- Email: [email protected]
Avoiding common mistakes
CHAPTER
Avoiding common mistakes
6
There are many pitfalls on the road to establishing a quality management system (QMS). Be alert for some of the common mistakes that companies make with their QMSs. One of the most frequently made mistakes in regulated medical device companies is not having a process to effectively manage regulatory inspections. Depending on where you design, manufacture, and sell your products, you will receive various regulatory inspections. In order to sell medical devices in the United States, you must register your facilities with the Food and Drug Administration (FDA). And this puts you on the list for potential inspections. Being ready for an FDA inspection requires ongoing effort and compliance with your QMS. But, it also highly important to have a plan in place long before the inevitable inspection. See Chapter 16, FDA Inspection Readiness for more detail. Certification to ISO 13485 is important to marketing products outside of the United States. And it is a big accomplishment to get certified. However, do not make the mistake of thinking that this prepares you for an FDA inspection. An FDA inspection involves another set of depth and rigor over a notified body audit. See Chapter 16, FDA Inspection Readiness to create an inspection preparedness plan. Mergers and acquisitions are important means of growth for many companies. Do not underestimate the challenge of fully integrating the acquisition. Although companies do due diligence, they are often surprised by later problems. Due diligence is only a small snapshot of the risk picture. Companies are often surprised by much bigger issues over time. My experience is that small companies can sometimes get away with a less effective QMS than a larger company might. I have seen too many cases where, very soon after acquisition, there was a serious quality issue like a recall or a major compliance issue such as a warning letter. Avoid training gaps in the organization. Culture and training play a huge role in execution of and compliance to procedures. In many companies, training is focused at lower level positions or manufacturing operators. Do not forget to train process owners and functional management all the way to the top. Awareness of regulation history, understanding of metrics, and risk-based decision making are essential skills. Training should be a vital part of improvement and prevention of quality problems, regardless of level, department, or role. Beware of automation. Automation, done well, is a good thing. In an effort to streamline activities and improve efficiency, many organizations attempt to Medical Device Quality Management Systems. DOI: https://doi.org/10.1016/B978-0-12-814221-9.00006-3 © 2019 Elsevier Inc. All rights reserved.
69
70
CHAPTER 6 Avoiding common mistakes
automate processes like complaint management, corrective and preventive action (CAPA), manufacturing batch records, document control, etc. Automation can bring big gains in productivity and process consistency. But, it is a common mistake to automate processes before they are ready. If the core process has underlying problems, automation will make it worse. Analyze and map your processes first. Identify improvements, stabilize, and then automate. Be cautious about customizing IT solutions or electronic data management systems excessively. Pick a company with a good product and do not attempt to customize excessively. This creates more work, more opportunities for error, and more difficulties in longterm maintenance and control. Take care when estimating your own capabilities and maturity. It is easy to overestimate your capabilities. Overestimating capabilities will give you a false sense of security. It is better to create clear criteria for your estimation. Support your estimation with data. Use a team-based approach to evaluations. Repeat the review annually as you create the next year’s goals and objectives. Selfawareness is a prerequisite to planning. Be especially careful to evaluate your internal audit capability. Use an independent, well-qualified, external third party to provide a clear evaluation. And no, that external third party should NOT be the FDA! Be proactive in understanding your skill sets. I have seen FDA Form 483 observations for internal audit deficiencies. Usually, these are basic issues such as not doing internal audit or not having a defined schedule. But, I do recall a particularly memorable warning letter in which there were several serious deficiencies for a specific design history file. The next item on the warning letter stated that the same file had just been reviewed in internal audit, which had missed all of these serious issues. Pay attention to the process approach and process ownership. All the elements of the QMS need to work together in an aligned and harmonious manner. Lack of alignment, gaps, and overlaps in processes can create tears in the fabric of the QMS. Be watchful for signs that functional leaders do not understand or accept their responsibilities for process ownership, control, and monitoring. Lack of process ownership is one of the main causes of an