It's already a bad day. You're feeling swamped with demands, got a ton of emails and other paperwork to get through, due in a meeting any second and haven't even started on today's 'to do' list. Then the word comes through from reception: an inspector from the Validation and Compliance Institute (VCI) is here to have a look around.
It's not an uncommon scenario, points out Norm Howe, senior partner at the VCI. "It could happen every year and a half or it could be once in ten years," he says. "But typically you do not get any warning until we're there knocking on the door."
Dependent on where a device OEM or even contract manufacturer is based in the world; where it is they're manufacturing, marketing and selling their products; and what category of device their wares fall into, a device company can be visited by any number of regulators.
Additionally, the amount of standards that manufacturers are required to meet grows almost continuously: as one process, principle or strategy is proved, or disproved, to work, regulatory requirements are tweaked or sometimes completely overhauled.
With an 8% increase in device warning letters (from 22% to 30%) issued by the Food and Drug Administration (FDA) in 2008 compared with 2007, inspection is a vitally important part of the medical devices landscape and one that, for obvious reasons, has to be taken very seriously by inspectors, government and industry alike.
Audits and their consequences
Inspections can result in the all-clear, what is known as Form 483, which is really just some observations on potential areas that could be improved, or a full-blooded warning letter, something that can have huge ramifications for your business and reputation.
"With a 483 you are not required to respond, though it may be a good idea to do so," says Howe. "Our advice is that you should respond in a timely manner and that you should tell the FDA what is going on, in terms of the citation and in terms of your target date and who is responsible for performing the activity required. What we are looking for is not just to correct what is usually a minor, often environmental, issue but to go back and cure the system error that created that
"If you get a warning letter you have to react quickly and comprehensively. If you have a really serious problem there is always the possibility of having product seized, being fined or even having employees indicted. There are a lot of tools at our disposal."
All warning letters go up on the FDA's website, though a 483 normally does not. Howe emphasises the fact that if anyone carries out a Google search on a company, the first thing that will come up – normally even before the company's own website – will be a link to that warning letter. It is therefore important to a firm's reputation to get it sorted and resolved.
The key to any audit, he suggests, is ensuring you have a good corrective and preventive action (CAPA) system in place. This is the system a manufacturer should have in place to identify errors in the process, find the root cause and install solutions to prevent them from happening again. Ideally, it is important to have a system that encourages everyone in the plant to be looking for potential sources of problems before they happen. The VCI runs online training courses on how to implement
such a system.
"If you have flaws, a good CAPA system is going to find them and correct them," Howe explains. "However, you also have to recognise that in any system run or overseen by humans there is the potential for flaws to creep in.
Audit essentials to be aware of
There are also a range of other elements that are important and that device manufacturers need to consider. Cultural transformation, for example, is one of the hardest parts of any organisation to overhaul, especially if an audit and gap analysis has indicated widespread system failures.
It may well be, for instance, that procedural and technical upgrades will not necessarily by themselves lead to full quality compliance. It may therefore come down to transforming the behaviour of most of your workforce, including converting behaviour patterns into improved quality results, even when the pressure to ship products and cut costs becomes intense.
"You need to be getting your standard operating procedures (SOPs) in good shape, with your employees trained in SOPs and ensuring your SOPs reflect your good manufacturing practices in the way they should."
Similarly, how you communicate with the FDA is, unsurprisingly, a critical part of this audit process. When responding to a 483 or warning letter, for example, it is important to include target dates and responsibilities.
The FDA will be looking not only for corrections to specific observations but also to the quality systems that underlie the citation, stresses Howe.
Then there may well be issues about your design controls that you need to consider. Every manufacturer of Class III, Class II and some Class I medical devices must have systems and procedures for controlling the design of their products, with the FDA requiring a written plan for each design project, including initial design requirements; verification that design outputs meet design input requirements; validation that initial production units conform to user needs and intended uses; that design is properly transferred to manufacturing; and that changes in design are tracked and documented.
