Content Deviation #5: Risk Control Options
ISO 14971: 2007 requires the manufacturer to “use one or more of the following risk control options in the priority order listed:
(a)  inherent safety by design;
(b)  protective measures in the medical device itself or in the  manufacturing process;
(c)  information for safety”
but does not require that all three options be used; instead ISO 14971: 2007 implies that once the risk has been reduced As Low As Reasonably Practicable then further risk control measures need not be taken.
In contrast, Annex I of the Medical Device Directive 93/42/EEC requires the manufacturer “to select the most appropriate solutions” by applying cumulatively what has been called “control options” in ISO 14971. The MDDs do not regard these control mechanisms as options or alternatives but as three separate control mechanisms that must be applied in consort to reduce the associated risk as far as possible.

It must also be remembered (as outlined in our previous newsletters) that the manufacturer must not stop reducing a risk when it has reached an acceptable level, but that the risk must be reduced as low as possible irrespective of the risk magnitude. When complying with the Medical Devices Directives the only justifications for not implementing a control are that either the control in question will not reduce the risk any further or that it may give rise to a new risk which is less desirable than the risk which it is intended to control.
It can therefore be concluded that risk acceptability has no impact upon whether or not risk controls are necessary. Traditional FMEA-based methods of risk analysis have included an evaluation of the risk – both before and  after the implementation of risk controls measures. Under ISO 14971: 2012 and the MDDs there is no need to perform a risk evaluation prior to the implementation of risk control measures. However, manufacturers may still want to show in the FMEA the effect of risk control measures on the RPN in order to support their claim that the risk has been reduced as far as possible. Therefore it may be a good idea to leave the before and after RPN calculations in the FMEA document but to omit any reference to the acceptability or otherwise of the risk in question prior to the application of control measures. Many risk management procedures that are based on the 2007 version of the standard contain a flowchart describing the risk management process; the preliminary risk evaluation step should be removed from the flowchart in addition to removing it from the risk management procedures and the FMEA, templates and records.

The impact of Content Deviation # 5 is to require the manufacturer to implement multiple control measure whereas in the past, one control measure may have been considered sufficient. For example; a manufacturer of a device which incorporates a heating element may have previously considered that the design of the device was sufficient to minimise the possibility of the device overheating and therefore the risk to the patient had been reduced to an acceptable level. Such a manufacturer is required under the MDD to explore means of protecting the patient from overheating in the (unlikely) event that it occurs and to consider including a warning in the IFU detailing the risk of possible device overheating, and the precautions to be taken. In many cases the manufacturer will already have done both of the above, but a review of a company’s risk analysis documents such as FMEAs will almost inevitably reveal risks for which the application of all three types of control measures has not been considered. Additionally, the manufacturer must explore if there are any further design controls necessary to reduce the risk as far as possible (and not just to an acceptable level).

The outcome of actions taken to deal with Content Deviation # 5 will mean additional design controls, increased protective measures and alarms, and longer, more detailed IFUs. However, additional measures must only be taken if they will actually reduce risk and will not give rise to additional or alternative risks that are equally or more undesirable.
In order to comply with Content Deviation # 5, manufacturers must do the following;

• Revise risk management procedures to require that all three types of risk control are utilised. Remove the risk management process step of risk evaluation prior to the application of risk control measures.
• Review and update risk management documentation to ensure that all three types of risk control measures have been applied and that risks have been reduced as far as possible.
• Review the information given to the user and in particular the IFU to ensure that all information that is necessary for reducing risk as far as possible, has been given to the user in a manner that is easily understood and can be easily acted upon.

In this newsletter we looked at the implications of Content Deviation # 5 and the requirement of the MDDs to implement all three types of control measures; design controls, protection measures and the giving of information to the user.

