Medical Device Risk Management – Hazards, Harm, & Causes

One of the most critical roles I play for medical device startup clients is that of educator. And the usual topics for those involved with medical device product development include Design Controls, Risk Management, and Quality Management System. Let me dive a little more into Risk Management with this post. Specifically, I want to help explain hazard, harm, and cause.

First, a few official definitions according to ISO 14971:

  • Harm – physical injury or damage to the health of people, or damage to property or the environment
  • Hazard – potential source of harm
  • Hazardous Situation – circumstance in which people, property, or the environment are exposed to one or more hazard(s)
  • Risk – combination of the probability of occurrence of harm and the severity of that harm
  • Severity – measure of the possible consequences of a hazard

While the definitions seem pretty clear, I can assure you from personal experience the concepts because risk management and how to capture the details can sometimes get confusing. Specifically, I’ve seen time and time again where the concepts of hazard, harm, and cause can get a little muddy.

So maybe thinking about it this way might help:

  • Harm is the potential outcome of a hazard.
  • Severity is the measure of the harm.
  • Cause is what can lead to hazard.

Build Your Medical Device Quality System to Meet FDA and ISO 13485

CQ is currently assisting a few clients with quality system efforts. We also have a couple of proposals out to build a quality system for medical device companies. All of these projects requested their quality system be compliant to FDA 21 CFR 820 regulations. I asked about also being ISO 13485 compliant. The clients seemed perplexed. I think in part because there is a misconception that establishing a QS that is compliant with both FDA and ISO might be a difficult and more expensive endeavor.

I assure you, though, that a QS can be compliant with both with minimal extra effort. And knowing this in the beginning of QS efforts is easier to address than adding on at a later date. I encourage you to pursue a QS that is compliant with both FDA and ISO–even if you do not have immediate plans for EU market.

And if you want some tips for pursuing ISO 13485 registration, you should check out the blog post from Rob Packard on QC Is Dead.

When Is the Best Time for Management Review?

Is there an ideal time of year for conducting Management Review? Does it make sense for this to be part of the year-end activities? Or will cramming it into December lose meaning and purpose?

My opinion is that having a Management Review towards the end of the year makes good sense–especially in helping the management team plan and prepare for the next year. My vote would be to have one sometime around Christmas. In my experience, things are usually less hectic for medical device companies during then.

I will be helping three clients conduct Management Reviews in December. Each of these clients has a different take and point of view with respect to Management Review. Let me summarize:

  • Client A – The December Management Review will be the 3rd one for 2012. They are very good about having at least one Management Review annually. However, sometimes the concept of Management Review is used too frequently. In my opinion, the time between Management Reviews is just too short. There are limited resources and their ability to make significant progress on QS and related issues between reviews is difficult. Plus, the team already meets weekly in a change review board to discuss complaints, CAPAs, ECOs, etc. I think this client uses Management Review too frequently. Twice year should be more than sufficient for them.
  • Client B – Currently addressing deficiencies identified in a FDA Warning Letter. They’ve been in business since the late 1970s. I venture to guess that they’ve never had a Management Review. And as we’ve worked through the deficiencies, I’m not sure they see the vision and benefit of this or any other QMS related activity. We are having a Management Review because we have to.
  • Client C – Hired CQ as a proactive measure, realizing their practices might not be in complete alignment with QS regulations. They want to be better and have asked me to provide guidance and direction to help them with compliance related initiatives. While they too have never held a Management Review, they realize the purpose of this and want to begin this practice this year.

Okay, three different “flavors” and approaches to conducting Management Review. And my advice to you is to incorporate Management Review as part of normal business. Just doing it to check it off the list really defeats the purpose.

What Is the Real Purpose of Medical Device Management Review?

Conducting Management Reviews is required form medical device companies per FDA 820.20 quality system regulations. Specifically:

Management with executive responsibility shall review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency according to established procedures to ensure that the quality system satisfies the requirements of this part and the manufacturer’s established quality policy and objectives. The dates and results of quality system reviews shall be documented.

And if you think about it, a periodic review of a company’s systems, processes, procedures, etc. does make very good business sense.

However, most medical device companies seem to treat Management Review as a checkbox activity that must be done because the regulations say so. And in some cases, I’ve witnessed Management Reviews as the time when executive management pays attention to the business. To me, this doesn’t work. In my opinion, executive management should always have their finger on the pulse of their business.

I’ve also rarely witnessed when Management Reviews actually effectively evaluate the suitability and effectiveness of a company’s quality system. Yes, the results of the various QS processes are reviewed and discussed, but executive management seems to be out of touch with QS efficiency.

I’ve also witnessed executive management using Management Reviews to assert their authority and dictate new initiatives that seem to be more of a whim than driven for overall streamlining and improvement.

Okay, I guess I just told you several things that Management Review should not be. So what should it be?

Management Review should critically and methodically evaluate quality data and objectives. To me, it starts with the overall vision and strategy of the company. So if the company lacks vision and strategy, then this must first be defined. With a strategy in place, quality plan and objectives can be defined to align with the overall vision and strategy. Management Review assesses whether these objectives are appropriate. Management Review is a time when course adjustments can be discussed in order to stay in alignment with the vision.

Medical Device FDA Inspections versus Notified Body – Is There A Difference?

Had you asked me this question a year or so ago, I would have answered “You bet!” Actually, my answer is still “You bet!” but with a twist. A year ago, I would have offered that FDA inspections are much more stressful and involved. Today, I’m not so sure. Based on recent experiences, I might even suggest that a Notified Body inspection is more stressful than FDA. Of course this assumes that you don’t have product issues and FDA is not conducting a for-cause inspection. Also, keep in mind that FDA inspectors are law enforcement. Yes, they carry a badge.

