In researching the manufacturing material, there was limited evidence of compliance issues specific to this requirement. One reason behind the absence of data, in Dr. D’s opinion, is because this requirement is somewhat redundant, as other sections of the QSR focus on aspects of manufacturing material in greater detail, i.e., purchasing controls, non-conforming product, acceptance activities, identification, environmental control, etc.
However, the same does not hold true for automated processes. Compliance issues, associated with automated processes, have appeared on the agency’s radar screen. There have been growing numbers of warning letters and Form 483 observations that reflect enforcement trends in regards to this requirement, specifically software and the need to control and validate software employed as part of the manufacturing process. In short, relying on the “it is just a black box” is no longer a valid defense. Furthermore, the agency wants to ensure all automated processes are documented and validated. Finally, if your organization does not want to be on the receiving end of a congeries (look-it-up time) of Form 483 observations, during one of FDA’s friendly visits, Dr. D strongly recommends compliance to 820.70; and all of the other requirements delineated within the QSR
Warning letter violation
In support of this week’s edition of DG, the doctor was able to quickly locate multiple violations of 820.70 (i), automated processes. This week’s offenders failed to validate software used in computers and data systems employed to manage their businesses. The observations appear to be relatively benign because the findings incriminate report generation employed as part of management meetings; and the employment of commercial-off-the-shelf (COTS) software. However, the QSR explicitly states; “When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol.”
Dr. D is again obliged to point out that the offender in the first warning letter had a grand total of 19 observations and 35 additional documented non-conformances to the QSR. Dr. D does not understand why these device manufacturers are constantly striving for ‘Non-compliance Rock Star’ status, instead of just working toward compliance! May be the device manufacturer that was the recipient of the first warning letter should subscribe to Medical Device Summit and read DG. This is the medical device industry and compliance to regulations is a salient requirement. Commit to memory DG Rule # 1 – Compliance, to regulations, is not optional it is mandatory and dictated by law.
Although I am not a software guru, I recommend that all device manufacturers also become fluent in 21 CFR, Part 11 to understand the agency’s overall compliance direction in regards to software, changes to software, instrumentation inputs and outputs, which are all germane to this week’s edition of DG. Remember electronic signatures and records are important too.
Warning Letter One (March 2010): Observation 9 of 19. Failure to validate computer software for its intended use according to an established protocol when computers or automated data processing systems are used as part of production or the quality system, as required by 21 CFR 820.70(i). For example, when requested, no validation documentation to support the commercial off-the-shelf program (b)(4) used to capture complaints, returned merchandise and service requests was provided.
Warning Letter Two (February 2010): Observation 3 of 7. Failure to validate computer software for its intended use according to an established protocol when computers or automated data processing systems are used as part of production or the quality system, as required by 21 C.F.R. §820.70(i) (Production and Process Controls – Automated Processes). For example, the CAPA analysis of nonconformances, which is used at management meetings, is inadequate in that the report is computer-generated on a non-validated software system.
FDA Response to Observation 3 of 7. We have reviewed your response and have concluded that it is inadequate because you state that you have eliminated the electronic recordkeeping for CAPA. But you have not provided evidence of an adequate recordkeeping system to replace the electronic system.
Quality System Regulation – 21 CFR, Part 820
Subpart G – Production and Process Controls Section 820.70
(a) General. Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications. Where deviations from device specifications could occur as a result of the manufacturing process, the manufacturer shall establish and maintain process control procedures that describe any process controls necessary to ensure conformance to specifications. Where process controls are needed they shall include:
(1) Documented instructions, standard operating procedures (SOP’s), and methods that define and control the manner of production;
(2) Monitoring and control of process parameters and component and device characteristics during production;
(3) Compliance with specified reference standards or codes;
(4) The approval of processes and process equipment; and
(5) Criteria for workmanship which shall be expressed in documented standards or by means of identified and approved representative samples.
(b) Production and process changes. Each manufacturer shall establish and maintain procedures for changes to a specification, method, process, or procedure. Such changes shall be verified or where appropriate validated according to 820.75, before implementation and these activities shall be documented. Changes shall be approved in accordance with 820.40.
(c) Environmental control. Where environmental conditions could reasonably be expected to have an adverse effect on product quality, the manufacturer shall establish and maintain procedures to adequately control these environmental conditions. Environmental control system(s) shall be periodically inspected to verify that the system, including necessary equipment, is adequate and functioning properly. These activities shall be documented and reviewed.
(d) Personnel. Each manufacturer shall establish and maintain requirements for the health, cleanliness, personal practices, and clothing of personnel if contact between such personnel and product or environment could reasonably be expected to have an adverse effect on product quality. The manufacturer shall ensure that maintenance and other personnel who are required to work temporarily under special environmental conditions are appropriately trained or supervised by a trained individual.
(e) Contamination control. Each manufacturer shall establish and maintain procedures to prevent contamination of equipment or product by substances that could reasonably be expected to have an adverse effect on product quality.
