Regulatory Nightmares

Is a retrospective activity worth the cost and aggravation?

by Les Schnoll

"Do it right the first time" is a mantra often used by quality professionals. In the associated world of regulatory affairs and compliance, this adage also represents an appropriate mindset.

Throughout my career, first as an employee and currently as an independent consultant, I have seen far too many times when this slogan was not taken seriously. While I could provide countless examples on the quality side, for purposes of this article I’ll concentrate on the impact of retrospective regulatory activities required because organizations and their management did not do it right from the beginning.

The number of potential regulatory disasters is quite large, but I have my own list of the top five nightmares that illustrate my point. Of course, organizations’ specific names have been eliminated to protect the guilty.

Nightmare No. 1: "I didn’t know my products were considered drugs or devices."

This lapse of judgment has significant implications, all of which could result in the affected products being considered misbranded and adulterated—and potentially recalled.

Consider this not-so-hypothetical scenario: A manufacturer of a class II medical device, which requires a 510(k) premarket notification submission,1 has distributed its product into U.S. interstate commerce and into other countries, including Canada, Europe and Australia. There is not a quality system in place—the organization did not know that it needed one. In addition, the organization has not trained its employees, and it does not have a registration and listing, device master record (DMR), design history file (DHF) or 510(k) submission.

Without these items, the product is adulterated and misbranded. In Canada, without complying with the registration and quality system requirements, Health Canada can mandate a recall. In the European Union (EU), failure to comply with the applicable medical device directive also can result in significant penalties.

During my career, I have seen this situation numerous times. Theoretically, the U.S. Food and Drug Administration (FDA) would be well within its authority to require that the organization recall all of the products it ever manufactured. Many times, however, the agency exercises enforcement discretion and allows the products to remain on the market if the organization complies with all regulatory requirements within a reasonable period of time.

After the organization meets its obligations, virtually everything must be created retrospectively. If you have ever been in a situation like this, you know that corrective action is not easy. While it is relatively simple and straightforward to develop the quality system, and to register and list the facility and manufactured medical devices, it is not a pleasant task to retrospectively create a DMF, DHF or technical file for the EU.

Developing and submitting a 510(k) takes significant time and can be expensive. The delays required to restart sales could range from several months to more than one year. During this period, the organization faces a negative cash flow—nothing is coming in, but expenses to implement the corrective actions are ongoing.

My advice to the small entrepreneur who wants to enter the regulated arena: Be sure you know what you’re getting into, research the regulatory status of your products and if you’re not positive about the status, hire someone who can help you before you get yourself into serious trouble.

Nightmare No. 2: "I didn’t audit my key subcontractors before using them."

While the following paragraph is an excerpt from a case study I use in my auditor training program, it is, unfortunately, not too far from the truth in a few organizations I’ve visited.

"The buyers are in control and knowledgeable about what is happening. As such, suppliers are approved by the buyers, and the company always gets credit for rejected materials."

Regulatory requirements for approval of suppliers for medical devices can be found in the FDA’s Code of Federal Regulations Title 21 (21 CFR), Section 820.50—Purchasing controls. It states that manufacturers "shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors and consultants."2 Simply being knowledgeable buyers isn’t enough.

For the unfortunate organizations that must retrospectively assess their suppliers’ capabilities, especially for services and components considered to be critical to the products, there can be disastrous consequences, including recall of marketed products and being forced to stop marketing the existing product until a suitable replacement supplier is identified and approved. 

Once, I audited a supplier of a patient-contact accessory to a medical device. The product was manufactured in a facility in China that was filthy, infested and completely unsuitable for manufacturing any product, let alone a medical device. Prior to my audit, no one from the company had visited the facility—the deciding factor had been that it was cheaper to purchase from that supplier than from any other subcontractor. 

Needless to say, my client was not happy with my report, probably preferring to remain clueless and continue on as is. The end result was that the approved supplier was disapproved and the product was taken off of the market. Extensive testing provided the organization with sufficient data to preclude the need for a product recall.

Nightmare No. 3: "What is process validation and what does this have to do with me?"

Process validation, as required by 21 CFR Section 820.75, is a project that can keep a team busy for months. 

Validation is required when "the results of a process cannot be fully verified by subsequent inspection and test."3 This means unless the organization performs 100% inspection and testing (meaning the process is fully verified), the process must be validated. Not completing this activity once again results in adulterated products.

Regulatory agencies expect that validation activities are prospective, or they are completed before the first unit of product is distributed. The excuse of "I didn’t know" or "No one told me that I had to," just doesn’t cut it. For those organizations, their only out is to perform a concurrent or retrospective validation, both of which are frowned on by the FDA.

Concurrent validation is considered by many to be medium-risk mitigation to a regulatory violation; retrospective validation is considered by those same people to be high risk. I think both are high risk.

Concurrent validation is basically continuing to manufacture product and put it into interstate commerce while using the next three lots or batches to perform the validation. "Not too bad," some may say. The organization is moving forward to resolve the issue, so the opinion is that this is a medium-risk activity.

But think about it a bit more: Yes, the organization is taking action—but what happens if the validation fails and the failure warrants a product recall? All the organization has achieved is putting more products into the market that must be recalled, increasing its costs and creating an administrative nightmare—not a very good solution.

Retrospective validation is performed using historical data to attempt to validate the process. The data may show the process is acceptable, and because the organization didn’t know it was regulated to begin with, what are the odds the data and records are less than impeccable?

