Embed Size (px)
Citation preview
HPRA Market Surveillance Activities:
Audit Process and Common Issues
Paul Moody, Inspector
Kevin O’Malley House, Earlsfort Centre, Earlsfort Terrace, Dublin 2.
23rd October 2014
Contents of this Presentation
• Compliance Department Responsibilities
• Auditing of Medical Device Manufacturers
• Common Non Compliances
• Notified Body Unannounced Audits
• Applications for Certificates of Free Sale for Medical Devices
• Sample Non-Compliances
2 21/10/2014
Compliance Department Responsibilities
• Inspection of manufacturers (H & V) and wholesalers (H); GCP & PhV
• Authorisation / Licensing for manufacture, wholesale activities
• Sampling and Analysis Programme
• Medical Device (MD) audits
• Enforcement (H & MD)
• Quality Defects, Recalls & Market Compliance
• Advertising Compliance
• Issue of Export Certificates (H, V, MD, Cosmetics)
• Issue of GMP Certificates (H & V, Cosmetics)
• Blood, Tissues, Cells & Organs Directive functions
• Controlled Drugs Licensing and Inspection
• Cosmetics
• Advice to Government
21/10/2014 3
Medical Device Audits
• Two types:
– Manufacturer Audits
– Notified Body Assessments
• Notified Body Assessments outside the scope of this
presentation
21/10/2014 4
What is a Manufacturer?
• MDD 93/42/EEC:
– ...person with responsibility for the design, manufacture,
packaging and labelling of a device before it is placed on the
market under his own name, regardless of whether these
operations are carried out by that person himself or on his
behalf by a third party.
– ...also [applies] to the ...person who assembles, packages,
processes, fully refurbishes and/or labels one or more ready-
made products and/or assigns to them their intended purpose
as a device with a view to their being placed on the market
under his own name...
• This includes Own Brand Label Device Manufacturers (OBL)
21/10/2014 5
HPRA Medical Device Audits
• Conduct post market surveillance in relation to public health.
– forms part of the HPRAs review of manufacturers compliance to the EU Directives and related Irish legislation.
– ensures that the medical device manufacturer or Notified Body is complying with the essential requirements and schedules of the Medical Device Directives and related Statutory Instruments.
• Two types of audit
– Proactive surveillance
– ‘For Cause’ audit
21/10/2014 6
Proactive and ‘For Cause’ Audits
• Proactive Surveillance Audits:
– carried out dependant on what the HPRA deems appropriate
e.g. targeted audits in relation to a specific category
• ‘For Cause’ Audits:
– as a result of a market issue, which requires market follow up in
the interest of public health
21/10/2014 7
Proactive Surveillance Audits
• Proactive surveillance is carried out based on a number of
factors.
• Manufacturers and Authorised Representatives
• Can include targeted audits in relation to a specific family of
device.
– Custom-made GMDs
– Class I GMDs
– General category IVDs
– Systems Procedure packs
21/10/2014 8
Proactive Surveillance Audits
• Risk based approach and can be initiated from a number of
sources:
– Post-market surveillance / compliance plan
– Post-market surveillance sampling across a specific
technology/sector
– Changes in legislation
– The HPRA medical devices registers
– Any other sources that may arise from time to time
21/10/2014 9
‘For Cause’ Audits
• Reactive audits where there is potentially a serious risk to
public health.
• These may be initiated from a number of sources including:
– concerns raised in relation to vigilance or compliance issues
– receipt of information from internal or external sources e.g.
requests from other CAs
– warning letters or complaints
– Complaints or information received from Notified Bodies
– Complaints or information received from members of the public
– Any other sources that may arise from time to time
21/10/2014 10
Proactive Surveillance Audit
• Audit notification issued
– Documentation requests
– General audit plan
– To be submitted within 2 weeks of the notification
• Procedure Requests
• Technical File Request – Area identified
• Brief company profile
• List of products manufactured
• Details of the Notified Body (if applicable)
• High level manufacturing flowchart
21/10/2014 11
Audit Scope
• Compliance to Directives / S.I.s / MEDDEVs
• Proactive Surveillance
– Manufacturing Activities
– Technical Documentation Reviews
– Post market surveillance
• Complaint handling
• Vigilance/Field safety corrective actions
– Quality Management System
21/10/2014 12
‘For Cause’ Audit
• Announced or Unannounced
– dependant on the risk to public health.
• Audit team usually consists of medical devices auditor and technical expert(s).
