A New Way to Grade Findings

Last November a new GHTF document was released on the topic of grading non-conformities: GHTF/SG3/N19:2012. This document is available on the new IMDRF website in the documents section. The 16-page document presents a new method for Certification Bodies to grade non-conformities and to communicate these findings to regulators such as the US FDA and Health Canada (e.g. – GD211 voluntary reports).

To download the guidance document, go to http://www.imdrf.org/.

N19 recommends the same three-part structure for writing nonconformities that is taught in Lead Auditor Classes, and there is even a table of examples provided with poorly written findings and well-written findings with more specific references to objective evidence.

Section 4.2 of the guidance document, however, introduces a new concept for grading of findings. The traditional grading of findings is: Major, Minor, and Observations. Opportunities for Improvement (OFI) are no longer allowed in regulatory reports to avoid the appearance of providing consulting advice to clients. For internal audits and supplier audits, OFIs are still used by most auditors.

The new grading process defined by the guidance document has a two-step process. The first step uses a grading matrix to quantitatively determine a grade for the finding based upon the impact upon the QMS and the frequency of occurrence.

The second step of the grading process is to review escalation rules that are defined in Section 4.2.2 of the guidance document. This section emphasizes the importance of using the word “absence” in the wording of findings if a required procedure is not present in the QMS. This type of finding should only happen during initiate certification audits where 100% of the required procedures are typically verified during the Stage 1 audit. If this occurs, then the grading is increased by 1 to a possible maximum of 5.

Another possible escalation event is the release of nonconforming devices outside the control of the manufacturer. If this occurs, then the grading is increased by 1 to a possible maximum of 5. If the required procedure is absent, and product is released that is nonconforming, the guidance states that the score should not be escalated above a 5.

In all of the Lead auditing courses I have taught, both of the above escalation events would be examples of a “Major Nonconformity.” Repeat occurrences of nonconformities would typically be escalated from a minor NC to a major NC, but in this new method the scores could be a “2” or a “4”—depending upon the impact upon the QMS.

I have had enough trouble in the past with training auditors to consistently grade findings during audits, and this is one of the most important sections of the exam for a Lead Auditing Course. Recently I suggested that a client consider using the risk analysis matrix that they were already using for process risk analysis and apply the matrix to grading of findings. An example of this type of matrix is shown below.

My client used semi-quantitative scores for severity (1-3) and occurrence (1-4). The two factors were multiplied to calculate a risk priority number (RPN) ranging from 1-12. The resulting matrix is also color coded to indicate the urgency of corrective action plans to be developed for the finding.

Has anyone implemented a grading system based upon this new guidance? If you have, please share your experiences here or on one of the LinkedIn Groups I have posted this question:

Medical Devices: QA/RA – http://bit.ly/SG3N19-QARA

ASQ – http://bit.ly/SG3N19-ASQ

Please share you own methods for grading findings?

Advertisement

What are the 6 New Essential Requirements?

Click HERE if you want to receive future “European Regulatory Updates” by email. Just provide your Name, Company, Phone Number, and the email address where you would like to receive updates.

Annex I of the European Medical Device Directive (http://bit.ly/M5MDD) is titled “Essential Requirements.” Most companies demonstrate that their device meets the 13 Essential Requirements (ERs) by creating an Essential Requirements Checklist (ERC). I have no idea what the origin of the ERC is, but you know that regulators love tables and checklists. This particular checklist is so commonly used that the Global Harmonization Task Force (GHTF) included an example of an ERC, called an “Essential Principles Checklist” (EPC) at the end of a guidance document on how to create Summary Technical Documentation (STED) for In Vitro Diagnostic devices (http://bit.ly/STEDIVD)—which is now maintained on the IMDRF.org website.

On September 26, 2012, the European Commission released a proposal for new EU Medical Device Regulations (http://bit.ly/EUProposal). This proposal still includes ERs in Annex I, but there are 19 ERs in the proposal. One regulatory professional recently sent me a follow-up question in response to an audio seminar I conducted in November (). Her question was, “What are the six new ERs?”

A few of the early reviews of the proposal indicated that there were no significant changes, but I have learned the hard way that you should always go to the source and verify the information for yourself (i.e. – Genchi Genbutsu). Here’s what I found:

General Requirements (ER 1-6a)

1. No real change to this requirement.
2. This requirement was reworded to clarify the intent (see Annex ZA of EN 14971:2012 for more info @ http://bit.ly/ISO14971-2012changes).
3. It appears as though the Commission thought the current ER 3 was redundant and the requirement was addressed by ER 1 and ER 5 already.
4. This is now the new ER 3, and the requirement now clarifies how Notified Bodies shall apply this requirement in cases where a lifetime of the device is not stated.
5. This is now the new ER 4, and there is no real change.
6. This is now the new ER 5, and the wording has been clarified.

