficient detail. In fact, if device establishments cut and paste these requirements from the ISO standard and place them into their own procedure, compliance will become a really simple task. However, establishments actually do need to hold management review meetings in accordance with their establishment’s stated frequency. The best practice is to build the management review meeting into the internal audit schedule. The doctor believes management reviews should occur shortly after an internal audit.
From Dr. D’s perspective, holding an annual meeting, which appears to be the industry default, is just not sufficient. Hell, the doctor cannot remember what he had for breakfast most mornings let alone what he had for breakfast a year ago. There is no doubt that the same philosophy holds true for device establishments and their management review discussion points. The doctor strongly believes that management review meetings should be held quarterly. In fact, quarterly would be considered a best practice. Even better would be monthly meetings (a world-class practice) but that would clearly require the commitment from an establishment and a dedicated resource to manage all of the management review data.
The next point that Dr. D would like to make is that if the management review meeting identifies issues requiring mitigation, make sure action items are assigned. Do not be afraid to open CAPAs to address issues. Even more important, hold the assignees accountable for CAPA activities. Ensure that assigned action items (or CAPAs) are discussed at each meeting until they are closed. Failure to have adequate resources to address assigned action items or mitigate CAPAs is considered worthy of a Form 483 observation by our dear friends from FDA.
Furthermore, if key members from the management team cannot make a meeting, postpone the meeting until all of the appropriate resources can attend. Can you say quorum? It makes zero sense to hold a meeting if the majority of the management team (e.g., CJO) are not in attendance.
Finally, always remember that device establishments do not have to share content of the management review meeting with FDA. The only thing that needs to be provided to FDA is documented evidence that the meetings are being performed. Dr. D prefers to share the attendance sheet and agenda with FDA. Nothing more and nothing less!
Takeaways
For this week’s guidance, the doctor will leave the readers with three takeaways. One – use the management review inputs and outputs depicted within ISO 13485:2016. It is much easier than re-inventing the proverbial wheel. Two – quarterly reviews are considered best practice. Three – device establishments do not have to share management review content with FDA, only documented evidence that the meetings are being held. In closing, thank you again for joining Dr. D; and the doctor hopes you found value (and some humor) in the guidance provided. Until the next installment of DG – cheers from Dr. D. and best wishes for continued professional success.
References
- Code of Federal Regulation. (2017, April). Title 21 Part 820: Quality system regulation.
Washington, D.C.: U.S. Government Printing Office. - Devine, C. (2011). Devine guidance for complying with the FDA’s quality system regulation – 21 CFR, Part 820. Charleston, SC: Amazon.
- Devine, C. (2013). Devine guidance for managing key attributes of a FDA-compliant quality management system – 21 CFR, Part 820 Compliance. Charleston, SC: Amazon.
- FDA’s enforcement page. (2017, September). FDA.gov Website. Retrieved October 23, 2017,
From https://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2017/ucm580281.htm
Related Articles
-
The guidance is intended to clarify the FDA’s approach for referencing the terms “device” and “counterfeit device” in FDA documents, as well as how the agency intends to interpret existing references to section 201(h) of the FD&C Act in guidance,…
-
The new guidance is intended to establish confidence in automation used for production or quality assurance systems and describe various methods and testing activities that may be applied to establish computer software assurance and meet regulatory software validation requirements.
-
The updated guidance document clarifies what constitutes a statement of the basis for the deficiency and includes examples of well-constructed deficiencies and industry responses to facilitate a more efficient review process.
-
The revised cybersecurity draft publication is not intended to be a checklist for healthcare organizations to follow, but rather a guide to help them comply with the HIPAA Security Rule.