(f) Buildings. Buildings shall be of suitable design and contain sufficient space to perform necessary operations, prevent mixups, and assure orderly handling.
(g) Equipment. Each manufacturer shall ensure that all equipment used in the manufacturing process meets specified requirements and is appropriately designed, constructed, placed, and installed to facilitate maintenance, adjustment, cleaning, and use.
(1) Maintenance schedule. Each manufacturer shall establish and maintain schedules for the adjustment, cleaning, and other maintenance of equipment to ensure that manufacturing specifications are met. Maintenance activities, including the date and individual(s) performing the maintenance activities, shall be documented.
(2) Inspection. Each manufacturer shall conduct periodic inspections in accordance with established procedures to ensure adherence to applicable equipment maintenance schedules. The inspections, including the date and individual(s) conducting the inspections, shall be documented.
(3) Adjustment. Each manufacturer shall ensure that any inherent limitations or allowable tolerances are visibly posted on or near equipment requiring periodic adjustments or are readily available to personnel performing these adjustments.
(h) Manufacturing material. Where a manufacturing material could reasonably be expected to have an adverse effect on product quality, the manufacturer shall establish and maintain procedures for the use and removal of such manufacturing material to ensure that it is removed or limited to an amount that does not adversely affect the device’s quality. The removal or reduction of such manufacturing material shall be documented.
(i) Automated processes. When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented.
Manufacturing material (subsection h)
Broken record time! Once again, the need for procedures is clearly depicted in subsection h, which means DG Rule # 6 – All procedures, work instructions, drawings, specifications, etc. must be written, well-documented, and controlled within a defined document control system, continues to be a salient requirement. Besides, other than death and taxes, rest assured, the agency will expect to see written procedures that reflect ongoing compliance with the QSR.
When writing the procedure or procedures in support of the manufacturing material requirement, some of the areas that should be considered are:
- Identification and removal of manufacturing material that will have an adverse effect on device quality;
- The quarantine and handling of material that has been identified as having an adverse effect on product quality;
- Management of age-sensitive materials such as adhesives and epoxies;
- Employment and disposal of chemicals as part of the manufacturing process;
- Location of Material Safety Data Sheets (MSDS), as required;
- Management of Kan Ban systems;
- Material storage locations;
- Material handling;
- Material identification and traceability;
- Line segregation and batch management practices to prevent the mix-up of manufacturing materials; and
- The identification of ways to support the reduction of manufacturing material.
Automated processes (subsection i)
Dr. D begins by stating “Validation of all software is required and all changes to software must be validated, reviewed, and approved.” Additionally, all activities associated with automated processes must be documented, in writing. Why? Broken-record time, “if the event or activity is not documented in writing, it simply did not happen.” In fact, with no documented evidence, your organization will not be able to prove to FDA that validation of software or changes to software occurred.
Focusing on the warning letters depicted in this week’s edition of DG, the first thing to notice is the employment of computers to generate reports managing quality metrics and integral parts of the quality system, e.g., CAPA, need to be validated. Additionally, COTS needs to be validated before it is released for use in the manufacturing environment in support of performing quality functions, e.g., complaint management or customer returns. Furthermore, firmware, PALs, storage devices, etc. all need to have their uses validated. Finally, do not forget Dr. D’s “black box” comment. If software, firmware, etc. drive the functionality (inputs and outputs), validation is required.
Conclusion: Do not fall into the COTS trap
The key takeaways from this edition of DG are: (a) manufacturing material can be tailored to a device manufacturer’s environment; and (b) the validation of all software employed by device manufacturers is required.
In regards to the manufacturing environment, it is important to ensure that other procedures documenting compliance to related QSR requirements, similar to non-conforming product, be aligned with the manufacturing materials procedure(s). It sounds like an easy task but it really does involve some intelligent thought while writing related and subservient procedures.
For automated processes, do not fall into the COTS trap by assuming the software has been validated by the developer; and is suitable for use in the medical device industry. When in doubt, Dr. D recommends asking for a copy of the validation report from the developer. Even if the developer has validated the software, your still need to ensure that the software and the validation is appropriate for your application.
In closing, thank you again for joining Dr. D and I hope you find value in the guidance provided. Until the next installment of DG, when guidance is provided for Subpart – G (820.72), focusing on inspection, measuring, and test equipment – cheers from Dr. D. and best wishes for continued professional success.
Code of Federal Regulation. (2009, April). Title 21 Part 820: Quality system regulation. Washington, D.C.: U. S. Government Printing Office.
Cognizant Technology Solutions. (2001). CFR Part 11 Compliance – The Cognizant Approach. Retrieved July 13, 2010, from http://www.21cfrpart11.com/files/library/compliance/cfr_whitepaper.pdf
Devine. C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ.
FDA – U.S. Food and Drug Administration Website. (2010). Warning letters. Retrieved July 7, 2010, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/