Abbreviations used in this newsletter:
FMEA: Failure Modes and Effects Analysis
IFU: Instructions for Use
MDD: Medical Devices Directive
RPN: Risk Priority Number

Risk Benefit Analysis involves weighing the clinical benefits derived from the device against the risks inherent in using the device, known as the residual risks (i.e. those risks that have not been designed out).  Clauses 6.5 and 7 of ISO 14971 suggest that a Risk/Benefit Analysis is only required for risks that would otherwise be deemed unacceptable. Annex D.6.1 of ISO 14971 gives guidance that Risk/Benefit Analysis is not required for every risk. However, Essential Requirements 1 and 2 contained in Annex 1 of the MDDs require that a Risk/Benefit Analysis be performed for each risk and for the overall residual risk. In addition, Essential Requirement 6a of the MDDs also requires a Risk/Benefit Analysis as part of the conclusion in the clinical evaluation report (see MEDDEV 2.7.1 rev 3 http://ec.europa.eu/health/medical-devices/files/meddev/2_7_1rev_3_en.pdf for guidance on the format and content of a clinical evaluation report).

The Medical Devices Directives require that a Risk/Benefit Analysis be performed for each individual risk and the totality of all residual risks—not just the risks that have been identified as unacceptable and irrespective of the magnitude of those risks. Performing Risk/ Benefit Analysis on risks that were hitherto described as acceptable or negligible risks may seem like an unnecessary and purely academic exercise; however this is required in order to conform to the Directives.

In order to comply with the Essential Requirements of the European Directives relating to Risk/Benefit Analysis  (i.e. the fourth content deviation between the ISO 14971 Standard and the Essential Requirements of the European Directives), a change is required to a manufacturer’s risk management process and procedures. To comply with EN ISO 14971:2012, it must be ensured that it is clear in the procedures that Risk/ Benefit Analysis is required for every risk regardless of magnitude. In the case of risks that cannot be justified by Risk/Benefit Analysis those risks cannot be considered acceptable and the product cannot be placed on the market unless those risks are eliminated or reduced to the point where they are outweighed by the clinical benefits of using the device. Risk/Benefit Analysis must take into account the risks of using the device given the current state of the art and alternative therapies that are available. This may mean that where new technologies become available, risks that were previously acceptable may no longer be justifiable.

In a previous blog, we determined that all risks must be reduced as far as possible, meaning an end to the concept of ALARP for devices sold in Europe. Combined with the requirement to perform Risk/Benefit Analysis, this effectively leaves only two classes of risk; those that have been reduced as far as possible and can be justified by Risk/ Benefit Analysis and those that cannot be justified by Risk/Benefit Analysis.

Clinical input is an essential component of Risk/Benefit Analysis. For companies that are currently involved in developing new products, access to clinical input should present no difficulty, but for companies that have older product lines, or are producing ’me-too’ devices or low risk devices, access to clinical input may require developing new relationships with clinicians where these do not already exist. Another possible difficulty could be reluctance by clinicians who have not been involved in the development stages of the product to sign off on Risk/ Benefit Analysis especially considering the litigious environment in which clinicians operate today.

However, clinical input need not always be direct clinical input. All devices placed on the market in Europe require a clinical evaluation.  In some cases this is achieved by a review of published clinical literature and post-market surveillance data so some form of clinical input will be available for every device already on the market. It is recommended that Risk/Benefit Analysis be included in the clinical evaluation process using the device’s residual risks as inputs to the clinical evaluation. The clinical evaluation report should include a statement as to whether these risks are outweighed by the clinical benefits of using the device.  The risk management report and the clinical evaluation should be cross-referenced. Both documents should provide traceability to each risk identified in the risk analysis, and decisions on risk acceptability should be based on the conclusions of the clinical evaluation. Risk Management Reports should state clearly that Risk/ Benefit Analysis has been preformed for the individual risks and for the totality of risk and that these risks are outweighed by the clinical benefits of using the device.

The clinical evaluation and Risk/Benefit analysis will need to be updated periodically following modifications to the device, in the event of adverse incidents and on foot of other post-market surveillance information. The need to do this should be included in the company’s Risk Management procedure as part of the system for period review of risk and in the company’ procedures on clinical evaluation and post market surveillance.

Compliance with Content Deviation Number Four will require updates to a number of procedures and to the format of Clinical Evaluation reports and Risk Management Reports. From the procedures and reports it should be clear that the total and individual risks associated with using the device are clearly out weighed by the clinical benefits.

