Does Your CAPA Process Need a CAPA?

Have you done Corrective and Preventive Actions (CAPA) on your CAPA process? If not, you need to seriously consider doing so because CAPA is the #1 reason why companies get 483 observations year after year.

In this episode of the Global Medical Device Podcast, Jon Speer talks to Mike Drues of Vascular Sciences about whether your medical device company’s CAPA process needs a CAPA. Why are medical devices companies continuing to struggle with CAPAs?

Listen now:

Like this episode? Subscribe today on iTunes or Spotify.

Some highlights of this episode include:

• Only 3-5% of adverse events of medical devices are actually reported to the manufacturer or FDA. People tend to report every little event as a CAPA or report nothing at all. 

• The five most common reasons why the FDA issued 483 observations and warning letters over the last 5 years were CAPAs, customer complaints, purchasing controls, medical device reporting, and process validation.

• If CAPA is the #1 reason why companies are getting 483 observations and warning letters, it may be due to an ineffective quality management system (QMS).

• Things happen every day during the course of running a business. Processes and routines may not go routinely. When something happens unexpectedly, will it happen again? What are you changing to ensure it does not happen again?

• CAPAs continue be the #1 reason because people do not have a common sense understanding of the quality system regulation. They focus on the words, but do not try to understand the meaning.

• CAPAs often generate negative connotations—the process requires extra work and more resources, not in the budget, and time pressure. However, people should view CAPA’s as an opportunity to improve a product and prevent problems in the future. 

• People do not follow procedures because sometimes they don’t even know that procedures exist, or those procedures are not updated/revised after events.

Links:

FDA - Corrective and Preventive Actions (CAPA)

FDA - Form 483 Observations and Warning Letters

FDA - Medical Device Overview

International Medical Device Regulators Forum (IMDRF)

ISO 13485 CAPA

21 CFR Part 820

Mike Drues on LinkedIn

Greenlight Guru Academy

Greenlight Guru Community

MedTech Nation

Greenlight Guru MedTech Lifecycle Excellence

Greenlight Guru YouTube Channel

Memorable quotes from this episode:

“A CAPA is an opportunity to really do a deep dive investigation to determine, is there a systemic issue that is influencing that process that you are following?” Jon Speer

 “People don’t focus on the common sensical understanding.” Mike Drues

 “Unless regulation makes sense, I don’t care what the regulation is, unless it makes sense, it is not good regulation.” Mike Drues

 “Part of going through the CAPA procedure is to identify the root cause of the problem.” Mike Drues

 “Only 3-5% of adverse events of medical devices are actually reported to the manufacturer or to the FDA.” Mike Drues

Transcript

Announcer: Welcome to the Global Medical Device Podcast, where today's brightest minds in the medical device industry go to get their most useful and actionable insider knowledge direct from some of the world's leading medical device experts and companies.

Jon Speer: Hello, Global Medical Device Podcast fans and listeners. This is Jon Speer, founder at Greenlight Guru. I'm sure you've noticed by now that Etienne Nichols, one of our medical device gurus has been doing a fantastic job with most of the new podcast episodes. So I thank him for that. I know he is excited about that and is really diving in deep on some topics. But from time to time, I'm still here. Time to time, I'll still be hopping on episodes and this is one where I sit down and chat with Mike Drues of Vascular Sciences. Again, a name and face that I'm sure many of you are very familiar with. He and I have done literally dozens probably, I don't even know... We'll just leave it at dozens. But anyway, without rambling any further, I want to introduce today's topic. Mike and I sit down and chat about CAPA and specifically talk about, or we propose this idea of you, as a medical device company and your quality systems probably should... Or actually Mike correct me and I'll correct myself. You need to highly consider doing a CAPA on your CAPA process. Why? Without spoiling what you're about to listen to, CAPA is the number one reason why companies get 483 observations and warning letters year after year after year. It's the top. It has been I think for like 10 years or something like that. So clearly we as an industry are failing to understand something. So we offer some tips and pointers. So I hope you enjoy this episode of the Global Medical Device podcast. Hello and welcome to the Global Medical Device podcast. This is host and founder of Greenlight Guru Jon Speer. Joining me today is familiar face and voice, Mike Drues, president of Vascular Sciences. So Mike, welcome to the Global Medical Device podcast.

Mike Drues: Thank you, Jon. Always a pleasure to speak with you and your audience.

Jon Speer: Absolutely. You and I have talked about some quality system stuff from time to time and I think even what we're about to dive in today, I think we've talked about here and there about CAPA and I guess for those listening at home, hopefully you know this. But the FDA data might suggest you don't. CAPA is an acronym for Corrective Action and Preventive Action. And I think it's important for us to talk about because we'll dive into it. But year after year after year, FDA publishes their data from FDA Inspections, 483 observations, warning letters and whatnot. And it's always interesting to see what makes it to the top of issues from industry. And I guess it's still kind of surprising to me that the number one issue is CAPA. Companies are struggling with CAPA. I don't entirely understand that, but that's sort of the frame of our conversation today. So anything you'd like to add before we dive, in Mike?

