U.S. FDA Approach to Auditing Including QSIT Christine Nelson Center for Devices & Radiological Health Food & Drug Administration 25 Sept. 2003 Frankfurt, Germany

FDA-Speak Terms Inspection = Audit Investigator = Auditor 25 Sept. 2003 Frankfurt, Germany

Why does FDA inspect device manufacturers? To evaluate compliance with the following FDA device regulations: Quality Systems Medical Device Reporting Medical Device Tracking Reports of Corrections and Removals Registration and Listing When FDA inspects a medical device manufacturer, we evaluate the manufacturer’s compliance with FDA’s Quality System Regulation. We also evaluate compliance with: Registration and Listing regulation The Medical Device Reporting regulation Reports of Corrections and Removals regulation Tracking Regulation for high risk devices We inspect manufacturers of finished medical devices. A finished medical device is one that is usable or capable of functioning. It does not have to be packaged or sterilized. We also inspect contract manufacturers and contract sterilization facilities and others/ We do not inspect manufacturers of components, unless they are part of the finished medical device manufacturer. 25 Sept. 2003 Frankfurt, Germany

Who conducts inspections for FDA? FDA investigators in 20 FDA District Offices around the U.S. FDA-trained Auditors from Conformity Assessment Bodies in the European Union (EU) In the future, FDA-trained auditors from independent third parties accredited by FDA 25 Sept. 2003 Frankfurt, Germany

How does FDA decide who to inspect? Registration database identifies who manufactures devices for distribution in the U.S. Listing database identifies what devices they distribute FDA prioritizes inspections by risk and gives higher risk devices/situations a higher priority Device manufacturers are required to register with FDA and list the products they intend to distribute in the U.S. FDA uses the registration database and the listing database to identify manufacturers for inspection. FDA does not routinely inspect manufacturers of Class I devices. We do prioritize our inspections by risk. We give a higher priority to inspecting manufacturers that make higher risk devices or are in high risk situations. 25 Sept. 2003 Frankfurt, Germany

What is high priority for inspection? Device manufacturers that: Make class III devices Make implantable devices and life supporting and life sustaining devices Recently introduced a new device to the market Have had significant violations in the past 25 Sept. 2003 Frankfurt, Germany

Does FDA notify the manufacturer of an upcoming inspection? FDA calls domestic manufacturers about 5 days before the inspection FDA contacts foreign manufacturers 2 - 3 months in advance to schedule inspection Manufacturer is requested to send Quality System Manual or equivalent for pre- inspection review 25 Sept. 2003 Frankfurt, Germany

What happens when the FDA investigator arrives at the site? The FDA investigator will: Ask to see the top management Present credentials (identifies person as an FDA investigator) Issue notice of inspection explaining FDA’s legal authority to inspect (only in the U.S.) 25 Sept. 2003 Frankfurt, Germany

What happens during the inspection? Investigator may tour the facility to get an idea of layout, workflow, and areas that may need closer inspection This helps the investigator decide how to organize the inspection 25 Sept. 2003 Frankfurt, Germany

What happens next? The investigator will: Ask about size and structure of company, who is in charge, what products are manufactured there Review registration and listing Evaluate compliance with FDA regulations using the Quality System Inspection Technique (QSIT) 25 Sept. 2003 Frankfurt, Germany

What is QSIT? www.fda.gov/ora/inspect_ref/igs/qsit/qsitguide.htm The Quality System Inspection Technique, or QSIT, is a plan for investigators to follow when evaluating a manufacturer’s compliance with regulations for Quality Systems, Medical Device Reporting, Corrections and Removals, and Tracking Here is the internet site where you can obtain a copy of QSIT. 25 Sept. 2003 Frankfurt, Germany

What is QSIT? Identifies 4 major subsystems to evaluate and states the purpose and importance of each subsystem Provides flowcharts and inspectional objectives to cover during inspection Offers advice Provides tables for statistical sampling of records for review 25 Sept. 2003 Frankfurt, Germany

What are the four main subsystems? Corrective & Preventive Actions Design Controls Production & Process Controls Management FDA has identified 7 subsystems in the Quality System. You can think of these subsystems as types of activities. You want find these subsystems identified quite as clearly in the Quality System Regulation. The four subsystems our investigators focus on are: Management Design control Corrective and Preventive Actions and Production and Process Control When we inspect the Corrective and Preventive Action Subsystem, we will also evaluate compliance with the regulations for Medical Device Reporting, Reports of Corrections and Removals, and Tracking. The QSIT handbook also includes guidance for covering sterilization when the Production and Process Control subsystem is inspected. Equipment & Facility Controls Material Controls Records, Documents, & Change Controls 25 Sept. 2003 Frankfurt, Germany

What does FDA look for in the Management Subsystem? Quality Policy established? Management representative appointed? Management reviews conducted? 25 Sept. 2003 Frankfurt, Germany

What does FDA look for in the Management Subsystem? Quality audit procedures established and quality audits conducted? Quality plan established? Quality system procedures established? 25 Sept. 2003 Frankfurt, Germany

What does FDA look for in the Design Control Subsystem? Design procedures and plan established? Design inputs or requirements for device identified? Design outputs or specifications for device identified? Design verification conducted? Design validation conducted? 25 Sept. 2003 Frankfurt, Germany

What does FDA look for in the Design Control Subsystem? Software validation completed? Risk analysis carried out? Design reviews conducted? Design transfer to manufacturing completed successfully? 25 Sept. 2003 Frankfurt, Germany

What does FDA look for in the Corrective and Preventive Action Subsystem? CAPA procedures established? Sources of data analyzed to identify nonconforming product and quality problems? Statistical analysis across data sources? Investigations conducted to identify root cause of failures? 25 Sept. 2003 Frankfurt, Germany