My next blog will deal with Content Deviation #5 Risk Control for CE Marking Medical Devices

Submitted by John Lafferty, SQT Healthcare tutor

In the area of medical device manufacture, all risks cannot be completely designed out and therefore there will always be some residual risk. This residual risk and precautions that are necessary by the user and contraindications are normally contained in the device Instructions for Use (IFU).  However the Essential requirements of the MDD require that all risks must be reduced as far as possible and not just as low as reasonably practicable (ALARP) as stated in the ISO 14971: 2009. The 2012 version of the Standard (EN ISO 14971: 2012) makes it clear that economic considerations are not an acceptable justification for not reducing a risk, regardless of the magnitude of that risk. Therefore, manufacturers cannot justify not reducing a risk because to do so would be too costly. The Medical Devices Directives do not permit financial considerations to override the Essential Requirements for safety and performance of medical devices.

Process Risks

As regards process risks, the same principles apply – economic considerations cannot be used as justification for not implementing process controls. The question must be asked, would additional process controls or inspections reduce the risk associated with the use of the device?

If the answer is yes, then the additional process controls must be implemented. The permissible reasons for not implementing additional controls are outlined later in this newsletter but they must not include economic considerations. It is important to note here, that the MDDs are only concerned with the risks associated the use of the device and not the risks to the manufacturing process itself, except the risk that stocking out the market would be deny patients treatment e.g. in the case of a unique therapy or a near monopoly situation.

The real practicable difficulty that arises here is the need to immediately comply with EN 14971:2012. Implementing additional process controls takes time, the process controls themselves must be risk assessed to ensure that there is no adverse effect from their use and the effectiveness of the controls must be validated or verified.

The question is; how does the manufacturer solve this problem? It is recommended that existing risk analysis documents such as pFMEA s be reviewed and additional controls be identified where necessary for each and every process risk (regardless of its magnitude). Once this has been done, a project plan should be drawn up for the implementation of the additional process controls. This plan should prioritise the risks of the highest magnitude. The project plan should be integrated into the company’s Quality System through a mechanism such as Change Control or a Quality Plan. The next step should be to contact your Notified Body as soon as possible, well in advance of your next audit or submission, and outline your plan for compliance.

Once the notified body is on side with the plan, the implementation of additional controls should be progressed without delay and the project plan should be kept up to date as the project evolves. Account must be taken of the Post Market Information as required by ISO 14971:2012 when implementing the plan. If information arises that indicates that a particular risk was higher than originally estimated or has increased or is increasing, then that risk should be re-prioritised within the project plan and the implementation of the additional risk controls for that risk must be brought forward if possible.

Does this mean an end to the use of ALARP?

Yes. For devices sold in Europe, the ALARP concept will no longer be permissible as a means of risk acceptance because it involves an economic element in the justification of acceptable risk.

In future, there will only be two categories of risk;

1. Intolerable risk – the presence of which means a device cannot be placed on the market unless justified through risk/benefit analysis.
2. Acceptable risk – risks that have been reduced as low as possible and have been justified through risk/benefit analysis. (Risk/benefit analysis must be conducted for each individual risk and for the totality of the risk).

Most company’s risk management system contain a risk acceptability matrix that displays the ALARP region of risk acceptability such risk acceptability matrices should be replace with a matrix such as the one shown in Figure D.5 of ISO 14971 (reproduced below).

 Where does this all end?

How far do I need to go in reducing risks is a question manufactures often ask? To take the principle of not using economic justification for reducing to its logical conclusion, I could ensure that my device is free particulate by having it built in space. As I cannot state that it would not be economically feasible to do so, how am I to proceed? You are not expected to go to the N^th degree but are expected to adhere to the ‘generally acknowledged state of the art’ as required by the MDDs. The MDDs do not define state of the art, but ISO 14971 does define sate of the art as follows:

“State of the art” is used here to mean what is currently and generally accepted as good practice. Various methods can be used to determine “state of the art” for a particular medical device. Examples are:

• standards used for the same or similar devices;
• best practices as used in other devices of the same or similar type;
• results of accepted scientific research.

State of the art does not necessarily mean the most technologically advanced solution.

As there is no content deviation in EN ISO 14971: 2012 relating to state of the art it can be concluded that this definition is valid for compliance with the MDDs. As long as your designs and controls are state of the art you can justify that you have reduced the risk as far as possible.

