Supply Chain Oversight is the FDA's Next Area of Concern

For Medical Device

Alan Schwartz

The FDA recently stated its intent to stretch its enforcement reach over foreign device suppliers through consent decrees. The FDA also asked manufacturers and importers to take bigger steps toward managing suppliers and tightening up the supply chain. Carmelo Rosa, an FDA compliance officer, explains that "Currently, the agency only has authority to establish import alerts for foreign companies with good manufacturing practice violations but it is looking at other options."

Rosa's quote is an interesting statement and if the FDA takes it seriously, it will start a new compliance incentive to shore up our borders and to prevent the entry of "adulterated" devices.

What could the FDA mean by this type of compliance policy?

Could the FDA actually take injunctive actions or civil penalties on foreign medical device manufacturers?

Could the FDA actually take injunctive actions or civil penalties on foreign medical device manufacturers?

Probably not, because the FDA does not have any legal jurisdiction over foreign companies. Can the FDA use the US courts to issue a consent decree to a foreign manufacturer? (Untried and what would be the effect of such an action?) Would the FDA even have the time and manpower to build up a case of adulteration like they do during US inspections? (Unlikely. Onsite inspections of foreign companies' inspections are not to exceed four days. A domestic inspection could run for weeks or sometimes months building a legal case for injunction.)

That being said, the FDA import alert basically imposes a consent decree on the foreign manufacturer by barring from the USA without severe restrictions. Therefore, the following stipulations could be required before shipments enter the USA:

  • Private laboratory testing of each shipment
  • A copy of the foreign company's quality system to FDA for review
  • A third-party audit for QS compliance

These import alerts are usually issued by the Agency as a result of FDA testing samples of shipments coming into the country and determining that they are out of compliance. You can view these importer alerts on the FDA website. They are listed in several ways:

  • By country
  • By product
  • By issue

There is the possibility that the FDA can issue an import alert without visiting the foreign manufacturer's site. However, to issue an import alert in this manner, the FDA has to conduct a significant amount of product testing. The question remains: Can the FDA test each shipment of devices entering the country? Many industry professionals think this challenge is simply economically impossible.

The other tool that the FDA uses is the Warning Letter. This action is usually issued as a result of an FDA inspection made at the foreign manufacturer's site when the company is found to be manufacturing their devices in violation of FDA QS/cGMP compliance regulations. When this occurs, the FDA issues the Warning Letter stating the areas of concern found during the inspection. Because of the serious nature of the findings indicated in the Warning Letter, the FDA prevents all future shipments from entering the USA without physical sampling. Basically, this preventive measure is like a consent decree without being an actual consent decree. This can be done because a foreign company has no right to export their devices to the USA unless the US Government provides such privilege to the foreign company. Until the Warning Letter is lifted (removed), the company's devices are automatically refused entry.

To get a Warning Letter suspended (lifted), the FDA requires the foreign company to provide their corrective action plans. Once the FDA has agreed to the corrective action plans, the FDA will schedule a re-inspection of the manufacturing operations to determine if the corrective actions have been made and that the company has addressed all the cGMP concerns. Until that time, the foreign company cannot do business in the USA.

So, when the Agency was trying to "stretch its enforcement reach over foreign device suppliers, potentially through consent decrees" maybe the FDA was actually looking to use this power over the initial importer and not the foreign supplier.

Previously, the FDA has basically looked away from the initial importer as having any regulatory responsibility for the products they import but under new regulations, these practices are changing. So what is the FDA's definition of an initial importer and what are the importer's responsibilities?

The Initial Importer and Its Responsibilities

An initial importer is anyone who furthers the marketing of a device from a foreign manufacturer to the entity that makes the final delivery or sale of the device to the ultimate consumer or user. The initial importer does not repackage or otherwise alter the container, wrapper, or labeling of the device or device package. The initial importer of the device must also register its establishment with FDA. Registration information can be found on the FDA's website at Establishment Registration.

Initial importers are also subject to Medical Device Reporting (MDR) under 21 CFR 803, Reports of Corrections and Removals under 21 CFR 806, and Medical Device Tracking under 21 CFR 821, if applicable. Under the MDR regulations, importers are required to report incidents where a device may have caused or contributed to a death or serious injury as well as report certain malfunctions. The importers must maintain an MDR event file for each adverse event. All product complaints (MDR and non-MDR events) must be forwarded to the manufacturer. Under Medical Device Tracking requirements, certain devices must be tracked through the distribution chain.