So why would I suggest that a Notified Body inspection is more stressful? Last summer, a client was subject to a FDA inspection. I was brought in just a day or two before the FDA inspector was scheduled. When the FDA inspector arrived, the inspection went fairly smoothly. There were some observations noted but no real surprises. Upon conclusion of the inspection, the company received a handful of 483 observations. Again, nothing too significant. No major issues. Within a month or so, we were able address all the issues and successfully complete the observations.

Fast forward about 9 months later with the same client. Their ISO 13485 certification was due for renewal. The notified body came in for an audit. We believed we were prepared and ready. The recent FDA inspection gave us quite a bit of confidence. That confidence was quickly shot down. The auditor had a different style–much more passive aggressive. He also seemed to be proving a point, although I’m not exactly sure what the point was. The level of detail, the depth of documentation reviewed, the strong opinions were all very surprising to me. I have been on both sides of a QS audit many times throughout my career. While I acknowledge the client had plenty of shortcomings and opportunities for improvement, it really seemed this auditor was trying to make some kind of example. Upon the conclusion, we received nearly 20 findings and deficiencies. Some were relatively simple to address. Others would take months. And the company worked diligently to resolve and correct the issues. Within a couple months, we believed we were on the right path. And literally during the week that the ISO certification was to expire, the auditor had issues with many of our corrective actions. We were forced into firefighting mode. Sometimes it’s okay to fight fires. But this felt like we were catering solely to an auditors opinion and preferences. Eventually, all issues were addressed and recertification was issued.

I realize inspectors and auditors have opinions. I realize they see many, many ways to do things–some good, some not so good. And I realize the more the auditors like how you do things may make this process easier. But through these experiences, I found the FDA inspector was much more tolerant and open to different ways of doing things. The FDA inspector seemed more interested in the actual documentation and records rather than making too much fuss about the process. The notified body auditor was kind of the opposite. He was more concerned with the process and interjected his opinions and influence. Not that he didn’t care about the records, he just didn’t seem to put as much weight in them.

On a related note, I noticed that Rob Packard recently wrote a post “FDA Inspection Strategies that DON’T Work”. It’s a great read, especially for anyone preparing for FDA and/or notified body inspections.

Can A Wiki Work for Medical Device Quality System?

My friend, Bob Packard recently wrote a blog post titled “Burn the Binders and Get a Wiki”, suggesting that a wiki could be a platform for a company’s quality management system. The idea is not his and references articles and work done by Geometrica. Here are links to a few articles posted on Geometrica:

Using a Wiki for Document Control

Using a Wiki to Implement a QMS

Sample QMS Wiki Organization

I’ll admit, I’m still trying to wrap my head around this concept. Yes, I understand that a wiki is a collaborative space. But as I read this, the question I’m trying to answer is this: Can a wiki work for a medical device quality system? Also, could a wiki have other applications within a medical device company? Would this platform be accepted by FDA and other regulatory bodies? Can it be validated?

Why Do Small Medical Device Companies Overburden Themselves with Wordy Procedures?

During the past few months, CQ has been working with a number of small medical device companies. While the products these companies produce are vastly different, they all have similarities in their culture and day-to-day business practices. And of these commonalities, the one that is most glaring to me pertains to the Quality System.

First, I should qualify that I prefer a descriptive meaningful picture instead of pages and pages of words.

Apparently, though–at least from my recent experiences, small medical device companies prefer lots of wordy procedures. In my opinion, my small medical device clients are overburdening themselves because of their QS. Yes, I know they need to address the FDA / ISO QS requirements. However, I’m kind of confused why they chose to waste so many words on paper to do so.

I suspect the reason is pretty simple. Many of the procedures I’ve been reviewing are more or less a regurgitation of FDA and ISO terminology. The company puts their “unique” spin on things, adding their lexicon and specific terminology. And while their procedures may in fact be in compliance with the regulations, I know there is a huge disconnect. I know they are NOT in compliance because they don’t always follow the words written in their procedures.

I know there is a better way to document QS procedures–especially for the small medical device company. My simple advice is this: map the processes and create a pretty, easy to follow flow chart.

November 17, 2010 – SME Chapter 37 November Meeting

SME Chapter 37 November Meeting

Our Next Chapter 37 Meeting will be on November 17, 2010 with a tour of Garrity Tool Company at 6:00 PM. This is a MUST SEE company.  Take time to look at their website at www.garritytoolcompany.com. Garrity Tool is located at 3555 Developers Road, Indianapolis, Indiana.

Garrity Tool Company, Inc. has been in business since 1986 and was incorporated in 1996. Certified to AS9100 / ISO 9001-2000 Quality Standards, Garrity Tool Company is a major supplier of machining services for Central Indiana Industries, such as Automotive, Aerospace/Defense, Medical Devices, and Material Handling.  Garrity Tool Company, Inc. is totally committed to providing zero defects, 100% on-time delivery and professional service at competitive pricing. Their  focus and commitment is to consistently meet and exceed their customers’ expectations through continuous improvement. Compliance to the strict and exacting quality standards set forth by all customers is the foundation on which our Quality Management System stands.

IMPORTANT…..Garrity Tool is an ITAR compliant facility.  ALL tour attendees MUST sign into the facility and be citizens of the United States.

Program Agenda:
6:00P   Welcome & Introduction:  Bill McCartney
Overview of Garrity Tool:  Mr. Donald Garrity – President
Plant Tour
Please email your RSVP after November 1, 2010 to my email address below.  Thank you and I hope to see you on the 17th.

Enhanced by Zemanta