ER6a is conspicuously missing from the proposed ERs, but don’t get excited. Clinical Evaluations are still required as part of the Technical Documentation in Annex II, Section 6.1c: “the report on the clinical evaluation in accordance with Article 49(5) and Part A of Annex XIII.”

Chemical, Physical & Biological Properties (ER 7)

ER 7.1 has one new requirement: “d) the choice of materials used, reflecting, where appropriate, matters such as hardness, wear and fatigue strength.” ER 7.2 and 7.3 remain unchanged. ER 7.4 has been simplified to what is proposed as the new, shorter ER 9. ER 7.5 is now the new ER 7.4, and the changes reflect the current status of phthalate regulations and similar issues. ER 7.6 is now the new ER 7.5, but there is no change to the content. The new ER 7.6 requires that manufacturers address the risks associated with the size and properties of particles—especially nanomaterials. The changes associated with this section will impact certain device types more than others—such as orthopedic implants.

Infection & Microbial Contamination (ER 8)

ER 8 is still ER 8, but ER 8.1 is now prescriptive regarding design solutions and the current ER 8.2 is now the new ER 10. The new ER 10 is expanded and references the new EU Regulations regarding devices manufactured utilizing tissues or cells of animal origin: Commission Regulation (EU) No 722/2012 of 8 August 2012 (http://bit.ly/AnimalTissueReg). The new ER 8.2 is a new requirement that was an oversight of the MDD, and the new ER 8.7 now clarifies that the labeling must differentiate sterile and non-sterile versions of the product; packaging is no longer an acceptable mechanism for differentiation. The balance of ER 8 remains unchanged.

Construction & Environmental Properties (ER 9)

This ER is now identified as the new ER 11, and this section is expanded. This reflects the emphasis on the need to evaluate the safety of devices with accessories, compatibility with other devices, and the affects of the use environment.

Devices with a Measuring Function (ER 10)

This ER is now identified as the new ER 12, but ER 10.2 from the current Directive appears to be missing. What’s up?

Take a look at the new ER 11. ER 10.2 is now the new ER 11.6.

Protection Against Radiation (ER 11)

This ER is now identified as the new ER 13, but there is nothing new.

Requirements for Devices Connected to or Equipped with an Energy Source (ER 12)

ER 12.1 and 12.1a are now ER 14. This section is specific to software requirements and has more detail than the current Directive. IEC 62304:2006, “Medical device software – Software life cycle processes,” is the Standard that will be expected by Notified Bodies as a reference for ER 14. ER 12.2 through ER 12.6 are now ER 15, but there is nothing new. This Section ER 12.7 and its sub-parts are now addressed by ER 16. ER 12.8 and its sub-parts are now addressed by ER 17.

Information Supplied by the Manufacturer (ER 13)

This is now identified as ER 19: “Label and Instructions for Use.” This section is simplified from ER 13 (i.e. – there are fewer sections), but this ER does not seem to be any shorter. ER 19.1 has sub-parts a-g, and this ER section incorporates the concepts previously addressed by ER 13.1, 13.2, 13.4 and 13.5. ER 19.2 is a new and improved version of the previous ER 13.3 specific to labeling requirements. This labeling section is expanded from sub-parts “a” through “n” to “a” through “q”. The UDI requirement is sub-part “h”. ER 13.6 is now ER 19.3 specific to the instructions for use (IFU). This section is expanded from sub-parts “a” through “q” to “a” through “t”.

The number of sub-parts to ER 19.3 doesn’t reflect the additional requirements for IFUs that are proposed by the Commission. The sub-sections of this part warrant special attention. Items that frequently are found missing from IFUs on the market today include:

1. ER 19.3c – performance intended by the manufacturer
2. ER 19.3h – installation and calibration instructions
3. ER 19.3k – how to determine if a re-usable device should be repaired/replaced
4. ER 19.3m – restrictions on combinations with other devices
5. ER 19.3o – detailed warning information
6. ER 19.3p – information about safe disposal of the device
7. ER 19.3t – notice to user/patient to report adverse events

ER 18 – Use by Lay Persons

This is a short section, but the requirement is new. There are now additional requirements for products intended for use by a lay person. The Risk Management Report, Design Validation, and Clinical Evaluation Report will need to include specific evidence to demonstrate conformity with this ER. The Post-Market Surveillance Plan for these products should carefully verify the accuracy of risk estimates. Post-Market Clinical Follow-up (PMCF) Studies would be challenging in the past, but the prevalence of social media and product registration databases may facilitate conducting PMCF Studies for these products in the future.

Australia & Canada

There is also an EPC that is required by the Therapeutic Goods Administration (TGA) in Australia (http://bit.ly/EPCTGA) and by the Therapeutics Product Directorate (TPD) in Canada (http://bit.ly/CanadianSTED). If you would like to learn more about the Essential Principles of Safety and Performance you should also review the GHTF guidance document on this topic (http://bit.ly/EPSafetyPerf) on the IMDRF.org website. This 2012 version of the document supersedes GHTF/SG1/N041:2005.

I have observed approval of products where the European ERC was submitted in lieu of an EPC for Australia and Canada. I guess they are a little more rationale than some other regulators, but if you have experienced any “push back” regarding this approach please share this by posting a comment or emailing me: rob@13485cert.com.

GHTF Just Released New and Updated Documents

GHTF Just Released New & Updated Documents.

Leonard Eisner recently posted these links to new guidance documents that were released on November 2, 2012 by GHTF. These are definitely worth reading and downloading for your external Standards library.

New Draft EU Regulations may be speculation now, but the crowd knows a secret.

Right now the precise content of the new draft EU regulation is defined but unclear. We know what is going to change, but the final language of the draft is still a “work in progress.”

Therefore, I am using the theory that the “crowd mind” collectively may be more accurate than any one source–at least until the release. I started gathering information from several different regulatory experts throughout Europe and the US.

Essentially what we know is:

1. this will be a regulation instead of a directive

2. the regulation will have a similar structure of articles and annexes, but we can expect the document to grow

3. the device classification section will be a risk-based classification similar to the GHTF guidance (IVD’s are expected to be A, B, C, D)

4. the requirements for Notified Bodies will be stricter, but we expect rotation of lead auditors–not actual Notified Bodies

5. the unannounced audits will probably resemble factory inspections as performed by other GHTF countries

6. the vigilance requirements and post-market-surveillance are expected to become more consistent between Competent Authorities and between Notified Bodies–including the addition of PMCF Protocols and Reports becoming part of the Technical Documentation required for Design Dossiers (the CMC should help achieve this)

7. there will be new requirements for economic-operators (i.e. – importers and distributors)

8. the Authorized representative agreements will become mandatory for the Technical Documentation as well (see the new MEDDEV from earlier this year…I wrote a blog about it on my 13485cert.com website, but Erik Vollebregt wrote a much more thorough blog on this topic)

9. tougher regulation of reprocessed / re-manufactured devices

10. minimum requirements for CE Certificates–including the addition of the GMDN codes to the certificate

11. implementation is expected in 2015/2016

As I gather more information, I am thinking about just editing this posting–instead of posting a new blog.

Please email me or comment on what information you have learned or what you want to know.

If you know of a website with information posted, please share it and I will add it to this posting.

What if we harmonized one clause at a time?

The primary public database for reviewing post-market adverse events is the MAUDE Database. In May, a new bill was introduced to The House of Representatives in order to accomplish two things:

1. Amend section 505(k)(3)(C) of the FDC Act to expand the post-market risk identification and analysis system and apply the section to medical devices, and
2. To encourage the FDA to finally issue the final form of the UDI rule.

Global cooperation has always been the dream of the idealists.

The final form of the UDI rule has been issued, but what is the future of post-market risk identification and analysis?

Most healthcare companies are either drug companies or device companies—not both. The US has developed a system for approval of combination products, but Europe and the US have separate systems for addressing post-market data collection for drugs and devices. Why not use the same system for both? The frequency of reporting is usually risk-based. Why couldn’t the depth of post-market data be risk-based as well? For drug we can continue to have the full reporting requirements, but for devices the depth of reporting could be classification dependent or product code dependent.

As an interim immediate measure in response to the PIP incident, European legislators are calling for better vigilance reporting and coordination of member states on incident assessments. The intent is to reinforce market surveillance by sharing information between the national authorities to monitor adverse effects and device recalls. What about sharing with non-member states?

Another measure included in the European plan is to improve the functioning of the vigilance system for medical devices. This would include, facilitating and actively encouraging patients, healthcare professionals and other groups to report all adverse events. The US is implementing electronic medical records throughout the healthcare system. This provides a vehicle for facilitating this type of systematic reporting.

Europe continues to struggle to establish a single European database for medical devices, but what about establishing a global medical device database?

Other measures in the European plan call for the introduction of an implant passport specifying the unique product code of the implant. With the introduction of the UDI rule, all US products will eventually have a unique product code—not just implants. Wouldn’t it make sense to incorporate this bar coding system into the implant passport for Europe? This could also be integrated with the implant registry card requirements for Canada. The GHTF presented draft guidance for a medical device UDI system on November 4, 2010.

The idea behind the GHTF was to harmonize the similar initiatives around the globe. Instead, GHTF is disbanded and legislators are developing parallel requirements that have the same purpose. This doubles or triples the regulatory burden for companies, and the opportunity to identify adverse event trends globally is diminished. Regulators from the “Big 5”, the GHTF’s founding members, elected to dissolve the GHTF in order to form a new entity consisting solely of regulators. Until this group is established and effective, some ad hoc working groups are needed to fill the gap.

A globally harmonized vigilance reporting system for drugs and devices seems to be the biggest opportunity to gain from cooperation. Please share your own ideas and comments here or on LinkedIn.