Quick Tip: engaging with the FDA on risk management
Understanding the FDA's perspective on risk is important for a productive interaction with the Agency
It is natural to feel a little anxiety when interacting with the FDA during an inspection. Your Quality System is under intense scrutiny and you don’t want to end up with a 4831 or a warning letter2.
During an inspection, the FDA investigator evaluates your Quality Management System for compliance with requirements of the Quality System Regulation (QSR).
When it comes to risk management, there may be some confusion about requirements because the QSR includes only a single reference to risk analysis in 820.30(g) under Design Controls. However, it is important to note that the FDA views risk as “folded in” throughout the entire QSR, and not as a standalone, independent concept.
A careful review of FDA warning letters shows that deficiencies in the risk management process are behind many of the officially cited observations in 483s and warning letters. As an example, if there is an observation about inadequate complaints handling, it is often based on findings of inadequate complaint investigations and considerations of adverse events. The basis of these observations are often gaps in your production and post-production activities3 as part of the risk management process.
On the other hand, it is not useful or productive to talk about during an inspection, or try to justify, your approach to risk management of new devices or design changes under review by the Agency as part of the pre-market regulatory review process. These discussions are best conducted as part of formal meetings with the FDA during the pre-market review and not during an inspection.
Check out this article to learn more!
Form 483 is issued to a medical device manufacturer at the conclusion of an FDA inspection. It outlines a list of observations which, in the judgment of the FDA inspector may “constitute violations of the Food Drug and Cosmetic (FD&C) Act and related Acts”.
A warning letter is issued to a medical device manufacturer when the FDA makes a conclusion that the manufacturer has “significantly violated FDA regulations”.
Requirements for production and post-production activities are outlined in Clause 10 of ISO 14971:2019, the international standard for application of risk management to medical devices.
This is an important concept, Naveen. As FDA shifts the QSR to the new QMSR and incorporation of ISO 13485:2016, manufacturers will experience this broader application of risk management in FDA investigations. ISO 13485 has a wider use of risk management, as opposed to risk analysis, in the current regulations. Also the application of risk-based thinking in 13485 requires the use of the risk management system.