Device Quality Management Systems (QMS): Similarities, Differences, and Ramifications

[Ref.: Pharma Help Google+ Group]

There are two major quality system documents governing medical device development and commercialization. US devices must be compliant with 21 CFR 820. International devices must be compliant with ISO 13485, which is based on ISO 9001. These documents are similar but have distinct differences. Differences between requirements such as with design control are described. Assumptions for US FDA 510(k) submissions are discussed. Medical devices not meeting US FDA CFR 820 GMP requirements are termed “adulterated.” Part of the 510(k) submission is a “Truthful and Accuracy” statement in which a senior manager certifies the submission is truthful, accurate, and no substantial material has been purposefully omitted. FDA policy requires initial review within 15 days so that submissions should be complete at the time of submission. If incomplete, the FDA may refuse to accept a submission. Knowing which QMS is operable, under what circumstances, and in which markets, is critical to compliance and to the accuracy of subsequent documentation in meeting regulatory requirements. Understanding that though ISO 13485 and 21 CFR 820 QMS requirements have many similarities, they are different documents with different requirements and different regulatory oversight.

INTRODUCTION

In reviewing the many forums on medical devices, it becomes evident that there is still much confusion over which Quality Management Systems (QMS) are operable for medical devices. There are two major quality system documents governing medical device development and commercialization. Product sold in the U.S must be compliant with 21 CFR 820, the QMS Regulation/cGMP for medical devices. The international QMS, ISO 13485, which is based on ISO 9001, is the EU version of a QMS for medical devices. Product sold in the EU and desiring the CE mark must comply with the international QMS. Product sold in the U.S does not need to comply with ISO 13485 and vice versa for product sold in the EU.

Both 21 CFR 820 and ISO 13485 are very similar in their basic systems and documentation, and many companies develop a QMS that includes both. There are, however, differences between the two documents. With CFR 820, a company develops product under a defined design control system with prescribed documentation. Similar requirements exist in ISO 13485 under “Product Realization,” but they are somewhat more generalized as to how the requirements are documented as having been met. CFR 820 requires a Design History File (DHF) showing development over time. ISO 13485 requires that each requirement be documented, but there is no DHF requirement per se. The EU Medical Device Directives (EU MDD) requires a Technical file/Design dossier to show that the Essential Requirements of the MDD have been met. This requirement is a snapshot of the device at a point in time, not a compilation of the development history of the device under change control.

DESIGN CONTROL UNDER 21 CFR 820.30

Design control documentation under 820.30 addresses nine areas, all of which must be documented to prove compliance:

1. Design and Development Planning (the author recommends Gantt Chart to address this requirement)
2. Design Input
3. Design Output
4. Design Reviews
5. Design Verification
6. Design Validation
7. Design Transfer
8. Design Changes—all compiled into the
9. Design History File (DHF).

The goal of these requirements, implemented in 1996–1997, is to ensure that device R&D, from a reasonable company-defined start date, is performed using change control. The FDA correctly reasoned that many device problems are design problems and that uncontrolled changes during R&D in the past were the cause of many of the device non-conformances. These changes in turn lead to field problems once the device entered the marketplace. 

510(k) ASSUMPTIONS

When the device has been developed, if US 21 CFR 8XX-defined as Class II, a 510(k) must be submitted to the US FDA for review and marketing clearance. In the 510(k), the submitter certifies that they have complied with the CGMPs as defined by CFR 820, including 820.30 Design Controls in the design/development of the product. Such certification strongly implies that the applicable elements of CFR 820.30 have been completed/documented prior to design transfer and manufacture. The submitting company is not audited against them, however, at the time of submission. The US FDA may not perform compliance audits such as these until some later date (a year or longer); however, the FDA requires compliance from the start of serious development (CFR 820.30) and from design transfer/manufacture for lots destined for sale in the US. 

