The Top 10 Most-Cited Issues In FDA FY2020 Medical Device Inspections
By Adam Atherton, PE, RAC, independent consultant
In my first article, I discussed the background and a few high-level observations of the FDA’s summaries of its medical device quality system inspections. This article digs into the details, starting with FY2020 observations, and concentrates on design controls, in particular.
During FY2020, FDA conducted fewer inspections than normal and conducted more remote inspections due to the ongoing pandemic. Consequently, the number of 483s issued against medical device quality systems was slashed by half. Approximately 1,600 medical device 483s were issued in FY2020.
Commanding the top three most cited clauses were CAPA (21 CFR 820.100), Complaints (820.198), and Design Controls (820.30) at 12.30%, 12.05%, and 11.12% of all cited sections, respectively. In other words, these top three accounted for 35% of all medical device 483s issued in FY2020. But what is included within each of these?
Later in the article, I examine the FY2020 citations regarding Purchasing Controls (820.50), Medical Device Reporting (21 CFR Part 803), and Production and Process Controls (820.70). I dedicate another section to citations regarding Nonconformance (820.90), Process Validation (820.75), Receiving Inspection (820.80), and Quality Audit (820.22), and I conclude by highlighting five primary takeaways.
CAPA Citations
CAPA is the process for making corrections, corrective actions, or preventive actions. Of the 197 times CAPA was cited, manufacturers either didn’t document their procedures (820.100(a), cited 165 times) or they didn’t adequately capture CAPA activities (820.100(b), cited 32 times). A great resource for implementing a robust CAPA process is the GHTF guidance titled Quality management system – Medical devices – Guidance on corrective and preventive action and related QMS processes.
Complaint Citations
Complaint is defined in 21 CFR 820.3 as “any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution.” Complaint handling is a commercial process. There are seven separate clauses for Complaints; the first five describe the process and the last two cover the geographical location of the complaint handing unit. All of the 483s that cited Complaints were against the process. Of the 193 times Complaints was cited, manufacturers didn’t document their procedures or maintain their files (820.198(a), cited 139 times), complaints of device failures were not investigated (820.198(c), cited 15 times), records did not contain required information (820.198(e), cited eight times), complaints weren’t investigated or lacked rationale for not conducting an investigation (820.198(b), cited seven times), or complaints that were MDR reportable were not promptly investigated (820.198(d)).
Design Controls Citations
Design controls as described in 21 CFR 820.30 has 10 parts. I’ll discuss each one, ordered from the most frequent citations in FY2020 to least frequent.
1. Design Validation (DVal, 820.30(g)): Cited 48 times
By far, the most frequently cited clause of Design Controls was Design Validation, which is essentially demonstrating the device conforms to the intended use and user needs. Of the 178 times Design Controls was cited in FY2020, DVal accounted for 48 of them, far exceeding any other Design Control clause. The observations ranged from not having procedures to not performing or documenting the risk analysis or software validation or not using production equivalent devices in validation studies.
Risk management is not an explicit part of design controls – it is only casually mentioned once in DVal – but it is inherent in executing all of these processes. ISO 13485:2016 makes this abundantly clear, which is important to note as FDA has already stated its intention to replace 21 CFR 820 with ISO 13485:2016.
Design Change (820.30(i)) and General (820.30(a)) were the next most cited clauses at 26 times and 22 times, respectively. DVal was cited at the same rate as these two clauses combined. For both Design Change and General, procedures were not properly established.
2. Design Change (DC, 820.30(i)): Cited 26 Times
Manufacturers did not properly establish procedures.
3. General (820.30(a)): Cited 22 Times
Manufacturers did not properly establish procedures.
4. Design Verification (DVer, 820.30(f)): Cited 19 Times
Manufacturers did not have adequate procedures or documentation and did not prove the design outputs meet the design inputs, which is fundamental to DVer.
5. Design History File (DHF, 820.30(j)): Cited 18 Times
Manufacturers did not have the documentation to show design controls were in place or that the design and development planning controls were followed.
6. Design Review (DR, 820.30(e)): Cited 15 Times
Manufacturers did not have procedures or did not adequately document the DR results in the DHF. A pattern is emerging.