For example: To have a line of six inspectors each checking the previous inspector has not missed a defect is not the state of the art; however, to have a vision system checking for defects which are associated with a high severity harm for the patient is state of the art, while to have a vision systems to check for every possible defect irrespective of the harm that it could cause is not state of the art.

Manufacturers must be aware that the state of the art changes over time and that they must keep up with the state of the art. Consideration of how current designs and controls compare to the state of the art should form part of the periodic review of risk conducted by top management as required by ISO 14971.

This leaves the following possible justification available for not reducing risk further:

• The risk has been eliminated.
• The designs and controls are state of the art.
• Improved design or further controls are not technically feasible (as opposed to economically feasible) taking into account the current state of the art.
• The existing design (or controls) have reduced the risk to the same level as the proposed new design.
• Additional designs or controls would conflict with the existing design or controls thereby resulting in a risk that is equal to worse than the current situation.
• The design or control introduces a new hazard that presents a risk that is equal to worse than the current situation.

How to Address Deviation No. 3

In order to address content deviation No. 3 your risk management team will need to change the risk management process to remove the ALARP risk category and the use of economic justification for not reducing risk. These will need to be replaced with requirements to reduce risk as far as possible given the state of the art and a requirement to clearly state that all risks have been reduced as far as possible. The risk review process will need to be updated to ensure that it contains a requirement that the designs and controls be kept up to date with the current state to the art.

Your team will need to review risk management documents such as dFMEAs and pFMEAs to remove all reference to ALARP and to ensure that all risks have been reduced as far as possible. Where this is the case a clear justification should be added to state that risks have been reduced as far as possible given the state of the art. Where this is not the case, redesigns and or improved controls will have to be developed in order to bring the device safety up to the state of the art. A project plan to achieve this should be embedded in your Quality System and kept up to date.

Finally communication with your Notified Body is vital to ensure that they are on side with your programme for compliance with content deviation No. 3.

Definition:

* Content Deviation: During the process of making ISO 14971 an EN standard (a process known as harmonisation), it became apparent that the standard did not comply with all the requirements of the Medical Devices European Directives, namely 90/385/EEC, 93/42/EEC and 98/79/EC. The differences between EN 14971: 2012 and the medical devices directives are known as Content Deviations.

The seven Content Deviations are:

Treatment of Negligible Risk
Risk Acceptability Assessment
Risk Reduction Economic Considerations
Risk-Benefit Analysis Not Optional
Risk Control Options
First Risk Control Option
Labelling Information Cannot Influence Residual Risk

Our previous blogs on the topic of EN 14971: 2012 Compliance and Content Deviations are available here

Submitted by John Lafferty, SQT Healthcare tutor

Content Deviation 1: Treatment of Negligible Risks

In Annex D8.2 ISO 14971 Standard indicates that the manufacturer may ignore negligible risks. However, the Essential Requirements of the three Medical Device Directives, state that “All risks, regardless of their dimension, need to be reduced as much as possible and need to be balanced, together with all other risks, against the benefit of the device”

The first step in risk analysis process is to identify hazards – best practice is to identify as many as possible at the beginning of the process and divide them into two categories – those that need to be analysed for risk as they could cause harm and those that cannot possibly cause harm (even in the case of misuse) often due to the design of the device. If you choose not to analyse a hazard, you must record the rationale for choosing not to conduct the analysis. Another alternative is to analyse the hazard and show that it has been reduced as far as possible.

How to Address Content Deviation No. 1

Annex D8.2, of ISO 14971 indicates that negligible risks may be disregarded. However, the Essential Requirement 1 and 2 of the MDD specifically require that all risks must be considered. This means that where possible controls need to be generated for all risks listed in your risk analysis documents (such as FMEAs). If no further controls are possible, then record a statement to this effect in the risk analysis documentation. It is important to remember that even for negligible risks an economic justification is not permissible for not reducing the risk as far as possible (See also Content Deviation No. 3 Risk Reduction Economic Considerations the subject of our next Newsletter). In achieving compliance with EN 14971: 2012 the Treatment of Negligible Risk will not be your highest priority. Discuss with your Notified Body a timeframe for implementation of reducing Negligible Risk as far as possible.

Tip: Do not include business risks or risks to manufacturing personnel in the risk analysis that you conduct to fulfil the Medical Devices Directives; this will simplify your risk analysis and exclude a number of (negligible) risks that would otherwise have to be reduced as far as possible in order to comply with EN 14971: 2012 and the MDD.

