Compliance Gurus had the unique opportunity to work with a small medical device company located in Massachusetts. The company was faced with many challenges. The first challenge was they wanted to get their product on the shelves of a major retailer. However, in order to do so, they had to pass a series of GMP audits by a third party contracted out by the retailer. Compliance Gurus Inc. was called in at this point to help assess and prepare for the audit. The second challenge the company faced was they had no QA department and very little understanding of the Code of Federal Regulations, especially 21 CFR Part 820. The third challenge the company faced was a lack of resources. These three challenges combined, made the task at hand seem impossible at first.
Like so many small to medium sized companies, a QA department doesn’t exist, nor does the company understand they are required to comply with aspects of the Quality System Regulation, 21 CFR Part 820. In some events, the QA Department consists of one individual that reports up into operations. Unfortunately, this is not considered an independent QA unit (QAU) so this poses a risk to an organization, as it jeopardizes the integrity of the QAU. In any event, in this case, there was no QAU, therefore, the company had to find a Quality Assurance function without having to hire a full-time employee. Subsequently, the company decided to outsource their Quality Assurance function to Compliance Gurus Inc.(CGI)
Once Compliance Gurus Inc. was engaged, we immediately sat down with the company’s key stakeholders to discuss their challenges and goals. There biggest goal was to get their product on the 7,000 shelves of a major US retailer. However, their challenges were a lack of resources and no Quality Assurance Unit (QAU) to guide them through the process.
First, CGI suggested that we assess their current Quality System so that we may put a stake in the ground and start our efforts somewhere. We performed the assessment and found several deficiencies throughout the Quality System. We then sat down with the company’s stakeholders and discussed the findings and why they were considered non-compliant with 21 CFR Part 820, Quality System Regulation. The company’s stakeholders were surprised they were so much out of compliance with what the federal government requires of them. We assured them that is was nothing we had not seem before and that we could help guide them throughout the process to compliance. The immediate concern of the company stakeholders was the lack of resources to be able to implement the solution.
The company had a small budget to work with. Each month they only had so much money to allocate toward their road to compliance. CGI suggested a phased approach to compliance. First, we suggested that we prioritize the audit findings in a manner that is mindful of both the budget and compliance. In other words, we said, “Let’s look at how our client can get the biggest bang for their budget.” So, we decided that the generation of a Quality Policy and Standard Operating Procedures was a good place to start, as these would serve as the foundation of their Quality System and would also be likely to be asked for during an audit. There is a very important point to make here before we dive too deep into the implementation.
The federal regulations are strict, but also flexible in that an organization must weigh the risk their device or product presents against what is required in the regulation itself. Any FDA investigator will tell you that you must take a risk based approach when adhering to the regulations. Now, if you are a small medical device manufacturer whose device does not present a significant risk to the consumer, then you have to weigh that risk against how you will interpret and apply the code of federal regulations. This is exactly what we suggested and implemented for our client. Our client manufactures a class II dental device, not a surgical implant device, therefore, there was a lower risk involved and more flexibility within the regulations. I cannot stress the importance of this correlation, as it is what I like to refer to has a “reasonable approach” and no investigator can fault you for taking a reasonable approach toward compliance. I always say that a good consultant is one that can recommend a reasonable approach, not an approach that is unreasonable and costly. Now, back to the implementation.
First, we started out with a Quality Policy that would serve as the umbrella document for all of the standard operating procedures (SOPs). In the Quality Policy we mapped out the most important and applicable aspects of 21 CFR Part 820, weighed the risk against the device, then decided on whether or not to include a section on that particular part of the regulation. Next, we prioritized the audit observations relating to the physical condition of the manufacturing facility.
We targeted the general housekeeping observations, as they do not cost much to address and are necessary to make a good impression for an auditor. Subsequently, we targeted the areas closest to the manufacture of the finished device, as we seen these as high-risk areas. Then, we addressed the manufacturing areas leading up to the manufacture of the finished device. Taking this approach with prioritizing the finished device areas first made sense from a compliance risk and budget perspective. Targeting the high-risk areas gave our client the most value for their budget. Next, we target the Standard Operating Procedures (SOPs).
We created SOPs according to our interpretation of 21 CFR Part 820 coupled with the level of risk the device presented. The following is a list of some of the SOPs we created: Complaint Handling, Equipment and Facility Cleaning, Medical Device Reporting, Change Control, Product Release, Nonconforming Product, and Device Recall.
In conclusion, it is essential to remember a few points when implementing a Quality System. Weigh the risk your device presents against the regulations so you can achieve the right balance of compliance and business requirements. Ensure your Standard Operating Procedures adequately address the applicable requirements in the predicate rules. Finally, take a reasonable approach and do not go overboard.