7. Design Inputs (DI, 820.30(c)): Cited 12 Times
Manufacturers did not adequately document procedures or requirements and did not capture the reviews and approvals appropriately.
8. Design Transfer (DT, 820.30(h)): Cited 8 Times
Manufacturers did not adequately document procedures.
9. Design Outputs (DO, 820.30(d)): Cited 7 Times
Manufacturers did not adequately document procedures and did not adequately document or review DO before release.
10. Design and Development Planning (DDP, 820.30(b)): Cited 3 Times
Manufacturers did not document their downstream activities sufficiently.
The breakdown of all Design Control clauses in FY2020 is shown in the following table.
|
Design Control Clause (In Decreasing Order) |
Number of Times Cited |
Percentage of All Design Control Clauses Cited (178) |
Percentage of All Clauses Cited in FY20 Medical Device 483s (1,601) |
|---|---|---|---|
|
820.30(g) DVal |
48 |
27% |
3% |
|
820.30(i) DC |
26 |
14% |
1.6% |
|
820.30(a) General |
22 |
12% |
1.4% |
|
820.30(f) DVer |
19 |
10% |
1.2% |
|
820.30(j) DHF |
18 |
10% |
1.2% |
|
820.30(e) DR |
15 |
8% |
0.9% |
|
820.30(c) DI |
12 |
6% |
0.7% |
|
820.30(h) DT |
8 |
4% |
0.5% |
|
820.30(d) DO |
7 |
4% |
0.4% |
|
820.30(b) DDP |
3 |
1% |
0.1% |
|
820.30 |
178 |
100% |
11.12% |
Purchasing Controls, Medical Device Reporting, And Production And Process Controls Citations
After CAPA, Complaints, and Design Controls citations, the next three most frequent clause citations accounted for 19.2% of all cited clauses, which is approximately half of the top three. Purchasing Controls (820.50), Medical Device Reporting (803), and Production and Process Controls (820.70) come in at 6.8%, 6.5% and 5.9%, respectively. Altogether, the first six clauses accounted for approximately 55% of cited clauses in FY2020.
Purchasing Controls
Purchasing controls is where a quality system establishes the process for choosing and controlling suppliers. Since industry heavily relies on contracted goods that are ultimately integrated with the finished goods, this clause carries much weight. This is prominently reflected in the medical device single audit program model where purchasing is reviewed in conjunction with management, CAPA, design and development, and production and service controls.
Of the 109 times Purchasing was cited, the lack of adequate procedures accounted for 60%, or 62 times. The remaining citations were related to choosing, controlling, and evaluating suppliers. Do the work necessary to maintain an approved supplier list and this clause should be covered.
Figure 1 MDSAP Audit Sequence
Medical Device Reporting
Medical device reporting (MDR) is the clause for reporting adverse events by facilities, manufacturers, importers, and distributors. These reports are captured on the Manufacturer and User Facility Device Experience (MAUDE) website.
Similar to Purchasing, the most often cited part of MDR is the lack of adequate written procedures, 78 out of 104 citations, or 75%. The remaining citations were related to not submitting MDRs when necessary, delays in doing so, not investigating MDRs in a timely manner, or incomplete reporting. MDRs by their nature necessitate an expeditious path through the quality system.
Production and Process Controls (PPC)
PPC is where the regulation levies the requirement for production processes to ensure a manufactured device conforms to controlled specifications. There are many parts to this clause, including: change control, environmental controls, contamination control and equipment installation, operation, and maintenance.
Consistent with the pattern already established here, the lack of adequate procedures tops the list at 60 times (63% x 95). Gaps in equipment qualification were cited 12 times. Failing to validate production software was cited 11 times. Inadequate monitoring and controls for production processes were cited nine times. Building and personnel requirements were cited a few times. Just as design controls must be in place for design and development, so production processes must be established, monitored, and maintained to ensure continued manufacturing of compliant and consistent product.
Rounding Out The Top 10 Clause Citations: Nonconformance, Process Validation, Receiving Inspection, and Quality Audit
Each of these clauses was cited approximately 5% of the time.