Mike Drues: Well, just to amplify a little bit further, Jon, and to start out slightly more broadly putting this in perspective, so over the last five years, 2017 to 2021, the five most common reasons why FDA issued 483 observations and warning letters were number one, CAPAs. That's obviously the topic of today's conversation. Number two, customer complaints. Number three, purchasing controls under the general topic of supplier management. Number four, medical device reporting or MDR procedures. And finally, number five, process validation. Those are the five most common reasons why FDA has issued 483 observations and warning letters over the last five years. We're going to dig into, in a fair amount of detail in today's discussion, the number one reason CAPA, and why you said a moment ago, Jon, you kind of struggled as to why this continues to be such a problem. I have some thoughts on that. But perhaps in future discussions, we might take a similar dive into some of these other most common reasons because these things have been around. These have been part of the quality system requirements pretty much since the beginning of time. Yet companies still get in trouble over, over and over. I hate to say it, Jon, but it's kind of Einstein's definition of insanity, doing the same thing over and over again, expecting a different result. My slight spin on Einstein, not like I'm going to top Einstein, but Einstein said doing the same thing over and over and expecting the same result, when I say thinking the same way over and over and expecting a different result. I think a lot of this is about the thinking. But we're going to dive into specifically the number one reason for 483 observations and warning letters. And that is CAPAs. Does that make sense?

Jon Speer: Absolutely. And I think what's interesting about that top five list, at least three of those five, the CAPA, the complaints and MDRs, which to me MDR is sort of a variant of a complaint in a manner speaking, but those are all measures of like effectiveness of a company's quality system and their practices. And in fact, I hope I'm quoting this right, but I think it comes from the former Global Harmonization Task Force, which is now known as IMDRF. But they had a guidance document and I think it's still published, I don't think they've changed it in years, as a GHTF guidance about CAPA. And I'm going to paraphrase this because I don't remember the quote exactly. But it talks about how robust or how effective a company's CAPA system is a measure of how effective their quality management system is. So I guess one could postulate that if CAPA is the number one reason why companies are getting 483s and warning letters, then that might indicate they don't have a very effective quality system.

Mike Drues: Indeed, John. You asked the question, what is the etiology of the word effectiveness here? That's a good question. I don't know off the top of my head. But the reason why I like that word is because it reminds me of a very similar word, something that most of us in the medical device industry are very familiar with and that is efficacy. So what is the efficacy of our CAPA system, or as you alluded to a moment ago, what is the efficacy of our entire quality management system? To get to that, I have some suggestions for our company friends as we'll get to further in our discussion. But specifically, how do you measure the effectiveness or what I call the efficacy of your CAPA system or of your higher QMS?

Jon Speer: Yeah, absolutely. So let's dive into some of that. Wow. I don't want to insult anyone's intelligence. If you want to learn more, or hopefully you already know this, but you want to read up on what FDA, QSR says about CAPA, I believe it's in 820.100. And then the parallel to that, boy, this is a test, don't quote me on this one, but I know there are sections and ISO 13485. I think it's 8.5.3 and 8. 5. 4, but don't quote me on that one. It's definitely in 13485 2016. But if you compare and contrast ISO and FDA verbiage with respect to CAPA, by and large it's pretty similar. But in my way of thinking about it, what is a CAPA? Well, things happen. In the course of running our business, just think of everyday life. Everyday life, we go through processes and routines and things that we do, whether that be go to the grocery store or change our oil or fill up our gas tank and that sort of thing. Maybe I shouldn't have brought up gas. It might be a sensitive topic these days. But we're following a process. And sometimes in the midst of following that process, maybe something didn't go the way that it routinely goes. And so you're like," Oh, that's interesting. That's some sort of event." But when that event happens, at least I think about this, I don't know if the average person does, I have to think," Okay. Is that thing that just happened that I did not expect, is that something that's going to happen the next time I do this process?" And maybe it's just an anomaly. Maybe it's a one time occurrence. But the next time I do that, if that happens again, I have to scratch my head and I have to think," Maybe there's something going on here. Maybe something has changed about the dynamics pertaining to this particular process. Maybe I need to revise my process. Maybe I need to take a closer look at what I was doing. Maybe this has always been there," whatever the case may be. But CAPA is an opportunity to really do a deep dive investigation to determine, is there a systemic issue that is influencing that process that you're following?