ineffective and inefficient QMS. When process owners fail to understand and embrace the responsibilities of their role, problems occur. The process is not effectively translated into clear procedures. Personnel do not follow procedure consistently. Output varies. Nonconformities occur. An ineffective and inefficient process is never predictable. And ultimately that hurts business results. A very common and serious mistake, resulting in an inefficient and ineffective quality management, is failure to use the CAPA system properly. Many companies treat CAPA as a regulatory requirement rather than what it is intended to be—a robust, methodical, closed-loop process to fix problems permanently. They treat CAPA as a burdensome process that is ineffective and hard to understand. They use an IT tool that is not intuitive or easy to use. They cram everything into an overloaded bureaucratic system where everything stalls. There is lack of prioritization and governance. This is known as death by CAPA. Your CAPA program
Avoiding common mistakes
needs a CAPA. See Chapter 15, Alphabet Soup for detail on creating an efficient and effective CAPA process. Another mistake is not managing CAPA timeframes in a rigorous manner. Some companies have CAPAs that are several years old. It is possible that some CAPAs make take some time to fix properly. In particular, product design changes may take some time. But, aged CAPAs should be the exception and not the rule. Actions should be commensurate with risk! Additionally, all CAPAs that are closed as ineffective deserve management scrutiny. Very old CAPAs, and evidence of closing and replacing an old CAPA with a new CAPA, should be viewed with much suspicion. Poor root cause analysis (RCA) is another common mistake with CAPA. Sometimes RCA is limited to an obvious symptom. In that case a a quick fix only is applied. The problem may seem to go away for awhile but eventually resurfaces. Or the root cause is incomplete resulting incomplete correction and corrective action. Contributing factors remain unaddressed and result in another problem somewhere else. When doing RCA for CAPA do not make the mistake of thinking there in only one true root cause. There may be several layers of causes as well as contributing causes. For every recall, there are at least two main causes. The first is the physical cause of the defect, and the second is the failure to detect it before it escaped the quality plan and got out to the customer. Dig deeper. Ask why five times, or more, if necessary. Why was the defect not detected? An inadequate test method? Perhaps a sampling plan that is not statistically valid. Think beyond the physical cause of the failure, and also to contributing causes including poor decision making and human error. Understand if MEDICS immaturity is a contributing cause (see Chapter 8 for detail on MEDICS). Taking corrective action based on incorrect or incomplete RCA is just a waste of time and energy. It wastes already precious resources exacerbating inefficiency and ineffectiveness. For serious problems, use the rigor of your CAPA process to put permanent fixes in place! Because CAPA is such an important foundational process, an entire chapter is devoted to it. Please see Chapter 15, Alphabet Soup for details on the CAPA process. That chapter includes detail on RCA concepts and a variety of tools that are basics for knowledgeable management with executive responsibility, management representatives, and process owners. Avoid holding management review meetings too infrequently. Management needs timely and regular information to make informed decisions and prevent trends from becoming full-blown issues. Hold management review with sufficient frequency to assess real-time information, so that actions can be preventive instead of reactive. Management review only once or twice a year is not optimal. Conduct management review in a complete and rigorous manner with clear information and sufficient detail to really understand the health and suitability of the QMS. The biggest mistake of all is to ignore the warning signs of problems. Every serious Form 483, warning letter, consent decree, or significant quality problem
71
72
CHAPTER 6 Avoiding common mistakes
that I have consulted on presented warning signs ahead of time. Yet, management failed to heed the warnings. They ignored evidence and/or took unacceptable risks. They failed to provide enough resources for a suitable and effective QMS. Do not make that mistake. Pay attention to the MEDICS, the capabilities to avoid these common mistakes. They are discussed in detail in Chapter 8, Capabilities and MEDICS for an Effective QMS. Levels of maturity for the MEDICS capabilities are defined, so each medical device can assess their current state. In conclusion, these mistakes can be avoided. Death by CAPA does not have to happen. CAPA can be the rigorous, methodical process necessary for solving the company’s toughest quality problems. Use it when necessary and then use it well. Assess the MEDICS levels to avoid common pitfalls. Pay attention to the details, DO sweat the small stuff, and focus on prevention to create an effective and efficient QMS.
