FDA Enforcement in 2018 - Medmarc...Industry reviewer for the international standard, BS 10008 Evidential Weight and Legal Admissibility of Electronic Information (2015) Lead expert

www.Ceruleanllc.com

© Cerulean Associates LLC 1

US FDA

Enforcement

in 2018Reading the Tea Leaves

John AvellanetCerulean Associates LLC

www.CeruleanLLC.com

Medmarc Insurance Group

January 2018

Agenda

NIPP and MDSAP

quick review of 2017

implications for 2018

© 2018 Cerulean Associates LLC

This is not legal advice. Information in this presentation draws upon a variety of sources, including published warning letters,

personal experiences, interviews and research, all or any of which may or may not have been prepared or conducted by Cerulean

Associates LLC. Cerulean Associates LLC does not provide a warranty concerning the accuracy of the information contained in this

presentation. The contents of this presentation are intended for general information only and should not be construed as legal

advice. Cerulean Associates LLC assumes no liability for actions taken or not taken as a result of the information in this

presentation. This presentation is copyrighted 2018 by Cerulean Associates LLC, all rights reserved.

2www.Ceruleanllc.com

www.Ceruleanllc.com


Presentation Objectives

1. Understand how FDA’s 2017 activities are continuing

into 2018

2. Learn the new role FDA expects to see for data integrity

when inspecting Medical Device firms

3. Recognize business implications of FDA’s anticipated

2018 enforcement priorities

4. Identify the real-world implications of FDA’s 2018

enforcement focus points to your quality system and

other controls

5. Improve your business and regulatory plans to align (or

better prepare for) FDA initiatives in 2018 and beyond

© 2018 Cerulean Associates LLC 3www.Ceruleanllc.com

About Your PresenterJohn Avellanet

John Avellanet gives practical, real-world compliance solutions and

streamlines quality systems for clients around the world. Winner of the

2009 & 2011 Best of Business Services award by the Small Business

Commerce Association, Mr. Avellanet has earned international acclaim for

his business-savvy, pragmatic advice

Trainer for FDA and Health Canada inspectors and district officers on

advanced data integrity inspection techniques and detecting data fraud in

clinical, laboratory, and manufacturing operations. Mr. Avellanet served on

behalf of the US Department of Justice as the independent overseer for the

five-year, multi-million dollar Dr. Comfort Corporate Integrity Agreement

Industry reviewer for the international standard, BS 10008 Evidential

Weight and Legal Admissibility of Electronic Information (2015)

Lead expert for the ISPE GAMP Data Integrity Working Group

Author of Get to Market Now! Turn FDA Compliance into a Competitive

Edge in the Era of Personalized Medicine (2010); co-author of

Pharmaceutical Regulatory Inspections (2014)

Prior to founding Cerulean, John spent more than 15 years designing,

implementing, and being accountable for quality systems and data

compliance programs for FDA, DEA, BIS, ICH, IMDRF, and ISO

[email protected]

www.ceruleanllc.com


www.Ceruleanllc.com


© 2018 Cerulean Associates LLC www.Ceruleanllc.com 5

“FDA is undergoing some its

biggest changes in over 20 years…and for some

things, since the 1990’s”

6© 2018 Cerulean Associates LLC www.Ceruleanllc.com

- Alonza Cruse, FDA, Office of Regulatory Affairs, December 2016

www.Ceruleanllc.com



Impacts in submission reviews

and inspections (NIPP and MDSAP)


www.Ceruleanllc.com



New Inspection Methods


www.Ceruleanllc.com


New Inspection Protocol

Project (NIPP)• NIPP leverages 10 years’ worth of

historical data with annual data, plus predictive analytics

• Uses algorithm to sort site data into inspection priorities

• Replaces routine inspections for:– 50% PAI

– 50% postmarket surveillance (e.g., PV) inspections

– “for cause” will be one-offs

• Piloted in 2015 and 2016• www.fda.gov/downloads/drugs/developmentapprova

lprocess/smallbusinessassistance/ucm445608.pdf


Medical Device Single Audit

Program (MDSAP)• Covers 7 different subsystems

• Emphasis on risk management (risk to public safety)

• Aligns with ISO 13485:2016

• Allows harmonized global inspections:– Brazil, US, Japan, Canada, EU,

Australia

– Supplemented with specific unique national requirements

– “for cause” will be one-off, unique

• Piloted in 2015 and 2016


So *theoretically* should NOT be inspected more than

1x every 2 years by ANY of these regulatory bodies

www.fda.gov/medicaldevices/internationalprograms/mdsappilot/

http://www.fda.gov/downloads/drugs/developmentapprovalprocess/smallbusinessassistance/ucm445608.pdf

www.Ceruleanllc.com


“So what?”


