REGULATORY OUTLOOK

Imagine for a moment that you are the CEO of a cutting-edge medical device manufacturing firm. You have just gotten your product to market after years of R&D, regulatory submissions, etc. Within months of putting your device on the market, just when you are finally generating some revenue, FDA audits you for the first time. The audit results in a warning letter citing the company's failure to develop and maintain operating procedures. This means you must now shift the focus away from sales, marketing, or developing the next generation of your product. Instead, you must look back and develop procedures and document systems from scratch. This situation could have been avoided if appropriate documentation had been created and maintained before product release.

Developing proper procedures and a system to control them helps prevent receipt of such warning letters. And if a warning letter has already been received, developing procedures and controlling them are critical aspects of a corrective-action plan.

For regulated organizations, developing and using operating procedures is a way of life. Well-written, organized, and controlled procedures can help ease internal confusion, avoid product liability actions, and reduce recalls. Having a defined system to manage process and documentation changes assists in maintaining control within both the quality system and the organization as a whole.

FDA Audit Findings

The Code of Federal Regulations for medical device manufacturers and other related regulated entities (Title 21, CFR Part 820) states repeatedly that firms must “establish and maintain” procedures. To do so, companies should define, document (either on paper or electronically), and implement standard operating procedures (SOPs). Additionally, companies must then follow up, review, and revise these documents as needed. The intent here is simple: Companies must ensure that their organization develops and manages operationally sound procedures that are compliant with the law.

FDA audit findings in 2006 clearly indicate that ensuring establishment and maintenance of procedures is fundamental in FDA's inspection strategy. During inspections in 2006, the agency commonly observed that companies failed to keep accurate records and that they neglected to establish and maintain procedures.

The following text is from a warning letter addressed to a medical device manufacturer. The letter was recently posted on FDA's Web site. Keep in mind that this is only a small portion of the text:

There are no written procedures for ensuring the installation, operation, or performance of the device….We have reviewed your response and have concluded that it is inadequate….Also, no procedures have been submitted for review…

Documentation is the primary method for recording process evolution and continuous improvement. Note that the objective is not to regurgitate the regulation into an SOP document. FDA does not need to see the content of its regulation. Rather, FDA inspectors, as well as inspectors from European Union notified bodies, want descriptions of the actual processes performed by a firm. To create such documents, OEMs should concentrate on controlled and approved process-specific procedures.

[4]

Figure 1. (click to enlarge) [4] Whether planning a new SOP document or changing an existing SOP, the process should be the same.

A document control program is a dynamic system. It follows procedures and their evolution, providing a living history of organizational development. Figure 1 [4] is a sample flowchart that demonstrates the change document procedure. FDA audits regulated companies throughout the course of their operating history. Process development is refined over time through quality system feedback loops, including internal audit programs, corrective and preventive actions, management review, external audits, and complaints.

SOPs (and the method by which process change is managed) serve as a fundamental means of communication for all levels of the organization. Not only do they involve employees departmentally, but they also allow management and employees to gain a cross-functional view of the organization. This approach encourages employees to think about how process change may affect other functional areas. A good change-control system forces managers to think through processes and examine how changes might affect product, personnel, production, and equipment.

Procedures provide an opportunity to clarify processes to ensure that personnel understand the procedure and are trained appropriately. Having well-organized and detail-oriented documentation ensures consistency on execution, which is especially important when more than one person is responsible for executing a process.

All companies experience change, especially in personnel. Employees leave and are replaced. Business processes and strategies evolve. However, documentation can remain a stable tool as long as employees are taught to use consistent rules when developing and modifying company documentation. Writing procedures and subsequently maintaining them removes ambiguity from interpretation and helps clarify the story of a document for future reviewers.

Document Control Elements

Several key elements are involved in creating a document change control system. A good system ensures that the correct people review and approve documents (approvals should be defined by document category and level of personnel, as well as being cross-functional and departmental). It also ensures that change occurs when needed, and not on a periodic basis (unless required procedurally or driven through other standards). Control of distribution and retrieval ensures that only the current, approved versions of documents are available for use.

In addition, a good document-change system should include the following:

• Complete revision history.
• Triggers for employee training.
• A short-duration change cycle.
• Review and approval by appropriate management.
• Change notification or request form.

Change notification or request forms should contain relevant information. Such information includes a description of change, unique document identification including revision level, and an effective date. In addition, a disposition of affected materials including forms and labels, justification for change, effect on validation status and training, links to regulatory review and status, approval signature and date, and release date are necessary.

Provisions should be made for disagreement resolution and a tracking process. And users must have the ability to control procedures and control all types of documentation required to support the quality system, including specifications, labels, forms, and protocols.

[5]

Figure 2. (click to enlarge) [5] Document levels should have a pyramid structure of hierarchy.