Avoiding common mistakes
6
There are many pitfalls on the road to establishing a quality management system (QMS). Be alert for some of the common mistakes that companies make with their QMSs. One of the most frequently made mistakes in regulated medical device companies is not having a process to effectively manage regulatory inspections. Depending on where you design, manufacture, and sell your products, you will receive various regulatory inspections. In order to sell medical devices in the United States, you must register your facilities with the Food and Drug Administration (FDA). And this puts you on the list for potential inspections. Being ready for an FDA inspection requires ongoing effort and compliance with your QMS. But, it also highly important to have a plan in place long before the inevitable inspection. See Chapter 16, FDA Inspection Readiness for more detail. Certification to ISO 13485 is important to marketing products outside of the United States. And it is a big accomplishment to get certified. However, do not make the mistake of thinking that this prepares you for an FDA inspection. An FDA inspection involves another set of depth and rigor over a notified body audit. See Chapter 16, FDA Inspection Readiness to create an inspection preparedness plan. Mergers and acquisitions are important means of growth for many companies. Do not underestimate the challenge of fully integrating the acquisition. Although companies do due diligence, they are often surprised by later problems. Due diligence is only a small snapshot of the risk picture. Companies are often surprised by much bigger issues over time. My experience is that small companies can sometimes get away with a less effective QMS than a larger company might. I have seen too many cases where, very soon after acquisition, there was a serious quality issue like a recall or a major compliance issue such as a warning letter. Avoid training gaps in the organization. Culture and training play a huge role in execution of and compliance to procedures. In many companies, training is focused at lower level positions or manufacturing operators. Do not forget to train process owners and functional management all the way to the top. Awareness of regulation history, understanding of metrics, and risk-based decision making are essential skills. Training should be a vital part of improvement and prevention of quality problems, regardless of level, department, or role. Beware of automation. Automation, done well, is a good thing. In an effort to streamline activities and improve efficiency, many organizations attempt to Medical Device Quality Management Systems. DOI: https://doi.org/10.1016/B978-0-12-814221-9.00006-3 © 2019 Elsevier Inc. All rights reserved.
69
70
CHAPTER 6 Avoiding common mistakes
automate processes like complaint management, corrective and preventive action (CAPA), manufacturing batch records, document control, etc. Automation can bring big gains in productivity and process consistency. But, it is a common mistake to automate processes before they are ready. If the core process has underlying problems, automation will make it worse. Analyze and map your processes first. Identify improvements, stabilize, and then automate. Be cautious about customizing IT solutions or electronic data management systems excessively. Pick a company with a good product and do not attempt to customize excessively. This creates more work, more opportunities for error, and more difficulties in longterm maintenance and control. Take care when estimating your own capabilities and maturity. It is easy to overestimate your capabilities. Overestimating capabilities will give you a false sense of security. It is better to create clear criteria for your estimation. Support your estimation with data. Use a team-based approach to evaluations. Repeat the review annually as you create the next year’s goals and objectives. Selfawareness is a prerequisite to planning. Be especially careful to evaluate your internal audit capability. Use an independent, well-qualified, external third party to provide a clear evaluation. And no, that external third party should NOT be the FDA! Be proactive in understanding your skill sets. I have seen FDA Form 483 observations for internal audit deficiencies. Usually, these are basic issues such as not doing internal audit or not having a defined schedule. But, I do recall a particularly memorable warning letter in which there were several serious deficiencies for a specific design history file. The next item on the warning letter stated that the same file had just been reviewed in internal audit, which had missed all of these serious issues. Pay attention to the process approach and process ownership. All the elements of the QMS need to work together in an aligned and harmonious manner. Lack of alignment, gaps, and overlaps in processes can create tears in the fabric of the QMS. Be watchful for signs that functional leaders do not understand or accept their responsibilities for process ownership, control, and monitoring. Lack of process ownership is one of the main causes of an ineffective and inefficient QMS. When