What does FDA look for in the Corrective and Preventive Action Subsystem? Nonconforming product controlled? Appropriate corrective actions and preventive actions carried out? Those responsible are told about CAPA activities? Management review of CAPA activities? 25 Sept. 2003 Frankfurt, Germany

Processes are controlled and monitored? What does FDA look for in the Production and Process Control Subsystem? Processes are controlled and monitored? Any rejects or nonconforming product? Equipment adjusted, calibrated and maintained? 25 Sept. 2003 Frankfurt, Germany

Manufacturing processes validated or fully verified? What does FDA look for in the Production and Process Control Subsystem? Manufacturing processes validated or fully verified? Software validated? Production employees trained and qualified? 25 Sept. 2003 Frankfurt, Germany

What about the other subsystems? The other three subsystems are covered through links with the four main subsystems: Records, documents and change control Facility and equipment control Material control 25 Sept. 2003 Frankfurt, Germany

What happens at the end of the inspection? The investigator will: Meet with management to discuss the inspection Present the FDA 483 list of observations of any significant deficiencies Discuss the deficiencies 25 Sept. 2003 Frankfurt, Germany

What should the manufacturer do after the inspection? Send a letter to FDA identifying how they have corrected deficiencies or will correct them Provide documentation of any corrections that have been completed Provide a timetable or estimated completion date for future corrections 25 Sept. 2003 Frankfurt, Germany

Where should I send the letter? Office of Compliance Center for Devices and Radiological Health (CDRH) Food and Drug Administration 2094 Gaither Road, HFZ-300 Rockville, Maryland 20850 U.S.A. 25 Sept. 2003 Frankfurt, Germany

Center for Devices & Radiological Health 25 Sept. 2003 Frankfurt, Germany

Office of Compliance Division of Enforcement A Dental, ENT & Ophthalmic Devices OB/GYN, Gastro & Urology Devices General Hospital Devices General Surgery Devices Division of Enforcement B Cardiovascular & Neurological Devices Diagnostic X-ray Devices Electronic Products & Devices Orthopedic, Physical Medicine & Anesthesiology Devices 25 Sept. 2003 Frankfurt, Germany

What happens next? Investigator writes an “Establishment Inspection Report” or EIR EIR is sent to the Office of Compliance, Center for Devices and Radiological Health (CDRH) Inspection is classified based on inspectional findings Office of Compliance reviewer writes Warning Letter for inspection classified “OAI” 25 Sept. 2003 Frankfurt, Germany

How does FDA classify inspection reports? NAI – No action indicated VAI – Voluntary action indicated – some deficiencies identified but not serious OAI – Official action indicated – serious deficiencies identified, and FDA must take action to assure correction 25 Sept. 2003 Frankfurt, Germany

What actions can FDA take to address OAI inspections? For device manufacturers outside the U.S.: Warning Letter Warning Letter + Automatic Detention 25 Sept. 2003 Frankfurt, Germany

Warning Letter FDA sends “Warning Letter” describing manufacturer’s violations of FDA regulations and requesting a reply within 15 days 25 Sept. 2003 Frankfurt, Germany

Warning Letter + Automatic Detention FDA sends “Warning Letter” describing manufacturer’s violations of FDA regulations and requesting a reply within 15 days Manufacturer’s products are put on automatic detention to prevent them from entering the U.S. 25 Sept. 2003 Frankfurt, Germany

What will the Warning Letter say about Automatic Detention? Given the serious nature of these violations of the Act, all products manufactured at this facility may be detained without physical examination upon entry into the United States. In order to prevent your devices from being detained without physical exam, your firm will need to respond to this Warning Letter (as set forth below) and correct the violations noted in this letter. In addition, the agency usually needs to conduct a follow-up inspection to verify that the appropriate corrections have been implemented. 25 Sept. 2003 Frankfurt, Germany

How do I get my devices off automatic detention? Submit documentation to FDA showing that deficiencies have been corrected FDA will inspect you to confirm that corrections are adequate before lifting automatic detention 25 Sept. 2003 Frankfurt, Germany

Where can I get more information about FDA inspections and regulations? QSIT: http://www.fda.gov/ora/inspect_ref/igs/qsit/QSI TGUIDE.PDF http://www.fda.gov/ora/inspect_ref/igs/qsit/qsit guide.htm Inspections of Medical Device Manufacturers Compliance Program 7382.845: http://www.fda.gov/ora/cpgm/default.htm#devi ces More . . . 25 Sept. 2003 Frankfurt, Germany

Where can I get more information about FDA inspections and regulations? Quality system regulation: http://www.accessdata.fda.gov/scripts/cdrh/cf docs/cfcfr/CFRSearch.cfm?CFRPart=820 General quality system info: http://www.fda.gov/cdrh/devadvice/32.html Investigations Operations Manual: http://www.fda.gov/ora/inspect_ref/iom/default .htm More . . . 25 Sept. 2003 Frankfurt, Germany

Where can I get more information about FDA inspections and regulations? Other medical device regulations: http://www.fda.gov/cdrh/devadvice/ Division of Small Manufacturers, International and Consumer Assistance - E-mail: dsma@cdrh.fda.gov Christine Nelson – E-mail: mcn@cdrh.fda.gov 25 Sept. 2003 Frankfurt, Germany

Summary Quality System Inspection Technique (QSIT) How FDA conducts inspections What should a manufacturer do after an inspection Warning Letter or Warning Letter + Automatic Detention Where to go for more information 25 Sept. 2003 Frankfurt, Germany