Nonconformance
Nonconformance is the process by which product that fails to meet specification is controlled separately from acceptable product. Nonconforming product must be identified and dispositioned according to procedures preventing inappropriate use. The lack of adequate procedures accounted for 87% (77 of 88) of the NC citations. The remaining 11 times were related to documenting rework (two) and not segregating NC product appropriately (nine).
Process Validation
Process validation is necessary where the results of a process cannot be fully verified by inspection or test. A common example is sterilization. A sterility assurance level (SAL) of 10-6 cannot be visually inspected or release tested, so a process is locked down and validated after ensuring the SAL is achieved with statistically significant sample size. Process validation citations were primarily driven by not following procedures (54 of 78 or 69%) rather than the more typical topic of lacking procedures (11). The remaining citations were related to improperly documenting the results or improper handling of changes.
Receiving Inspection
Receiving inspection (RI) is the process used for accepting incoming components from vendors into inventory. Product failing inspection is treated as nonconforming product, whereas acceptable product is available to be used for production or development purposes. RI citations fell into one of two buckets: the familiar lacking procedures (67 of 78) and improperly documenting results (nine). Procedures need to cover inspections that occur during incoming inspection, in-process inspection, and final device acceptance inspections.
Quality Audits
Quality audits are the periodic internal audits of the quality system. These audits confirm there are records to demonstrate proof the corresponding procedures are being followed. Internal audit findings do not need to be shared with FDA inspectors; however, proof of their occurrence and any CAPAs that result are fair game. The lack of adequate procedures accounted for 54% (40 of 73) of quality audit citations. An additional 22 citations were related to not performing quality audits or not performing them at adequate intervals. The remaining 11 citations were related to auditor independence, documentation, and management communication.
The top 10 clauses accounted for 75% of all clauses cited during inspections of medical device quality systems.
5 Takeaways From FDA FY 2020 Inspections
- Cutting across the top 10 clauses cited in FDA 2020 quality system inspections, the number one area is the lack of adequate procedures. Of the 1,191 times the top 10 clauses were cited, the lack of procedures accounted for 67% of them (803 of 1,191). Medical devices must be developed, manufactured, distributed, maintained, and surveilled within the constraints of a quality system. Establishing and maintaining procedures for each of the functions involved is vital to developing and sustaining safe and effective medical devices.
- A distant second to the lack of procedures are two topics: improper documentation (140 of 1,191) and not following procedure (143 of 1,191). It is common knowledge in the medical device industry that lacking documentation is analogous to not doing the activity required by the procedure. Not following procedure is acceptable as long as it is not systemic, indicating a change in procedure or methodology is needed, and it is appropriately documented. Failing to document deviations is problematic, as it may create suspicion in the auditor’s mind. Losing the confidence or trust of the auditor will result in a more difficult audit.
- FDA and the European Union care about post-market surveillance (PMS), and so should you. Together, the complaint (820.198) and MDR (803) processes account for 23% of the top 10 citations (193+104 of 1,191). The regulatory function is normally responsible for collecting and handling PMS data, but it also communicates the results. Be actively aware of field issues to improve existing products and improve future designs.
- Manufacturing is king. Design controls may be done well, but if design transfer or change control within manufacturing is not done well, then the risk of field issues increases. Shore up the change control process so it is clear if changes can be made within manufacturing or if design controls come into play. Remember, changes within manufacturing cannot shift the intended use or risk profile or add functionality to approved product designs.
- Follow your process. If you don’t like your process, change it when appropriate. When the opportunity arises, seek cross-functional input on necessary improvements and implement changes only after considering the risks and impacts.
About The Author:
Adam Atherton, PE, RAC, is an independent consultant to medical device and combination product manufacturers. He develops strategies to address technical feasibility, new product development, remediation, regulatory, clinical, manufacturing, and post-market surveillance for Fortune 200 medical device and pharmaceutical companies as well as startup ventures. He manages key aspects of design control, risk management, product architecture, and quality systems. He graduated from Naval Postgraduate School with his MSEE degree and from California State University, Fresno with his BSEE degree. He can be reached at www.keb-llc.com or info@keb-llc.com.