Mike Drues: Well, Jon, I think that was a great common sense explanation to what is a CAPA and when should they be used? I think coming back to the question that you asked sort of rhetorically at the beginning of our discussion, why does CAPAs remain the top reason for warnings and 483s for the last five years, probably more, is because people don't focus on the common sensical understanding. In other words, if we were to take what you said and then just share in a little bit of detail what the actual regulation says in 21 CFR 820.100A... You forgot the A, Jon. Yeah. But anyway, I'm not impressed by people that memorized what those regulation numbers are. Quite frankly, I could care less. What I'm much more interested in is, do they understand the regulation? And most importantly, do they understand the intent of the regulation? So there are actually five requirements in that particular section of the CFR. I'll just read the first one. These are the capital requirements right out of the QSR regulation. Investigating the cause of nonconformities relating to products, processes, and quality system. That in and of itself is something that we could dive into a little bit because CAPAs are not limited to just the device itself, problems related to the device. They also can include the processes related to them. And I'm not talking about just the manufacturing process. Jon, as I've said in some of our discussions before, regulation is about two things: the interpretation of words and our ability to defend our interpretation. So how do you interpret the word process? One interpretation is the manufacturing process, but that's a pretty limited connotation. There are a lot of other processes as well. And then the third thing that the regulation specifically says is investing in nonconformities of the quality system. This is sort of the title of today's discussion. Does your CAPA need a CAPA, right? You have a CAPA system in place because I assume that your QMS ticks those regulatory requirements. But how do you know if it works? It obviously doesn't work in a lot of cases, because as we've said, that's the number one reason why FDA issues 483 observations and warning letters. The other requirements just very, very quickly, and we can provide a link for our audience, Jon, I don't want to bury people in the regulatory minutia, but this one in my opinion is the root cause of why so many people, so many because they focus on the words, but they don't try to understand the meaning. Identifying the action or actions needed to correct and prevent the recurrence of a non confirmed product or other quality issue, that's the second requirement. The third of the five requirements is verifying or validating a CAPA to ensure that it is effective and does not adversely affect the finished device. In other words, how do you know that your corrective action indeed corrected or solved the problem? Many companies that I work with, they either come up with a solution that doesn't in fact solve a problem, or they come up with a solution that solves that problem at the same time it creates a new problem. So it's that whole verification validation. Just like we do with medical devices, we're applying the same regulatory logic, Jon, something that I talk about a lot to the system, in this case to the cap system. Finally, the last two requirements and I'll now pause and let you chime in here, amplify or provide examples to whatever you want, implementing and recording changes in methods and procedures needed to correct and prevent the identified quality of problems. By the way, when I have difficulty reading something just right out of the regulation, maybe that's indicative of part of the problem as well because normal people don't speak this way. And I say this to my customers all the time, unless regulation makes sense. I don't care what the regulation is, unless it makes sense, it is not good regulation. And finally, the last requirement out of the CFR, no editorializing, ensuring that information related to quality problems or to a non- conforming product is disseminated to those directly responsible for assuring the quality of the product or preventing the problem. That one is a little bit easier understand, but unfortunately that's something that a lot of companies fall down on as well. That's actually what the regulation says, and I'm happy to provide a link for the audience. I'm sure you didn't catch all of what I just read. But that's not the point. Anything in there, Jon, that resonated with you, anything that you wanted to pour some gasoline on?

Jon Speer: Yeah. The whole root cause piece, I'm just thinking about when I was more in the trenches at working for medical device companies and of course the numerous companies I interact with on a fairly frequent basis. I think to your point, maybe we do need to do a CAPA on our CAPA process.

Mike Drues: Maybe, Jon? Why would you say MAPA? Why would you say maybe?

Jon Speer: Okay. We need to do a CAPA on our CAPA process. But one of the things I've observed over the years at numerous companies, this isn't an isolated occurrence by any stretch of the imagination, is a couple things. I think first and foremost, people look at CAPA as almost like a bad word." Oh, we got another CAPA," or that sort of thing. So there's a lot of negative head trash and connotations that people associate with a CAPA. Well, my way looking at it is a CAPA is an opportunity to improve something about what we're doing or some product we have or some process that we have, it's that opportunity to improve. But I think once CAPA is initiated, I think this contributes to part of the issue is a lot of times companies have KPIs or some sort of metrics in place with respect to their quality system and quality objectives and whatnot. And oftentimes and all far too many times, one of those is usually the time to close a CAPA. I've seen so, so many companies that will have one of their quality metrics that says," Close a CAPA within 90 days." That's kind of absurd and we can get into that here in a moment. But because it's a negative thing, it's probably extra work that we didn't budget for or allocate resources for. I've already got too much on my plate to begin with." And by the way, here, do this CAPA in your spare time," which you may have little or no spare time. And I know that there's this time pressure. And so I've got to hurry, hurry, hurry, hurry, hurry. So I'm reacting, reacting, reacting. And I don't really do a very good job of root cause. Oftentimes I just restate the problem and I start throwing things at it." Oh, let's do this, let's do that. Let's change this word. Let's do this. Let's update that thing." I'm just throwing things at the issue in hopes, and sometimes I think there is this a lot of finger crossing that happens in hopes that the things that I throw at it will make it go away. And I think that's a big part of the problem. I think that's a big reason why we see this percolate to the top year after year after year with 483s and warning letters.

