Corrective and Preventive Action In Medical Device Manufacturing
ISO 9000 made more rigorous to ensure a robust system
by Les Schnoll
Representatives of the U.S. Food and Drug Administration (FDA) have been very active on several ISO 9000 technical committees, including TC 176 and TC 210. The regulatory requirements for medical devices, previously known as the good manufacturing practices, were revised in 1995 to more closely emulate ISO 9001:1994. These revisions to 21 CFR (Code of Federal Regulations) 820 were renamed the Quality System Regulation (QSR).
With the advent of the QSR, the inspection methodology used by the FDA was also changed. The agency adopted the quality system inspection technique (QSIT) for most of its routine regulatory inspections. Again, the philosophy behind this change was based on a review of the system rather than on an investigation of compliance to the letter of the regulation.
The ISO 9001 international quality management standard was not adopted verbatim for a variety of reasons, the most critical being the FDA believed--and rightly so--several of the elements in the standard were not quite rigorous enough for the purpose of ensuring a robust system for the products the agency regulates.
One crucial element that was strengthened was the need for a system (or subsystem) to monitor the effectiveness of actions implemented to resolve past or potential nonconforming conditions. This subsystem, known as corrective and preventive action (CAPA), has become of ever increasing importance and value. The requirements for this subsystem are identified in 21 CFR 820.100.
Within its documented quality (and regulatory compliance) system, a medical device manufacturer should have a high-level procedure that describes its CAPA program. The basic sections of this procedure are described in this article.
Purpose and scope of CAPA
The purpose of a CAPA subsystem is to collect and analyze information, identify and investigate product and quality problems, and take appropriate and effective corrective and preventive action to prevent their recurrence.
Figure 1 depicts the scope of activities generally encompassed within the corrective and preventive action subsystem under the QSIT.
CAPA should be viewed as an umbrella system that allows a company to assess its entire program. The scope of any corrective and preventive action system must include the verification or validation of corrective and preventive actions.
Additional elements include communicating corrective and preventive action activities to those responsible, providing relevant information for management review and documenting those activities. These activities are essential in dealing effectively with product and quality problems, preventing their recurrence and preventing or minimizing device failures.
Under the CAPA umbrella, the organization should include all activities and processes taken to eliminate the causes of potential nonconforming products, processes and conditions within its documented quality system. For most manufacturers of medical devices, these activities include their methods for:
- Complaint handing (21 CFR 820.198).
- Medical device reporting (21 CFR 803).
- Reports of corrections and removals (21 CFR 806).
- Product recalls (21 CFR 810).
- Postmarket surveillance (for companies assessed under the Medical Device Directive 93/42/EEC from the European Economic Community).
- Quality audits (21 CFR 820.22).
- Nonconforming products, processes and conditions (21 CFR 820.90 for nonconforming products).
- Device tracking, as appropriate (21 CFR 821).
Responsibilities and authorities
Assignment of responsibilities and authorities for the corrective and preventive action system (see the sidebar, "Key Definitions") will vary among companies, primarily as a result of organizational structure. In a hypothetical organization, let's make the following assignments to department management, quality department personnel and everyone else in the company.
Department management is responsible for:
- Maintaining overall responsibility for management of corrective and preventive action activities in areas of responsibility.
- Responding to identified nonconforming conditions within defined time periods and with complete information to describe the planned (and actual) corrective actions taken.
- Assigning appropriate personnel and other resources to develop and implement corrective and preventive action plans.
- Ensuring implemented corrective and preventive actions are completed, effective and documented.
- Notifying quality department personnel of the corrective and preventive action resolutions.
Quality department personnel are responsible for:
- Maintaining a listing or database of nonconformance reports and the identified corrective actions.
- Maintaining a listing or database of identified preventive actions.
- Performing periodic statistical analyses (for example, trend analyses) of identified nonconforming conditions.
- Reviewing corrective and preventive action documentation for timeliness.
- Coordinating verification of corrective and preventive actions by the assigned personnel.
Company personnel are responsible for reviewing and implementing corrective and preventive action procedures and changes that impact their positions.
CAPA inspection objectives
When the corrective and preventive action system is assessed during a QSIT inspection, investigators focus on the following 10 key activities:
1. Verify the CAPA system procedures that address the requirements of the quality system regulation have been defined and documented.
2. Learn whether appropriate sources of product and quality issues have been identified and confirm data from those sources are analyzed to identify existing product and quality issues that may require corrective action.
3. Determine whether sources of product and quality information that may show unfavorable trends have been identified and confirm data from those sources are analyzed to identify potential product and quality issues that may require preventive action.
4. Challenge the quality data information system and verify the data received by the CAPA system are complete, accurate and timely.
5. Verify appropriate statistical methods are employed where necessary to detect recurring quality issues and determine whether results of analyses are compared across different data sources to identify and develop the extent of product and quality problems.