When developing a program to support a company's procedures, categorize those procedures into document levels (see Figure 2 [5]). Device makers often do not understand the difference between SOPs and work instructions. SOPs are high- to mid-level documents that describe a departmental process (e.g., document control or complaint handling). An SOP should describe the overall process.

Work instructions are lower-level documents and typically apply only to the employees performing the specific task. They are detailed written instructions on how to execute a specific task. For example, if document control is an SOP within the organization, most departments need to understand the overall process. The document control SOP provides the broad description of the process as a whole. However, the detailed instructions on how to handle specific activities that support the document control process could be described in detailed work instructions. For example, processing a change order or releasing approved documents should have step-by-step instructions, but do not necessarily need to be seen by other personnel. Having work instructions incorporated into your document control system is not a requirement. However, they can be developed to assist with detailed instructions for department-specific tasks.

Creating Well-Written Procedures

Professionals in the device business would recognize that developing procedures that support the business is crucial to the livelihood of the organization. Yet FDA continues to issue inspectional observations regarding the failure to create and maintain accurate records and failure to establish and maintain procedures. Usually, the failure to create and maintain records is the result of having procedures that do not adequately support operational processes or do not exist at all.

One of the most common mistakes that regulated entities make when writing procedures is copying the regulation word for word, resulting in a procedure that does not provide employees any instruction or tools for performing tasks. The following information should help firms organize and write procedures, as well as self-audit their existing ones.

Procedures should be made up of several sections, which at a minimum can include purpose, scope, definitions, background, associated and reference documents, responsibilities, revision history, and the actual steps of the procedure.

Procedures should begin with a purpose section, which defines what the procedure is going to describe (process, assembly, etc.). The purpose can additionally define the requirements being met by the particular procedure.

The scope of the procedure should describe to whom or to what the procedure applies. The scope of a document can be specific so that it includes only a subset of the employee population or process, or it can be general and include the entire organization, location, or process.

A definition section is typically considered optional; however, it can be helpful with complex or technical documentation. Definitions are exactly as you would expect them to be: a dictionary or glossary of terms that are mentioned within the procedure. The background section, also considered optional, is a good place to tie in the quality and regulatory reasons or associations for the existence of the procedure.

The responsibilities section of the procedure defines who is responsible for the execution of the process both directly and indirectly. There can be several responsible parties associated with one procedure. Both individuals (e.g., training coordinator) and groups of people (e.g., management, the quality assurance department) can be responsible for a procedure. Do not call out specific employee names. It is better to address the responsible job title or function (e.g., document administrator). The responsibilities section is important because it works as a guide for auditors (internal and external) to ensure employee training compliance. Companies can also use this section as a tool for creating training curriculum.

Revision history allows an organization to review earlier versions of a procedure. The organization can also revisit methods and programs previously employed. Such tools enable firms to avoid duplicating mistakes or having to recreate processes. Avoiding duplication and limiting the number of mistakes an organization makes can ultimately save money and time and reduce employee frustration.

When developing the procedure section, describe how to execute the process in the same order that the tasks are performed. Using flowcharts is a great way to explain process direction and is acceptable for communicating internal processes. Flowcharts should be used in conjunction with a textual description. The procedure section should give instructions for correctly completing (i.e., filling in blanks) the supporting forms and reference attachments. Include sufficient detail to ensure consistent execution of the task.

Developing SOP Skills

Writing and developing solid operational procedures is skill that develops over time. Procedures are usually fairly technical and often describe complex subjects. These procedures are reviewed by subject-matter experts, as well as by internal and external auditors and by employees at all levels of the organization. Therefore, it is important to consider the language used when communicating an idea. Terms like must, shall, and will indicate steps within a procedure that must be adhered to exactly with each execution. Avoid words that cause ambiguity. Words such as periodically, generally, may, should, and can typically indicate a preference and do not enforce consistent execution.

Document format and organization of procedures and forms lead to ease of use in the maintenance of records, which results in greater accuracy. Procedures should always follow a predetermined format. Encourage employees to use templates by making them available and easily accessible.

Conclusion

Writing detailed procedures and developing document management systems seem tedious and, for many, are not core competencies. However, procedures are the cornerstone of a strong quality system; they provide infrastructure. Inspectors will audit processes against approved procedures.

Creating appropriate procedures eliminates the need for interpretation by employees and ensures that procedures are being followed as intended. They allow for consistency of business process execution, thus limiting inspectional findings, product liability, and recalls. Both developing procedures and controlling them force managers to think about how change might affect production, materials, and validation.

If developed appropriately, well-written procedures and a control system demonstrate that a company is conducting business in a controlled quality system environment. It also supports meeting the overall goal of providing the public with safe and effective medical products, which, at the end of the day, is what all regulated entities strive to achieve.

Lori Hardwick is director of operations for Reglera Corp. (Lakewood, CO). She can be contacted at hardwickl@reglera.com [6].