Donald M. Powers
Over the past few years, warning letter trends and other regulatory actions have signaled that FDA is increasingly targeting IVD companies for failure to meet contemporary validation standards. Ronald M. Johnson, executive vice president of Quintiles Consulting (Rockville, MD), contends that companies that have not kept up with evolving validation standards place themselves and FDA in a difficult position. "The agency cannot ignore potential threats to the public health," said Johnson at a recent seminar sponsored by the Institute for Validation Technology. "Companies that fail to identify and remediate these threats place themselves and the FDA in an untenable situation. FDA is forced to act." Johnson initiated numerous regulatory actions against device firms while he was director of the Office of Compliance at FDA's Center for Devices and Radiological Health (CDRH).
Manufacturing processes and test methods for products introduced since 1997, when FDA implemented design control requirements as part of its quality system regulation, should already be in compliance with the current validation standards. However, chances are good that products that have been on the market for many years have suffered from neglect.
In this regard IVD manufacturers are no different from the rest of the medical device industry. Companies already under FDA scrutiny, or whose quality metrics have raised warning flags about its process controls, or who treated validation as a perfunctory, one-time exercise, are likely skating on thin regulatory ice. To compound the situation for IVD manufacturers, the deadline for mandatory CE marking of IVD products is now less than two years away, and some company official will shortly have to sign a declaration that the company's products and manufacturing processes conform to the requirements of the European Union's IVD Directive.1
Companies should recognize that substandard validations and other inadequate process controls place them in a precarious compliance position. To avoid risking the consequences of a regulatory action, such companies need to know how to begin a remedial compliance program.
Remediation Approaches
When executing a remedial compliance program, device companies commonly use one of two approaches. The first is to assemble a team of product and process experts who can draw upon their extensive experience and knowledge to determine what needs to be fixed. Such a brainstorming session can often develop a compliance plan within a few hours. To execute the plan, the company will then spend the next year involved in an impressive (and costly) flurry of activity. In the end, the most obvious compliance gaps will have been closed.
A second approach is to assemble the same team of experts, but with a different goal in mind. In this case, the team is asked to map out the company's manufacturing processes, to examine them in detail, and to answer the following two questions.
- Where is it possible for the company's processes to fail in a hazardous way?
- What controls are required to ensure that the company's finished products meet specifications?
In this approach, the team uses recognized risk-assessment tools and actual experience (e.g., failure data) to guide its expert judgment. With the data provided by such tools, the team then identifies the essential control points, determines whether the right controls are in place, and evaluates whether the processes (including process verification methods and controls) are validated to contemporary standards. The deliverable product of this approach is documented evidence that the company's processes are in control and assurance that its products are safe and effective.
Although each of these two approaches probably requires about the same commitment of time and resources, why would a management team select the first approach? That method may enable a company to address obvious compliance problems, but it will not generate documentation sufficient to assure FDA that the company's processes are in control or that its products are safe and effective. Nevertheless, "brainstorming the compliance gaps" is precisely the approach that most companies in trouble choose to adopt.
Emphasizing the Essential
Ultimately, manufacturing must be in full compliance—which means that all processes must be either validated or fully verified. But if a company has been skating close to the edge of a compliance cliff, there simply isn't enough time to examine every process, test method, and software validation, and remediate them to today's standards. The next inspection could begin at any moment, and firms that are unable to demonstrate adequate control are in a precarious position. So the manufacturer's first priority must be to compile documented evidence that all its essential processes are in control—and that its products can therefore be considered safe and effective.
An effective approach to achieving this end is the risk-based product assessment and traceability (PAT) process developed by Quintiles Consulting.2 A cross-functional team is formed with representatives from the scientific, engineering, and clinical disciplines necessary to evaluate the product and associated manufacturing processes. The collective knowledge of the cross-functional team makes this a powerful approach. The process begins with identification of the essential user requirements for a safe and effective diagnostic assay, which are typically described in the product's labeling. Hazards to the patient are defined as failures to meet the essential user requirements, such as accuracy, precision, and other performance characteristics. The corresponding hazards would be inaccurate results, imprecise results, and so on.
To determine the essential control points associated with each process, the cross-functional team performs a top-down hazard analysis, such as fault tree analysis, and a bottom-up analysis, such as failure mode effects and criticality analysis (FMECA).3,4 By combining the use of these analytical tools, the PAT process minimizes the possibility that an important failure will be missed and helps to focus FMECA on the most important potential failures. To lend objectivity and credibility to the process, the team agrees on criteria for hazard severity, probability of occurrence, and detectability before starting the hazard analysis. Each point in the process that exceeds the predetermined risk criteria is defined as an essential control point. The essential control points identified in this way are traceable back to the product's essential user requirements.
