The medical device industry faces the challenge of delivering safe and cost-effective products on time, every time. The pressure to introduce products into the marketplace is undoubtedly intensified by the strict guidelines enforced by the FDA and other global regulatory bodies. Medical device companies are obligated to meet market demands while fully complying with regulatory requirements.

Over the last several years, there has been a significant increase in audit findings, warning letters and consent decrees that have, in some cases, caused a supply chain delay or even plant closure. Every organization understands that an effective corrective and preventive action (CAPA) program is mandatory for doing business while still satisfying FDA and international regulatory guidelines. The bottom line is to find ways to operate effectively within a CAPA system while maintaining profitability.

Death by CAPA

While working with FDA district directors of both the Southern California and San Francisco districts several years ago and examining the device industry, one director stated that if we didn’t do something to move companies toward better risk management of the myriad inputs to the CAPA system they would suffer “Death by CAPA.” That simple comment went viral and is now commonly used throughout the industry.

In short order, we began to reexamine the CAPA “feeders” for the types of outcomes that were best suited to solve particular inputs. Better definitions were determined for corrections, corrective actions, and preventive actions. The front end of the CAPA process was replaced with a risk gateway that determined what to do based upon the severity of the situation and the probability of occurrence. At the same time, the work that we were doing with the Global Harmonization Task Force (GHTF) in an effort to harmonize a global standard reflected this needed change.

No longer is it appropriate to drive every quality event (complaint, deviation, product non-conformance, audit finding, etc.) into a one-to-one path toward a corrective or preventive action. Many quality events are handled through a correction or containment action and withdrawn from the more rigorous formal quality event management/CAPA process early.

Risk models can be developed to reflect the business of that device manufacturer that will eliminate many of the pains caused by Death by CAPA syndrome (See Figure 1).

The green ovals in Figure 1 demonstrate how exit points in the process allow for quality events to be resolved at the simplest stage based upon the risk inherent to the event. Those that require a corrective action are investigated inside the CAPA process, while more simple events are resolved immediately with containment strategies or are monitored via tracking and trending until an action is needed. (Compare this to the GHTF/IMDRF Study Group Three Final Document, pages 5-6.)

The risk assessment called out in the center section of the diagram is often referred to as the CAPA gateway. In a sense, by responding to the questions raised via the CAPA gateway and determining the associated risk, you understand the “finish line” required for each quality event. For example, if a quality event that has a risk factor in which the impact of the occurrence is serious and the frequency is high, an investigation is needed to determine root cause. Then, a corrective action must be taken to eliminate reoccurrence of the cause. At that point, verification is required to ensure the problem has been solved.

It is also wise to connect the corrective action to the change control process. Doing so makes it easier to determine if the change will result in potential problems either downstream in the process or as it may connect to the solution. These potential problems can be addressed with preventive actions that keep the potential problem from occurring.

Medical Device Case Study: One CAPA System, Two Quality Events

To better understand the benefits of risk gateways, consider the following example. A company that manufactured diabetes test strips had many quality events logged into the CAPA system. Two particular complaints from the field warrant deeper analysis:

1. The ink color on the outside of the container was the wrong Pantone color of green (easily readable with no other errors)
2. The test strip had caused a false positive reading and insulin was misjudged resulting in hospitalization (serious medical intervention)

The first example requires either no action or a correction. The second quality event requires a thorough investigation and corrective action. A risk gateway early in the CAPA process would have determined the appropriate finish line and required actions based upon risk assessment.

Unfortunately, the company had placed both events into the formal CAPA process and was then required to follow all the steps in the process—investigation, correction and validation—before the actions could be closed and the correct finish lines crossed. A CAPA process with exits similar to those shown in the process in Figure 1 would have allowed for an earlier exit with containment/correction rather than an exit later in the process when more rigor is mandated for closure.

A thorough understanding of risk ensures that resources are dedicated to the most serious problems. When reporting to management in quality review meetings, good risk management approach also makes it much easier to address the most significant quality events and actions taken. Great advantages of efficiency and effectiveness come as a result of eliminating Death by CAPA.

While procedures such as GHTF CAPA Study Three, ISO 14901, and others provide useful guidelines, an organization must make sure the terms used to describe definitions of impact and frequency in its risk matrix are effective for its particular products and services. Subsequently, these definitions must also make it possible to effectively handle all of the quality events that feed into the system and ensure each event can be dispositioned according to appropriate actions.

Senior management must recognize that daily decisions will be made using these risk scales and must approve of and endorse the dispositioning path. They, not the people following the risk process and executing decisions, will be held accountable.

When first setting up risk definitions and using a new risk matrix, it is also prudent to validate the effectiveness of the system by conducting a post-setup audit. This can easily be achieved by examining quality events after three- and six-months time. These audits allow the organization to thoroughly check the effectiveness of the disposition path and whether or not the appropriate actions (correction, corrective, or preventive) were taken to resolve the quality event. A post-setup audit also allows you to make any necessary adjustments to terms/definitions, review the process with senior management, and monitor and recheck after a few months until it can be refined into the most effective system.

By tracking data generalized over a wide array of device manufacturers, it is evident that the overall number of quality events that have advanced to full investigations and corrective actions have been reduced by more than 50% over the last five years. The industry as a whole has also seen much better utilization of resources against more serious problems. Quality, engineering, manufacturing and development departments, just to name a few, are working much better together, because common goals are realized and focus is aligned to quality assurance and business/production objectives.

Monthly quality review meetings with management have generally become more productive, as key CAPA actions are reviewed and management inputs the decision criteria to the quality team. Conversely, the quality team provides useful data that helps management make better daily decisions that serve long-term goals.