Thus, devices must comply with 21 CFR 820 (not ISO 13485) as far as sale in the US is concerned. The FDA 510(k) is an FDA review process for mainly Class II medical devices, as defined by the US CFR, not the EU Medical Device Directive—Council Directive 93/42/EEC, for marketing clearance in the US. The device must be manufactured under the US CGMP as spelled out in CFR 820, whether by a US company or offshore company for products for sale in the US. One of the 21 required sections of the “traditional” 510(k) submission, among other things, must indicate such. Some of the CFR 820 requirements are the Design History File (DHF); Device Master Record (DMR); Device History (batch record) (DHR); Production and Process Control (P&PC); Corrective and Preventive Action (CAPA), including complaints and Non-Conforming Material Report (NCMR); verification and validation (V&V), and so on. Much of the aforementioned is also addressed in ISO 13485 but often using different terminology. While CFR 820.30 requires a DHF (documenting product development and change control over time, meeting requirements of 820.30; classified under 21 CFR 8XX-series), the EU MDD requires proof of compliance in the form of a Design Dossier or Technical File showing device status as currently marketed and classified under the Annex IX Rules of the MDD.

While there are many similarities between these two major QMS, there are important differences in each QMS and related device requirements and classification. The US FDA does not currently accept ISO 13485 audits as indicating compliance to 21 CFR 820 and vice versa. Notified-Bodies, hired or contracted by the device manufacturer, audit for ISO 13485 compliance, while US FDA personnel, supported by the US taxpayer and device manufacturers in the form of fees, audit for 21 CFR 820 compliance, and so on. 

TRADITIONAL 510(k)

The traditional 510(k) must address 21 elements (see FDA.gov) with data submitted or summarized (or N/A) under each of the 21 elements. Some of the FDA forms required in the 510(k) submission help the submitter through specific documentation requirements by means of checklists or data completion forms. US FDA Guidance documents exist for many devices and their requirements including specific software / firmware documentation requirements. These provide helpful information when involving similar products. The FDA 510(k) database on fda.gov can provide information on the predicate devices. Both the EU and US require hazard analysis with both using ISO 14971 as the de facto standard. Both require biocompatibility studies per ISO 10993 if applicable. The same applies to device sterilization if applicable. Other ISO standards are also accepted/required as applicable by both. When using an outside consultant to generate or review 510(k) documentation or CGMP QMS system, it must be done in accordance with 21 CFR 820 (not ISO 13485) for medical devices for sale in the US.

While some contend that CFR 820 is not relevant to the 510(k) process, the author strongly disagrees. All product for sale in the US must be manufactured under the FDA CGMPs, which is 21 CFR 820 and not ISO 13485. The device must be developed under CFR 820.30, and documented under the documentation/records requirements of CFR 820, which defines the company QMS for US marketed product. The test samples used for the testing required under the 510(k)—functional, predicate comparisons, biocompatibility, shelf life, sterility, and similar—must be so manufactured and documented. All of this is understood by the FDA and should also be understood by the submitter. Those documents must then be retained for the life of the product and at least two years beyond the last date of shipment. The documents are subject to future FDA auditing after that device is marketed in the US since it has been cleared in the 510(k) review process.

ADULTERATED MEDICAL DEVICES

Anything less than meeting the above documentation requirements leads the FDA to term the resultant device "adulterated," i.e. not proven/documented to have been manufactured in accordance with CFR 820 CGMP requirements. In fact, if a company had developed a US Class III (PMA) device, that company would have to provide the FDA a detailed description of its QMS, as defined by 820, in its pre-market approval (PMA) submission. In support of this, see the FDA’s general reference at: 

http://www.fda.gov/medicaldevices/deviceregulationandguidance/howtomarketyourdevice/premarketsubmissions/premarketapprovalpma/ucm050384.htm, which in part states the following:

All manufacturers (including specification developers) of Class II and III devices and select Class I devices are required to follow design controls [§820.30] during the development of their device. The design control requirements are basic controls needed to ensure that the device being designed will perform as intended when produced for commercial distribution.

TRUTHFUL AND ACCURATE

Part of the 510(k) submission is a Truthful and Accuracy statement in which a senior manager certifies the submission is truthful, accurate, and no substantial material has been purposefully omitted. While one can argue that this only applies to the data in the 510(k), this author submits that, since the FDA expects the above to have been done on the test samples and will be done for production, agreement to those facts is also included in signing such a certification. During a manufacturer’s first US FDA CGMP compliance audit after marketing, the company will be audited per FDA QSIT (Quality System Inspection Technique) on its highest risk product, including its 510(k) (or PMA) and its DHF (per 820.30) along with other applicable parts of 820. In fact, failure to follow such requirements would prevent accurate CAPA (Failure Investigation, Root Cause Analysis), P&PC (process improvements over a device's life cycle) and similar continual improvement, as well as assurance that the product in the field is safe and effective and as cleared (510[k]) or approved (PMA). 