Mike Drues: Well, Jon, you just went through an awful lot there and we could peel many layers of that onion. And I want to do that a little bit, but I also want to get onto some specific examples of what led to 483 observations and warning letters dealing with CAPAs. But regrettably, I do think there's a lot of truth to what a lot of people in our industry think of CAPA. They think of this as a bad word or a bad phrase I think because they think that this is going to be a very laborious or arduous kind of a process. But I also think that you said it's an opportunity to approve. I agree. Coming from, as some of your audience know, Jon, I used to teach medical school. So putting a clinical spin on this. A CAPA is sort of the equivalent, substantially equivalent if you will, to a morbidity and mortality conference, an M and M conference, which basically is if you have a suboptimal event. And a suboptimal event is a fancy way of saying something didn't work. But if we say said that we didn't work, we couldn't bill for it. So instead we call it suboptimal event, it sounds a little bit better. But an M and M conference is an opportunity to for physicians or surgeons to get into a room and to literally take the gloves off and duke it out and talk about the good and bad and the ugly for a bunch of reasons, not the least of which is try to prevent these problems from happening again in the future. And that in essence is what a CAPA is supposed to be. You also mentioned that a lot of companies will have some sort of a metric CAPAs might be closed in 90 days or whatever the number is. On one hand, I understand why companies will do that. But on the other hand, I am adamantly against having numerical values like that because in some circumstances, a CAPA might be able to be closed in a very, very short period of time. And it might have to be closed in a very short period of time. In other cases 90 days, three months might not be long enough to do a thorough investigation and come up with an action and so on and so on. And finally the problem most importantly, Jon, and maybe this is the topic of a different discussion, but the most important things that you mentioned is part of going through the capital procedure is to identify the root cause of the problem. Let me tell you, I hear a lot of people talking about the root cause. Very rarely do they get to what I as a professional biomedical engineer and regulatory consultant would call the root cause. They're usually dancing around the surface. The root cause, I hate to say present company excluded I'm sure Jon, but the root cause of most of the problems that we face is what's between the ears. It's the thinking process that gets us there. But anyway, if you want to respond, Jon, feel free. Otherwise, we could go on to some specific examples for our audience.

Jon Speer: Yeah. Let's just go on into some examples. I think that might hopefully help connect some dots and turn on some light bulbs for a few folks.

Mike Drues: Okay, perfect. So I have three specific examples that I'd like to share, and maybe we can discuss between the two of us. These are CAPA issues that were noted in either 40th observations or warning letters from the FDA. They're fairly short, I'll read each one and then we can talk about it. The first one is failure to follow a procedure where any employee discovering a quality incident is required to initiate a corrective action, failure to follow a procedure where any employee discovering a quality incident is required to initiate directive action. This is something that FDA cited that led to a warning letter for this particular company account. Thoughts on that one, Jon?

Jon Speer: Yeah. So what I'm hearing from this citation from the FDA is it sounds like the company had a procedure that defined that anyone in that company who identified an issue could surface or escalate that matter to a CAPA. This is speculation of course. But I'm guessing that the FDA investigators saw evidence that somebody in the organization had an issue, identified an issue in whatever their processes or their roles were that didn't result in a CAPA. And so that's probably saying," Hey, your procedure says when you find something, doesn't matter who you are, what level you work in that company, you can raise your hand and say,'Hey, this is a CAPA.'" And that probably wasn't the case. So I guess first piece of advice for companies, do what you say you're going to do in your procedures. Now, I don't think that a CAPA procedure needs to be that specific that says anyone can issue a CAPA. But I think you need to have a very, I'll say a culture of quality that encourages people to communicate when there are issues. And I don't mean to be demeaning and hopefully this comes out okay. But the person on the manufacturing floor, they know X, Y, Z, about manufacturing. They may not understand bigger picture quality system practices and whatnot. They may not be skilled and experts with CAPA. But if they have an issue, they need to be encouraged to say," Hey, Mike, I'm making this thing, this widget, and these parts don't go together anymore. There's an issue here." That needs to be encouraged. And that needs to be escalated appropriately. And hopefully there's someone or an entity or a group or a board or something that receives that information and can start to assess," Okay." And do this investigation, dive in a little bit deeper." Why is this happening? Why are these parts that used to fit together, why are they not fitting together anymore?" That question why I think is really, really important with respect to identifying and triaging and investigating issues. But that's my reaction to that first example.