The initial importer also needs to be registered. The registration process includes the completion of a complaint procedure, the maintenance of a complaint file, the submission of Medical Device Reports (when necessary) and the completion of a corrections and removal (recall) procedure. Could the FDA be planning to impose harsher regulatory requirements and penalties on these initial importers?

Unfortunately, it is probably long overdue. Becoming an initial importer has always been an easy business to start up, with very little regulatory oversight. The process goes somewhat like this: find a manufacturer in a foreign country, negotiate a good price, make sure that the foreign company is properly registered with the FDA and the devices listed and/or have a 510(k) and presto--you are in business! In the past, performing due diligence regarding a potential manufacturer to assure that they are actually operating in QSR/cGMP compliance was not necessary. Testing the devices was an afterthought. Now things are changing.

As you can see, the initial importer has very little responsibility for the devices they import and distribute. It is the foreign manufacturer/exporter that has the regulatory responsibility (510(k)) standards, FDA registration and listing) and providing the assurance that the device is manufactured in FDA QSR/cGMP compliance. In some cases—like for a Class I device that is 510(k)-exempt as well as cGMP-exempt—these manufacturers receive very little FDA oversight.

What are the FDA Compliance Specifications for Developers, Importers and Distributors?

When a company develops a device and obtains 510(k) clearance, and then uses a contract manufacturer to perform manufacturing duties, the company is referred to as a specifications (spec) developer. The spec developer must register with the FDA and the product must be listed with the FDA.

When the spec developer is outsourcing manufacturing to a contract manufacturer, the FDA expects that the spec developer will make sure the contract manufacturer is QSR/cGMP compliant. The spec developer is required to assure that the device is manufactured under QSR/cGMP. It is their responsibility to make sure that the devices are safe and meet specifications.

When the FDA audits a specifications developer, the FDA determines if the spec developer has conducted its own audit of the contract manufacturer. Please be aware that the results of the internal audit should remain confidential and do not have to be shown to the FDA, per QSR regulations 21CFR820.180(c).

Note: This section of Part 21 CFR 820 does not apply to the reports required by 820.22 quality audits, or supplier audit reports used to meet the requirements of 820.50(a) ("Evaluation of Suppliers, Contractors, and Consultants") but it does apply to procedures established under these provisions. Under the request of a designated employee of the FDA, an employee in management with executive responsibility must certify in writing that the management reviews and quality audits required under this part, and supplier audits (where applicable), have been performed and documented. Additional information that should be documented includes the dates on which supplier audits were performed and also any required corrective actions that were taken.

Determining Each Party's Role in Compliance

The FDA's present policy on contract manufacturers is to require contract manufacturers that manufacture and distribute the finished device for the spec developer to be registered with the FDA. In other words, if you are a contract manufacturer that makes a finished medical device and you ship it back to the spec developer for distribution, the FDA no longer expects you to register with the FDA as a contract manufacturer. (Visit to learn more about which domestic contract manufacturers must register with the FDA.Please understand that this does not affect foreign contract manufacturers. All foreign manufacturing companies are required to register with the FDA under the Bio-Terrorism Act).

The FDA is now placing more accountability on the spec developer to assure that its contract manufacturer is in compliance with QSR/cGMP regulations. Basically, the agency expects that the OEM (Original Equipment Manufacturer) will view the contract manufacturer as an extension of its own operations. The spec developer is also expected to audit the contract manufacturer and if QSR compliance problems arise, they will be addressed by the contract manufacturer and brought into compliance.

The spec developer has a lot more to lose in assuming that the contract manufacturer is in FDA compliance. For example, if a problem with a device develops that may cause an injury to the patient or user, and the spec developer has not conducted its own audit of the contract manufacturer's facility, it would appear to the FDA (and others) that the OEMs due diligence was minimal or non-existent, thereby greatly increasing the OEM's liability exposure.

In a recent inspection of one OEM by the FDA, the agency learned the name and location of the OEM's contract manufacturer and additionally found out that the spec developer had visited its outsourcing partner during initial negotiations but—not being familiar with FDA regulatory requirements—had not conducted an audit as part of the due diligence process. This contract manufacturer was ISO certified and was already supplying finished medical devices to other companies. However, the FDA had never audited this contract manufacturer and it was found that the contract manufacturer was not even registered with the FDA (it was a domestic contract manufacturer).

The FDA decided to audit the contract manufacturer for QSR compliance. The audit resulted in the company receiving a very extensive 483 (the list of observations that the investigator finds during the inspection that are in violation with the QSR regulations). The 483 resulted in both the specification developer and the contract manufacturer being issued a Warning Letter.

