At first glance, FDA's Quality System Regulations (QSR) for medical devices - contained in 21 CFR 820 - may make your eyes cross and your stomach churn. The rules are intimidating, yes - but impossible to follow, no.
Like the old proverb says, the way to eat an elephant is one bite at a time, and the way to comply with the QSR is to break down your quality system into bite-size chunks, which FDA has conveniently labeled "subsystems."
Mastering these key subsystems also will keep your ISO auditors happy
Focus on four key quality subsystems; connect and strengthen those subsystems with relevant data and you'll go far in meeting FDA's expectations for quality products, processes and systems. And not so incidentally, mastering those key subsystems also will keep your ISO auditors happy, thanks to FDA's efforts to harmonize its regulations with international standards.
FDA believes four core quality subsystems should be the foundation of every firm's quality efforts. These subsystems are:
Let's take a closer look at each subsystem:
In FDA's eyes, the Management Controls subsystem is where you:
Most companies audit for nonconforming products, but do you also audit for nonconforming processes and systems as well? It's important to know that FDA says you should. In addition, FDA wants you to seriously consider the type and amount of resources you need for an effective quality system. Adequate resources are more than just financial; they include people and time too.
Management review also refers to (or encompasses) looking at the big picture. For example, it's more than just asking, "How many CAPAs are open...has this piece of equipment been validated...what's going on in production?" FDA wants you to regularly ask yourself and your colleagues: "Is the quality system we have in place the one we should have in place or do we need to make changes?"
In your Design Controls subsystem, plan to:
FDA believes the most overlooked part of design control is accurately transferring design to production. Most companies handle design transfer well during the initial design stages. But when they tweak original designs in reaction to component changes, assembly problems or customer feedback, their design documentation becomes fuzzy or non-existent. No matter how big or small your design changes, make sure you apply all of your standard design controls.
Also, design transfer should include product installation and servicing. When you build your Design Controls subsystem, remember to factor in the entire lifecycle of your product.
Your CAPA subsystem should be built around these activities:
The purpose of the CAPA subsystem is to serve as your feedback loop. It should identify and investigate quality problems no matter the source - not just nonconformances discovered on the shop floor but also complaints, medical device reports (MDRs) and product corrections, removals and recalls.
In most years, FDA writes more 483s (inspection observations) around the CAPA subsystem than any other. That's because every FDA inspection starts with the CAPA feedback loop. When the Agency sees gaps in your CAPA subsystem, it assumes you're not doing enough to understand your own issues and resolve problems before they impact your customers.
At its most basic level, your Product and Process Controls subsystem has just one main activity:
The Device Master Record (the final output of product design) is the foundation of this subsystem. Your production procedures and processes must be built around the latest design you've verified and validated. That's the only way you can be confident you're reproducing something you know is safe and effective for its intended use.
To realize the full value of your core subsystems, reinforce them with data links. Interconnect your subsystems with the relevant data they naturally produce.
Start by developing a process flow diagram of your entire quality system, then track how you want data to flow. Look at your procedures to ensure they support fast and accurate data transfer among your subsystems. In doing so, you'll likely spot gaps in both links and procedures.
Figure 1 is a simplified diagram of the subsystems approach. Notice the CAPA subsystem resides squarely in the middle. All your subsystems should send data into CAPA and—subsequently—data you collect and analyze under CAPA should flow back to inform and improve the other subsystems.
With your CAPA subsystem as your central pillar, don't neglect these important data connections:
From your Design Control subsystem, production specifications should flow into your Production and Process Controls subsystem. In return, data reflecting the real-world experience of making products should flow back into design control. Design control also should feed your CAPA subsystem, because design should dictate what data you collect and review for continual design improvement.
Data links to and from the Design Control subsystem are especially important for managing risks throughout your product's lifecycle. ISO 14971, the risk management standard for medical devices (which is recognized and endorsed by FDA), requires you to collect and analyze production and post-production data to improve your initial product risk assessments. Similarly, FDA expects your CAPA subsystem to track and trend quality data about your production processes and designs.
A single effort can achieve both purposes. Use the same data you collect under CAPA to update the risk assessments developed in your Design Control subsystem. As a further bonus, this data should be the first place you look when investigating nonconformances.
In your Management Controls subsystem, create inbound links from nonconformance data identified by internal audits conducted under CAPA. Use management controls to review all recommended corrective actions and look for warning signs of additional deficiencies in your quality system. Additionally, use management controls to double-check how thoroughly you're investigating the root causes of nonconformances flowing from your CAPA subsystem.
In your Production and Process Control subsystem, make sure design changes and engineering revisions flow quickly to the production lines. In return, feed nonconformance data from your testing stations (you should be testing incoming components, in-process assemblies and finished products) into your CAPA subsystem.
You also want to ensure your Management Controls subsystem reviews all concerns about production yields and efficiencies. A well-linked CAPA subsystem often will suffice, but some seemingly harmless production problems may be shielded from the "quality folks," including product concessions (products deemed OK for release despite some degree of nonconformance). Make your Production and Process Controls subsystem a gold mine of production data. Then let your CAPA and Management Controls subsystems decide what's important and what's not.
FDA says three other subsystems, Material Controls, Change Controls, and Facility and Equipment, are worthy of your attention. All are important, and all are interrelated. Depending on your specific product and processes, some may even rank as high as any of the top subsystems; but overall, FDA believes a firm's attention to the four core subsystems provides the best indicator of its commitment to QSR compliance.
So simplify your approach to meeting the elephant-size QSR requirements by thinking in terms of easy-to-digest, interconnected subsystems. Make each one as strong as you can and build friction-free channels for passing data from one subsystem to another. At least once a year, as part of your management controls, take a step back and critically evaluate each subsystem and its connections. Construct a quality system that works not only today but for the products you'll build tomorrow.
Done right, the four quality subsystem pillars make a towering statement to your senior executives, customers, shareholders and FDA authorities. More importantly, they will elevate your level of safe and effective products for years to come.
Enjoying this blog? Learn More.
Compliance with 21 CFR 820 and ISO 13485 Using MasterControlDownload Now
Support for the Internet Explorer browser will end on June 15, 2022 and some site features may be unavailable. For the best experience, we recommend using a modern web browser such as Google Chrome, Mozilla Firefox or Microsoft Edge.