Magazines & Journals
Informed Outlook

Printer Friendly
I Want To

Volume 9 · Issue 1· January 2004


Assessment and Training in the Medical Devices Industry
What Does It Take to Manufacture in a Regulated Sector

By James W. Kolka

The ISO 9001:2000 transition is completed, and organizations seriously need to review the requirements in this generic quality management system (QMS) requirements standard, whether or not they are using it, and take away lessons that will protect them from competitive pressures and risk. That is, even if your organization is not registered to ISO 9001 or a sector-specific derivative aligned with it, there are requirements in it that are critical to meet, especially in regulated sectors.

The risks that could affect a manufacturer or service provider include customer dissatisfaction, which could take the form of bad publicity or, worse, a liability situation. There is also the risk of failing to comply with regulations applicable to a given type of organization, its products/services and its employees.

Many service providers and most manufacturers must comply with federal, state and local regulations as well as equivalent legal requirements applicable in other countries where an organization offers a product, even if it is a service. As has been discussed recently in the ISO 9000:2000 Product Support Initiative’s Q&A series, regulatory requirements are cited in several clauses and subclauses of ISO 9001:2000, and it is cited for good reason.

And some industrial sectors face greater regulatory requirements than others. Unlike most manufacturers in the marketplace that must maintain compliance of their operations to avoid penalties and other problems, medical device manufacturers must achieve regulatory compliance with the US Food and Drug Administration (FDA) Current Good Manufacturing Practices (GMPs) Quality System Regulation (QSR) and related regulations before they will even be permitted to market their products in the United States.

Failure to achieve and maintain regulatory compliance while marketing and selling medical devices can result in fines, civil penalties, injunctions, recalls, seizures and criminal prosecution. The European Union (EU) and other regions of the world have similar regulatory requirements that medical device manufacturers must meet to sell product in those markets.

However, the US situation is somewhat more risky, because all FDA regulatory actions are in the public domain through the Freedom of Information Act (FOIA). Consequently, FDA imposition of regulatory sanctions on a medical device manufacturer can also have a direct impact on the manufacturer’s credibility, integrity and financial stability in the consumer and shareholder marketplace.

What does this have to do with ISO 9001 or any other QMS standard, since FDA’s QSR does not involve ISO 9001 or other registration? A manufacturer of medical devices must demonstrate critical capabilities to operate and sell regulated devices in the United States, specifically:

  1. Compliance of facility operations and processes with FDA’s QSR CFR 820 and related FDA regulations
  2. Personnel capable of manufacturing medical devices in compliance with the QSR.

What is critical about the QSR and other regulatory situations facing medical device manufacturers? The fact is that, although the QSR was written to provide the equivalent requirements of ISO 9001:1994 without adopting its verbatim language, it nevertheless was written as if FDA intended these manufacturers to conform with Subclause 6.2.2, Competence, Awareness and Training. The QSR requirements hold Top Management of a medical devices manufacturer accountable for providing adequate resources to its production operations, including the assignment of trained personnel for the management of those operations, the performance of work and assessment activities.

The QSR was published October 7, 1996, in the Federal Register. And, to paraphrase the QSR, hiring procedures and training alone cannot assure that employees know their assigned responsibilities for quality and safety. Only knowledge assessment can accurately document what employees know or have learned from their training.

Therefore, even if your organization is not using ISO 9001:2000 or ISO 13485/88, which provides QMS requirements specific to the regulatory environment of medical device manufacturers, it is important to consider two requirements in ISO 9001:2000 that are in the 2003 edition of ISO 13485, Medical devices—Quality management systems—Requirements for regulatory purposes, which is partially aligned with ISO 9001’s requirements:

  • The need for the organization to determine the level of competency required of personnel performing work affecting product quality, which will involve the assessment of personnel capabilities against the criteria for a given job
  • The need to take action, training or other steps, to address any shortfalls in personnel competency identified as a result of assessment, the production of nonconforming product or the identification of nonconformities.

If your organization is not in a highly regulated sector, it may still find it useful to understand the importance of assessing personnel competency and taking steps to train those personnel who do not possess the required competency for a given task.

If your organization is a medical device manufacturer or supplies another industry where regulatory enforcement is a risk, but where there is a general sense that being caught with a noncompliance is unlikely to happen, it would be wise to reconsider the risk your organization is taking in its complacency. What follows is an educational look at the medical devices sector and regulatory enforcements in this sector and what it indicates about the need for an effective QMS in any organization.

Regulatory Enforcement
Is regulatory enforcement a risk factor that is unlikely to affect more than a few medical device manufacturers or is it a potential event that should be avoided through effective management of an organization’s QMS, including maintaining the competency of all employees who affect product or process quality?

Table 1. FDA Enforcement for FY 2002
FDA Enforcement Activities
Medical Devices


Total Inspections
2,490 2,585

Import Samples
1,279 362

Domestic Samples
385 1,712

FDA-483 Letters
633 756

Warning Letters
285 107
Seizures 2 3

1* 5†

Civil Money Penalty
1 1
Recalls 1,454

*Injunction. †Prosecutions.

Tables 1 and 2 at the end of this article contain data from Fiscal Year (FY) 2002 that has been published by the FDA in different reports and presentations. Table 1 is actually a compilation of two fairly comparable lists, although some variation exists in the specific items identified.

For instance, the enforcement activities when QSR noncompliances are found involving medical device manufacturers are injunctions while the activities when GMP noncompliances are found involving pharmaceutical manufacturers are prosecutions.

Table 2 shows the impact of these enforcement activities in monetary and criminal prosecution terms. The FDA’s web site does contain a summary of the different types of regulatory activities taken (

Note that few of these enforcement activities involved actual nonconforming product, which is the goal of FDA’s inspections since human health and lives depend on preventing nonconforming product from entering the marketplace. However, to help you understand the ramifications of the story Tables 1 and 2 present, I will provide an examination of one entry that is the same for both medical devices and pharmaceuticals in Table 1—warning letters—which any organization should hope never to receive, even though it does not often lead to the results in Table 2.

Table 2. FDA Penalties and Sanctions for FY 2002
Total Fines Levied $24,027,549
Asset Forfeitures
Criminal Cases:



Tables 1 and 2 give you an idea of the magnitude of regulatory enforcement activities by FDA involving medical device and pharmaceutical manufacturers, including the fact that the FDA had to issue 272 warning letters to pharmaceutical manufacturers and 107 to medical device manufacturers because of GMP/QSR noncompliances or potential noncompliances identified during inspections or sampling. Because of the correlation between the QSR and QMSs conforming with ISO 9001:1994 and ISO 13485:1996, I will look at the situation involving medical devices warning letters.

Each medical devices warning letter generally starts with the following statement:

Devices are adulterated within the meaning of section 501(h) of the Act (Federal Food, Drug and Cosmetics Act) in that the methods used and, or the facilities or controls used for manufacturing, packing, storage, or installation are not in conformance with the Quality System/Good Manufacturing Practice (QS/GMP) for Medical Devices Regulation, as specified in title 21, Code of Federal Regulations (21 CFR), Part 820.

In other words, the letter warns the recipient not to assume it is only responsible for items listed in the warning letter. Although a warning letter will refer to specific devices, if FDA happened to miss some noncompliant situation or devices in an inspection, the manufacturer is still accountable.

Warning letters require a written response within 15 days of receipt, and the response must identify the specific steps taken to correct the violations, including an explanation of each step taken to prevent the recurrence of similar violations. Warning letter recipients should anticipate follow-up FDA inspections to determine if the violations have been resolved effectively. It is important to note the qualifications of personnel—that is, the fact that one or more employees are not qualified for their job responsibilities by assessment against job criteria and adequate training—are one of the top 10 reasons for the issuance of warning letters.

In some cases, the need for training is implied in the warning letters, while in other cases it is made quite specific. In either case, FDA states at the conclusion of each letter:

This letter is not intended to be an all-inclusive list of deficiencies at your facility. It is your responsibility to ensure adherence to each requirement of the Act and regulations. The specific violations noted in this letter and in the FDA-483 issued at the close of the inspection may be symptomatic of serious underlying problems in your firm’s manufacturing and quality assurance systems.

As noted above, FOIA makes these letters available for public review—in fact, they are posted on the Internet ( Listed below are selected quotations from five recent FDA warning letters to the Chief Executive Officer or President of a medical device manufacturer regarding QMS failures concerning personnel:

  1. ConMed Corporation (May 8, 2003)—“Failure to establish procedures for identifying training needs and to ensure that all personnel are adequately trained to perform their assigned responsibilities, as required by 21 CFR 820.25(b).”
  2. ElectraMold, Inc. (August 11, 2003)—“Failure to adequately train personnel to perform their assigned responsibilities. [21 CFR 820.25(b)] Specifically, no quality or manufacturing employees had been trained on the quality system regulations.”
  3. Enviropak, LLC (August 5, 2003)—“The inspection revealed no quality system procedures [21 CFR 820.20(e)], inadequate employee training [21 CFR 820.25(b)]…”
  4. MagnuVu (July 11, 2003)—“Procedures for identifying training needs have not been followed [21 CFR 820.25(b)]. Specifically, employee training needs were not addressed and training was not documented.”
  5. Electro Surgical Instrument Company (May 21, 2003)—“Failure to establish procedures to identify training needs. Training is not documented. [21 CFR 820.25(b)]”

What Makes Training Such a Problem?
If you are surprised by the samples of medical device manufacturers cited for training noncompliances, consider the fact that these are organizations in a highly regulated industry. Taking it further, consider what is likely occurring in organizations that are not in highly regulated sectors, even when ISO 9001:2000 is being used. Why has training been a problem for medical device manufacturers? Based on my examination of the enforcement actions taken by FDA and of the nature of the sector, I have identified four reasons that contribute to the situation:

  • The FDA QSR is relatively new. The full regulation only went into effect in June 1998.
  • The QSR’s QMS approach, patterned after ISO 9001:1994 and ISO 13485:1996, creates a stronger regulation by placing greater responsibility on Top Management to control an organization’s operations, including personnel performance.
  • A major reason for FDA’s adoption of the QSR was to require manufacturer accountability for the design of medical devices and for personnel assessment and training for all phases of the design, manufacture and distribution of medical devices.
  • The medical devices industry is not familiar with how to test employee knowledge (i.e., what they know and what they have learned from training). As a consequence, there is no accurate record of employee knowledge concerning FDA’s QSR and their job responsibilities.

The real issue may be the lack of understanding of assessment of personnel competency. Before it is possible to effectively train an employee in any type of organization, it is necessary to understand what he/she knows and does not know in order to develop an effective training strategy. This requires a diagnostic assessment of each employee, which is a challenge given the constant movement of personnel in and out of the workforce and from one organization to another.

Therefore, it is necessary to use an assessment methodology capable of testing employees throughout the year and not simply to hold periodic training sessions and declare that the training has been successful in making each employee competent to perform his/her job based on knowledge of the job and what it involves.

On the other end of the assessment and training process, outcomes measurement is the only effective way to determine success. But where can an organization learn more about outcomes testing? For medical device manufacturers, a good source of information are the hospitals and health care organizations to which they sell product.

Under pressure from the Joint Commission for the Accreditation of Health Care Organizations (JCAHO) and the US Occupational Safety and Health Administration (OSHA), hospitals and health care organizations have become quite adept at testing their employees’ competence and identifying areas of weakness to be addressed by training.

When JCAHO auditors visit a hospital, they draw random samples of employee files to determine if competence testing is occurring and improving employee performance. It is the same approach used by FDA auditors when visiting medical device manufacturers. Outcomes measurement will vary by the nature of the jobs being tested for and the regulations and QMS requirements that apply to the organization and the employee.

What are the benefits of effective employee assessment? For medical device manufacturers, benefits include the ability to:

  • Demonstrate compliance with FDA regulations
  • Avoid FDA citations, fines, civil and/or criminal penalties
  • Avoid/Minimize product liability lawsuits
  • Create knowledgeable employees who are quality- and safety-conscious.