Either way, there are hurdles to overcome, including ongoing suspicions by the FDA that tighter scrutiny may be warranted for those organizations for the foreseeable future.

Nightmare No. 4: "We can’t find our DMR."

It doesn’t matter whether your medical device is a tongue depressor, intraocular lens or volume ventilator—a DMR is not optional. The requirement in 21 CFR Section 820.181 is clear: "Each manufacturer shall maintain device master records."4

The DMR is the recipe for the device and includes everything needed to manufacture, test, inspect, package, label, store, sterilize (if applicable), service and distribute the product. Not having one results in products being adulterated.

Not realizing the DMR is needed and creating one retrospectively is not a big deal—it just takes time to gather the information—assuming the information is available to gather—and putting everything into an acceptable format. Not realizing that this key document is needed does nothing to help the organization’s relationship with the FDA, but it is something that can be overcome with time.

Having a DMR at one time and losing it is another matter. A former employer had a DMR for an obstetrical monitoring system manufactured at one of its facilities. While document management was generally pretty good at this organization, for some unknown reason, the only copy of the DMR for this device was stored on the hard drive of an engineer’s desktop computer, which was never backed up anywhere.

For reasons still unknown, more than 10 years after the fact, the hard drive on this computer was reformatted and the DMR and everything else ceased to exist. Four years and about $7 million later, the DMR was retrospectively recreated and the organization began to sell the product again. During the time it took to resurrect the DMR, the organization could not distribute the product.

Nightmare No. 5: "Our employees have been with us forever and don’t need to be trained."

21 CFR Section 820.25(b) of the quality system regulation requires that manufacturers "identify training needs and ensure that all personnel are trained to adequately perform their assigned responsibilities."5 In addition, all training must be documented.

If an organization’s seasoned employees were adequately trained and the training was documented, it may be OK—partially. However, because the FDA considers training in the regulatory requirements, such as the quality system regulation or the good manufacturing practices (GMP), to be required training and the organization didn’t know it was regulated, that training probably never took place.

My favorite warning letter of all time—because I never worked or consulted for the organization—was one issued by the FDA Atlanta district office in 1998. The letter includes descriptions of violations with respect to training:

You have failed to assure that each person engaged in the manufacture, processing and packaging of your drug products has the education, training and experience to enable that person to perform their assigned functions. No one at this facility exhibited a basic knowledge or understanding of the GMPs.

Your quality control manager stated that he had never read the GMPs. No employee involved in the production of your drug products had been trained in GMPs. The laboratory technician responsible for performing microbiological testing had received no training in microbiology.6

Seldom does the FDA reach a conclusion about the cause of a violation in its warning letters, but in this case, it did:

This lack of training and understanding could possibly explain the confusion exhibited by key personnel at your firm about which products at your firm should be considered as drug products.7

How would you like to be the CEO of this organization and open this letter from the FDA first thing in the morning?

You should know

I’m not sure who first came up with the statement, "You don’t know what you don’t know," but in the world of regulatory affairs, what you don’t know may just be the tip of the iceberg. In the continuum of knowledge (or lack thereof), you might use the following sequence:

  1. You know.
  2. You don’t know.
  3. You know what you don’t know.
  4. You don’t know what you don’t know.
  5. You don’t know what you don’t know you don’t know.

There are consequences associated with each of these statements, but regulatory agencies really don’t care that you don’t know—ignorance is not an excuse in their eyes.

It does not matter if your regulated product is a medical device, drug, biologic, food or cosmetic—before you get into a business regulated by the FDA, you must fully comprehend what you’re getting into. Failure to do your homework can result in serious consequences for your organization, employees and patients.

References and note

  1. 510(k) is a premarket submission made to the U.S. Food and Drug Administration to demonstrate the device to be marketed is at least as safe and effective, that is, substantially equivalent, to a legally marketed device that is not subject to premarket approval. Find more information at www.fda.gov/medicaldevices/
  2. U.S. Food and Drug Administration, Code of Federal Regulations Title 21, Section 820.50—Purchasing controls, revised April 1, 2013.
  3. U.S. Food and Drug Administration, Code of Federal Regulations Title 21, Section 820.75—Process validation, revised April 1, 2013.
  4. U.S. Food and Drug Administration, Code of Federal Regulations Title 21, Section 820.181—Device master record, revised April 1, 2013.
  5. U.S. Food and Drug Administration, Code of Federal Regulations Title 21, Section 820.25—Personnel, revised April 1, 2013.
  6. Letter from Ballard H. Graham, director of U.S. Food and Drug Administration Atlanta district office, to Medical Packaging Technologies Inc., Aug. 18, 1998, www.fda.gov/
    (case sensitive).
  7. Ibid.

Les Schnoll has more than 35 years of experience in industries regulated by the Food and Drug Administration (FDA). He is a senior member of ASQ and an ASQ certified quality engineer, auditor and manager. A former member of the U.S. technical advisory group to ISO technical committee 176, Schnoll wrote The Regulatory Compliance Almanac (Paton Press, 2001, 2008). He is currently the principal of Quality Docs, LLC, providing quality and regulatory consulting services to FDA-regulated industries. He also teaches several courses in master’s degree programs in regulatory affairs at Arizona State University and Northeastern University.

Average Rating


Out of 0 Ratings
Rate this article

Add Comments

View comments
Comments FAQ

Featured advertisers