Mike Drues: Well, that's a great start, Jon. Before we move on to the next example, let's dig into that a tiny bit further. Just a moment ago, we talked about root cause. So as a biomedical engineer, I spent a lot of my time thinking about root cause. What is the root cause of the problem? Failure to follow a procedure? Well, let's assume for the sake of this discussion that the company did follow the procedure. The next question you asked at the end of your last comment, Jon, is why. Why did the company or why did the people in the company not follow the procedure? Is it that they didn't follow the procedure because they didn't know there was a procedure? This is an example I see so many companies where employees don't know what is in their own management system. And I've got several examples, I'm sure you do as well, where I have pointed out sections of the company's own QMS. I'll share with you one quick example, Jon. I was reviewing a company's quality management systems and in it I saw references to products to devices that that company did not make. And I asked the company, I said," Hey, do you make this particular device?" And they said," No, Mike, why do you ask?" And I said," Because you've got procedures for it in your own quality management system," which to me is no better example of somebody copying and pasting from somebody else's QMS and worse. At least my graduate students will usually read what they're copying and pasting before they actually paste it to see if it's actually applicable. You're laughing, Jon. But this is what I run into I don't want to say every day, but more common than you might think. So is it that the company had the procedure and the employees didn't know about it or is it that they didn't even have the procedure? And this is exactly the kind of question that I love to give my attorney friends during discovery, Jon, as you know, before I spent some of my time working as an expert witness medical device product liability case, because no matter what answer the company gives, it's not going to make them look good. Either they didn't have a procedure, and so why didn't you have a procedure? Or they did have a procedure and people didn't follow it. So why didn't they know about it? So this is exactly what I mean by, what is the root cause of the problem? Does that make sense?

Jon Speer: A hundred percent. That highlights that... The first answer to a why question might be," Well, the person didn't know that that procedure existed."" Oh, why not?"" Well, we didn't train them on it. We didn't share it with their..." Whatever, you could keep going on and on and on. But-

Mike Drues: Yeah. Let me go just one step further and then we'll move on to the next example. Since you just said you can go on and on and on and on, indeed you can go on and on and on and on because the last part of what I reported in this problem, which by the way is not hypothetical, it's real. I didn't mention any specific companies or devices, but it's a real citation. This occurred when the incident is required to initiate a corrective action, required to initiate a corrective action. Well, what exactly were the requirements? Are these requirements specified in detail?" Under these circumstances a CAPA needs to be started. And under the other circumstances, a CAPA does not need to be started," and so on. How clear is that verbiage in the company's own quality management system? In my experience, Jon, feel free to either agree or disagree, a lot of companies, either they don't mention it at all. For example, what criteria does the company use when a complaint should go on to start a CAPA? And in what situations do, what situations do not? Does the company in the QMS, do they provide examples? Just as a side note, I happen to teach a two day course on post market surveillance and complaint handling. And in that course, we don't just think about what the regulatory requirements are because anybody that's graduated elementary school could read the word. What I spend a lot of time talking about is talking about having those requirements in your from when a complaint goes on to become a CAPA and specifically what the requirements are. And does the company update, revise these requirements from time to time or did they just create them once five years ago and they never touched them again? So these are all the things, when you said on and on and on, I know you meant that sort of metaphorically, but I took that as literally.

Jon Speer: Yeah, I think that's a good point because if a procedure is ambiguous about when and what and how to treat an event, I guess there is a guarantee. You can guarantee that will be left up to each person's interpretation of what to do.

Mike Drues: Yeah. And I remember years ago I took a GMP training and the instructor used as an example, since you mentioned procedures, a procedure at SOP for scrambling eggs. Everybody knows how to scramble eggs. So on one hand, you can write a one step procedure," Get some eggs, crack them into a pan and cook them." Or you could write a 5, 000 page procedure where you specify the genomic makeup of the chicken they come from, the direction that you stir them, and blah, blah, blah, blah, blah. So what detail? That's not a trivial question. Let's move on to the next example, Jon. A firm did not initiate a CAPA in response to multiple complaints. A firm did not initiate a CAPA in response to multiple complaints. And by the way, for the benefit of our audience to let Jon off the hook, we haven't shared with him in advance these specific examples. So I'm kind of hitting. What do you think about this one, Jon? A firm did not initiate a CAPA in response to multiple complaints.

Jon Speer: A couple of reactions. First is, I guess a little prelude to that. Industry and practice, I've seen we'll say two basic predominant flavors if you will of approach to CAPA. One is overuse of CAPA, like every single event triggers a CAPA.

Mike Drues: The boy who cried wolf. Yeah.

Jon Speer: Who cried wolf. Yeah. In fact, I think someone out there has even coined the phrase death by CAPA. That's certainly a way to do that. And then the other extreme is the opposite, it's like almost never using CAPA system at all. But I look at CAPA as, it's a mechanism to handle systemic issues. So as I hear you read that particular item from FDA, that citation, would they say three? Or there's certainly multiple, right?

Mike Drues: Multiple, yeah.

Jon Speer: Multiple complaints, which would apply to definitely more than one, probably more than two that almost says there's a systemic issue happening here with this product. And whenever there's a systemic issue, that's an ideal situation or candidate for a CAPA. The other thing that I have to wonder in this case is, did companies in this case say," Once we hit X number of complaints on this product, it's the trigger for CAPA," that could be another piece that was defined there. And back to the point you were making earlier, maybe that company actually did define when something needs to be escalated to CAPA and they didn't follow it. But either way, think of CAPA as a means to address systemic issues.