Content Deviation No. 2: Risk Acceptability Assessment.

This Deviation relates to the process of evaluating risks. The ISO 14971 states that the acceptability of risk must be decided by the manufacturer. Clause 3.2 of the 14971 Standard, states that, “Top management  shall: define and document the policy for determining criteria for risk acceptability.”   The manufacturer’s risk management policy must define and record the criteria that it uses for deciding which risks are acceptable or not.   Essential Requirements 1 and 2 states that risks be reduced as far as possible, and that all risks shall be included in a risk/benefit analysis—not just the risks that meet a certain criteria. Therefore, the requirement to establish a risk policy for the acceptability of risk directly contradicts the MDD.

The question is: how does a manufacturer establish acceptability criteria?

Robert Packard of www.medicaldeviceacademy.com in his excellent blog on the Content Deviations recommends the following:

“For new devices, I recommend benchmarking the risks of the new device against existing devices. In other words, if the new device presents equal or lower risks than existing devices, then the risks of the new device are acceptable. For existing devices, I recommend performing a risk/benefit analysis, evaluating adverse events observed with the device against the benefits of using the device”.

 What is Acceptable?

In order to comply with the EN ISO 14971:2012 version of the risk management standard, you will need to implement risk controls for all risks, regardless of acceptability. However, you will also need to perform a risk/benefit analysis. The risk/benefit analysis should consider not only the benefits to patients and the risks of using the device, but the analysis should also consider relative benefits of using other devices.

The clinical evaluation report and the risk management report for the device should be based upon clinical evidence of the device for the intended use—including adverse events. For new devices that are evaluated based upon literature review of equivalent devices, Notified Bodies expect a Post-Market Clinical Follow-up (PMCF) study to be conducted in order to verify that the actual risk/benefit of the device is consistent with the conclusions of the clinical evaluation. In order to perform this analysis, a clinical expert is necessary to properly evaluate the risk/benefit ratio of the device, and to create a protocol for a PMCF study.

MEDDEV 2.12/2 rev 2, Post Market Clinical Follow-up Studies, indicates that the PMCF study protocol should indicate the study endpoints and the statistical considerations. In order to do this, your company will need to establish quantitative criteria for acceptability of the identified risks. Therefore, your documentation should make it clear that risk acceptability criteria should be based upon clinical data. Acceptance of risks should be conducted at a later point in the risk management process than under the ALARP system (e.g., – as part of the overall risk/benefit analysis).

How to Address Deviation #2

As your company becomes aware of the second deviation between the ISO 14971 Standard and the Essential Requirements of the MDD, your risk management team will need to change the risk management process to clarify when risk acceptability should be evaluated, and the risk management policy should specify how acceptability should be determined.

The risk management process at your company will need to specify that implementation of risk controls is required for all risks—regardless of acceptability. You should also consider eliminating the evaluation of risk prior to implementation of risk controls. Instead, your company should base acceptability of risk solely upon the clinical risk/benefit analysis, and should involve the manufacturer’s medical expertise in making this determination.

Finally, your risk management process should specify the need for Post Market Clinical Follow-up Studies in order to verify that actual clinical data supports the conclusion that the risk/benefit ratio is acceptable over the lifetime of the device.

The proper place to document this conclusion is in the conclusions of the clinical evaluation report and risk management report. Both of these documents should cross-reference to one another and the conclusion should be reassessed as new post-production data is collected over time.

*Content Deviation: During the process of making ISO 14971 an EN standard (a process known as harmonisation), it became apparent that the standard did not comply with all the requirements of the Medical Devices European Directives, namely 90/385/EEC, 93/42/EEC and 98/79/EC. The differences between EN 14971: 2012 and the Medical Devices Directives are known as Content Deviations.

The seven Content Deviations are:

• Treatment of Negligible Risk
• Risk Acceptability Assessment
• Risk Reduction Economic Considerations
• Risk-Benefit Analysis Not Optional
• Risk Control Options
• First Risk Control Option
• Labelling Information Cannot Influence Residual Risk

Submitted by John Lafferty, SQT Healthcare Tutor

During the process of harmonisation of ISO 14971: 2007 as an EN standard, it became apparent that the standard did not comply with all the requirements of the Medical Devices European Directives, namely 90/385/EEC, 93/42/EEC and 98/79/EC. Seven discrepancies were identified; these discrepancies are described in EN 14971 as “Content Deviations”. What does this mean for the medical device manufacturer?