• Scope is focussed on area of interest with supporting
systems
21/10/2014 13
Onsite: Opening Meeting
• Opening Meeting - conducted by lead auditor
– Introduce the auditors / technical experts and their roles
– Confirm the audit objectives, scope and criteria
– Explain the requirements under the legislation
– Confirm the audit plan
– Indicate the methods and procedures to be used, including the
fact that the audit evidence is only a sample of the information
available
– Confirm that audit findings will be kept confidential during and
after the audit (e.g. Article 20 of MDD 93/42/EEC)
– State the method of reporting and the grading of non-
compliances
21/10/2014 14
14th April 2011 Slide 15
Non-Compliances
• Non-compliance
report presented at
close-out meeting
• Signature of auditee
and auditor
15
Categories of NCs: Manufacturer Audits
Major: where the relevant essential requirements or any part of the Medical Device Directives or related Irish transpositions or related amendments have not been appropriately applied and / or which may result in a significant risk to public health. Corrective action required within a short agreed timeframe.
Minor: where the relevant essential requirements or any part of the Medical Device Directives or related Irish transpositions or related amendments have not been appropriately applied. The severity of a risk of a minor non-compliance would be significantly less than a major non-compliance. Corrective action required within an agreed timeframe
21/10/2014 16
Categories of NCs: Manufacturer Audits
Comment: A mechanism to prompt the manufacturer to
improve future practice and does not always
require corrective action. While the HPRA
should not necessarily insist that the
manufacturer acts on any comments raised it is
always sensible to discuss them and where
possible agree a process of implementation
21/10/2014 17
Audit Conclusion
• 4 to 6 weeks for responses
• The manufacturer’s responses are received & reviewed
– Root Cause(s)
– Corrective Action(s)
– Target Date(s)
• Notify HPRA if date changes.
• Responses Satisfactory:
– Close out audit
– Close out letter is sent to manufacturer
21/10/2014 18
Audit Conclusion
• If the responses are Not Satisfactory:
– Request further information
– Follow-up audit
– Discuss removal of the medical devices from the market and the risk to public health
– If the issue cannot be resolved and the non-compliances are not satisfactorily addressed, further action may be taken which may involve the use of the enforcement power
21/10/2014 19
Most Common Findings
• Lack of / Inadequate Vigilance & FSCA Processes
– Complaint Handling
– Vigilance reporting timelines
• Risk Analysis (pre & post market)
– Assessing to outcome
– Feed back from other Quality System Elements
• Qualification and maintenance of Contract Manufacturers
– No process in place
– No Supplier maintenance process
21/10/2014 20
Most Common Findings
• Process Validation
• Cleaning Validation
• Procedures and Records
– Not following procedures
– Accuracy of records
21/10/2014 21
Most Common Findings (Custom Made)
• Lack of / Inadequate Vigilance & FSCA Processes
• Lack of/Inadequate Complaint Handling
• Control and lack of material traceability
• Failure to provide Custom Made Device Statement for named
patients
21/10/2014 22
Most Common Findings (Authorised Rep)
• Access to manufacturer documentation
• Access to Technical Files
• No Designation of Authority from Manufacturer
• Weak Contractual Arrangements
• Lack of / Inadequate Vigilance & FSCA Processes
• Lack of/Inadequate Complaint Handling
21/10/2014 23
General References
• Medical Device Directive 93/42/EEC, as amended,
• Active Implantable Medical Device Directive 90/385/EEC, as
amended
• In-vitro Diagnostic Medical Device Directive (IVD) 98/79/EC
• S.I. No. 252 of 1994 European Communities (Medical
Devices) Regulations 1994, as amended
• S.I. No. 253 of 1994 European Communities (Active
Implantable Medical Devices) Regulations 1994, as amended
• S.I. No. 304 of 2001 European Communities (Medical
Devices) Regulations 2001, as amended
21/10/2014 24
HPRA Device Guidance Documents
• HPRA Medical Device Manufacturer Audits
• System and Procedure Packs
• Custom Made Dental Devices
• Custom Made Device Manufacturers
• In-vitro Diagnostic Devices
• Class I Manufacturers
• Vigilance System
21/10/2014 25
Other References
• NBOG Guidance -notified body obligations with
manufacturers
• MEDDEVs
• IMDRF
21/10/2014 26
Notified Body
Unannounced Audits
Notified Body Unannounced Audits
• Provision stated in the MD directives
• Commission Recommendation 2013/473/EU
– Establish a practice for Unannounced Audits
– Annex III
• At least once every three years
• Not cyclical
• NBs have initiated programs
• Risk Based approach to frequency and priority
• Team NB Guidance is under draft
21/10/2014 28
Certificate of Free Sale
Application Issues
Application for Certificates of Free Sale
• Some issues with recent applications for Class II and Class III
devices:
– Authorised Representative (AR) must be approved by the NB
and evidenced through
• Design Examination Certificate
• Full Quality Assurance Certificate
• AR must be named on the certificate and include address in ROI
– Copies of Labeling and IFU are required to support application.
