Medical Device Link.

Originally Published MX January/February 2006

INFORMATION TECHNOLOGIES

An integrated approach to data management can help executives align their company’s compliance activities and business goals.

Karim Lokas

Although the ins and outs of medical device manufacturing sometimes seem far removed from top-level executive board discussions in medtech companies, the impact of what happens on the manufacturing floor is far-reaching. Many organizations operate as if regulatory compliance and the business objectives of the enterprise were separate entities, when in fact they inextricably intertwine.

It isn't very hard to find examples of the close association between a medtech company's regulatory compliance and its business standing. The proposed megadeal for industry giant Johnson & Johnson (New Brunswick, NJ) to acquire Guidant Corp. (Indianapolis) has been severely affected by just such issues.¹ In May 2005, questions about the safety of Guidant's line of implantable cardioverter-defibrillators and pacemakers began to emerge, leading to regulatory inquiries and ultimately the recall of nearly 300,000 devices. As a result, Guidant's reputation has suffered, and so has its value. After months of tense discussions and the beginnings of litigation, J&J renegotiated its offering price to $21.5 billion, about 15% less than the original deal price. At the eleventh hour, Boston Scientific (Natick, MA) has made a bid to purchase Guidant for $25 billion, thereby overtaking J&J and restoring much of the company's lost value. But neither offer is a done deal yet (closure of some agreement is expected in the first quarter of this year), and Guidant shareholders will have to consider themselves lucky if they are able to sidestep the damage initiated by the company's compliance failures.

Incidents on the scale of the J&J– Guidant–Boston Scientific episode are rare, but similar episodes occur frequently among medtech companies. For medical technology executives, such events underscore the importance of regulatory compliance and demonstrate its powerful effect on an organization's reputation and bottom line.

To avoid similar fates, medical device manufacturers can act strategically by integrating quality into their manufacturing and business practices. To do this, organizations must first make themselves aware of industrywide points of weakness by examining areas where medical device manufacturers traditionally fall short. Then, medical device manufacturers can effectively implement tools that convert those points of weakness into strengths for the organization. By using current technology to create a manufacturing compliance platform, medical device manufacturers can build compliance into their manufacturing processes, and use that same platform to capture key data that the organization can use for both compliance purposes and business performance metrics. Such a tool helps executives protect their organization and enables them to stand before their investors with confidence and transparency, and to demonstrate how the strength of their quality process translates into fiscal stability for the organization.

Warning Letters and the Bottom Line

When an FDA field inspector provides a medical device company with a list of problems observed during a plant inspection (a form FDA-483), most organizations recognize that it is prudent to submit a detailed reply outlining how the organization will solve the immediate problem and what measures it will take to address the root problem at the system level. Since any information FDA procures from inspectional observations can support later allegations, follow-through at the system level can help companies to avert further FDA action.

Medtech companies rightly take FDA warning letters even more seriously. Warning letters are very serious notifications issued to organizations that have manufactured adulterated devices or have not addressed a noncompliance related to the requirements of FDA's quality system regulation (QSR).² Once a manufacturer receives an official FDA warning letter, it typically has just 15 business days to address the problem. Responding to the letter usually necessitates the preparation of a costly, complicated, lengthy document that provides the logical basis and details of the organization's plan to remedy the problems responsible for its flawed product or noncompliant process.

If the manufacturer does not address the areas outlined in the warning letter, FDA will take action against the firm, the product, and the responsible individuals. Failure to act promptly to correct infractions listed in FDA-483 forms and warning letters could ultimately result in FDA seizing goods, declaring products misbranded, issuing injunctions, demanding product recalls, and closing facilities. Moreover, FDA can seek to impose civil and criminal penalties extending to multiple levels of management within the accused organization.

FDA publishes all warning letters on its Web site and uses them as a tool for communicating with the medical device community at large.³ Such public disclosure builds a good source of information for manufacturers seeking to identify potential weak spots in their own processes. On the other hand, making company failures a matter of public record is also a source of grave embarrassment—and worse. Multiple warning letters or, in some cases, even a single warning letter can mar an organization's reputation to an extent that it loses investors, experiences declines in stock value, or sees its sales and market share plummet. Such diminishing numbers make it tough for company executives to make financial requests of their investors and can hinder aspirations to go public or split stocks.