To be complete, the risk assessments must consider all of the following elements of the manufacturing process.
- Raw materials.
- Production and control equipment.
- Manual and automated processes.
- Control and monitoring systems.
- Test methods.
- Product storage.
- Distribution systems.
- Operators.
The risk assessments should also encompass all elements of the diagnostic system, including reagents, calibrators, control solutions, instruments, accessories, and the end-user. Since the primary focus is on demonstrating that production processes are in control, product design issues might be considered outside the scope of the risk assessment for the moment. Nevertheless, adequate design validation is important to demonstrate that the product is safe and effective.
In its emphasis on risk analysis and essential control points, the PAT process resembles FDA's hazard analysis and critical control points (HACCP) method. In fact, the process borrows from HACCP principles and methodology.5 In the end, risk analysis and risk management simply represent common sense.
Although the design control sections of FDA's quality system regulation require manufacturers to perform risk analyses, design controls do not apply to products on the U.S. market if no design or process changes have been made since mid-1997, when the quality system regulation became effective. As time goes on, however, products exempt from design control requirements will be increasingly rare.
Perhaps more pressing is the timeline for full implementation of the European Union's IVD Directive, which has no grandfather provision for products already on the market. In contrast to FDA's quality system regulation, the IVD Directive requires manufacturers to conduct a formally documented risk assessment for all products sold in the EU after December 2003.1,6
Analysis of Essential Control Points
Once the essential control points have been identified, the cross-functional product assessment team then determines which quality attributes are critical to the manufacturing process and must be well controlled to prevent unacceptable failures from occurring. These are termed critical quality attributes (CQAs). For an IVD assay, examples of such quality attributes might be clarity, uniformity, solubility, stability, accuracy, specificity, homogeneity, precision, bioburden level, and so on.
At this point, the team is ready to examine existing process controls and determine whether they are sufficient to control the process's specified CQAs. In this part of the PAT process, the most important activity is systematically assessing existing process validations and verification activities associated with each essential control point, including test method validations, software validations, and equipment qualifications.
To ensure consistency among those doing the assessments, the PAT process uses objective compliance checklists. The completed checklists also provide documented evidence of compliance or remediation requirements. Checklist questions are based primarily on FDA and Global Harmonization Task Force (GHTF) guidance documents on process validation, the quality system compendium published by the Association for the Advancement of Medical Instrumentation, and current industry practices.7–9
Typical checklist questions address such validation requirements as whether acceptance criteria were predetermined, study designs were based on statistical rationale, worst-case conditions were challenged, protocols were approved prior to execution, instruments and equipment were qualified, the CQA was adequately addressed, documentation is complete, and other requirements were met. The assessor notes deficiencies along with recommended remediation activities.
During the risk assessment process, test methods used for product release are almost always identified as essential control points. If not, it is a good idea to consider release tests as such. Validation requirements for test methods in the medical device industry have not been defined as clearly as other process validation requirements. Although CDRH has not published guidelines for the validation of test methods, both the Center for Biologicals Evaluation and Research and the Center for Drug Evaluation and Research have endorsed the guidelines of the International Conference on Harmonization (ICH), which were designed for the validation of analytical test methods in the pharmaceutical industry.10,11 Since the same analytical performance characteristics and scientific principles generally apply to all analytical test methods used in the IVD industry, it makes sense for IVD manufacturers to adapt the ICH guidelines for their test methods.
Written operating procedures and work instructions are also important process controls. In the PAT process, checklists based on regulatory requirements and guidelines enable consistent and objective assessment of compliance. Questions address common deficiencies stemming from lack of such necessary elements as clear, unambiguous instructions; defined responsibilities; completeness; criteria for satisfactory completion of a task; and so on. Other controls, such as reference materials and standards, engineering drawings, blueprints, test fixtures, inspection and evaluation methods, and operator certification, are evaluated for their adequacy in controlling CQAs.
In addition to process controls and monitoring systems, product and process specifications should be reviewed against requirements and performance data to determine if a detailed specification assessment is warranted.
The Remediation Phase
Identifying essential control points provides a defensible rationale for giving higher priority to activities associated with their remediation, and for deferring remediation of less-essential process controls. But having defined an essential control point in a process, it is important to remediate any deficiencies with due urgency. After all, if an essential control point is not adequately controlled, what can be concluded about the safety and effectiveness of the product made by that process?
Most companies can expect to identify some deficiencies that must be remediated. The amount of required remediation work depends on the number of essential control points and the nature of the deficiencies.