Similarly, it is important before you implement a change in your process that you first evaluate the impact of the change on the quality of the product. A manufacturer must be able to provide documented assurance that the quality of the product will not be adversely affected by the change.
Within all this it is a good idea to be carrying on regular, and robust, gap analysis, Howe suggests. This is the process of comparing your system to FDA requirements and, as the name suggests, identifying gaps. Questions to consider might be along the lines of: what do the gaps in your programme mean? Do you have some lapses in the execution of a fundamentally sound system, or are there underlying issues that manifest themselves in seemingly unrelated errors?
Finally, device manufacturers need to be paying close attention to deviations. However, it is important to recognise, suggests Howe, that deviations can occur in any workplace, whether planned or not. Any deviations that occur in the manufacturing or testing of a bulk or drug product must be documented and reviewed by management.
A review of the effect of the deviation on the quality and efficacy of the product must be performed and documented by quality and production management. This review must include any necessary steps or corrective actions that are required. Responsible personnel must be listed for each item. It is also important to recognise that you need not suffer alone and, in fact, being proactive and using the VCI's expertise before you get to the point where you are playing catch-up with the FDA can
be a good idea.
How the VCI can help
The VCI runs one-day training courses on CAPA, preparing participants to complete CAPA investigations on their own, learning what it means to have control over deviations so that failures can be prevented before they happen, how to write CA reports that will be used as written and to learn how a well-maintained CAPA system can save time as well as money.
Developing remediation plans
A remediation plan identifies root causes for deficiencies and puts into place a system that corrects and prevents those deficiencies from re-occurring. Failure investigations are performed to document the investigations and resulting actions involving a known off-specification batch or customer complaint. Because of the compliance scrutiny that failure investigations must endure, these investigations must be thorough and complete. Therefore, a systematic approach must be applied each and
every time a failure occurs.
Device development support
The VCI offers consultancy advice on formulating regulatory and submission strategies, which will need to be an integral part of your device development business plan; the speed with which you can get your product on the market and generating cash depends in large part on this submission and approval process.
Developing and writing a Validation Master Plan
A Validation Master Plan is an integral part of any well-organised validation project. It needs to document the company's approach to complex validation projects, clarify responsibilities, general objectives, procedures to be followed for validation and prioritise multiple validation tasks. It may reference several protocols and procedures to be written to conduct the qualification of several different pieces of equipment and different processes and may specify schedules for validation and
the allocation of resources needed to perform the validation
Inspectors on the lookout
So, what do inspectors look for, what should you expect and how should you prepare? The first thing to note, warns Howe, is that even before the knock on the door the inspection will have started.
"When I go in to do an audit, the first thing I do – I do not know if people realise this – is that when I drive up I am already carrying out the audit, even before I knock on the door," he explains. "So I will spend some time observing the facility from the outside, looking at the buildings, which are, after all, the first layer of protection for your client. It will be a question of looking at how things are designed and kept, whether there are any pests, dirt and so on out there. If it is an isolated building, is there half a metre of clearance around the outside of the building so that people can walk around the perimeter?
"Then the moment I walk into the building I do a quick scan to get a first impression: what the place looks and feels like, is it well organised? There will normally be an initial meeting, often in the executive offices but I also make a point of going out into the far corner of the plant and looking into the employee bathroom.
""The bathroom will tell you a lot about the culture of a place. If it is a pit, then you know you probably have to look deeper, even if the executive offices are very nice. I'll probably spend about 70% of my time during an inspection looking at documentation, 20% looking at the facility and 10% talking to employees," he adds.
"As well as the detailed documentation, I'll be looking for things such as cracks in the window frames, whether there is the right sort of lighting, the attitudes of management and employees within the organisation, and so on."
Howe advises trying to put yourself into the eyes of an inspector and go around your plant imagining it is the first time you have seen it. Also, it makes sense to plan for an audit. Not only will it help you pass, it will also have the added benefit of simply ensuring quality improvement, and improving quality systems, become a day-to-day issue within your organisation.