As we inch closer toward the start of football season, the doctor somehow feels compelled to use one of his favorite sayings, “basic blocking and tackling.” When it comes to management review, it is incumbent upon management to actually hold these reviews. ISO 13485:2016 and 21 CFR, Part 820.20 require that management actual take the time and review the effectiveness of the quality management system (QMS) they are charged with overseeing. However, from Dr. D’s perspective, it boils down to knowing and understanding what influence the day-to-day activities have on the QMS, and the overall impact the QMS exudes on the safety and efficacy of the medical devices an establishment enters into commerce. The doctor never wants to be that chief jailable officer (CJO), sitting across from an investigator from the FDA, having to reach for excuses in an attempt to defend why reviews are not being held. Even the most imperturbable (look-it-up) of CJOs would have great difficulty attempting to keep his or her calm when attempting to defend not complying with one of the most basic of quality requirements. Enjoy!

Warning Letter – July 25, 2018

The doctor reviewed another observation extracted from this this warning letter in early August. The warning letter cited seven observations. A couple of the observations noted within the warning letter cited failures to comply with what Dr. D feels are extremely basic quality concepts, one being management review. It is the doctor’s opinion that management reviews should be held with sufficient frequency to ensure the management team and all of the team members have a clear idea as to what direction the establishment is trying to accomplish. Can you say, “Everyone should be on the same page?” As establishments grow, management review becomes increasingly more important as the lines of communication become elongated and more complex.

Warning Letter Excerpt(s)

Observation Six (6) – “Management with executive responsibility has not reviewed the suitability and effectiveness of the quality system per the requirements of 21 CFR Part 820.20(c).”

“You provided a Management Review procedure, QMP-012, revision: NEW, Section 4.1, which states your firm will conduct management reviews (b)(4). This procedure does not note any effective or implementation date, or any evidence it has been reviewed or approved, yet you told our investigator it became effective April 6, 2018. No related procedure preceding that date was provided during our inspection. Your firm was distributing medical devices but did not conduct management reviews to meet the requirements of 21 CFR 820.20 from 2014 – 2017.”

“Your May 4th response states your firm will revise your “Quality Plan” by June 15, 2018, to require management reviews be conducted (b)(4) for at least (b)(4) to ensure the adequacy and suitability of the quality system. Your June 2nd response did not provide any specific updates on this item. Therefore, we cannot evaluate the adequacy of your firm’s response and proposed actions at this time as you have not provided objective evidence of corrections to date.”

“We request that you review 21 CFR Part 820.20 and provide a summary of your corrections, including the (b)(4) review schedule (once established), and evidence of the completion of your first review.”

21 CFR, Part 820.20 – Management Responsibility

“(c) Management review. Management with executive responsibility shall review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency according to established procedures to ensure that the quality system satisfies the requirements of this part and the manufacturer’s established quality policy and objectives. The dates and results of quality system reviews shall be documented.”

Compliance for Dummies

The doctor will begin by stating device establishments do not have to provide excruciating detail to the FDA when they share documented evidence of compliance with §820.20. All that is required is documented evidence that reviews are occurring with sufficient frequency. In fact, §820.180(c) “Exceptions” documents the fact that only documented evidence of reviews being performed needs to be shared with FDA, upon request. Can you say management review attendance sheet and agenda? Conversely, because device establishments pay their notified bodies for some level of regulatory pain, the notified body auditors will want to examine the management review meeting minutes with (in some cases, mind you) excruciating detail. For those of you familiar with ISO 13485:2016 Clause 5.6, a high-level of detail is required in support of the management review process. Can you say review input (Clause 5.6.2) and review output (Clause 5.6.3)? Note: As the medical device world attempts to migrate toward MDSAP, ISO 13485:2016 will become increasingly more important.
Complying with the management review process is so easy a caveman could do it (thank you, GIECO). Seriously, for starters, the doctor recommends ensuring the management reviews are actually scheduled. Dr. D. has seen some establishments loading the reviews into their annual audit schedule. The reviews are scheduled to be held a few days after the conclusion of an internal audit. Regardless, the doctor prefers to see quarterly reviews; however, most establishments hold annual reviews, as a minimum.

Since ISO 13485 does such a nice job of defining required review input and output, it makes perfectly good sense to follow the established blueprint. There is no need to re-invent the quality, regulatory or statutory wheel (that’s a lot of wheels). Additionally, establishments should always script an agenda and have an attendance sheet. Why? If you must ask, you are scaring the old doctor. These documents (attendance sheet and agenda) can be shared with FDA and regulators other than a device establishment’s notified body. Furthermore, if key members of the management team cannot attend the review, it is an acceptable practice to postpone and reschedule the meeting. No management, no meeting. Wow, Dr. D likes the previous mantra, “No Management, No Meeting!” If the meeting is postponed, make sure the reason behind the postponement is documented.

Finally, use the management review meeting to drive continuous improvement. If the performance of the QMS is not meeting expectations, management must take the appropriate action to address the deficiencies and ensure the QMS is firing on all cylinders. Please, do not be afraid to assign action items to individuals when areas within their sphere of responsibility are failing to perform. Remember, management review is not only used to inform, it is a tool for driving organizational improvements.

Takeaways

For this episode of Devine Guidance, the doctor will leave the readers with four takeaways. One: Establishments are required to hold management reviews with sufficient frequency to be effective. Two: Establishments do not have to share content of the reviews with our dear friends from FDA, only documented evidence that they have occurred. Three: The purpose of management review is not only to inform, it is to drive continuous organizational improvement. Four: No Management, No Meeting! In closing, thank you again for joining Dr. D, and I hope you found value (and some humor) in the guidance provided. Until the next installment of DG, cheers from Dr. D., and best wishes for continued professional success.

References

1. Code of Federal Regulation. (April 2017). Title 21 Part 820: Quality system regulation. Washington, D.C.: U.S. Government Printing Office.
2. Devine, C. (2011). Devine guidance for complying with the FDA’s quality system regulation – 21 CFR, Part 820. Charleston, SC: Amazon.
3. Devine, C. (2013). Devine guidance for managing key attributes of a FDA-compliant quality management system – 21 CFR, Part 820 Compliance. Charleston, SC: Amazon.
4. FDA. ( July 2018). Inspections, Compliance, Enforcement, and Criminal Investigations. Anigan, Inc. Accessed August 27, 2018. Retrieved from https://www.fda.gov/ICECI/EnforcementActions/WarningLetters/ucm615066.htm