6. Using sampling tables, determine if failure investigation procedures are followed and that the degree to which a quality issue or nonconforming product is investigated is commensurate with the significance and risk of the nonconformity. Investigators will also determine if failure investigations are conducted to determine root cause, where possible, and verify there is control for preventing distribution of nonconforming product.
7. Using sampling tables, determine whether appropriate actions have been taken for significant product and quality issues identified from data sources.
8. Determine whether corrective and preventive actions were effective and verified or validated prior to implementation and confirm corrective and preventive actions do not adversely affect the finished device.
9. Using sampling tables, verify that corrective and preventive actions for product and quality issues were implemented and documented.
10. Determine whether information concerning nonconforming product, quality issues and corrective and preventive actions has been properly disseminated (this includes distribution for management review).
The CAPA system should be designed to include actions needed to correct nonconforming product and other quality problems (correction), prevent recurrence of nonconforming product and other quality problems (corrective action), and eliminate the cause of potential nonconforming product and other quality problems (preventive action).
In most cases, a process approach can be followed to ensure the system captures the required information using appropriate sources of data and is effective. The concepts utilized in this approach are:
- The CAPA system procedures address the regulatory requirements and quality system standards.
- Management has provided definitions and interpretation of words or terms.
- Existing and potential problems are identified (quality data sources are identified and data from those sources are analyzed). Data are complete, accurate and analyzed in a timely manner.
- Statistical and nonstatistical techniques are used to detect recurring quality problems. Results of analyses are compared across different data sources and used to identify and develop the extent of problems.
- Failure investigation is adequate (procedures are followed and the investigation is commensurate with the significance and risk of the nonconformity). Where possible, the root cause has been identified.
- Product is controlled to prevent distribution of nonconforming product.
- After root causes are identified, appropriate corrective and preventive actions are taken. Actions are verified and validated, are effective and do not adversely affect the finished device. Corrective and preventive actions are documented.
- CAPA information is disseminated to individuals directly responsible for assuring product quality and preventing quality problems.
Sources of data
Data to be included in a CAPA system come from a variety of sources, both internal and external. Some sources of internal data include:
- In-process and final inspection and test data.
- Scrap and yield data.
- Process control data.
- Incoming component testing and inspection test data.
- Equipment data (preventive maintenance, calibration).
- Internal audits.
- Device history records.
- Training records.
- Change control records.
- Rework and reprocessing.
- Nonconforming materials reports.
Some sources of external data include:
- Complaints--customers, employees, MedWatch (the FDA's medical products reporting program), field service reports, journal articles, information from the FDA and other regulatory bodies.
- Warranty reports.
- Legal claims.
- Study reports.
- Third-party audits.
Corrective action procedures
Documentation of the identified nonconforming product, process or condition should be performed according to the organization's documented procedures. After being informed of the identified nonconformance, responsible personnel then assign appropriate personnel to investigate the nonconformance and identify its root causes. Representatives from other functions may be used.
Once the investigation is completed, appropriate meetings, discussions and training sessions are held with department personnel and other groups whose activities may be impacted by the investigation and corrective action implementation.
The identification of the root causes (established, in part, by failure analysis, when appropriate) is indicated on the company's appropriate documents. The documents are completed, returned to the individuals who identified the nonconformance and then reviewed according to the process described in documented procedures.
Once the corrective action has been verified as implemented, the documents are forwarded to quality department personnel, who enter the corrective action information into the database for future statistical analysis.
Preventive action procedures
As a result of identified nonconformances (for example, identified through trending) and effective corrective actions, an individual may decide to implement a similar action to prevent the occurrence of a nonconforming condition.
If department management identifies and approves a preventive action plan, it should also initiate documentation. The preventive action plan and associated documentation are described on the report form. Once the preventive action plan is accepted, the initiator verifies implementation and effectiveness.
Documentation of preventive action is forwarded to quality department personnel for entry into the database and possible subsequent statistical analysis.
Finally, records of corrective and preventive actions are maintained in accordance with the company's defined process for control of quality records.
21 CFR 803, Medical Device Reporting, April 2001.
21 CFR 806, Medical Devices, Reports of Corrections and Removals, April 2001.
21 CFR 810, Medical Device Recall Authority, April 2001.
21 CFR 820, Quality System Regulation, April 2001.
21 CFR 821, Medical Device Tracking Requirements, April 2001.
Guide to Inspections of Quality Systems, August 1999.
LES SCHNOLL is director, quality assurance, for Gliatech Inc., Cleveland, OH. He is a member of ISO/TC 176 and ISO/TC 210 with more than 25 years experience in quality assurance and quality control, auditing, regulatory compliance, management and microbiology in medical, pharmaceutical, preclinical and clinical laboratory and food areas. Schnoll is the author of two books published by Paton Press: The Regulatory Compliance Almanac--A Guide to Good Manufacturing, Clinical and Laboratory Practices and The CE Mark: Understanding the Medical Device Directive.
Schnoll replaces Joe Tsiakals, who is unable to continue as one of QP's "Standards Outlook" columnists. We thank Tsiakals for his past contributions.