This means that conforming to ISO 14971: 2007 no longer guarantees conformance with the Medical Device Directives. If you are selling devices in Europe then you will need to revise your risk management process to become EN 14971: 2012 compliant, unless you have already done so. *

(*EN 14971: 2012 applies only to manufacturers selling devices on the European market – if your devices are not sold in Europe or countries requiring compliance with the Medical Devices Directives, then ISO 14971: 2007 is still the applicable standard for your company.)

What does EN 14971: 2012 require?

In summary; EN 14971: 2012 has the following implications:

• All risks identified, whatever their size, must be reduced as far as possible, without consideration being given to the cost of doing so.
• Risk Benefit Analysis is always required
• Providing safety information on labelling cannot be considered a risk reduction measure

Only the Annexes of EN 14971 have changed in the 2012 version, the rest of the content of the standard remains the same. The differences seven between the Medical Devices Directives’ Essential Requirements and the requirements of ISO 14971:2007, known as Content Deviations are outlined in the new  “Z” Annexes of EN 14971: 2012

The seven Content Deviations are as follows:

1. Treatment of Negligible Risk
2. Risk Acceptability Assessment
3. Risk Reduction Economic Considerations
4. Risk-Benefit Analysis Not Optional
5. Risk Control Options
6. First Risk Control Option
7. Labelling Information Cannot Influence Residual Risk

Does this mean an end to ALARP?

Yes. For devices sold in Europe, the ALARP concept will no longer be permissible as a means of risk acceptance because it involves an economic element in the justification of acceptable risk.

In future, there will only be two categories of risk;

1. Intolerable risk – the presence of which means a device cannot be placed on the market unless justified through risk/benefit analysis.
2.  Acceptable risk – risks that have been reduced as low as possible and have been justified through risk/benefit analysis. (Risk/benefit analysis must be conducted for each individual risk and for the totality of the risk)

What lead-in time do I have to comply?

For a new or revised standard, the lead in time is normally three years but for EN 14971:2012 immediate compliance is what is expected. This is because the Medical Device Directive has been in place since 1993 and manufacturers should have already been compliant with the Directive.

What should I do if not already compliant?

Follow these 3 steps

1. Draw up a plan to achieve full compliance.
2.  Prioritise the highest risk items
   –      Remove economic considerations from ALARP risk acceptance.
   –      Conduct risk/benefit analysis.

3. Talk to your Notified Body as soon as possible; well in advance of your next audit or submission, and outline your plan for compliance to them.

Submitted by John Lafferty, SQT Healthcare tutor

Much can be modeled from those who process pharmaceuticals. High standards, many with the force of law, govern pharmaceutical and medical device production. The U.S. Food and Drug Administration (FDA) issues ever-increasing regulations to control the processes by which pharmaceuticals are manufactured and packaged. The regulations that appear in Title 21 of the Code of Federal Regulations, Section 210 (21CFR210) and in subsequent sections are referred to as Current Good Manufacturing Processes (cGMP). The word “current” emphasizes that knowledge of processes evolves and that a process that was “golden” 20 years ago may not be acceptable today. Similar medical device regulations are defined in other sections of 21CFR. Even those not governed by pharmaceutical or medical device requirements would profit by becoming familiar with the principles of cGMP practices.

CGMP HISTORY
The first GMP regulations from the FDA appeared back in 1963. A major revision in 1978 produced most of the regulatory language in use today. An axiom is that good manufacturing processes be documented and validated. Validation is defined as:

“Establishing documented evidence which provides a high degree of assurance that a specific process will consistently produce a product meeting its pre-determined specifications and quality attributes.”

In 2002, the FDA announced an initiative, Pharmaceutical Current Good Manufacturing Practices (CGMPs) for the 21st Century, to enhance and modernize the regulations. A key aspect of this initiative is to adopt risk management approaches in quality management systems. We have previously discussed the risk management approach for validating cleanliness of medical devices.