– AR must be registered with the Companies Registration Office.
• Guidance document available on the HPRA website
21/10/2014 30
21/10/2014 31
Appendix: Sample Non-
Compliances
Sample NCs: Supplier Controls
• The Supplier Qualification process as was considered
deficient with respect to:
– Criteria for categorisation of suppliers was not defined
– Criteria for management of suppliers was not defined
– Criteria for selecting suppliers for audit was not defined. At the
time of the inspection, no supplier audits had been performed.
– Procedures for auditing and audit resolution were not defined.
– Criteria for disqualification of suppliers was not defined.
– Criteria for the periodic evaluation of suppliers was not defined.
21/10/2014 33
Sample NCs: Supplier Controls
• The Supplier Qualification process as was considered
deficient:
– No requirement for supply/quality agreements
– No defined criteria for the qualification of external auditors to
conduct supplier audits
– Non Compliance levels; Major, Minor, other were not defined
– No definition of poor supplier performance within the
procedure in order to delist suppliers
– Inadequate review or documentation relating to close out of
vendor audits.
21/10/2014 34
Sample NCs: Supplier Controls
• The Supplier Qualification process as was considered
deficient:
– Management of conditionally approved suppliers and the
process for the approval or rejection was not described within
the procedure
– Close out of audits when performed by third parties was not
described
– It was not clear that the audit scope of <company> would be
included when supplier audits were performed by <corporate>
group.
– It was not clear how supplier ratings related to the approval
status of the ASL
– The procedure did not describe when a supplier would not be
considered acceptable.
21/10/2014 35
Sample NCs: Supplier Controls
• The 2013 annual supplier performance evaluation for <company>
stated that the supplier’s current status was Approved. However,
the supplier was only provisionally approved. Further to this the
Approved Supplier Listing stated that the supplier’s status was
Historical Approval.
• The supplier audit for <company> had not been completed as per
Supplier Audit Schedule. Management Review minutes from
<time> incorrectly stated 100% of supplier audits had been
completed on-time. The minutes also stated that <company> were
to remain on the audit schedule but did not justify why the audit
had not yet been completed nor that the audit required to be
rescheduled
21/10/2014 36
Sample NCs: Supplier Controls
• Quality Agreements were not in place for all suppliers and
this was not justified. For example, <Device> supplied by
<contract manufacturer>. Further to this, there was no
system in place for periodic review of agreements to ensure
their accuracy.
21/10/2014 37
Sample NCs: Supplier Controls
• In relation to incoming material checks, the following was
considered deficient:
– Approved Supplier lists did not contain the approved addresses
– Incoming material was not subject to cross reference with the
approved suppliers list.
– Manufacturer information (docket and labels) was not verified
upon receipt of material
21/10/2014 38
Sample NCs: Complaint Management
• In relation to complaint investigations, the following was
considered deficient:
– Complaint process timelines not adhered to
– There was no documented justification for not filing vigilance
incident reports.
– There was no consideration to considering delays in
treatment/diagnosis as indirect harm
– No documented evidence of the assessment of the clinical
impact of the issues within the file.
Note: Should only be done only by persons qualified to do so.
21/10/2014 39
Sample NCs: Complaint Management
• In relation to complaint investigations, the following was
considered deficient:
– No documented link between FSN/FSCA and associated
complaints
– The input of post-production data to the risk management
process was not adequately described in the relevant
procedures e.g. risk management, post market surveillance,
customer complaints, CAPA, etc.
– Complaints were not subject to periodic trending based, for
example, on product family.
– The <procedure> did not reference the revision of MEDDEV
2.12-1
21/10/2014 40
Sample NCs: Vigilance Reporting
• In relation to Vigilance Reporting, the following was
considered deficient:
– The complaint procedure stated that only <Type A> complaints
were assessed for vigilance reporting. The company did not
consider that issues associated with <Type B>complaints may
also meet vigilance reporting criteria.
– The rationale for not conducting a field safety corrective action
(FSCA) and not issuing a field safety notice (FSN) to users who
had received affected product in complaint files relating to
mislabelled instructions for use were not appropriately
documented.
– Complaints were not reported to the Competent Authority
where required and this was not justified
•
21/10/2014 41
Sample NCs: Vigilance Reporting
• In relation to Vigilance Reporting, the following was
considered deficient:
– The communication issued to customers as a result of <complaint file>
relating to an incorrect expiry date on the instructions for use was not
issued in the appropriate FSN format, nor was the issue reported to
relevant Competent Authorities as a FSCA. There was no appropriate
rationale documented on the file for not issuing an FSCA and FSN.
