CPGM 7382_845: Part 3 INSPECTIONAL

Compliance Program
Manual for FDA Staff

PART III

INSPECTIONAL

BACKGROUND

This program includes guidance for determining compliance with the Quality System/Good Manufacturing Practices (QS/GMP) regulation, Medical Device Reporting (MDR) regulation, Medical Device Tracking regulation, Corrections and Removals regulation, and the Registration and Listing regulation.

A. OPERATIONS

1. Inspectional Strategy

a. Quality System/GMP inspections should be conducted using the Quality System Inspection Technique (QSIT). Guidance for "how to" perform the inspections is provided in the Guide to Inspections of Quality Systems, August 1999, also called the QSIT Guide. This QSIT tool can be scaled to meet the needs of each particular inspection. Using the QSIT TABLE below, decide which type of inspection is being conducted, and cover the appropriate sections in the QSIT Guide.

QSIT TABLE

Inspection

Level

Reason for

Inspection

QSIT Subsystems

Inspected

Abbreviated

CAPA plus one subsystem

(PAC 82845A)

Baseline (Comprehensive)

The four major subsystems (PAC 82845B)

Compliance Follow-up

As directed by inspection guidance

(PAC 82845C)

NOTE: Although the Quality System regulation has seven subsystems, the following four subsystems are considered major subsystems and are the basic foundation of a firm’s quality system: Management Controls, Design Controls, Corrective and Preventive Actions (CAPA), and Production and Process Controls (P&PC). The three remaining subsystems (Facilities and Equipment Controls, Materials Controls and Document/Records/Change Controls) cut across a firm’s quality system and can be evaluated while covering the four major subsystems.

LEVEL 1 – Inspections

Level 1 inspections are considered Abbreviated Inspections. Level 1 inspections can be done at the district's discretion on firms whose previous Baseline inspection was classified VAI or NAI. Note: All firms should initially have one Baseline (Comprehensive) inspection using the Level 2 QSIT approach. The Level 2 inspection is considered the Baseline for determining a firm's compliance with the quality system regulation. Level 1 inspections should always cover the CAPA subsystem plus one other subsystem, using the QSIT Guide. Prior to deciding which subsystems to inspect (in addition to the CAPA subsystem) determine if there were:

Changes in management control procedures or in management controls
Changes in design control procedures or in device design
Changes in production & process control procedures or production & process changes

Your findings from the above determination can assist in your decision of which other subsystem to cover in addition to the CAPA subsystem. Before choosing which additional subsystem to inspect as the "plus one", review the previous EIR(s) and determine which subsystems were previously covered. The "plus one" subsystems should be rotated, so that as many subsystems as possible are covered during the period before the next Level 2, Baseline (Comprehensive) inspection.

LEVEL 2 – Inspections

Level 2 inspections are considered Baseline (Comprehensive) Inspections. Outcomes from conducting a Level 2 inspection are considered the Baseline for determining a firm's compliance with the quality system regulation. During these inspections, cover all four major subsystems as explained in the QSIT Guide. All firms should have one Level 2 inspection to provide the agency with an overview of the firm’s quality system. Once the Baseline is satisfactorily established, future inspections can be performed at Level 1 as described above. Note: As district resources permit, Baseline (Level 2) inspections should be conducted at least every 6 years.

Note regarding Level 2 inspections: The QSIT approach, which evaluates all four major subsystems (management controls, design controls, corrective & preventative actions (CAPA), and production & process controls) is considered a complete review of the firm’s entire quality system. Thus, it is not necessary to inspect beyond the questions and inspectional guidance in the QSIT Guide unless you are asked to perform a Level 3 inspection.

LEVEL 3 – Inspections

Compliance Follow-up Inspections are considered Level 3 inspections. As mentioned in Part V of this compliance program, Level 3 inspections are necessary AFTER a firm was found to have Situation I conditions during a previous Quality System/GMP inspection (which was classified Official Action Indicated (OAI)). During Level 3 inspections you are expected to: (A) verify that adequate corrections have or have not been implemented to the quality system problems previously identified, and (B) if the corrections were not implemented, verify that the violations continue to exist, and provide adequate evidence to support a possible regulatory action. Use the chart below to determine how far to go for the Level 3 inspection. You should also use the QSIT Guide for guidance, but work closely with the district compliance officers during Level 3 inspections to assure that you cover appropriate inspectional areas at enough depth, document the noncompliant findings (conditions) appropriately, and collect sufficient evidence to support an appropriate regulatory action recommendation. See Part V, section A.5.b of this compliance program for additional guidance on these inspections. Level 3 Inspections: Guide for choosing how far to go on compliance follow-up inspections.* If new Situation 1 criteria were found, the inspection should follow those to their conclusion and document the findings.

yes

2. Inspectional Instructions

a. Required Statement. For all Quality System inspections the Form FDA-483 should contain the following statement: THE OBSERVATIONS NOTED IN THIS FORM FDA-483 ARE NOT AN EXHAUSTIVE LISTING OF OBJECTIONABLE CONDITIONS. UNDER THE LAW, YOUR FIRM IS RESPONSIBLE FOR CONDUCTING INTERNAL SELF-AUDITS TO IDENTIFY AND CORRECT ANY AND ALL VIOLATIONS OF THE QUALITY SYSTEM REQUIREMENTS. b. Quality System/GMP inspections should be conducted using the Quality System Inspection Technique (QSIT). Guidance for "how to" perform such inspections is provided in the Guide to Inspections of Quality Systems, also called the QSIT Guide. Some program areas are considered satellites to the four major quality subsystem (Management Controls, Design Controls, CAPA, Controls and Production and Process Controls) areas:

CAPA Satellites

MDR

Corrections & Removals

Tracking

Production & Process Control Satellite

Sterilization

Refer to the QSIT Guide for details on how to inspect for those areas mentioned above. Refer to Part V of this Compliance Program for guidance on Regulatory and Administrative follow-up to these programs.

c. When to inspect for the programs.

Use the following guidance for determining when to cover the various programs, which are mentioned in section "b" above. (Use the QSIT Guide for "how" to inspect those areas.)Quality Systems/GMP. Each inspection. Coverage is determined by the "level" of desired inspection. See Part III, section A.1 for guidance on which level to use, and thus which subsystems to inspect.MDR. An MDR inspection should be conducted each time a Level 2 Quality System/GMP inspection is done. An MDR inspection should also be initiated when complaints involving a death(s) or serious injury (ies) are reported, or when a Level 1 inspection finds CAPA violations.Corrections & Removals. A Corrections & Removals inspection should be conducted each time a Level 2 Quality System/GMP inspection is done. A Corrections & Removals inspection should also be initiated when a manufacturer is reporting corrections & removals of their devices on their MDR or Part 806 reports. You should make this determination during each inspection. Attachment G provides further information on this program.Tracking. When appropriate, a Tracking inspection should be conducted each time a Level 2 Quality System/GMP inspection is done. Be sure to check the list of "Tracked Devices" before initiating your inspection to determine if tracking requirements apply. To obtain Tracking information, refer to Guidance for Medical Device Tracking, published in the Federal Register, January 24, 2000, or access http://www.fda.gov/cdrh/modact/tracking.htmlSterilization. A Sterilization inspection should be conducted when you are inspecting a contract sterilizer, or when you choose sterilization as the "process" for review under the production & process controls section of QSIT. Sterilization does not need to be covered during each quality system inspection.

Registration and Listing
Electronic Records and Electronic Signatures

Follow agency policy when inspecting electronic records and signatures. For further information, see Compliance Policy Guide entitled "Enforcement Policy: 21 CFR Part 11; Electronic Records; Electronic Signatures (CPG 7153.17) and Chapter 4 of the Regulatory Procedures Manual concerning Warning Letters at the following respective websites:http://www.fda.gov/ora/compliance_ref/cpg/cpggenl/cpg160-850.htm http://www.fda.gov/ora/compliance_ref/rpm_new2/ch4.html.For additional guidance, contact Paul Motise (HFC-240) at (301) 827-0383. 5. Sample Collection For QS/GMP, MDR, Tracking, and Correction and Removals (CAR) violations, samples are not generally necessary to support a Warning Letter. However, your District may require at least a documentary sample to support even a Warning Letter. Follow your district requirements. The level of the inspection is immaterial to whether a sample is needed, it's the findings that count and whether the District Compliance Office wants to track actions through samples. Physical samples are generally not required to support QS/GMP violations, and should not be routinely collected for QS/GMP cases. If the district should reference violative documentary or physical samples as evidence to support QS/GMP deviations, the sample should be tied to the QS/GMP deviation to show a cause/effect relationship.Normally, the collection of samples for sterility issues is not to be performed during Level 1 (Abbreviated) inspections of device manufacturers or contract sterilizers. The following items provide guidance on sampling decisions. Should you have questions regarding the need to collect samples related to the sterilization process, you should contact Sarah Mowitt, Sterilization Expert, at (301) 594-4595.

Finished device samples should not routinely be collected and tested for sterility to prove quality system deficiencies in sterilization validation or process control. Under certain circumstances, the Center may request that samples be collected for sterility testing. In such cases, randomly collect 132 devices from a lot unless the lot size is small or the cost is prohibitive. If 132 devices are unavailable because of lot size or cost, contact the analyzing lab to determine the minimum number of devices that should be collected.

Field examination of packaging used for sterile devices may be indicated when your assessment of packaging operations demonstrates a lack of control such that inadequate packaging is likely to occur. Examine the packages for integrity of the sterility barrier, paying close attention to seals.

Samples of defective packaging found during a visual field examination, if regulatory action is contemplated for packaging deficiencies, consist of 20 sterilized packaged devices.

Bioburden samples are to be collected only 1) when your review of the results of bioburden testing performed by the manufacturer finds unrealistically low results, and 2) the sterilization process is a bioburden based cycle with no safety overkill element. The sample is to consist of 20 unsterilized devices.

Biological indicators are not to be collected routinely. Collect fifty biological indicators only if you have reason to question the effectiveness of the indicators or under direction by the Center.

Endotoxin samples are to be collected only when endotoxin control is necessary for the device and when your review of the manufacturer's test methodology leads you to believe that the manufacturer's test results may be unrealistically low. Collect 10 sterilized devices.

If the investigator is uncertain as to whether a sample should be collected, the district should consult with the CDRH Headquarters Laboratory Liaison or the Division of Field Science in ORA on the laboratory capability to conduct the analysis. (See Part VI, C. for program contacts). 6. Follow-up Inspections See Part V, Section A. 5. b. for guidance. 7. Foreign Inspections All foreign inspections should be conducted using the QSIT Guide and at the appropriate Inspection Level as defined by the inspection assignment. The failure of foreign device manufacturers to register and to list products exported to the US will subject medical devices to detention upon entry. The foreign manufacturer's compliance with registration and listing requirements should be covered during foreign inspections.NOTE: For all foreign inspections, use the same PACs as those used for domestic inspections, i.e., 82845A, B, C, or G, etc., as appropriate. Special Note: PAC 82R806 is now obsolete.

B. SPECIAL SITUATIONS

1. For Cause InspectionsFor Cause inspections shall still be conducted as the need arises. These inspections are generally more in-depth than the QSIT inspections. "For Cause" inspections should be directed towards the quality problems, and if applicable, tracing the root causes and assuring that appropriate corrective and preventive actions are initiated. "For Cause" inspections are usually initiated at the request of CDRH, ORA headquarters, Regional or District directives. These inspections are usually intended for, but not limited to: follow-up to recalls, consumer complaints, defective products, etc. Immediate investigations/ inspections are needed in these cases. If you encounter a serious public health risk during a QSIT inspection you should consider switching over to a For Cause inspection. These inspections can be conducted using the QSIT Guide; however, often, more in-depth investigations are needed in the CAPA area. The December 1997, Guide to Inspections of Medical Device Manufacturers is recommended when conducting For Cause inspections."For Cause" inspections may also be initiated at a contract sterilizer when an inspection at a device manufacturer raises questions about the adequacy of processing or quality assurance by the contract sterilizer. Likewise, an inspection at a contract sterilizer may lead to a "For Cause" inspection of device manufacturers if significant deficiencies are observed. The deficiencies may be an indication that the device manufacturer(s) has not assumed appropriate responsibility for the sterilization validation and processing of its own devices. The district that has identified the need for the additional coverage is to notify the home district of the establishment that needs a "For Cause" inspection. 2. Special Instructions Concerning Design Controls The inspectional authority for review of design control records is derived from Section 704(e) of the Act. Such authority applies only after the establishment has manufactured the device for which the design has been under development or taken an action that precludes the argument that the product under development is not a device. Such action includes: (1) submitting to an Institutional Review Board plans for clinical investigation of the device, (2) submitting to FDA a Product Development Protocol (PDP), (3) submitting to FDA an IDE, 510(k), or PMA, (4) change to an already marketed device. Refer to Attachment D for decision chart outlining when FDA has inspectional authority to review design control records.THE ABOVE LIMITATION DOES NOT APPLY TO INSPECTIONAL AUTHORITY TO REVIEW ALL GENERIC DESIGN CONTROL PROCEDURES AT ANY POINT IN TIME.Review of design controls should cover any design processes performed after June 1, 1997. The establishment is not required to retrospectively apply design controls to any stages in the design process that it had completed prior to June 1, 1997. If an establishment normally designs its own devices, but has not initiated any design changes to current devices since June 1, 1997, or does not have a design project underway that is reviewable by FDA given the limitation discussed above, investigators should limit their coverage to a review of the design control change procedures that the establishment must have defined and documented.There are a number of multi-establishment firms that conduct all design activities at a single facility (sometimes referred to as a research and development (R&D) center or corporate design facility). If the establishment scheduled for inspection is serviced by an R&D center or corporate facility, review the establishment jacket, before beginning your inspection, consult the agency’s on-line OEI databases and/or directly contact the district involved. Determine if the home district of the R&D center or corporate design facility has conducted a design control inspection of that facility within the previous two years. If such an inspection was conducted, it will not be necessary to conduct a design control assessment at the establishment scheduled for inspection. If an inspection was not conducted within the previous two years, issue an assignment to the home district of the R&D center or corporate design facility requesting a design control inspection.Some establishments have their devices designed under contract. Such situations must comply with the requirements for using contractors under 21 CFR 820.50 as well as ensure compliance with 21 CFR 820.30. The manufacturer must maintain or have reasonable accessibility to copies of a Design History File for any device that is in production. The observations that are placed on the Form FDA-483 should be limited to the adequacy of the procedures and/or controls established by the firm. Do not place observations on the Form FDA-483 that concern the adequacy, safety, or efficacy of a particular design. Any such concerns should be noted in the EIR and the EIR flagged for review by the Office of Device Evaluation. 3. Special Instructions for Sterilization Processes NOTE: Sterilization inspectional guidance is found in the QSIT Guide. Effective upon issuance of this compliance program, sterilization processes will no longer be inspected under separate compliance program circulars. (Sterilization checklists are now obsolete.) The previous compliance program circulars 7382.830A (Sterilization of Medical Devices) and 7382.830B (Contract Sterilizers) are replaced by instructions in this compliance program and in the Sterilization Process Controls section found in the QSIT Guide. Such coverage has become a sub-part of the Production and Process Controls subsystem. The instructions for inspecting sterilization processes are applicable at the following types of facilities:

- device manufacturers that sterilize their own product;

- device manufacturers that use contract sterilizers; and,

- contract sterilizers.

NOTE: The portion of the inspection spent covering sterilization processes should be reported under PAC 82845S.Refer to Part III, A. 4, for guidance on collection of samples relating to sterilization issues. 4. Inspection of Radiation Emitting Devices Medical Devices which are also deemed to be "electronic products" as defined by the Federal Food Drug and Cosmetic Act, Subchapter C – Electronic Product Radiation Control, section 531(2), may be inspected under this compliance program. These devices have additional Radiological Health requirements to protect the public from unnecessary radiation. The requirements include the affixing of a certification labeling, additional reporting and record keeping, and the continued testing to verify product conformance with applicable Federal Performance Standards promulgated under 21 CFR 1020 - 1050. If the device being inspected is subject to Radiological Health requirements, follow the appropriate Compliance Program. Report any Radiological Health time under the appropriate Rad Health PAC.REMINDER: When conducting QS/GMP inspections, you may find that the firm manufactures medical devices which are capable of emitting electronic product radiation. Based on district concurrence, you should also assess the firm’s devices against the applicable standards promulgated under Chapter V, Subchapter C - Electronic Product Radiation Control of the FD&C Act. This assessment is not a QS/GMP activity and should not be reported as a QS/GMP activity. Use Compliance Programs 7386.001, 7386.002; and 7386.004 through 7386.007 for guidance on inspecting, regulatory consideration, and reporting the time used for the inspection of this area. For Field Compliance Testing of Diagnostic Medical X-Ray Equipment, use CP 7386.003.Device manufacturers subject to existing FDA performance standards (21 CFR Parts 1020 – 1050) should include in their device master and history records those procedures and records demonstrating compliance with the applicable standard, self-certification (21 CFR 1010), and reporting (21CFR 1002 – 1005). 5. Implantable and Life Sustaining Devices (Formerly Critical Devices) Under 21 CFR 820.65, the requirements for devices and component traceability applies to implantable devices and life sustaining devices. See Attachment B for a list of such devices. (Note: This list may not be comprehensive. The definition specified in 21 CFR 820.65 should be used when determining if these requirements must be met.)6. Comparison of Requirements Between the 1978 GMP Regulation and the 1996 Quality System RegulationWhile the QS/GMP requirements that apply to manufacturing are similar in both regulations, some of the requirements were reworded or otherwise modified in an effort to better harmonize with ISO 9001. See The FDA and Worldwide Quality System Requirements Guidebook for Medical Devices for a chart comparing the requirements in the old and new regulations. See Part VI, Reference Number 21. 7. FDA Field Accomplishments and Compliance Tracking System (FACTS) a. When selecting specific manufacturing processes to represent profile classes, investigators should give preference to processes that are used in the manufacture of higher risk devices; that have had problems as indicated by evaluation of the Corrective and Preventive Action Subsystem (CAPA); that present a higher risk should the device fail; that are used in manufacturing multiple devices; with which the firm is unfamiliar or lacks experience; or that cover a variety of process technologies and profile classes. A list of the device related profile classes appears in the current FDA COMSTAT Manual. NOTE: If all profile classes are not directly covered during an inspection, but are covered indirectly under CAPA, then all profile classes the firm is involved with can be listed on the Profile Data Sheet, and/or the appropriate FACTS screen. b. Inspections conducted under a COMSTAT assignment should include: (1) coverage of the device(s) specified in the assignment, or devices and related manufacturing processes representing all the same profile classes as the assigned device; and

other devices as required to provide coverage of any remaining profile classes, except QS/GMP exempt Class I devices.

c. Since the QSIT approach covers "systems" you can apply the finding from the inspection to all profile classes at this firm. 8. Imports No import field examinations or sample collections are scheduled under this program. 9. Exports The FDA Export Reform and Enhancement Act of 1996 amended Section 802 of the FD&C Act to allow an establishment to export unapproved Class III devices or uncleared Class II devices subject to mandatory standards under Section 514, to any of those countries listed in Section 802 of the Act that authorize marketing, and to any other country that recognizes the marketing authorization of a listed country without first obtaining FDA authorization. Section 802 also requires that any such device must be manufactured in "substantial" conformance with the QS/GMP requirements.Firms must notify FDA when they make the first shipment of an unapproved device. CDRH has sent copies of the notification letters to the appropriate districts for inclusion in the firm’s file jacket. When you review the firm’s file jacket prior to the inspection and find that CDRH has forwarded one such letter, you will make an assessment during the QS/GMP inspection. During the inspection, the district should confirm that the establishment has subjected the device(s) to substantially the same quality system used for devices sold domestically. This confirmation should be done by asking the firm whether the exported device is covered and subject to the same quality system as that inspected. Physically inspect QS/GMP records for the exported device unless you determine that the exported device is subject to a separate quality system. Review approximately 10 history records, comparing them against the master record for the review. If you determined that products for export are not subject to substantially the same quality system as domestically distributed products, documented observations should be included on the FDA-483. In the event that Situation I conditions are identified, investigators should contact HFZ-305, Attn: Wes Morgenstern. Otherwise, Class I & II devices that are manufactured in the U.S., but not marketed in the U.S., are not subject to the QS/GMP requirements, provided that the manufacturer has documented proof that its devices have been offered for sale only in foreign countries.Section 801(d)(3) of the Act permits the importation of adulterated or misbranded devices, components, or accessories for further processing or incorporation into a finished device, provided that the device is subsequently exported.Chapter 9 of the Regulatory Procedures Manual provides guidance on "import for export", including record keeping requirements and the types of operations that qualify as further processing or incorporation of a component into a finished device. All such operations are subject to the requirements of the QS regulation.Manufacturers are required to make prior arrangements with their FDA district office before initiating an import for export operation. Your review of the factory jacket should reveal when firms are performing such operations. You should confirm that the firm is complying with the applicable requirements of the QS regulation using 10 history records as described above. NOTE: FDA expects the Export regulation to publish during FY 2001. C. REMARKETED DEVICES1. Remanufacturers of Used Devices Remanufacturers are persons who process, condition, renovate, repackage, restore or do any other act to a finished device that significantly changes the finished device’s performance or safety specifications or intended use [21 CFR 820.3(w)]. Remanufacturers are considered to be manufacturers, and are subject to all applicable requirements of the Quality System regulation, MDR requirements, Device Tracking requirements, Registration and Listing, and premarket clearance. If an establishment disputes its regulatory status, the district should refer the EIR to the appropriate Division of Enforcement within CDRH/OC for assistance in interpreting the definition of a remanufacturer.NOTE: For a discussion of the above issues see Federal Register Notice: December 23, 1997 (Volume 62, Number 246), pages 67011 – 67013. 2. Third Party Refurbishers/Reconditioners/Servicers of Used Devices Third party refurbishers, reconditioners, servicers and "as is" resellers of used devices are currently not subject to the requirements of the Quality System regulation. In 1997, FDA published an Advanced Notice of Proposed Rulemaking (ANPR) requesting public comments/proposals on regulation of third party refurbishers, reconditioners, servicers and "as is" remarketers of used devices. If the district receives an assignment to inspect such an establishment, the district should contact Wes Morgenstern (HFZ-305) at 301-594-4699 to determine the current regulatory status of such establishments. 3. Reprocessors of Single Use Devices Third party reprocessors of single use devices are considered to be manufacturers and are subject to those requirements of the Quality System regulation that apply to the operations they perform. Because contractual arrangements with hospitals and questions of ownership may sometimes make the responsibilities of the third party unclear, the district should contact Larry Spears (HFZ-340) at 301-594-4646 for guidance before conducting an inspection of an establishment believed to be a third party reprocessor of single use devices. See Enforcement Priorities for Single-Use Devices Reprocessed by Third Parties and Hospitals, August 14, 2000, for guidance on FDA’s enforcement strategy. Copies are available from: http://www.fda.gov/cdrh/reuse/index.shtml D. REPORTING 1. General Reporting requirements are listed on the cover page.

Quality System/GMP Observations--If you observe violations of the QS/GMP requirements, you should place them on the Form FDA-483. The QSIT Guide provides guidance concerning major QS requirements and the identification of major deviations. The most serious system deficiencies should be noted on the Form FDA-483 first. Observations should be grouped by subsystem, if possible. Special Note: Refer to IOM, Section 512.3 for information concerning annotation of the Form FDA-483.

510(k) Observations--If the establishment does not have a valid 510(k) for a device that was offered for introduction into interstate commerce for the first time after May 28, 1976, or has made significant changes to a device that require a new 510(k), investigators should not place the observations on the Form FDA-483 unless you obtain concurrence from CDRH/OC. Refer to existing policy in the IOM, Section 512.1, 15.
Registration and Listing Observations -- If a firm has failed to list device(s), or to verifiy that their listings are up-to-date every six months and update them if they are not, as required by 21 CFR Part 807, you should make note of this observation(s) in the EIR for consideration for action by your Compliance Officer. If a firm has failed to renew its annual registration for the last two or more years as required by 21 CFR Part 807, you should make note of this observation in the EIR for consideration for action by your Compliance Officer. All registration and listing observations should be reported to firm management but should not be cited on the FDA-483.

^th

http://www.fda.gov/cdrh/comp/estregls.html

Field Accomplishments and Compliance Tracking System (FACTS)--Refer to existing policy in the IOM, Section 180, page 26.


FDA Home Page \| Federal-State \| Import Program \| Compliance \| Inspection \| Science \| ORA Search