The Consequences of Failure to Ensure Competence
No organization wants its employees to be incapable of doing their jobs effectively, but many organizations fail to ensure the competence of their employees, either because they don’t know how to assess what a specific job entails and what an employee needs in terms of training or other assistance to eliminate any competency gaps or because conducting such assessments and customizing training and other actions is too difficult.

Yet, such actions are required by the FDA’s QSR and by ISO 9001:2000 for organizations outside the medical devices sector. Competence is an absolute requirement in the medical devices field and should be pursued as a continual improvement opportunity in all other fields, if for no other reason than to eliminate a risk to an organization.

Take the example of Guidant Corporation. In July 2003, FDA charged Guidant Corp. with 10 felony counts and fined the medical device manufacturer $94 million for 12 deaths and 57 emergency surgical repairs that Guidant never reported to FDA. Guidant admitted to covering up 2,628 instances in which the device malfunctioned or was associated with serious injury or deaths between 1999 and 2001.

Often, when the delivery part of the device lodged in a patient’s body and could not be removed, company sales representatives—present in the operating room—would advise doctors to break the handle of the device and pull it out piece by piece. This often resulted in the need to conduct emergency surgery.

Again, here is a lesson to be learned by any organization trying to do things correctly: Even though they often are a cause for litigation, sales representatives for medical device manufacturers are rarely assessed or trained on FDA’s QSR regarding their responsibilities for quality and safety.

FDA regulatory actions are available through FOIA. Guidant and its sales representatives are now being sued in multiple global lawsuits. There are several web sites of plaintiff attorneys that provide a few examples (

In conclusion, it is necessary for medical device manufacturers to develop a strategy that assesses employee knowledge of:

  • FDA’s QSR relating to their job responsibilities
  • Quality and safety issues relating to their job responsibilities
  • Awareness of device defects that may occur from improper performance of their jobs
  • Defects and errors that may be encountered as a part of their job functions
  • Health, cleanliness, personal practices and clothing required if contact between employees and the product or environment could be expected to have an adverse effect on product quality.

It is clear that the rapid change of personnel in and out of the workforce, combined with the increasing complexity of employee responsibilities and FDA’s regulatory expectations of Top Management, necessitate the ability of a medical device manufacturer to conduct and document employee assessments on a continual basis.

While training can be conducted In-House/On-Site or externally, assessment of employee competence and training needs will require many organizations to have access to special educational expertise that is not cost-effective to maintain In-House/On-Site when the organization’s Human Resources Department lacks significant depth.

Such assessment is critical in the medical devices sector for training to be effective in complying with the QSR. In other fields, employee assessment and outcomes assessments may be valuable tools to help improve employee productivity and to continually improve the effectiveness of the QMS and the product the organization delivers to the customer.

James W. Kolka, PhD, JD, is an international legal consultant and President of QLex International, LLC, Forensic & Preventive Legal Services. He is also involved in the creation of Knowledge Testing Services, Ltd., of Metro Atlanta, GA. His professional experience spans more than 30 years in the education and legal fields. During the past 12 years, he has developed a comprehensive Forensic & Preventive Law Program that utilizes both ISO 9001-conforming QMSs and ISO 14001-conforming EMSs to reduce product, services and environmental liability for companies in the US and EU markets. Dr. Kolka has developed training materials and consulted with US and EU medical device manufacturers on regulatory compliance for both markets. He has conducted more than 300 seminars and workshops for Asian, European, Latin American and North American companies and has written more than 250 articles and five books on the topics of liability, EU Directives, technical standards, ISO 9000 and ISO 14000, including more than 30 articles, chapters and presentations on FDA’s QSR and more than 50 articles and a book on the EU’s CE-marking medical devices directives. As a senior administrator at the University of Wisconsin, Dr. Kolka developed the University’s Adult Extended Degree Program and has also served on the American Council on Education’s National Commission on Educational Credit and Credentials and was instrumental in creating the Center for International Standards and Quality (CISQ) at Georgia Tech. Dr. Kolka can be reached by e-mail ( to learn more about Knowledge Testing Services, Ltd., or to pursue matters discussed in this article.