Previously on….


www.Ceruleanllc.com


QSIT and CAPA+2

• Quality System Inspection Technique (QSIT)

• Covered 5 different subsystems

• Pharma investigators used a “CAPA+2” approach (“CAPA+Production+1”)

• Examine 10 CAPAs and 10 production records

• Examine 1-2 other area such as:– design control – changes, validation, etc.

– raw material controls (incoming acceptance, supplier qualification, etc.)

– outsourced production-related controls (control over CMO, etc.)

– process validation

– records controls (records retention, data integrity –includes Part 11, etc.)

– distribution controls (anti-counterfeiting, etc.)

– postmarket surveillance (PV) and complaint-handling/MDR


Inspection War Room Setup


Meeting Room A

FDA investigatorsand firm’s host

Meeting Room B

firm’s support staffFDA request

firm’s best response in 4-24 hours

various document requests out to firm’s personnel

www.Ceruleanllc.com


During a regulatory inspection, the investigator asks for a specific record. After 24 hours, you cannot find it. Which response is best?

a) Give us another 24 hours to locate the record

b) The record is at another site

c) We noted a discrepancy and opened a CAPA


Firm’s response in 15-30 MINUTES or less (“real-time”)

Inspection War Room Change


Meeting Room A

FDA investigatorsand firm’s host

Meeting Room B

firm’s support staffFDA request

firm’s best response in 4-24 hours

various document requests out to firm’s personnel

www.Ceruleanllc.com


NIPP and MDSAP Realities

• Team-based inspections (at least 1 Quality System/Data Integrity expert and 1 Product Specialist)

• Heavy reliance on “live” access to the firm’s digital records and systems (no time for “war room” reviews)

• Long-term goal is for ALL members of the ICH and IMDRF to use these methodologies by 2020

• Significantly increased likelihood of getting a FDA-483 observation (wouldn’t be inspecting your site if not flagged as risk OR as part of a one-off “for cause”)

• All FDA CPGMs, MAPPs, RPMs, Inspection Guides, etc. are being re-written (including inspection policies….)


MDSAP v QSIT

MDSAP Structure

Management Oversight and Involvement

Marketing Authorization and Facility Registration

Measurement, Analysis and Improvement

Adverse Events and Reporting

Device Design and Development

Production and Servicing Controls

Purchasing Controls

QSIT Structure

Management Controls

--

--

Corrective and Preventative Actions

Design Controls

Production and Process Controls

--


www.Ceruleanllc.com


MDSAP v QSIT

MDSAP Structure

Management Oversight and Involvement

Marketing Authorization and Facility Registration

Measurement, Analysis and Improvement

Adverse Events and Reporting

Device Design and Development

Production and Servicing Controls

Purchasing Controls

QSIT Structure

Management Controls

--

--

Corrective and Preventative Actions

Design Controls

Production and Process Controls

--


FDA Implementation Timeline


For both MDSAP (devices) and NIPP

(drugs)

www.Ceruleanllc.com


FDA Implementation Timeline


For both MDSAP (devices) and NIPP

(drugs)

Three Hidden Implications

Greater 483

chance

laxity

lose touch


www.Ceruleanllc.com


QUICK REVIEW OF 2017

CDER enforcement

CDRH enforcement


FDA’s Enforcement Evolution


High benefits to patients with little risk to public safety

FDA exercises enforcement

discretion

Low benefits to patients with high

risk to public safety

FDA takes enforcement

action

www.Ceruleanllc.com


Overall Summary Statistics


Enforcement Action Total Count

FDA-483 Observations 5,155

FDA Warning Letters 443

Recall Events 2,945

CDER Top 6 Issues (drugs)


01Procedures Not Fully FollowedResponsibilities and procedure applicable to [quality unit] are not fully followed, not in writing, et al

02No Scientifically Sound Laboratory ControlsLaboratory controls do not include scientifically sound and appropriate specifications, sampling plans, test procedures, et al

03Failure to Investigate DiscrepanciesThere is a failure to review any unexplained discrepancy, the failure of a batch to meet any of its specifications, et al

www.Ceruleanllc.com


CDER Top 6 Issues (drugs)


04Absence of Written ProceduresThere are no written procedures designed to assure that the drug product has the identity, safety, quality, and purity expected

05Cross ContaminationInadequate or insufficient cleaning of equipment and utensils in manufacturing, in laboratory, et al

06Releasing Product that Does Not Meet SpecificationsTesting procedures for final product are insufficient in that they do not test whether product meets approved specifications, etc.