Mike Drues: I like the systemic approach. It's sort of a riff on the root cause kind of issue that we talked about a minute ago. Again though, I personally, I'm troubled when companies put in their specific numerical requirements, like after three complaints or after five complaints or whatever it is, because first of all, we have to be careful about overgeneralizing when it comes to complaints. Some complaints are very, very significant. Others are not. If it's cosmetic defect, somebody calls you up and complains because the housing of your device has a little scratch on it or something, quite frankly I could care less from a safety and efficacy perspective. But also in terms of frequency, we have to be careful. First of all, we all know how big of a problem under reporting is this industry. So if you have a small number of complaints and you assume you're doing a good job, can you assume that your devices are working as intended? I would never make that assumption. The late great Carl Sagan said that the absence of evidence is not evidence of absence. As you and I have talked about before, Jon, here's a statistic from my PMS and complaint handling course that I mentioned a moment ago. Only 3- 5% of adverse events of medical devices, only 3- 5% of them are actually reported to the manufacturer or to the FDA. And I can provide reference to that as part of the podcast if people want. If you split that statistic the other way, if I don't embarrass myself with the arithmetic, 95- 97% of adverse events are never rewarded. So just because you don't have that many complaints doesn't necessarily mean that your devices are working as they're supposed to be. Years ago, one of my best friends who happens to be a senior VP of quality and regulatory at a Fortune 50 medical device company, he and I were very good friends in graduate school, he and I met for dinner. And we got into sort of a philosophical question about CAPAs. And what's the ideal number for CAPAs? You know, some people might say if you have zero CAPAs, is that a good thing? Maybe that just means that you're not doing your homework. Some people might say, if you have a whole lot of CAPAs, is that a good thing or a bad thing? That might mean you're crying wolf too many times or that you're being really diligent in your investigations. If zero and a whole bunch or neither one of them are desirable, that's sort of advice that there's some number in between. That would be the ideal number of CAPAs. Right? Logically that makes sense. But in reality, I don't think that's a good way to think about it. So anyway, what does multiple complaints mean and what kind of complaints? Let's move on to the third example, Jon. No documentation exists explaining why a CAPA was not initiated upon learning of the problem. No documentation exists explaining why a capital was not upon learning about a problem. I'll start us off on this one. And then if you want, feel free to chime in. But this is a riff, when I go to the FDA with precepts, this is what you and I have talked about before, I justify not just what I'm doing and why I am doing it. But I also justify what I'm not doing and why I'm not doing it. This is exactly the same regulatory logic here. If you are going to have a CAPA based on a complaint or something, here's our CAPA and this is the reason why we're having a CAPA. Similarly, it makes sense to me if you get a complaint or a series complaints and for whatever reasons you are not going to have a CAPA, I'm not suggesting that's the right decision or the wrong decision, but you need to explain and you need to document why you're not having a CAPA because, what's the old adage from the GMP trading, Jon? If it wasn't documented, it didn't happen. And I would love to hear your thoughts on this, Jon. Put yourself in the shoes of an FDA inspector. They see a complaint, or maybe in some cases a series of complaints. There's no CAPA that seems to go along with that complaint. The question is, why? Did you not start a CAPA because you don't know what a CAPA is and therefore you didn't start one? Did you not do a Kappa because you did some sort of an investigation and you determined that a CAPA is not necessary? The inspector or the FDA reviewer, they have no idea. Don't document just what you did. Also document what you didn't do and why you didn't do it. Does that make sense, Jon? Or do you think I'm maybe smoking my socks here?

Jon Speer: Well, I don't think you're smoking your socks about that. So yes, it doesn't make sense. And to kind of continue it a little bit, I suspect a lot of folks out there, they probably have some sort of form or template or something for various quality events, whether that be a manufacturing nonconformance or deviation or a complaint or what have you. And I bet a lot of those forms have a little question on that form that says, is a CAPA required? And it probably has a little tick box for yes or a tick box for no.

Mike Drues: And that's exactly why I hate forms with a yes or no question, kind of like the 510( k) Substantial Equivalence from FDA where it asks you those series of six yes or no questions. I never answer them with the yes or no only. I always say yes... or no...

Jon Speer: And I think that's the key thing for folks regardless of what your answer is, explain and justify and support your answer with corroborative evidence.

Mike Drues: Like in elementary school when your teacher says,"Show your work."

Jon Speer: Show your work.

Mike Drues: Two plus two equals four. Okay. Show me how you got to four.