This column is not saying a 510(k) requires providing information on a company's QMS, and it does not imply any pre-approval QMS inspection for devices. The device must, however, have been developed under CFR 820.30. Proven by the test data, the data supplied in a 510(k) pertaining to its SE (substantial equivalence) to the predicate must be performed on product manufactured under such a QMS (CFR 820), as does all subsequent product. The FDA will then audit such data during a future audit. 

Implied in the use of the term "certify" pertaining to the 510(k) as mentioned above, the truthful and accurate statement should be viewed as providing such certification. The author has successfully submitted numerous 510(k)s for clients to the FDA. Some FDA reviewers request copies of a submitter’s SOPs defining the manufacturing and testing requirements and proof of meeting the CGMPs for the device in the 510(k). That is not to say this approach is the only way, but it is one approach that has passed repeated tests with FDA reviewers. It is also the approach the author makes clear to clients before agreeing to accept an assignment. 

KNOW WHICH QMS IS OPERABLE

While adherence to CFR 820 should be obvious, the discussion on applicable internet forums and many consultants’ experiences with clients desiring to submit a 510(k) shows that is often not the case. Further, anybody can interpret the 510(k) requirements in several ways (including different FDA reviewers/staff—see the FDA’s 510(k) Report of August 2010). A potential submitter should be aware of all the issues/expectations in such a submission—implied as well as stated.

If specification developers are separate from engineering and manufacturing, then some combination of them or the ultimate owner will be responsible to ensure that the applicable CGMP requirements are met, documented, and available for audit. These different entities are listed in the 510(k), although their respective QMS documentation responsibilities are not listed but are nonetheless required.

COMPLETE SUBMISSIONS

Years ago, 510(k) with a few missing data points could be submitted and the intervening 90 days could be used to "fill in the blanks" that had to be completed prior to going to market. This is no longer an option since under current FDA policy; the submission is now immediately reviewed (within 15 days). Review uses its Acceptance Checklist, filled out and included as part of the submission, and a defined time period is given to address any problems, or the submission is Refuse to Accept (RTA), the fee is lost, and a new submission is required. See the following:

http://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm315014.pdf

If questions pertaining to the submitted data still exist after the applicant successfully meets the RTA process, then there is usually an automatic 180-day extension granted by FDA. This means the basics have already been addressed during that initial RTA check. If such questions involve some issues with 820.30 data or other issues such as basic product verification, validation, functional testing, biocompatibility, sterilization, etc., they may not be able to be addressed acceptably within the deadlines stated by the FDA. It is much better to have all work done prior to submission so that any extra review time granted can be used to address other specific device issues. 

CONCLUSION

Knowing which QMS is operable, under what circumstances, and in which markets, is critical to compliance and to the accuracy of subsequent documentation in meeting regulatory requirements. Understanding that though ISO 13485 and 21 CFR 820 QMS requirements have many similarities, they are different documents with different requirements and different regulatory oversight. Understanding these differences will prevent errors and omissions, insure a common ground for discussion, and ensure the necessary compliance as proven by the documentation. 

GLOSSARY

510(k): A 510(K) is a premarket submission made to FDA to demonstrate that the device to be marketed is at least as safe and effective, that is, substantially equivalent, to a legally            marketed device that is not subject to premarket approval (PMA).

CDRH: US FDA Center for Devices and Radiological Health

CGMPs: Current Good Manufacturing Practices (Devices 21 CFR Part 820 Quality System Regulations; Drugs 210/211; Biologics 600- 680; and HCT/P 1271)

CFR: US Code of Federal Regulation

DHF: Design History File (21 CFR 820.30)

DHR: Device History [batch/lot] Record (21 CFR 820.184)

EU MDD: European Union Medical Device Directives

FDA: United States Food and Drug Administration

ISO: International Standards Organization 

PMA: FDA Pre-Market Approval (for the majority of Class III devices, involving clinical data)

QA: Quality Assurance

RA: Regulatory Affairs

R&D: Research and Development 

SOP: Standard Operating Procedure