The Four Pillars of QSR Compliance

For Medical Device

At first glance, FDA's Quality System Regulations (QSR) for medical devices - contained in 21 CFR 820 - may make your eyes cross and your stomach churn. The rules are intimidating, yes - but impossible to follow, no.

Like the old proverb says, the way to eat an elephant is one bite at a time, and the way to comply with the QSR is to break down your quality system into bite-size chunks, which FDA has conveniently labeled "subsystems."

Mastering these key subsystems also will keep your ISO auditors happy

Focus on four key quality subsystems; connect and strengthen those subsystems with relevant data and you'll go far in meeting FDA's expectations for quality products, processes and systems. And not so incidentally, mastering those key subsystems also will keep your ISO auditors happy, thanks to FDA's efforts to harmonize its regulations with international standards. 

Four Subsystems Support All Your Quality Efforts

FDA believes four core quality subsystems should be the foundation of every firm's quality efforts. These subsystems are:

1. Management Controls
2. Design Controls
3. Corrective and Preventive Actions (CAPA)
4. Production and Process Controls (P&PC)

Let's take a closer look at each subsystem:

Core Subsystem #1: Management Controls

In FDA's eyes, the Management Controls subsystem is where you:

• Audit for nonconformances
• Ensure adequate resources for quality system activities
• Review and evaluate your quality system regularly

Most companies audit for nonconforming products, but do you also audit for nonconforming processes and systems as well? It's important to know that FDA says you should. In addition, FDA wants you to seriously consider the type and amount of resources you need for an effective quality system. Adequate resources are more than just financial; they include people and time too.

Management review also refers to (or encompasses) looking at the big picture. For example, it's more than just asking, "How many CAPAs are open...has this piece of equipment been validated...what's going on in production?" FDA wants you to regularly ask yourself and your colleagues: "Is the quality system we have in place the one we should have in place or do we need to make changes?"

Core Subsystem #2: Design Controls

In your Design Controls subsystem, plan to:

• Manage and document design changes made in response to nonconformances or product enhancements
• Transfer product design to the production floor after the initial design and after further product changes and enhancements

FDA believes the most overlooked part of design control is accurately transferring design to production. Most companies handle design transfer well during the initial design stages. But when they tweak original designs in reaction to component changes, assembly problems or customer feedback, their design documentation becomes fuzzy or non-existent. No matter how big or small your design changes, make sure you apply all of your standard design controls.

Also, design transfer should include product installation and servicing. When you build your Design Controls subsystem, remember to factor in the entire lifecycle of your product.

Core Subsystem #3: Corrective and Preventive Actions

Your CAPA subsystem should be built around these activities:

• Identify, document and resolve nonconformances associated with your product, process and the quality system itself
• Track any (and all) changes to product design, production, procedures and documentation
• Gather feedback across the full spectrum of your product's lifecycle and funnel the resulting data to management

The purpose of the CAPA subsystem is to serve as your feedback loop. It should identify and investigate quality problems no matter the source - not just nonconformances discovered on the shop floor but also complaints, medical device reports (MDRs) and product corrections, removals and recalls.

In most years, FDA writes more 483s (inspection observations) around the CAPA subsystem than any other. That's because every FDA inspection starts with the CAPA feedback loop. When the Agency sees gaps in your CAPA subsystem, it assumes you're not doing enough to understand your own issues and resolve problems before they impact your customers.

Core Subsystem #4: Product and Process Controls

At its most basic level, your Product and Process Controls subsystem has just one main activity:

• To flawlessly reproduce your latest product design

The Device Master Record (the final output of product design) is the foundation of this subsystem. Your production procedures and processes must be built around the latest design you've verified and validated. That's the only way you can be confident you're reproducing something you know is safe and effective for its intended use.

Map Data Links to Strengthen Your Subsystems

To realize the full value of your core subsystems, reinforce them with data links. Interconnect your subsystems with the relevant data they naturally produce.

Start by developing a process flow diagram of your entire quality system, then track how you want data to flow. Look at your procedures to ensure they support fast and accurate data transfer among your subsystems. In doing so, you'll likely spot gaps in both links and procedures.

Figure 1 is a simplified diagram of the subsystems approach. Notice the CAPA subsystem resides squarely in the middle. All your subsystems should send data into CAPA and—subsequently—data you collect and analyze under CAPA should flow back to inform and improve the other subsystems.

Figure 1

With your CAPA subsystem as your central pillar, don't neglect these important data connections:

Linkages to and from Design Controls

From your Design Control subsystem, production specifications should flow into your Production and Process Controls subsystem. In return, data reflecting the real-world experience of making products should flow back into design control. Design control also should feed your CAPA subsystem, because design should dictate what data you collect and review for continual design improvement.

Data links to and from the Design Control subsystem are especially important for managing risks throughout your product's lifecycle. ISO 14971, the risk management standard for medical devices (which is recognized and endorsed by FDA), requires you to collect and analyze production and post-production data to improve your initial product risk assessments. Similarly, FDA expects your CAPA subsystem to track and trend quality data about your production processes and designs.

A single effort can achieve both purposes. Use the same data you collect under CAPA to update the risk assessments developed in your Design Control subsystem. As a further bonus, this data should be the first place you look when investigating nonconformances.

Linkages to and from Management Controls

In your Management Controls subsystem, create inbound links from nonconformance data identified by internal audits conducted under CAPA. Use management controls to review all recommended corrective actions and look for warning signs of additional deficiencies in your quality system. Additionally, use management controls to double-check how thoroughly you're investigating the root causes of nonconformances flowing from your CAPA subsystem.

Linkages to and from Production and Process Controls

In your Production and Process Control subsystem, make sure design changes and engineering revisions flow quickly to the production lines. In return, feed nonconformance data from your testing stations (you should be testing incoming components, in-process assemblies and finished products) into your CAPA subsystem.

You also want to ensure your Management Controls subsystem reviews all concerns about production yields and efficiencies. A well-linked CAPA subsystem often will suffice, but some seemingly harmless production problems may be shielded from the "quality folks," including product concessions (products deemed OK for release despite some degree of nonconformance). Make your Production and Process Controls subsystem a gold mine of production data. Then let your CAPA and Management Controls subsystems decide what's important and what's not.

Subsystem Health Demonstrates Your Commitment to Compliance

FDA says three other subsystems, Material Controls, Change Controls, and Facility and Equipment, are worthy of your attention. All are important, and all are interrelated. Depending on your specific product and processes, some may even rank as high as any of the top subsystems; but overall, FDA believes a firm's attention to the four core subsystems provides the best indicator of its commitment to QSR compliance.

So simplify your approach to meeting the elephant-size QSR requirements by thinking in terms of easy-to-digest, interconnected subsystems. Make each one as strong as you can and build friction-free channels for passing data from one subsystem to another. At least once a year, as part of your management controls, take a step back and critically evaluate each subsystem and its connections. Construct a quality system that works not only today but for the products you'll build tomorrow.

Done right, the four quality subsystem pillars make a towering statement to your senior executives, customers, shareholders and FDA authorities. More importantly, they will elevate your level of safe and effective products for years to come.