Failure to Comply - Document Control in a Regulated Industry

It is not possible to overstate the importance of effective document control in a highly regulated industry such as medical devices. Those of you that have been rewarded with an FDA Form 483 observation for failing to comply with 21 CFR, Part 820.40 (Document Controls), or a minor non-conformance from your notified body for failing to comply with ISO 13485:2012, Clause 4.2 (Documentation Requirements) are not alone. However, there really is no excuse for failing to comply with adequate documentation controls.

Effective document control management systems such as Qualio are available to assist medical device manufactures with the challenges associated with managing the day-to-day activities associated with document control. The control of documentation is one the fundamental cornerstones required for supporting the foundation needed for an effective quality management system, whether compliance is to (a) ISO 13485:2003; (b) ISO 9001:2008; 93/42/EEC (the Medical Device Directive), or the FDA's quality system regulation (QSR) there should never be any excuses.

The system employed for document controls must be all-encompassing in regards to capability, e.g., document creation, storage, issuance, changes, reviews, approvals, etc. Additionally, the system employed for document controls must be able to handle all types of documentation, i.e., procedures, forms, reports, drawings, specifications, etc. Furthermore, the system needs to efficiently and effectively process change requests, including signatures and dates of approvers.

Can you say 21 CFR, Part 11 compliance? Finally, all aspects of the system, employed for document controls, must be fully documented, by written procedures, with the ability to ensure only approved documents are released for use, including the system validation. A final point is record retention, e.g., all documents, must be maintained. FDA will assess the effectiveness of document controls as part of their friendly visit; and verify the adequacy of your system, premised on a review of the records being maintained. Remember, if an event or action is not documented in writing, then in the eyes of FDA and most regulators scattered around the globe, the event, activity, or action never occurred.

Having a quality system that complies with all aspects of the Quality System Regulation (QSR) is the basic cost of admission into the medical device industry...

What We Have is a Failure to Comply

The doctor emphatically states, "Having a quality system that complies with all aspects of the Quality System Regulation (QSR) is the basic cost of admission into the medical device industry in the United States. Conversely, failure to comply with 93/42/EEC is a failure to comply with the MDD in Europe. Either way, the offending device manufacturer is in deep doo-doo. " From Dr. D's perspective, if I notice a single occurrence during an audit, I typically treat the violation as an oversight and ask for immediate correction.

However, eleven Form 483 observations, noted in an FDA Warning Letter is evidence of a complete system failure, or equally as bad, the complete absence of an effective system. Either way, you should be prepared to acknowledge the Form 483!" In the case of the warning letter Dr. D has cited in this paper, there was an abundance of evidence supporting the lack of a documented procedure and subsequent process for effective document controls. The doctor would have loved to have seen the look of shock on the investigator's face when he or she reviewed this organization's approach, or should I say lack of an approach, to document controls. From a U.S. FDA perspective, the regulation is pretty clear in regards to effective document controls. That being said, failure to comply is a complete mystery to Dr. D.

Excerpt from Quality system regulation - 21 CFR Part 820 Document Controls

Document controls

Let the doctor begin by emphatically stating, "detailed written procedures are required that define the entire approach to document controls." All procedures, work instructions, drawings, specifications, etc. must be well-written, well-documented, and well-controlled within a defined document control system.

Enough wells for you? In fact, the doctor's good friends at Qualio  have developed their software approach for these very same reasons. Yes, this approach applies for document controls, as well (another well for you). Just in case you have not noticed, to participate in the medical device industry quality and regulatory professionals need to generate a whole bunch of procedures.

By the way, industry professionals actually need to train and adhere to these procedures too. What a surprise? Unfortunately, we also kill too many trees in pursuit of our need for procedures. So electronic documentation is the only way to go; it is green and saves trees. Remember, the regulator in the EU love ISO 14001. Regardless, regulations, procedures, changes to regulations, changes to procedures, etc. is what keeps most of us quality and regulatory professionals gainfully employed.

Document Approval and Distribution

In pursuit of breaking down regulations, you need to start by identifying the appropriate individuals that will be responsible for reviewing and approving documents prior to their release and subsequent use. For many organizations, this activity is performed as part of a Change Control Board (CCB) meeting. Why not automate the process. Again, software packagers such as Qualio  can do that for you, electronically, with the current state-of-the-art of document management systems.

Either way, the intent of the regulation is to ensure qualified individuals are reviewing and approving documents prior to their release. Once again, the review and approval process requires a signature (could be electronic) and the date reflecting the approval (Part 11 Compliance in the U.S. baby). All documents, relevant to ongoing operations, must always be released and available for use at appropriate locations. For example, assembly instructions should be released to the manufacturing floor. In fact, all operators should always have the applicable assembly or work instruction available and opened at their workstation.

Not to belabor a point, all inspection instructions should be available at the inspection stations; shipping and receiving procedures at the shipping and receiving workstations, etc. Are you following Dr. D's drift here? Additionally, all obsolete documentation must be quickly identified and removed from use. I recommend stamping each document with a bold OBSOLETE stamp and quickly collecting each one. The expectation is that organizations know the exact quantity of documents issued; e.g. let us say seven documents were previously issued, so seven documents need to be stamped as obsolete and collected when new revisions are released. Pretty simple concept, right? Please keep in mind, the use of e-documents will preclude the need for collecting paper copies.

Finally, although not specifically called out in this requirement, training is important. Every-single-time a change occurs to a procedure, work instruction, assembly instruction, inspection instruction, etc. the organization needs to ensure training to the new revision occurs. Trust Dr. D, the FDA will verify training is occurring to the new release of documents. If training is not occurring, can you say, "Please give me another Form 483 observation?"

If training is not occurring, can you say, "Please give me another Form 483 observation?

Document Changes

Managing change to documents requires the same diligence in regards to review, approval, and evidence of signatures and dates. When making changes to documents, ensure the same functional areas responsible for reviewing, approving, and releasing the original document are included in the review, approval, and release of subsequent document changes. Once again, you will need to trust Dr. D when I say; "The FDA will review the change history of documents, when warranted, as part of their investigative process." As a minimum, the following change request information is required:

1. A detailed description of the change;

2. A list of all documentation affected by the change;

3. The individual or organization requesting the change;

4. A list of change approvers;

5. The actual signature (can be electronic) and approval date of the change;

6. The effective date of the change; and

7. Additional information that may be relevant to supporting the change.

Focus on document controls

Medical device manufacturers need to focus on document controls. The control of documents is the cornerstone supporting the foundation for an effective quality management system. It is imperative the latest, greatest, and correct revisions of documentation, e.g., procedures, assembly instructions, inspection instructions, drawing, etc. are released and employed by medical device manufacturers. Additionally, all changes must receive the appropriate level of oversight in regards to review, approval, and release. Furthermore, similar to all records required in support of QSR compliance, signatures and dates are important. Finally, do not forget to collect all documentation that has been identified as obsolete.

References

1. Code of Federal Regulation. (2013, April). Title 21 Part 820: Quality system regulation. Washington, D.C.: U. S. Government Printing Office.

2. Devine, C. (2011). Devine guidance for complying with the FDA’s quality system regulation – 21 CFR, Part 820. Charleston, SC: Amazon.

3. ISO 13485:2003. (2004, February). Medical devices – quality management systems – requirements for regulatory purposes (ISO 13485:2003).