Jon Speer: Right, right. But I think it's that issue. You mention that if somebody says no and moves on and an FDA investigator looks at it and questions that, there's no rationale or explanation as to why, that's one scenario. But I've been guilty of making a decision about something myself and then coming back and looking at the item and like," How did I come to that conclusion?" Maybe it's the next day, but usually some time has passed. How did I come up with that rationale? And if I didn't keep good notes, who knows? So the notes are not just important from an FDA perspective, but it's important from your own internal communication perspective. And I guess to think of a hypothetical, maybe that first thing that happened, maybe you had a complaint on a product and you were going through your form and you come to that question on your form that says,"Is a CAPA required, yes or no?" And you say no and you provide that explanation. Let's imagine maybe a few months later you have another complaint for a similar or same type of issue. And now you're going to hopefully try to pull all other complaints that are similar to or related to this issue because it's happened before. And now you can look back as to why you made decisions then, and use that as inputs into how you're making decisions now. So just without the details, it's impossible to make informed decisions.

Mike Drues: I could not agree more Jon. And to illustrate a parallel, I know that there are many people in our audience who listen to our podcast, not just this podcast, but a lot of our podcasts and I'm very grateful for that. You probably hear that there are some occurring themes through a lot of these discussions. And one is what I like to focus on, regulatory logic. What Jon and I are talking about right now, this example of one of the most common reasons why 483 and warning letters arise from CAPA issues, no documentation exists explaining why a CAPA was not initiated. This is the regulatory equivalent of one of the most common reasons why regulatory submissions 510(k), Denovo, PMAs and so on are rejected because a section is omitted. Put yourself in the shoes of the reviewer. If a section is omitted, they have no idea why it was omitted. Was it omitted because it was not applicable or did you just forget about it? Put yourself in the shoes of the inspector. There's no documentation why the CAPA was not started. Was it not started because you don't know what a CAPA is or you forgot about it, or it's not applicable and here's the reasons why? A lot of recurring themes here. And this is why I say, Jon, and it's maybe kind of strange coming from a regulatory consultant, we do not need more regulation. We've got thousands and thousands and thousands of pages of that. What we need is people thinking and understanding the regulation, not just the words, what the regulation is, but more important, the intent.

Jon Speer: Right? Absolutely.

Mike Drues: Let's move on to the last and perhaps the most important part of this discussion, Jon, and then we can wrap this up. And you mentioned it earlier in our discussion. How do we measure the effectiveness or what I call the efficacy of our CAPA system? How do you know if your CAPA system is working? Because after all, I'm sure most if not all of the companies in our audience today listening, they have a quality management system. A portion of the QMS probably involves CAPA. And I'm sure that ticks the regulatory requirements on the box. And yet at the very beginning, we said that this is number one reason why companies get 483s and warning letters. So clearly we have companies that have these systems, but these systems are not working. So Jon, what are your thoughts, what are your advice on what you a company to make sure that their CAPA system is working?

Jon Speer: This may sound a bit utopian and I'll go with it for a moment. But if I go to the effort of addressing a systemic issue through a CAPA investigation and I identify the root cause and I implement corrections and corrective actions and whatnot, at the end of the day, I hope that those measures that I took prevent that thing from becoming an issue again. That's what I should strive for with an effective CAPA system. But I don't think that's the case. For things we've already discussed already today, I think a lot of folks, they're slapping some Band- Aids on it. They're doing some things and they get maybe some false positives along the way that says," Oh, look, we did this thing and it didn't rear its ugly head again," until it does. And I think so if an in infraction or an issue or an event, whatever the right word is, if that event happens again after I've already addressed it with a CAPA, that's to me a pretty clear indication that my CAPA system might not be all that effective. So again, I think the goal of taking on a CAPA is to mitigate this so it doesn't happen again. That to me is the best measure of effectiveness.

Mike Drues: But that's certainly a good measure of effectiveness. And that's a suggestion that I give to my customers as well, Jon. I would like to take that a little bit further though. So what you just explained there is basically one of the regulatory requirements that I read earlier, the verification and validation of your CAPA. In other words, how do you make sure that the same problem or a similar problem doesn't happen again in the future? To use a postmarket surveillance analogy, that would be path postmarket surveillance. The question is now postmarket surveillance as you know in Europe and starting in the US, that's no longer efficient. Companies are now being required to do active post market surveillance where you don't simply sit around twiddling your thumbs waiting for problems to be reported to you. You actually go out and look for them. So here's my active way of measuring the efficacy of your almost a post market surveillance system, but your CAPA system. There's a lot of similarities. Fire drill. You remember when you were a kid, Jon, in elementary school. You didn't wait until God forbid there was a fire in the building and then all of a sudden they figure out how to get the kids out. You had a fire drill so that it in the event of a fire, you would know what to do. I have made this suggestion to many companies in the past, Jon, and I would love to hear your thoughts as a quality guy, purposely inject a problem into your system, a complaint for example, a fictitious example. And then track that problem to see how it's handled through your complaint handling system. Does it initiate a CAPA? Does the CAPA then get investigated properly and so on and so on? In other words, don't just fix problems that you already know about. Create a fictitious problem and report it, feed it into your system and see how your system responds. We're all used to measuring the efficacy of our medical devices, but how many of us think about measuring the efficacy of our systems, including our quality management system and more specifically, including our CAPA and complaint handling system? Do you think that's a reasonable recommendation, Jon?