In addition to the sometimes-irreparable damage that a company's reputation can suffer, an unfavorable FDA investigation can cost a company a tremendous amount of time and money. This can be the case even when a company proves itself compliant with FDA requirements.⁴

Even a device company with great quality practices should be aware that if those practices are not transparent to FDA, the company could face a damaging investigation.

Identifying Weak Points

Figure 1. Analysis of warning letters issued to medical device manufacturers by FDA's Center for Devices and Radiological Health (CDRH) in 2004, citing top 10 QSR violations by area. Source: CDRH. (click to enlarge)

In 2004, FDA's Center for Devices and Radiological Health (CDRH) issued 38 warning letters to medical device manufacturers, all together citing more than 180 separate violations of the QSR (see Figure 1). Although the warning letters covered all areas of the QSR, warning letters for some areas of quality were much more prevalent, indicating a weak spot for manufacturers.

Most of the CDRH warning letters involved corrective and preventive action (CAPA) violations, which represented 20 of the findings resulting in warning letters. Also high on the list of violations were problems with design controls, insufficient process validation, and complaint handling. Rounding out the top 10 reasons for the issuance of warning letters in 2004 were violations in the areas of medical device records; management issues; misbranding; quality audits; receiving, work-in-progress, and final-goods acceptance; and production and process controls (PAPC). Most of the warning letters FDA issued revealed more than one finding and often represented multisite inspections.

When devising strategies to address quality and regulatory compliance, executives should look at these industrywide points of weakness and ask themselves some tough questions, particularly if they are in receipt of a form FDA-483 observation. If facing a CAPA violation, for example, executives should look at similarities and differences between their own organization and organizations that have received warning letters with similar findings.

CAPA violations can result from myriad causes. If the finding behind the violation is a common one faced by several device manufacturers, company leaders should try to determine why multiple organizations fall short in that area. Such CAPA violations might represent simple documentation problems or could stem from more-complex work flow management issues. Conversely, a high number of CAPA violations in a given year might just reflect FDA's view that the area is highly significant and that it is an area of intense FDA scrutiny. Analyses such as these can help manufacturers successfully position themselves in key regulatory compliance areas.

While an individual warning letter to top management serves as a stringent reminder of executive responsibility, it also provides upper management with a snapshot of the perceived weaknesses in their organization's quality policy. However, by analyzing the weaknesses of the industry to see what other manufacturers are struggling with, organizations can stay steps ahead of FDA—and the competition.

Devising a Quality System

FDA's QSR presents the medtech industry with multifaceted challenges and documentation requirements, which companies must balance against the costs involved in compliance and the risks related to noncompliance. According to FDA, executive responsibility for such decisions resides with senior executives who have the authority to make changes to the company's quality system and quality policy. Similarly, it considers anyone who has responsibility for establishing or maintaining QSR compliance, or for reporting those items to executive management, to be a management representative.

An organization's quality policy consists of the guidelines established by management with executive responsibility to express the intent and direction of the organization concerning quality. The quality policy includes the organization's plan, management review procedures, audit procedures, and instructions and procedures for its quality system. Of great importance is the fact that FDA has the authority to hold executive and management-level individuals directly and individually accountable when a defective product hits the market, and these individuals further have an obligation to protect their organization, their customers, and their shareholders.

FDA examines overall how the organization puts into practice all of the aforementioned plans and procedures in the context of the company's quality policy and objectives. Therefore, a thorough FDA inspection necessarily includes an appraisal of the company's organizational structure, management representatives and reviews, and system for quality audits. Lastly, these FDA inspections focus on maintenance, specifically evaluating the potency of the organization's plans and structures designed to maintain the quality system.

FDA has an inspection tool to help it accomplish consistently robust inspections. Developed by senior-level FDA individuals at both CDRH and the Office of Regulatory Affairs, the quality system inspection technique (QSIT) was designed to help field investigators assess medical device manufacturers' compliance with the QSR.⁵ A QSIT evaluation first looks at management and proceeds to an analysis of design controls, CAPA, and PAPC, and then ties these back to the management level again. Using this inspectional guidance, FDA assesses the quality system of an organization from the top down, looking at how the organization designed its overarching quality system.

Because of the inherent liability placed upon individuals with executive responsibility, it is imperative that they implement a system upon which they can rely. In other words, company executives must ensure that they have a quality system that they can depend on to help their organization meet regulatory requirements. Similarly, executives also desire a quality system they can rely on to provide them with the real-time information necessary to oversee the day-to-day operating status of their organization.