CDER Numbers (drugs)

Regulation Issue No. of FDA-483s

21 CFR 211.22(d) Procedures not fully followed 185

21 CFR 211.160(b) No scientifically sound laboratory controls 124

21 CFR 211.192 Failure to investigate discrepancies 100

21 CFR 211.100(a) Absence of written procedures 91

21 CFR 211.67(b) Procedures for equipment cleaning not followed 68

21 CFR 211.165(a) Failure to test products to spec before release 64

21 CFR 211.68(b) Computer controls over data 62

21 CFR 211.113(b) Failure to prevent contamination of drug product 62

21 CFR 211.68(a) Calibration/inspection/maintenance not done 61

21 CFR 211.166(a) Lack of a stability program 61


www.Ceruleanllc.com


Implications for Pharma Firms

Liability

Science

Basics


Data Integrity

CDRH Top 6 Issues (devices)


01Lack of or Inadequate CAPA ProceduresProcedures for corrective and preventative actions (CAPA) are not adequately followed, enforced, documented, et al

02Lack of or Inadequate Complaint Handling ProceduresProcedures for receiving, reviewing, and evaluating complaints by a formally designated unit are not established, followed, enforced, et al

03Lack of or Inadequate Purchasing Controls ProceduresProcedures to ensure that all purchased or otherwise received product and services conform to requirements are not established, enforced, et al

Remember this for data integrity and cybersecurity….

www.Ceruleanllc.com


CDRH Top 6 Issues (devices)


04Lack of or Inadequate Process ValidationA process whose results cannot be fully verified by inspection and testing has not been validated according to established procedures

05Lack of MDR ProceduresProcedures for when a device error or adverse event needs to be reported to the FDA have not be written, followed, enforced, et al

06Lack of Non-Conforming Product ProceduresProcedures have not been [adequately] established to control product that does not conform to specified requirements

Remember all of these for data integrity and

cybersecurity….

CDRH Numbers (devices)

Regulation Issue No. of FDA-483s

21 CFR 820.100(a) Lack of or inadequate CAPA SOPs 400

21 CFR 820.198(a) Lack of or inadequate complaint handling SOPs 269

21 CFR 820.50(a) Lack of or inadequate purchasing controls SOPs 138

21 CFR 820.75(a) Lack of or inadequate process validation 137

21 CFR 803.17 Lack of or inadequate MDR procedures 127

21 CFR 820.90(a) Lack of non-conforming product procedures 127

21 CFR 820.100(b) Inadequate documentation and follow-ups 115

21 CFR 820.30(i) Lack of or inadequate design control procedures 80

21 CFR 820.22 Lack of or inadequate quality audit procedures 78

21 CFR 820.80(d) Lack of or inadequate final testing procedures 67


www.Ceruleanllc.com


CDRH and Data Integrity

• September 4-8, 2017 – First set of CDRH investigators receive “inspecting for data integrity” training in St. Louis

• FDA trains the device investigators to cite device firm records for Part 11 data integrity requirements under the specific FD&C citations of 21 USC §§ 331(e)(w), and 360i(a), and under the specific predicate citations of 21 CFR §§ 803.18(c)(d), 807.26(c), 820.180(b)

• September 12, 2017 – FDA informs all CDRH investigators that they will receive data integrity inspection training over the course of the next 4-9 months


search text of any regulation, law, or guidance for “years” or “data” or “record” – that’s a citation point


“Everything that we do is based on

the integrity of the data.

Data integrity is mission critical.”- Doug Stearn, Director, ORA, US FDA, November 2017

www.Ceruleanllc.com


Implications for Device Firms

Supplier Oversight

SOPs

Audit Actions


Data Integrity

2018 ENFORCEMENT FORECAST

overall

data integrity

MDSAP and NIPP

international cooperation


www.Ceruleanllc.com


Overall

• CDRH will continue training its investigators• improved ability to trace safety and efficacy features and testing

from design through post-market surveillance reporting and investigation (public safety risk aligned with MDSAP)

• how to look for data integrity issues during an inspection (e.g., is the device firm’s data TRUSTWORTHY?)

• cybersecurity awareness – design and post-market processes

• CDER will continue to focus on data integrity• slow growing scrutiny around data controls from critical suppliers

• priority focus is completing rollout of NIPP by year end


Data Integrity

• Expansion of CDER/CBER/CVM’s 2010 data integrity “special focus” inspections to CDRH

• see FDA BIMO CPG, Attachment A: Computerized Systems http://www.fda.gov/ICECI/EnforcementActions/BioresearchMonitoring/ucm133927.htm

• Assessment of data trustworthiness controls around device and component testing, in apps, in post-market controls and non-conforming product controls

• Review of cybersecurity controls on any computerized medical device and/or app

• documentation and validation as part of design control

• change management as part of postmarket changes and reporting


http://www.fda.gov/ICECI/EnforcementActions/BioresearchMonitoring/ucm133927.htm

www.Ceruleanllc.com


MDSAP and NIPP


International Cooperation


www.Ceruleanllc.com


International Cooperation

“We will be updating FDA’s requirements for

accepting foreign clinical data used to bring new medical devices to market. While helping to ensure the quality and integrity of clinical trial data and the protection of study participants, this rule should also reduce the burden on industry because

it will harmonize with the standards currently used in drug regulation.”

- Scott Gottlieb, M.D., US FDA Commissioner, December 14, 2017


Key Point Recap

FDA is expanding its data integrity enforcement to devices as it

rolls out modernized inspection techniques of NIPP and MDSAP

FDA is strengthening its enforcement of harmonized international

standards and guidelines; the agency already enforces ICH

guidelines as regulations – and has repeatedly stated its intention to

use the IMDRF to harmonize device regulations no later than 2020

FDA’s NIPP and MDSAP inspection techniques allow the agency to

more easily ferret out data integrity issues such as data fraud and

weak product safety controls, especially in post-market situations

FDA’s MDSAP and NIPP mean reduced inspection frequency with

higher chances of receiving FDA-483s and a Warning Letter (e.g.,

FDA would not be inspecting you if they had not detected a post-

market signal OR if you had not made a submission); this will

inevitably lead to an increase in product liability litigation and

disgruntled shareholder litigation44© 2018 Cerulean Associates LLC www.Ceruleanllc.com

www.Ceruleanllc.com


Agenda Recap

NIPP and MDSAP

quick review of 2017

implications for 2018


Request Expert Training

Visit Cerulean’s website to learn more about our

private, tailored, highly interactive workshops

held onsite at your location

Sample agendas and Request form at

www.ceruleanllc.com/private-training/


www.Ceruleanllc.com



John Avellanet gives practical, real-world compliance solutions and

streamlines quality systems for clients around the world. Winner of the

2009 & 2011 Best of Business Services award by the Small Business

Commerce Association, Mr. Avellanet has earned international acclaim for

his business-savvy, pragmatic advice

Trainer for FDA and Health Canada inspectors and district officers on

advanced data integrity inspection techniques and detecting data fraud in

clinical, laboratory, and manufacturing operations. Mr. Avellanet served on

behalf of the US Department of Justice as the independent overseer for the

five-year, multi-million dollar Dr. Comfort Corporate Integrity Agreement

Industry reviewer for the international standard, BS 10008 Evidential

Weight and Legal Admissibility of Electronic Information (2015)

Lead expert for the ISPE GAMP Data Integrity Working Group

Author of Get to Market Now! Turn FDA Compliance into a Competitive

Edge in the Era of Personalized Medicine (2010); co-author of

Pharmaceutical Regulatory Inspections (2014)

Prior to founding Cerulean, John spent more than 15 years designing,

implementing, and being accountable for quality systems and data

compliance programs for FDA, DEA, BIS, ICH, IMDRF, and ISO

[email protected]

www.ceruleanllc.com



Recent Resume Highlights

• Trainer for FDA and Health Canada on advanced data integrity inspecting

• Industry Expert Reviewer, BS 10008 Evidential Weight and Legal

Admissibility of Electronic Information

• Lead author of 2 certification courses for US RAPS

• Lead Expert, ISPE GAMP Data Integrity Working Group

• Independent Reviewer for DOJ-Dr. Comfort Corporate Integrity Agreement

• 2010 and 2011 Top 10 FDA Compliance Blog

• 2010 Top 50 Pharma/Biotech Blog

• 2009 and 2011 Best of Business Services Award

• 2008-2012 Guest Lecturer at NIH

• 2006 Lifetime Achievement Award – Who’s Who of Biopharma & Device

Executives

FDA Lean Compliance Consulting Services

• Streamline SOPs and policies

• Simplify Part 11 and Data Integrity compliance

• Perform audits for compliance and cost-effectiveness

• Develop FDA recordkeeping and corporate retention policies

• Conduct private training and corporate workshops

• Serve as consent decree IRO and litigation support

[email protected]

www.ceruleanllc.com


www.Ceruleanllc.com


thank you


Picture Credits

Photos, images and clip art that appear on these slides have been used to enhance this presentation and may NOT

be used for commercial or promotional purposes without permission from copyright holders.

Do not remove or copy from this presentation.

Contact:

iStockphoto.com

Shutterstock

Google Images

Cerulean Associates LLC


Documents

FDA Enforcement in 2018 - Medmarc...Industry reviewer for the international standard, BS 10008 Evidential Weight and Legal Admissibility of Electronic Information (2015) Lead expert