Jon Speer: I think it's a great idea because as you talked about, the fire drill, I used to ride the bus to school as I'm sure many folks did too, we used to do the drills on the bus too. If there was a fire on the bus or a tornado and all that sort of thing. I grew up in the Midwest, but thankfully none of those things ever happened in real life. But gosh darn it, I feel like as an eight year old kid, I was pretty prepared for if and when they did, which door I was supposed to go out and where I was supposed to meet, muster with the rest of the class and all that sort of thing. So yeah. It's a great way. And I think another thing, talking about CAPA effectiveness, kind of goes back to those metrics that I spoke about earlier. I think a lot of companies are measuring the incorrect things with respect to their quality system and specifically with their CAPA. And I think the classic CAPA metric is time to close a CAPA. And so the way they state their system is effective is like," Oh, look, all of our CAPAs are below that threshold that we set." That was kind of a BS threshold to begin with that has no value or meaning to whether or not your process works. So yeah, I think we just need to revisit that. So yeah, I think it's time. Everyone should do a CAPA on their CAPA probably at least on an annual basis.

Mike Drues: I'm glad you liked the idea and two things. First of all, I agree with you that oftentimes we're using the wrong metrics. You said the time to closure. Coming from a medical background, there's a lot of ways that you can measure the efficacy of a surgical procedure. But usually the time to close the patient is not one of them. So I don't think the emphasis should be here the amount of time that it takes. But more importantly, I'm glad you liked the suggestion. And I made that suggestion to companies and I do make it a lot, purposely inject a problem to see if your system can detect it. Some companies say to me," Mike, that's a great idea, but we're not going to do it." Any thoughts as to why you think they might not want to do it, Jon? And I know we got to wrap this up.

Jon Speer: My pause was not for dramatic effects, but I'm searching. I can't imagine why improve them. The low hanging fruit answer is they look at quality systems as a checkbox to demonstrate compliance. And so they're just trying to satisfy an auditor or a regulatory body with respect to their practices.

Mike Drues: Well, there's two responses that I typically get from people when they say they don't want to do this, purposely inject a problem. One is they say, where is it required? Where does it say that I have to do this? And of course it's not required anywhere. It's my recommendation. The other reason why, which is even the scarier reason for me, is because they don't want to test their system for fear that they get a result that they don't want. In other words, what if they purposely inject this problem and it turns out that their system does not detect it? Now, what have they done? Now, they have now totally invalidated their equality management system. And now you're in a much bigger problem than you had before. So I think it's a great suggestion. I'm glad that you agree that it's a good suggestion. But like everything, there's advantages and disadvantages. The last quick thing that I would say, Jon, and I know we got to wrap this up, is I think I've mentioned in some of our conversations before, I think the whole emphasis of CAPA is bass ackwards to be blunt. Corrective action, preventative action. Why do we put the emphasis on corrective action? I think we should call it a PACA, a preventive action corrective action. This is all about a prospective versus retrospective clinical trial or passive postmarket surveillance versus active postmarket surveillance. The parallels here to other areas of quality and regulatory are just stunning. But it's amazing to me how few people see them because they're not thinking in the terms, they're not thinking in what I like to call regulatory logic. Is that, or maybe I'm just this whackadoodle Drues guy who doesn't know what the heck he's talking about?

Jon Speer: Well, I think the packet is... and you and I have talked both on and off the podcast and conversations, the emphasis is in the wrong place. There's probably Duran or Deming or some father of quality that's credited with some sort of saying along these lines. But companies always find time to fix problems that happen and they don't take the time to make sure that the problems never occur in the first place.

Mike Drues: What do they say?"" An ounce of prevention, a pound of cure." Whatever cliche you want to use, they all have a lot of truth. So why don't you wrap this up, Jon? And we'll call it a day.

Jon Speer: Sure. Yeah, absolutely. So folks, certainly glad that you tuned in to hear Mike and I riff a little bit about CAPA and hopefully you take some of the things you heard, he and I shared with you to heart. Highly encourage you to do a CAPA on your CAPA process. Maybe one of the things, the recommendations that you come up with is," Hey, let's call it a PACA." Maybe there are ways that you can inject sort of these opportunities into your processes, these fire drills so to speak so that you can test and confirm with confidence that your processes are robust enough to handle the issues that are fictitious so that when you have a real issue, you have confidence. And I think that's what we're looking for with respect to our processes is confidence that they will work and address the needs when we need them to the most. So again, thank you all for listening to the global medical device podcast. This is your host and founder at Greenlight guru, Jon SPEER. And of course Mike Drues, president of Vascular Sciences. Until next time.

About the Global Medical Device Podcast:

The Global Medical Device Podcast powered by Greenlight Guru is where today's brightest minds in the medical device industry go to get their most useful and actionable insider knowledge, direct from some of the world's leading medical device experts and companies.

Like this episode? Subscribe today on iTunes or Spotify.