QMSR Tip #3: 5 blind spots to check in your CAPA process
CAPA continues to be the top issue for most medical device manufacturers. Check these 5 blind spots in your CAPA process as you get ready for the QMSR.
Darrin Carlson contributed to this article.
FDA requires medical device manufacturers to establish and maintain procedures for implementing corrective and preventive action (CAPA) according to the current quality system regulation, 21 CFR 8201.
CAPA is one of the most critical processes of a quality system to ensure continued safety and effectiveness of a medical device. Yet, it continues to be significant compliance challenge for most medical device manufacturers. As shown in the Figure below, CAPA is the top category of FDA inspection observations2, accounting for an average 14% of the total observations issued in the last 5 years.
As you prepare your transition to the Quality Management System Regulation (QMSR), it is important to appreciate that FDA scrutiny on CAPA will only increase. One reason is that FDA will be able to apply the requirements of ISO 13485:2016 as this International Standard has now been included in the amended regulation as a normative reference. A key point to note here is that ISO 13485 treats corrective action (CA) and preventive action (PA) as two different concepts, and expects a risk-based approach to CAPA.
This article highlights 5 potential blind spots in your CAPA process you should check and fix as you prepare to transition to QMSR compliance. Although not a comprehensive list, we think these are the most important areas of opportunity based on our analysis of recent FDA warning letters.
Why you need a new perspective on CAPA under QMSR
As a reminder, FDA will evaluate your CAPA process using the requirements of ISO 13485:2016, outlined in Clauses 8.5.2 for corrective action (CA) and 8.5.3 for preventive action (PA).
A key point to note is that CAPA requirements in ISO 13485 are included in a section on Improvement (Clause 8.5). Improvement is key to maintaining a suitable, adequate and effective quality management system to ensure continued safety and effectiveness of a medical device. Further, the framework for identifying and conducting improvement activities include the quality policy and objectives, audit results, post-market surveillance, data analysis, corrective actions, preventive actions and management review.
That is why it is important to view CAPA, not as an isolated, stand-alone process, but an integral part of your overall continuous quality improvement process. This requires a change in mindset because the industry has so far operated under the current Quality System regulation (QSR), where clause 820.100 outlines CAPA requirements without providing any context, or relationship, to other aspects of the overall system. As a result, a check-the-box mentality has driven the industry practice of CAPA with a heavy focus on documentation for the sake of regulatory compliance.
FDA expects a risk-based approach to CAPA under QMSR
In response to Comment #20 in the QMSR3, FDA highlights the need to take a risk-based approach to CA and PA, proportionate to the effects of actual or potential nonconformities.
What does that mean? How do you assess the risk(s) of each individual nonconformity to take appropriate action?
FDA emphasizes the need to develop processes to facilitate a risk-based decision making approach to CAPA:
Include processes such as developing procedures for assessing the risk4, the actions needed to be taken for different levels of risk, and the methods that correct or prevent the problems from recurring.
A common practice in the industry is to establish a risk management procedure that outlines appropriate risk analysis techniques, risk acceptability criteria and actions needed to control the risk. However, there continues to be a significant gap in integrating it efficiently throughout the quality management system.
Let us now review 5 potential CAPA blind spots with this perspective
As shown in Figure 1 above, CAPA is the top category of FDA inspection observations accounting for an average of 14% of 483 observations related to 21 CFR 820 in the last 5 years. Actual numbers highlight the magnitude of the challenge - there were 1254 CAPA citations out of a total of 8978 citations related to 21 CFR 820! Pick up a random 483 or a warning letter, and there is a good chance you will find a CAPA related observation.
Readers of this Let’s Talk Risk! newsletter know that we compile a comprehensive summary of FDA approvals, warning letters and recalls each month to share the most recent MedTech news. Below are 5 key CAPA-related issues we have noticed in recent FDA warning letters.
CAPA blind spot #1: Complaints, including reportable adverse events, are not considered for CAPA decision
In a warning letter issued to a leading manufacturer of endoscopes and accessories5, FDA cites the following observations
Since November 2020, Olympus Medical has received approximately 160 complaints describing the “distal end cover” model number MAJ-2315 has “dropped out.” Your firm performed trending and identified that number of complaints was above the expected numbers for that type of complaint. However, your firm did not consider this increasing trend of complaints to be a quality data input to initiate a corrective and preventive action
Further,
The process flow diagram of Procedure for Complaint Handling/OMBS (b)(4) describes that complaint investigations that would require evaluation for reportability would not be considered for Corrective and Preventive Action. Complaints are specifically required to be analyzed for inclusion into the CAPA subsystem and complaints that are deemed reportable are of the highest risk complaints and therefore especially important to be considered for corrective and preventive action implementation.
