- Verify that a quality policy, management review and quality audit procedures, quality plan, and quality system procedures and instructions have been defined and documented.
- Verify that a quality policy and objectives have been implemented.
- Review the firm's established organizational structure to confirm that it includes provisions for responsibilities, authorities and necessary resources.
- Confirm that a management representative has been appointed. Evaluate the purview of the management representative.
- Verify that management reviews, including a review of the suitability and effectiveness of the quality system, are being conducted.
- Verify that quality audits, including re-audits of deficient matters, of the quality system are being conducted.
At the conclusion of the inspection....
- Evaluate whether management with executive responsibility ensures that an adequate and effective quality system has been established and maintained.
The purpose of the management control subsystem is to provide adequate resources for device design, manufacturing, quality assurance, distribution, installation, and servicing activities; assure the quality system is functioning properly; monitor the quality system; and make necessary adjustments. A quality system that has been implemented effectively and is monitored to identify and address problems is more likely to produce devices that function as intended.
A primary purpose of the inspection is to determine whether management with executive responsibility ensures that an adequate and effective quality system has been established (defined, documented and implemented) at the firm. Because of this, each inspection should begin and end with an evaluation of this subsystem.
1. Verify that a quality policy, management review and quality audit procedures, quality plan, and quality system procedures and instructions have been defined and documented.
Prior to the start of the inspection, preferably at the time you make the preannouncement of the inspection (if preannounced), you should ask the firm to send you their overall (or top level) quality system policies, objectives, and procedures. This should include their management review procedures, quality policy, and quality plan. If not received prior to the start of the inspection, you will need to review these documents at the start of your inspection.
Quality Policy and Objectives
The firm must have a written quality policy. The definition of quality policy is provided in the Quality System Regulation. It means the overall intentions and directions of an organization with respect to quality. The firm is responsible for establishing a clear quality policy with achievable objectives then translating the objectives into actual methods and procedures. Management with executive responsibility (i.e. has the authority to establish and make changes to the company quality policy) must assure the policy and objectives are understood and implemented at all levels of their organization. The policy does not need to be extensive. Personnel are not required to be able to recite the policy but they should be familiar with it and know where to obtain it.
Management Review and Quality Audit Procedures
Management reviews and quality audits are a foundation of a good quality system. Assure that the manufacturer has written procedures for conducting management reviews and quality audits and there are defined intervals for when they should occur. The firm's quality audits should examine the quality system activities to demonstrate that the procedures are appropriate to achieve quality system objectives, and the procedures have been implemented. A successful implementation of the firm's procedures should result in the firm achieving its quality policy and associated objectives. Whether the quality policy and objectives are "good" may become evident as the other subsystems are reviewed during the inspection.
The firm must have a written quality plan that defines the quality practices, resources and activities relevant to the devices that are being designed and manufactured at that facility. The manufacturer needs to have written procedures that describe how they intend to meet their quality requirements.
For firms that manufacture devices as well as other products, there must be a quality plan that is specifically relevant to devices. Much of what is required to be part of the plan may be found in the firm's quality system documentation, such as, the Quality Manual, Device Master Record(s), production procedures, etc. Therefore, the plan itself may be a roadmap of the firm's quality system. The plan in this case would need to include reference to applicable quality system documents and how those documents apply to the device(s) that is the subject of the plan.
Quality plans may be specific to one device or be generic to all devices manufactured at the firm. Quality plans can also be specific to processes or overall systems.
Quality System Procedures and Instructions
All manufacturers of medical devices are required to establish and implement a quality system tailored to the device manufactured. Each manufacturer must prepare and implement all activities, including, but not necessarily limited to the applicable requirements of the Quality System Regulation, that are necessary to assure the finished device, the design process, the manufacturing process, and all related activities conform to approved specifications.