Will FDA now use this approach with initial importers/distributors? Will the FDA expect the initial importer to be responsible for the quality of the devices that they intend to import even though they do not control the specifications, changes to the design, manufacturing, and any corrective actions made by the manufacturer?

Initial importers—whether they are a spec developer or not—have to understand that though their manufacturing partners may say that they are in compliance with FDA QSR regulations and/or are ISO 13485 certified and in some cases KFDA (Korean) or SFDA (China) registered, there is no guarantee that such establishments would be able to pass an FDA inspection. Though the FDA's QSR and the ISO 13485 standards are similar in their content, the ways in which the FDA and ISO auditors conduct their audits are entirely different—often resulting in very different outcomes.

Will the FDA now hold the feet of the initial importer "to the fire" to be legally responsible for the devices they distribute? If a device that is distributed is involved in a field correction and/or recall, should the company that put that device on the market be responsible for the regulatory consequences especially if this is a recurring event?

One would think that this is not too far-fetched. Could the FDA issue a warning letter to an initial importer for the problems caused by their supplier when the initial importer has no legal responsibility to meet quality regulations? Or, should the initial importer (similar to the spec developer) know what they are importing and distributing and only sell devices that meet required specifications?

Optimal Manufacturing Agreements

Specification developers and/or initial importers looking for a contract manufacturer or supplier should be aware of these possible changes in FDA policy. The spec developers and initial importers must increase their due diligence on how their suppliers are selected. With this possible change in FDA policies, a contract manufacturer's or supplier's FDA compliance problem(s) will now become a problem(s) for its customers, who include the spec developers or initial importers. Therefore, these importers can no longer take things for granted and assume they will be immune from the regulatory compliance problems of a contractor/supplier.

To ensure that the importers can maintain some control over their suppliers, the following areas of concern should be addressed in an agreement with the contract manufacturer:

  1. Require registration with the FDA of all foreign medical device manufacturers who export to the USA.
  2. Require the manufacturer to have a comprehensive quality system that is compliant with QSR/cGMPs regulations and that is documented. Also, if there are intentions to sell to the European Union and/or Canada, the company must be ISO 13485 certified and must also be certified to Canadian standards.
  3. The contract manufacturer will notify the importer of any past FDA regulatory actions, FDA 483 observations or Warning Letters that were issued, in addition to any pending or ongoing FDA investigations.
  4. The manufacturer will notify the importer when they are expecting an FDA inspection of their operations.
  5. The manufacture will notify the importer if they have received any written notifications from the FDA.
  6. The manufacturer will be notified in writing if there are any changes in any of the device raw materials or specifications, prior to making these changes.
  7. If a potential problem is found concerning the manufacturing process that may have affected the finished medical device(s), the importer will be notified immediately.
  8. The manufacturer must notify the importer if there any reported problems on their devices that they distribute in other countries that may affect the importer's devices.
  9. The manufacturer ensures that it has an enforced insurance policy.
  10. As part of its quality system compliance, the contract manufacturer must make sure that all automated processes have been validated.
  11. The software in the operating systems of manufacturing equipment has been validated.
  12. The importer is allowed to audit the operations for QSR compliance.

  13. The importer is allowed to watch the manufacturing operations of its devices with unannounced visits.

It would appear that the least burdensome way for the FDA to increase its scrutiny on imported devices is to enforce device quality at the importer level. Therefore, the initial importer should expect a higher level of examination when problems arise that could possibly end up in warning letters and/or injunctions.

If the FDA decides to adopt and enforce this policy, culture shock may ensue for the many initial importers presently bringing in and distributing millions of medical devices. It could also put a real crimp in the foreign manufacturer's processes when they learn that future shipments could be jeopardized without ever being inspected by the FDA.

It's plain that ensuring compliance up front will lead to fewer problems down the road for all parties involved.

Alan P. Schwartz of mdi Consultants, Inc. in Great Neck, NY has been providing strategic planning on FDA regulatory compliance issues since 1978. Prior to mdi, Alan was a supervisor of field operations for the US FDA. He has been a speaker on topics that include FDA policy in the US and abroad. His insight and understanding of the FDA regulatory strategy, the preparation of FDA 483s and Warning Letters as well as his experience obtaining third-party certification under FDA approval has provided companies with some very novel approaches to dealing with their regulatory problems and an assurance of full FDA compliance. Schwartz has also published many articles regarding FDA regulatory prolicies and procedures. To contact Schwartz please call 516.482.9001 or contact him via email at