Aligning Business and Compliance Goals

Figure 2. Interaction of data flow among key IT systems, using a manufacturing compliance platform. (click to enlarge)

To address both FDA requirements and their own business needs, many medtech companies are beginning to explore the creation of a manufacturing compliance platform (MCP) based on a manufacturing execution system (MES). An MCP is an automated, electronic strategy designed to meet the specific regulatory and information needs of life sciences manufacturers (see Figure 2). The MCP provides medical device manufacturing enterprises the ability to manage the requirements surrounding the manufacture of products and associated processes. As a core part of this strategy, an MCP looks at products as manufacturing occurs. At the same time, it integrates data from top-layer enterprise resource planning (ERP) systems that help organizations determine what to build with data from product life cycle management (PLM) tools that help organizations determine how to build.

As part of an enterprisewide strategy, an MCP relies on systems such as ERP and PLM for managing certain documents. These can include, for example, standard operating procedures and production plans. However, the MCP knows where such key data reside, and goes and gets them when necessary, so there is no need to replicate these data. Because MES software is the workhorse and basis of an MCP, the system can "point" to data contained in other systems so that there is a real-time view from any level of the organization.

The MCP also works synergistically with these other systems. For example, ERP excels at rolled up financials, order planning, and production planning. Likewise, it can provide a single, logical view of the enterprise. However, it requires other systems for real-time production details and feedback, the results of exceptions, and tracking detail beyond the order level. It is in this context that the two systems truly complement one another. ERP can align with the MCP to handle real-time production and tracking details, as well as exceptions. An MCP has the capability to fill in the gaps for ERP, thereby increasing the value of the company's ERP system. For example, an MCP can locate real-time information about the status of works in progress and associated manufacturing orders, and can provide that information to the ERP system. This results in improved inventory accuracy and the ability to perform real-time planning.

Another example of how an MCP can work synergistically with other systems is in its integration with PLM. PLM systems shine when it comes to managing the engineering process. They can serve as centralized document repositories and can help organizations manage document distribution and revision controls. However, PLM systems cannot manage actual manufacturing activities and results, nor complex information such as process specifications and certain acceptance activities, all of which fall under the domain of the MCP. The MCP manages those areas by executing the master batch record and device master record requirements in real time to ensure that the specifications are satisfied and that the in-process acceptance activities are captured. An MCP can integrate with a PLM system already in place to create a seamless information environment that includes both engineering and manufacturing.

While an MCP based on a manufacturing execution system cannot help manufacturers address design control and misbranding issues directly, it can help them address eight of the top 10 citations found in FDA warning letters. These include CAPA; process validation; complaint handling; device master records; management responsibilities; quality audits; receiving and acceptance of works in progress and finished goods; and PAPC.

Executives who want to devise a rock-solid quality system should focus on a centralized strategy that integrates with industry-standard software already in place in their organizations. Because it provides an instantaneous, real-time view of the organization and its processes, an MCP enables executives to verify that the processes they have put in place are enforced. The system also creates electronic records that serve as demonstrable evidence of compliance, so executives can arm themselves with relevant information in the event that regulators or their investors question their quality system.

Going Electronic

Implementing a manufacturing compliance platform to align business and compliance goals is a move that makes sense for any medtech organization. This is true because the data that regulators require provide the same information that interests investors. Executives can give lip service to the strength of their organization's quality system and manufacturing processes, but both regulators and investors want to see evidence of a solid strategy. By streamlining manufacturing, medtech executives can demonstrate that they are implementing lean, top-notch plans and that they are leading the organization based on solid, available data. When top-level management considers the business and compliance goals of their organizations together, converting to electronic systems becomes paramount to the success of the organization.

Replacing paper-based compliance processes with an electronic MCP helps manufacturers respond speedily and accurately to auditors, and provides them with access to real-time business-performance data. Such a system can monitor key manufacturing parameters to ensure that processes are operating within control criteria, and it can guide necessary adjustments so that output is inherently compliant. Similarly, an MCP automates and simplifies the documentation of unpleasant necessities, such as CAPA, complaint tracking, and recall handling.

In some medtech enterprises, the costs related to compliance documentation have become so great that they actually exceed manufacturing costs. Many manufacturing executives fear that converting to an electronic system will only multiply costs and intensify their already escalating compliance worries, particularly when they consider additional FDA requirements relating to the use of electronic signatures and electronic records.⁶ In fact, converting to electronic systems can reduce both manufacturing and compliance costs in three measurable areas: