The firm must document procedures that describe what training programs are necessary to assure personnel and trained to adequately perform their jobs. Look for examples (Device History Records (DHR), in-process failure records, etc.) where personnel failed to perform, or inadequately performed a task; e.g., bonding, molding, assembly. These are indications that training procedures are deficient, or required training has not been provided, or personnel with inadequate education, background, training or experience are performing these duties. Also,
- Verify the firm has procedures for identifying training needs.
- Review training records to assure training is documented and being conducted as required by their procedures.
- Verify all personnel have been made aware of defects and errors that may occur if they fail to properly perform their jobs.
- Verify personnel involved in verification or validation activities have been made aware of defects and errors that may be encountered as part of their job function.
4. Document Controls - 21 CFR 820.40
Manufacturers are required to have written procedures for the approval and distribution of documents. The approval procedures must assure the documents meet the requirements of the QS/GMP as well as assuring they are adequate for their intended use. Obsolete documents must be removed from circulation and documentation of document approval must include a signature and date. Removal (or prevention of use) of obsolete documents must be verified. Verify that written procedures (manufacturing, design, quality control, laboratory, etc.) are signed and dated as approved.
When reviewing Device Master Record (DMR) and DHR documents, assure that those in use have been signed and dated as approved. All documents prepared to comply with the QS/GMP must be available at the point at which they are to be used or otherwise needed. Assure that they are.
Changes to all approved documents must be reviewed and approved, communicated to appropriate personnel in a timely manner and maintained. Review document change records to assure they include a description of the change, identification of the affected documents, an appropriate approval signature, approval date and effective date of the change. Changes should not be implemented prior to approval. The approving official should be the same person or from the same department as the original approver. If not, there must be documentation that specifically designates who is responsible for approving the change.
5. Purchasing Controls - 21 CFR 820.50
Manufacturers are required to have procedures to ensure all purchased or otherwise received product and services conform to their specified requirements. A lack of adequate control over purchases has resulted in a significant number of recalls due to component failures. FDA is not regulating component suppliers, therefore the purchasing control requirements should provide manufacturers with additional assurance that only acceptable components are used to manufacture finished devices.
- Verify that the firm's written procedures include requirements, including quality requirements, that suppliers, contractors and consultants must meet.
- Verify that the firm evaluates and selects potential suppliers, contractors and consultants on the basis of their ability to meet the specified requirements.
- Verify that the type and extent of control needed over the product, suppliers, services, contractors and consultants has been defined and is based on the evaluation results.
- Verify that there are records of acceptable suppliers, contractors and consultants.
- Verify that the firm has written, approved, and specified requirements, including quality requirements, for purchased or otherwise received products and services.
Where possible, the approved purchasing documents should include an agreement that the suppliers, contractors and consultants will notify the manufacturer of any changes in the product or service. Manufacturers must evaluate these changes to determine whether they affect the quality of their finished devices.
Again, as stated previously under Quality Audit above, Investigators are not to review actual results of supplier audits. The procedures for those audits may be reviewed.
6. Identification and Traceability - 21 CFR 820.60
The manufacturer is required to have written procedures for identifying products during all stages of receipt, production, distribution and installation to prevent mix-ups. The manufacturer has flexibility to identify product by whatever means they describe in their procedure.
Review DHRs against the DMRs to assure the appropriate components were used in each stage of the manufacturing process. Further compare the DHRs against the incoming and in-process acceptance records to assure only acceptable (passed) product was used in each subsequent stage of the manufacturing process.
For certain devices;
- Intended for surgical implant into the body,
- or to support or to sustain life,
- and whose failure when properly used in accordance with labeled instructions for use can be reasonably expected to result in a significant injury to the user, the manufacturer must have written procedures for identifying each unit, lot or batch of finished device or where appropriate components with a control number. The procedures should facilitate taking corrective action, and the identification must be documented in the DHR.
This control number can be the same as the Identification number used to prevent mix-ups during manufacture or may be different. The control number is used for those devices that used to be defined as "critical." However, the list of "critical devices" was last updated in 1988 and there are no plans to update it. Therefore, the definition needs to be used to determine if a manufacturer has any devices that must meet this QS/GMP requirement.
Traceability need only go the level of the initial consignee, which is the first person(s) outside of the manufacturer's control. This control number would be used to facilitate complaint investigations, recalls, market withdrawals, market corrections, etc.
The traceability requirement should not be confused with the tracking regulation under 21 CFR 821. The tracking regulation requires certain devices to be tracked to the end user or patient through the entire distribution process.
Components of a device subject to traceability requirements must be identified with a control number where appropriate. Manufacturers must define which components are to be identified with control numbers and provide justification for those that are not identified with control numbers.
The manufacturer can utilize the definition of critical component in the original GMP regulation as guidance. However, they should perform some sort of risk analysis first on the finished device, and subsequently on the components of that device to make this determination.
Manufacturers must evaluate their device and identify the components that "are essential to the proper functioning of the device" i.e. "critical." When an investigator chooses to challenge a manufacturer's selection or non-selection of a component as "essential to the proper functioning of the device," documentation for CDRH evaluation must be collected to support this challenge.
The QS/GMP requires manufacturers to evaluate their suppliers and to evaluate their quality data for problems. One method of doing this, similar to the requirements in the old GMP, is to record the percentage of "essential" component rejects per lot, as well as the percentage of lots rejected. If the manufacturer has the raw accept/reject data in a form that can be evaluated to determine supplier performance, and is periodically doing this evaluation, this would be acceptable in lieu of recorded percentages.