Here, FDA is pointing out a significant disconnect between procedures:
Complaints procedure requires trending and appears to have action limits, but this information is not flowing into the CAPA procedure for action; and
Complaints of reportable adverse events represent potential high risk, but they are explicitly excluded from CAPA decision.
Key point: Make sure you have a tight connection between different procedures, especially complaints and CAPA. Also note the emphasis on risk - some of the quality data inputs, such as reportable adverse events, related to high risk events in the field must be reviewed and considered for timely corrective action.
CAPA blind spot #2: Failing to conduct a health hazard evaluation (HHE) when required by CAPA procedure
In a warning letter issued to a leading manufacturer of a heart monitoring system6, FDA cites the following observation:
Your firm failed to perform an HHE when it became aware of the error titled “Activation Time Mismatch.” During a CAPA investigation, you identified the “Activation Time Mismatch” error, in which prior patient data was not fully erased from the device prior to the device’s reuse. The CAPA investigation showed that this issue has the potential for adverse effect on product quality and is a risk that is not identified in an existing risk assessment document. As this was an unanticipated risk identified in this CAPA record, an HHE was required.
A health hazard evaluation (HHE) is an important step that helps assess potential risk and need for action, especially when there is an impact on patient safety.
In this case, it is good that the CAPA procedure requires a HHE, but it appears that there is no clear guidance on when a HHE should be initiated.
Key point: Make sure to include clear guidance and examples to facilitate risk-based decisions as part of your CAPA process. A good practice is to create supporting guidance documents associated with key procedures to provide working examples and criteria for risk-based decisions.
CAPA blind spot #3: Missing out on potential safety signals and not taking timely action through CAPA
In a warning letter issued to a leading manufacturer of dialysis systems and accessories7, FDA cites the following observation:
You did not take a corrective and preventative action until almost 2-years after you learned of a potential issue impacting your Hemodialysis Machines that contain peroxide crosslinked silicone tubing. You were notified on December 3, 2020, of PCB emissions that were detected from the peroxide crosslinked silicone tubing component, and you did not open CAPA 1100660 until June 15, 2022. The devices were not recalled until November 25, 2022.
The recall of these hemodialysis machines was classified by the FDA as a Class I recall, the most serious type, which involves devices that may cause serious injury or death. Trace amounts of non-dioxin-like (NDL) polychlorinated biphenyl acids (PCBAs) from the tubing may cause serious adverse health effects, months to years after initial exposure, including endocrine dysfunction, liver issues, neurobehavioral changes, skin problems and male infertility8.
Key point: It is possible that the firm did not realize the full impact of adverse health consequences of PCB emissions when such emissions were reported. As a result, they missed this potential safety signal. However, this is exactly the reason to conduct a rigorous health hazard evaluation (HHE) when a potential safety signal is identified from post-market surveillance data. These signals should be included in the quality inputs for CAPA decisions.
CAPA blind spot #4: Failing to escalate manufacturing nonconformances to CAPA for corrective actions
In a warning letter issued to a leading manufacturer of in-vitro diagnostic devices9, FDA cites the following observation:
Your procedure, “Manufacturing Non-Conformance CAPA Eligibility,” GLB-QS-WI-0020, Revision 3.1, does not provide uniform process or includes clearly defined criteria to escalate events such as nonconformances to a CAPA.
In this case, FDA is pointing to a lack of a process for assessing risks of a single nonconformance in manufacturing. Risk of each nonconformance needs to be assessed in terms of potential severity and probability of occurrence. Further, there should be a clear decision making process for taking corrective actions, not just a correction, for nonconformances with a potential for a high severity outcome. Corrective action should also be considered for low-risk nonconformances if there is a clear pattern of frequent recurrence.
Key point: Manufacturing non-conformances are common in the medical device industry. In a majority of cases, a common practice is to apply a quick fix (i.e., a “correction”), or accept the nonconforming product under concession, in order to meet product delivery timelines. However, high-risk nonconformances and frequently occurring low-risk nonconformances should be considered for suitable corrective actions to prevent recurrence.