– In a number of complaint cases, the customer was requested to discard
the lot and a replacement lot was sent to customers. This was not
considered a field action by the company.
21/10/2014 42
Sample NCs: Manufacturing Controls
• In relation to material and product storage, the following
was considered deficient:
– The acceptable storage warehouse temperature range was
defined as 0-30°C. It was noted that the upper temperature for
<product> was 27°C
– The acceptable storage warehouse temperature range was
defined as 15-25°C. It was noted that the upper temperature
for <another product> was 22°C
– 20-30°C storage areas were not alarmed.
– Product and material storage areas were not subject to
temperature mapping. E.g. cold rooms and the ambient
warehouse.
–
21/10/2014 43
Sample NCs: Manufacturing Controls
• In relation to material and product storage, the following
was considered deficient:
– There was no temperature monitoring in the production area or
ambient warehouse and the impact of this on products stored
and had not been established.
– There was no justification for the lack of temperature
monitoring during transport of cold chain components used in
the finished kit
– The status of materials within the finished product cold room
and freezers were not identified as appropriate e.g. quarantine,
released etc
21/10/2014 44
Manufacturing Controls: Process Validation
• In relation to process validation, the following was
considered deficient:
– The validation approach was not consisted with that of the
Validation Master Plan
– The approach to validate unit operations and not the process in its
entirety was not adequately justified within the documentation
reviewed
– All critical steps were not validated e.g. machine speeds
– Process Mixing validation, hence solution homogeneity and the
associated validation of the sample taken was not considered to
have been demonstrated
– Solution homogeneity had not been demonstrated for batches.
Records did not require the recording of mixing parameters and
this was not justified.
21/10/2014 45
Manufacturing Controls: Process Validation
• In relation to cleaning validation, the following was
considered deficient:
– Cleaning processes had not been validated
– Reusable scoops for commercial product were permitted to be
utilised in the preparation of R&D materials and these had not
been subject to cleaning validation for the R&D components as
appropriate.
– It was permitted to store dirty equipment for undefined
durations and the subsequent affectivity of the cleaning process
was not justified.
– It was permitted to store clean equipment in close proximity to
dirty equipment.
– Cloths stated to be clean were visibly dirty.
21/10/2014 46
Sample NCs: Material/Product Segregation
• Material and personnel flows within the manufacturing
facility had not been risk assessed and this was not justified
• The filling line clearance process was not considered to be
sufficiently detailed to enable consistent line clearances to
be performed.
• Inappropriate segregation of material was observed on the
filling lines in that two products were under fill in <area>.
Both utilised the same reagent container closure. An
unlabelled work in progress tote containing filled units was
observed between both filling stations.
21/10/2014 47
Sample NCs: Documentation
• The filling line opening criteria had not been completed. For
example, the label reconciliation form, Alarm Sheet, and
cleaning record for the filling machine were not documented
as being present and appropriately completed. The section
had been reviewed, the batch released. It was noted that the
associated forms were not present within the batch file.
• Executed batch records were not subject to Quality review
and this was not justified.
• Batch records were observed to be signed as completed
without documentation of the final material quantities
recorded.
• Expired materials, while in a quarantine area, did not have
their approved status labels defaced.
21/10/2014 48
Sample NCs: Documentation
• The address listed on delivery note from <supplier> was not
current.
• Technical File <for a product> declared conformance to the
incorrect standard (not to the appropriate harmonised
standard)
• The Declaration of Conformity for <product> declared
conformance to the obsolete standards
• The CE marking procedure incorrectly stated that
<company> Notified Body was <A> and not <B>.
21/10/2014 49
Sample NCs: Quality Management
• Construction of a new <room> within the area currently
utilized for manufacturing was not subject to change
management.
• Those risk assessments reviewed were not subject to
periodic review. Further to this, there was no mechanism to
ensure periodic trending, such as complaints or deviations
fed back to product risk assessments as appropriate.
21/10/2014 50
Sample NCs: Authorised Representative
• The roles and responsibilities of <company> and <AR> were
not adequately described within all relevant documents
reviewed.
• There was no letter of Designation of Authority from
<Manufacturer> to <AR>
21/10/2014 51
Sample NCs: Custom Made Devices
• There was no system for tracebility of materials to the patient
level
• There was no statement that the product was a custom
made device for the exclusive use of a specific patient.
• There was no system in place for documenting complaints or
reporting vigilance cases to the HPRA.
21/10/2014 52