A detailed remediation plan should include timelines, milestones, resources, and assigned responsibilities. At the same time, manufacturers should remember to take into account other quality system requirements—particularly those for corrective and preventive actions (CAPA) and design control. Since the deficiencies being addressed are quality system nonconformities, the remediation plan must tie in to the manufacturer's CAPA system in such a way as to comply with company procedures, ensure that potential consequences are adequately assessed, and receive active management oversight. And, of course, any significant changes to a product or its manufacturing processes must follow the established design control procedures.
Documentation
Following a logical assessment and remediation process enables the company to systematically document its conclusions, decisions, and rationale. Such a process provides complete documentation about the selection of the essential control points. And perhaps more importantly, it documents the reasons that other control points are not considered essential for ensuring safe and effective product. The latter requirement is often overlooked.
The documentation produced by the product assessment team becomes part of the product's design history file, subject to review by FDA investigators and European competent authorities. It is therefore important that the completed project files document all of the following elements.
- Credentials and participation of PAT team members.
- Approved procedural instructions followed by the team.
- Essential user requirements and corresponding hazards.
- Predetermined hazard assessment criteria.
- Hazard analysis results.
- Quality data used to support the assessment.
- Events that may have affected the team's assessment.
- All issues identified and resolved by the team.
- Evaluation of existing controls.
- Remediation plan.
- Remediation activities.
A set of integrated worksheets facilitates capturing all relevant information as it is developed, so that in the end a controlled product assessment file is compiled to tell the entire story. A complete file should exist for each product that was developed prior to design control requirements.
Achieving Full Compliance
Once essential control points are identified and remediated, companies may be tempted to stop. Although the GHTF guidance document allows a company leeway to decide whether a process requires validation based on risk, FDA has not accepted this strategy. Instead, agency officials have maintained that the quality system regulation requires all processes that cannot be fully verified to be validated.
For this reason, manufacturers should establish a plan to evaluate and remediate all other process validations to bring them into compliance. This plan can be carried out on a less-urgent basis, once the essential control points have been addressed.
Going forward, having a well documented product risk assessment will make it easier for companies to evaluate changes to manufacturing processes. Any change that modifies the validated design must be implemented under design controls. Once a firm has conducted and documented a baseline assessment for its existing products, each change can be evaluated for its effect on the state of control, using the FMECA scoring rules and risk criteria already developed. Following this procedure will provide the firm with solid evidence that its manufacturing processes remain in control after each change.
References
1. "Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on In Vitro Diagnostic Medical Devices," Official Journal of the European Communities L331 (1998): 1–37.
2. Product Assessment and Tracebaility Process Training Manual (Rockville, MD: Quintiles Consulting, 2001).
3. WE Veseley et al., Fault Tree Handbook, NUREG-0492 (Washington, DC: U.S. Nuclear Regulatory Commission, 1981).
4. Analysis Techniques for System Reliability—Procedure for Failure Mode and Effects Analysis (FMEA), IEC Standard Pub. 60812 (Geneva: International Electrotechnical Commission, 1985).
5. HACCP for Medical Devices [on-line] (Rockville, MD: FDA, Center for Devices and Radiological Health, 1997 [cited 12 February 2002]); available from Internet: http://www.fda.gov/cdrh/gmp/haccp2.html.
6. "Quality System Regulation," Code of Federal Regulations, 21 CFR 820.
7. A Shaw, Guideline on General Principles of Process Validation (East Brunswick, NJ: Center for Professional Advancement, May 1987) reprint in CDER Home Page [on-line] (Rockville, MD: FDA, Center for Drug Evaluation and Research, 1993 [cited 12 February 2002]); available from Internet: http://www.fda.gov/cder/guidance/pv.htm.
8. "Process Validation Guidance," in GHTF Home Page [on-line] (Rockville, MD: Global Harmonization Task Force, Study Group 3, 1999 [cited January 2002]); available from Internet: http://www.ghtf.org/sg3/sg3-final.html.
9. AAMI Quality System Compendium: GMP Requirements and Industry Practice (Arlington, VA: Association for the Advancement of Medical Instrumentation, 1998).
10. "Guideline for Industry: Text on Analytical Method Validation, Q2A," in CDER Home Page [on-line] (Rockville, MD: FDA, Center for Drug Evaluation and Research, 1995 [cited 12 February 2002]); available from Internet: http://www.fda.gov/cder/guidance/ichq2a.pdf.
11. "Guidance for Industry: Q2B Validation of Analytical Procedures," in CDER Home Page [on-line] (Rockville, MD: FDA, Center for Drug Evaluation and Research, 1996 [cited 12 February 2002]); available from Internet: http://www.fda.gov/cder/guidance/1320fnl.pdf.
Donald M. Powers, PhD, is president of Powers Consulting Services (Rochester, NY), an independent IVD regulatory and quality consulting firm.
No comments:
Post a Comment