CAPA blind spot #5: Failing to check CAPA effectiveness and to ensure there is no adverse effect on the device
In a warning letter issued to a leading manufacturer of a Class III implantable cardiac device10, FDA cites the following observation:
On 1/25/22, Incident Investigation 11-074 Rev. A (“Burr on Impeller CP below (b)(4) to (b)(4)”) was initiated for a burr on Impeller CP identified on AU rotor pump 350. “The burr can not be avoided due to the mold and impeller design.” Your firm implemented a Quality Notification Deviation (QN No. 210008359, closed out on 9/9/22) involving a “(b)(4)” for an inspection of the parts for a Burr and complete removal of a burr with a (b)(4) since the (b)(4) process does not “completely remove the burr between lower (b)(4) edge and (b)(4)”. “Subsequently, the area was polished with the (b)(4)”. All changes within the deviation were implemented by your firm without verifying the process steps did not adversely affect the finished device.
In this case, the firm simply corrected the issue by polishing the burr, but did not check if this action affected the safety and performance of the finished device. There was no corrective action to prevent the issue from recurring even though it is considered to be an unavoidable artifact of the mold and impeller design. In the absence of an effective corrective action, this problem is very likely to occur in the future, and in some cases, may pass undetected in the finished device.
In a recent podcast, Darrin Carlson highlighted a common challenge in the industry around CAPA effectiveness checks, and emphasized the need to establish effectiveness check criteria early in the CAPA process:
Key point: It is absolutely critical to verify or validate the effectiveness of your corrective and/or preventive actions, and to make sure there is no adverse effect on product quality. An ineffective CAPA is a sign of a significant weakness in your quality management system. As Darrin points out in this brief clip, a best practice is to identify your effectiveness check plan with clear and measurable criteria early in the CAPA process.
In conclusion
The Corrective and Preventive Action (CAPA) process continues to be a practical challenge for most medical device manufacturers. According to the FDA inspection observation data, CAPA related observations account for an average of 14% of total 21 CFR 820 related observations in the last 5 years.
CAPA will continue to face intense scrutiny from the FDA under the Quality Management System Regulation (QMSR) because the amended regulation is based on ISO 13485 requirements, which separate corrective action (CA) from preventive action (PA), and require a risk-based approach.
By studying recent warning letters, we can become aware of potential blind spots in our CAPA process. Some of these blind spots relate to not including complaints, safety signals and manufacturing nonconformance when evaluating the need for CAPA. A health hazard evaluation (HHE) is a useful tool for applying a risk-based approach, but often it is not conducted even when required by procedure. Finally, CAPA effectiveness checks continues to be a challenge as a majority of CAPAs are conducted without a clear effectiveness check plan in place.
It is useful to take a careful look at the CAPA process to identify these blind spots and proactively address them as you prepare your transition to the QMSR.
See 21 CFR 820 Subpart J - Corrective and Preventive Action
FDA: Inspection Observations, Updated November 22, 2023.
Federal Register: Medical Devices; Quality System Regulation Amendments, issued February 2, 2024.
As a reminder, “risk” in the context of ISO 13485 applies to safety or performance requirements of the medical device, or meeting applicable regulatory requirements. Although, it is defined as the combination of the probability of occurrence of harm and the severity of harm, the scope of risk also includes regulatory compliance. When assessing the risk of quality system nonconformities that relate to regulatory compliance, it is useful to consider their impact on affected product quality attributes that can be directly correlated with safety and effectiveness. An industry best practice is to conduct a health hazard evaluation (HHE).
FDA: Warning letter issued to Olympus Medical Systems Corp., CMS 654013, March 15, 2023
FDA: Warning letter issued to iRhythm Technologies, Inc., CMS 643474, May 25, 2023.
FDA: Warning letter issued to Fresenius Medical Care AG & Co. KGaA, CMS 666791, December 04, 2023.
FDA: Fresenius Medical Care Class I recall announcement, Updated 24 Oct 2023.
FDA: Warning letter issued to Beckman Coulter, Inc., CMS 678042, March 15, 2024.
FDA: Warning letter issued to Abiomed, Inc., CMS 663150, September 19, 2023.
This is analysis of an essential (and often confusing) regulatory requirement. The article is required reading for anyone with CAPA responsibilities, now and as the QMSR go-live date approaches.