The term "quality system" as specified in the Quality System Regulation encompasses all activities previously referred to as "quality assurance" which were necessary to assure the finished device meets its predetermined design specifications. This includes assuring manufacturing processes are controlled and adequate for their intended use, documentation is controlled and maintained, equipment is calibrated, inspected, tested, etc. Some manufacturers may use the terms "quality control" or "GMP Control" or "quality assurance" instead of quality system. It doesn't matter what term is used as long as the quality system concept is understood and implemented.
Written quality system procedures and instructions are required. Any FDA 483 observation regarding Quality System procedures must be specific and point out the controls that are missing or believed inadequate.
2. Verify that a quality policy and objectives have been implemented.
One way to determine whether personnel are familiar with the quality policy is to ask employees directly. This should not be done when the employee is engaged in the actual performance of his/her duties, but could be done when he/she is at break or when he/she has finished a task and before he/she begins his/her next task.
You can also look to see how management has made the policy available. For example: Is it in their Quality Manual or another part of their written procedures? Is it posted at points throughout the building? It doesn't matter how they made the policy known, only that personnel know that there is a policy and where they can read the policy for themselves.
A review of employee training records to show they have been trained in the firm's quality policy and objectives can also be done. In particular, this should be done for those employees involved in key operations.
3. Review the firm's established organizational structure to confirm that it includes provisions for responsibilities, authorities and necessary resources.
The firm's organizational structure must be adequate to ensure devices are designed and manufactured in accordance with the Quality System Regulation. The organizational structure should ensure the technical, administrative, and human factors functions affecting the quality of a device are controlled. These functions may involve hardware, software, processed materials or services. All such control should be towards the reduction, elimination, or ideally, the prevention of quality nonconformities.
To determine what the firm's organizational structure is, start by asking the authority and responsibility questions that are the start of every FDA inspection. Review the firm's organizational charts.
The firm's procedures should describe the functional areas or people responsible for performing certain tasks governed by their quality system. They should also include provisions for resources and designating a management representative.
Determine whether personnel involved in managing, performing or assessing work affecting quality have the necessary independence and authority to perform those tasks. Organizational freedom or independence does not necessarily require a stand-alone group. However, the responsibility, authority and independence should be sufficient to attain the firm's stated quality objectives.
Adequate resources must be available for the quality system to assure the firm's stated quality objectives can be achieved. Resources include money, supplies, personnel, etc. One approach to confirm that adequate resources are available is to ask the management representative how resources are obtained and allocated.
4. Confirm that a management representative has been appointed. Evaluate the purview of the management representative.
The firm must appoint a management representative who is responsible for ensuring the quality system is effectively established and maintained, and who will report on its performance to management with executive responsibility for review. The appointment must be documented.
To determine whether there is in fact a documented management representative, review the firm's organizational chart(s) or their Quality Manual.
Determine whether the appointed management representative actually has the purported responsibility and authority granted to him/her by the firm's procedures or organizational structure. Ways of reaching this determination include: Whether he/she has sign-off authority for changes to documents, processes, or product designs; whether the people conducting quality audits report or provide him/her with their results; and noting how he/she interacts with corrective and preventive actions, relative design control issues, complaints, MDRs, in-process or finished product failures, etc. In other words, his /her responsibility and authority should be apparent through the review of the other subsystems.
Verify that the management representative is reporting back to the management with executive responsibility on the performance of the quality system. These reports should either be the subject of the management reviews or at least provide the framework for those reviews.
5. Verify that management reviews, including a review of the suitability and effectiveness of the quality system, are being conducted.
Management reviews must measure the firm's quality system against the Quality System Regulation and the firm's own stated quality objectives as defined in their quality policy. Management reviews must be documented. There must be written procedures for conducting management reviews. These procedures can be inspected and the firm must certify in writing, if requested, that the firm has complied with this Quality System Regulation requirement.
Review the firm's management review schedule to confirm management reviews are being conducted with sufficient frequency. Management reviews should be frequent enough to keep them informed of ongoing quality issues and problems. During your review of the CAPA subsystem, if you find that there are quality issues that do not seem to be known to executive-level management, then the reviews may not be occurring with sufficient frequency.
The dates and results of management reviews must be documented to show dates conducted and whether management with executive responsibility attended the reviews. It is not permissible as explained above for an FDA Investigator to review the firm's actual management review documentation. However, the firm should be able to show you how the reviews are to be documented. Management review procedures or instructions should include a requirement that the results of the reviews be documented and dated.
6. Verify that quality audits, including re-audits of deficient matters, of the quality system are being conducted.
Review the firm's quality audit schedules to assure quality audits are being conducted with sufficient frequency. It is recommended that the time between quality audits not exceed a 12-month period. More frequent audits may be recommended if the firm has a serious Quality System Regulation problem.
Quality audits should consist of a formal, planned check of all elements in the quality system. They are NOT product audits. Quality audits must be conducted using adequate detailed written procedures by appropriately trained individuals. If conducted properly, a quality audit can detect system defects and, through isolation of unsatisfactory trends and correction of factors that cause defective products, prevent the production of unsafe or nonconforming devices. Without an effective quality audit function the quality system is incomplete and there is no assurance the manufacturer is consistently in a state-of-control.
Evidence of inadequate auditing may exist without gaining access to the written quality audit reports. This evidence may be obtained by relating the audit program to deficiencies observed in other subsystems. If significant quality system problems have existed both before and after the firm's last self-audit, then you should critically review the written audit procedures. The audit procedures should cover each quality system, and should be specific enough to enable the person conducting the audit to perform an adequate audit. The auditors must be adequately trained. If it is necessary and possible to interview an auditor, ask how the audits are performed; what documents are examined; how long audits take; etc.
Audits should be conducted by individuals not having direct responsibility for matters being audited. One person and other very small firms must generally establish independence, even if it means hiring outside auditors, because the failure to have an independent auditor could result in an ineffective audit. If there are significant FDA 483 observations, and independent audits are being performed, but deficiencies are apparently not being identified by the auditor, then an FDA 483 should contain an observation indicating a lack of adequate audits.
Determine whether corrective action by upper management is being taken. Auditors may be asked if they observed any of the ongoing Quality System Regulation deficiencies during their prior audits (ongoing Quality System Regulation deficiencies may also be identified by reviewing prior FDA 483's). If the answer is yes, check the written audit schedule, if available, to determine if a follow up audit is scheduled for the deficient areas. Check the written audit procedure for instructions for review of audits by upper management . For example, do the procedures require quality audit results to be included in the management reviews? Verify that the procedures contain provisions for the re-audit of deficient areas if necessary. A failure to implement follow-up corrective actions, including re-audits of deficient matters may be listed as a Quality System Regulation deficiency on the FDA 483.
7. Evaluate whether management with executive responsibility ensures that an adequate and effective quality system has been established and maintained.
At this point in QSIT, you stop your review of the management system. You continue your inspection by evaluating the other subsystems. While you evaluate the other subsystems, keep thinking about what you are finding and whether it indicates that management is appropriately carrying out responsibilities for providing adequate resources and overseeing the quality system to detect problems and address them.
From your review of the other subsystems, you have a better idea on whether the management representative has the appropriate authority and responsibility, whether the organizational structure is adequate, whether the quality audits and management reviews are sufficient, whether the quality policy has really been implemented, and whether the training being provided is sufficient.
You need to take the time after reviewing the other subsystems, to evaluate the inspectional findings of the management and other subsystems. You need to determine whether the management representative and management with executive responsibility are ensuring the adequacy and effectiveness of the quality system and whether that system has been fully implemented at this firm.
If you found major nonconformances (as defined in the Compliance Program, Part V) in your review of the management or other subsystems that indicate management with executive responsibility is not ensuring the establishment and maintenance of an adequate quality system, you may cite this deficiency on your FDA 483. This cite should not be used routinely, but should be used in those situations where major portions of a quality system have not been established and maintained or whenever there is a total lack of a quality system.
When you have made that determination and have completed your FDA 483, or decided no FDA 483 is needed, you may proceed to your final discussion with Management, or the official closeout meeting with the firm.