For Medical Device Professionals - Is Your Executive Management Involved with Quality?

Chritine Park

We've all heard of the recent FDA decisions to increase the focus of inspections on management with executive responsibility. There have been at least two warning letters issued this year with observations targeted in this area. While there are 26 references to the role of executive management within the Quality System Regulations (QSR 21 CFR820) these warning letters address two very basic requirements of quality systems:

Now is the time to step back and re-evaluate the role your executive management team is playing in your own quality system.
  • "Failure of management with executive responsibility to adequately ensure that the quality policy is understood, implemented, and maintained at all levels of the organization, as required by 21 CFR 820.20(a). For example, the Quality Policy has not been established by any member of executive management..."
  • "Failure to establish and maintain procedures for management with executive responsibility to review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency according to established procedures to ensure that the quality system satisfies the requirements of 21 CFR Part 820 and the manufacturer's established quality policy and objectives as required by 21 CFR 820.20(c)."

These examples are obviously blatant and send a strong message. Now is the time to step back and re-evaluate the role your executive management team is playing in your own quality system.

21 CFR 820 defines management with executive responsibility as "those senior employees of a manufacturer who have the authority to establish or make changes to the manufacturer's quality policy and quality system." What does this really mean and how can you as a Quality Professional help your executive management team meet these requirements in the course of every-day business practice?

In most organizations, the company quality policy is derived by the executive management team and signed by the CEO or President of the company along with the Head of Quality. The quality policy is then widely distributed to all employees with appropriate explanation to understand the intent and purpose of the policy. Additionally, the quality policy must be measurable and reviewed for adequacy as part of the management review.

The responsibilities for management with executive responsibility can be distributed into four key areas of focus:

  • Core competencies
  • Internal audit program
  • Meaningful metrics
  • Risk management

Core Competencies

The executive management team is responsible and accountable to provide clear direction and a definition of the business structure and its related vision. The organizational structure and interrelationships—(whether hierarchical or matrix—)must be documented with defined core competencies and skill sets. Core competencies lead to well-defined skill sets and job descriptions for employees. A gap assessment of competencies and required skills versus current employees identifies areas of concern or weakness within the quality systems.

The documentation of core competencies and skill sets should be integrated into the overall business plan and managed by the executive team. The Quality Manual can effectively achieve this daunting task when written and implemented as a roadmap to compliance. All employees, especially those with executive responsibility, should be familiar with this document as it is the master quality plan for the organization

Internal Audit Program

We live in a world of matrixed organizations and operations. The silo approach to business process and quality system management is not effective to achieving the overall business and quality plan. The internal auditors must look at the interfaces between processes as well as the individual function or process. Process failures and break downs are often found at the point of a handoff or a transfer to another process. A strong auditor will follow the threads through the individual process as well as through the interfaces.

The data from the internal audit program should be presented to executive management in a format that demonstrates the effectiveness of the quality system structure and business process. Just because the number of non-conformances decreases from audit to audit or the non-conformances are being addressed individually in a timely manner does not mean the internal audit program is good or the quality system is effective. The data analysis should look across the core competencies, functions, and processes to determine any potential systemic issues.

Meaningful Metrics

The most common approach to keeping executive management involved is through Quality System Management Review (QSMR). These are regularly scheduled with the executive management team based on the business needs and requirements. There is no requirement for the number of management reviews during the course of the year. This is usually determined based on the maturity of the quality system. A very robust system may meet twice each year while a new system (or one in remediation) may meet quarterly or more frequently if necessary. While the primary focus of the QSMR is to review quality performance, it is most effective to present the information based on overall impact to the business.

The CAPA (corrective action preventive action) system is one of the most effective tools in the quality system and is a major source of data for the QSMR. The CAPA system should integrate all of the elements of the quality system into one central focus point. While there are many feeders or contributors to the CAPA system, the internal audit program is a major contributor to the process. Non-conformances and opportunities are identified from all feeder systems and require prioritization with the other business priorities. An executive oversight committee is strongly recommended to ensure CAPA activity is properly resourced and projects are moving forward. This committee should assess appropriate risk and ensure CAPA projects and activities receive equal (if not greater) focus than new product research when appropriate.

The key to successful management review is to present meaningful data rather than just presenting data for data's sake. When the QSMR focuses on the significant (though few) metrics rather than presenting trivial information, a much more compelling story is presented for the executive management team. While there are many guidance documents outlining what to include in the management review, it's important to present information that has the biggest impact on the business from a quality and/or financial perspective. Each chart presented should tell a story and speak for itself. This approach sets a stronger foundation for risk based decisions.

Risk Management Process

The executive management team makes risk based decisions as a part of their routine business activities; it's a core responsibility of their job! Risk management extends beyond the product risk preparations and analysis as required by the regulations. Risk management also covers process and project risk. In most companies, resources are limited and priorities must be evaluated and set to drive the business to success and high customer satisfaction. There are many tools available to evaluate risk, prioritize activities, and reduce the potential for failure. These tools should be included in the everyday decision making process for the management team. When the quality management system and the business plan are integrated at the executive level there is a strong foundation for the organization to make good decisions—business as well as product quality.

Here are some points to consider:

  • When was the last time you reviewed and discussed the adequacy of your organization's quality policy? Is this documented?
  • How effective is your management review process? Do you provide data for data's sake or are you providing appropriate analysis to help the executives be more aware of product and process quality so they can make better business decisions?
  • How does your organization use your quality manual? Is it a roadmap providing guidance for compliance to regulation and business process? Or just another book on the shelf?
  • When was the last time you reviewed (with management) the executive responsibilities in the QSR and performed a gap assessment of your system against the requirements?
  • Are you sure that you could provide adequate evidence that the executive management team is actively involved with the quality system?

Take a few minutes and evaluate your own system now. It may save you the agony of a warning letter in the future. Quality is not hard—it's just good business.

Christine Park is a seasoned Quality Assurance professional with a wealth of experience in establishing and remediating quality systems of all sizes. Using a pragmatic approach to compliance and quality assurance, Ms. Park has successfully focused on results-oriented solutions that integrate quality into the daily business activities of organizations. Her experience in R&D and general manufacturing for medical devices, IVDs, and biotech/pharmaceuticals provides a well-balanced background for her work in compliance.

Whether working on a full quality system or on key quality components (CAPA, complaints, audits, supplier quality, management controls), Ms. Park provides employees and management not only with adequate direction and tools to maintain compliance, but also with the understanding of why they must comply with specific requirements.

Ms. Park has played an active role in the generation and review of technical documentation in support of regulatory submissions. Her direct experience includes facilitating product and process risk assessments, change management (design as well as manufacturing), product and process validation plans and protocols. She has developed strong relationships with manufacturing as well as design/development organizations. She can be reached at