Risk management inherently involves process understanding; so rather than being an expense, risk management can enhance productivity and profitability. In a report generated as a result of the initiative, the FDA states:

“Quality and productivity improvement share a common element — reduction in variability through process understanding (e.g., application of knowledge throughout the product lifecycle). Reducing variability provides a win-win opportunity from both public health and industry perspectives.”

CROSS CONTAMINATION
The recall of a pharmaceutical product due to cross-contamination led to increased FDA awareness

of the importance of validation and control of cleaning procedures. Drums containing recycled solvent used for pharmaceutical production had previously been used for solvent recycled from pesticide manufacturing. As a result of inadequate cleaning procedures for the drums, pesticide residues were inadvertently transferred to the pharmaceutical product. The example also illustrates the need for well-documented acceptance and monitoring programs for process chemicals and storage containers.

SUPPLY CHAIN INTEGRATION
The incident involving cross contamination of drums brings to mind the need to control and monitor activities of the entire production supply chain. Manufacturers must be confident that raw materials, process chemicals, biologics, and components provided by suppliers are appropriately processed, packaged, and stored. Sub-vendor and supplier processes and certifications must be documented. Requirements, acceptance criteria, and audit policies and findings must be both available and supportable. As noted previously, if suppliers use commercial cleaners, formulations may change without notice or documentation. Such changes can compromise efficacy of cleaning and adversely impact performance of the assembled product.

IQOQPQ
The concept of IQOQPQ (Installation Qualification, Operation Qualification, Performance Qualification) is often part of cGMP. IQOQPQ is employed to verify and validate process equipment. Installation Qualification (IQ) involves verifying that equipment is installed according to manufacturer specifications (i.e., the wiring is hooked up correctly). Operation Qualification (OQ) verifies that the equipment operates to manufacturer specifications (i.e., it does what the spec sheet says it should do). Maintaining equipment calibration is an aspect of OQ. However, correct installation and operation does not insure that the best or even suitable equipment has been selected for the task. Performance Qualification (PQ) verifies that not only is the equipment performing but that the process is working. Analytical testing may be required to verify that the product is sufficiently clean.

PROFITABLE CGMP
To achieve efficiency, quality, and profitability, cGMP should not be tacked on as a list of rules for assembler training; cGMP should not be implemented in a pro forma manner. Profitable cGMP involves understanding the process. Achieving profitable cGMP can require a paradigm shift. A developer of cGMP training programs says,

“It is difficult to make workers aware of contamination issues. The hardest job is changing their attitudes and behaviors. A program that just presents ‘how to’ will not be as effective as one that also discusses ‘why.’ It is very important that all aspects of GMP are supported from the top management through to the workforce on the ground. It is a culture that should be planted and maintained throughout the business. A high standard of GMP should be not be an ‘extra’ part of the working day but should be part of the work ethic of all personnel.”

Quality management is a crucial part of the manufacturing process. The receiver of a manufactured item, your customer, performs their own version of IQ and OQ. As a manufacturer, it is your responsibility to insure that for your customer there will be no surprises either on incoming inspection or in subsequent utilization. By incorporating cGMP as part of the work ethic, you can minimize the occurrence of such surprises and quickly resolve any that happen.

They state the aim is for people within the healthcare sector to share their knowledge, practical experiences and insights, and illustrate that solutions do exist to these occupational health and safety challenges. The HSA plan to publish the case studies that illustrate the best solutions to health and safety challenges on its website.

More information here.

ISO 13485 :2003 is still the global standard. This is due for revision sometime in 2015.

The EN version of the standard contains a revised foreward & revised Annexes ZA, ZB & ZC. This is to link the European harmonised version of the standard with the European Directives:
– Annex II & V of Directive 90/385/EEC Active Implantable Directive
– Annex II,V & VI of Directive 93/42/EEC Medical Device Directive, &
– Annex III,IV & VII of Directive 98/79/EC In Vitro Diagnostics Directive.
There is no text difference between ISO 13485:2003 & EN ISO 13485:2012.

Our next training course on ISO 13485:2003 & The Medical Devices Directives is on 22-23 May 2012 in Galway. Please contact jfeehan@sqt.ie or telephone 061 339040 if you would like us to reserve you a place.

We deliver Process Validation training on both a Public and In-house basis.