process owners fail to understand and embrace the responsibilities of their role, problems occur. The process is not effectively translated into clear procedures. Personnel do not follow procedure consistently. Output varies. Nonconformities occur. An ineffective and inefficient process is never predictable. And ultimately that hurts business results. A very common and serious mistake, resulting in an inefficient and ineffective quality management, is failure to use the CAPA system properly. Many companies treat CAPA as a regulatory requirement rather than what it is intended to be—a robust, methodical, closed-loop process to fix problems permanently. They treat CAPA as a burdensome process that is ineffective and hard to understand. They use an IT tool that is not intuitive or easy to use. They cram everything into an overloaded bureaucratic system where everything stalls. There is lack of prioritization and governance. This is known as death by CAPA. Your CAPA program
Avoiding common mistakes
needs a CAPA. See Chapter 15, Alphabet Soup for detail on creating an efficient and effective CAPA process. Another mistake is not managing CAPA timeframes in a rigorous manner. Some companies have CAPAs that are several years old. It is possible that some CAPAs make take some time to fix properly. In particular, product design changes may take some time. But, aged CAPAs should be the exception and not the rule. Actions should be commensurate with risk! Additionally, all CAPAs that are closed as ineffective deserve management scrutiny. Very old CAPAs, and evidence of closing and replacing an old CAPA with a new CAPA, should be viewed with much suspicion. Poor root cause analysis (RCA) is another common mistake with CAPA. Sometimes RCA is limited to an obvious symptom. In that case a a quick fix only is applied. The problem may seem to go away for awhile but eventually resurfaces. Or the root cause is incomplete resulting incomplete correction and corrective action. Contributing factors remain unaddressed and result in another problem somewhere else. When doing RCA for CAPA do not make the mistake of thinking there in only one true root cause. There may be several layers of causes as well as contributing causes. For every recall, there are at least two main causes. The first is the physical cause of the defect, and the second is the failure to detect it before it escaped the quality plan and got out to the customer. Dig deeper. Ask why five times, or more, if necessary. Why was the defect not detected? An inadequate test method? Perhaps a sampling plan that is not statistically valid. Think beyond the physical cause of the failure, and also to contributing causes including poor decision making and human error. Understand if MEDICS immaturity is a contributing cause (see Chapter 8 for detail on MEDICS). Taking corrective action based on incorrect or incomplete RCA is just a waste of time and energy. It wastes already precious resources exacerbating inefficiency and ineffectiveness. For serious problems, use the rigor of your CAPA process to put permanent fixes in place! Because CAPA is such an important foundational process, an entire chapter is devoted to it. Please see Chapter 15, Alphabet Soup for details on the CAPA process. That chapter includes detail on RCA concepts and a variety of tools that are basics for knowledgeable management with executive responsibility, management representatives, and process owners. Avoid holding management review meetings too infrequently. Management needs timely and regular information to make informed decisions and prevent trends from becoming full-blown issues. Hold management review with sufficient frequency to assess real-time information, so that actions can be preventive instead of reactive. Management review only once or twice a year is not optimal. Conduct management review in a complete and rigorous manner with clear information and sufficient detail to really understand the health and suitability of the QMS. The biggest mistake of all is to ignore the warning signs of problems. Every serious Form 483, warning letter, consent decree, or significant quality problem
71
72
CHAPTER 6 Avoiding common mistakes
that I have consulted on presented warning signs ahead of time. Yet, management failed to heed the warnings. They ignored evidence and/or took unacceptable risks. They failed to provide enough resources for a suitable and effective QMS. Do not make that mistake. Pay attention to the MEDICS, the capabilities to avoid these common mistakes. They are discussed in detail in Chapter 8, Capabilities and MEDICS for an Effective QMS. Levels of maturity for the MEDICS capabilities are defined, so each medical device can assess their current state. In conclusion, these mistakes can be avoided. Death by CAPA does not have to happen. CAPA can be the rigorous, methodical process necessary for solving the company’s toughest quality problems. Use it when necessary and then use it well. Assess the MEDICS levels to avoid common pitfalls. Pay attention to the details, DO sweat the small stuff, and focus on prevention to create an effective and efficient QMS.