Preparing for an FDA QSIT inspection can be a daunting task for medical device manufacturers. Many companies worry they will fail and often feel a sense of being “policed.” If you prepare well in advance of an inspection, not only can you reduce these fears, but you can find that your company can actually reap many benefits throughout the process.
We talk about it time and time again--we all want to produce the safest, most effective medical devices, right? Well, this so happens to also be the overarching goal of a FDA QSIT inspection. Here’s some background on the topic and what you need to know to prepare:
Free Resource: FDA QSR & ISO 13485:2016 QMS Audit Checklist. Click here to download.
What is QSIT?
The requirements for quality systems are defined in 21 CFR Part 820. The guidelines and regulations found in document have been in place for over 20 years now. FDA has also published guidelines intended for inspectors on the inspection process of quality systems, known as QSIT or Quality System Inspection Technique. It’s an aid to teach them how to inspect a medical device company so that they demonstrate compliance with Part 820 regulations.
As a medical device company, you know what the rules are and you can use the Guide to Inspections of Quality Systems as a resource to help you understand what inspectors will be looking for.
The chart below is from the QSIT guidance and shows the quality system and major subsystems. A QSIT audit will likely look at at least three or four subsystems per FDA inspection. In this article, we will focus on the four primary subsystems recognized by FDA. While reading, imagine how your procedures and records fit within these subsystems and linkages.
Corrective & Preventive Action (CAPA)
You should also know that some subsystems will always be included in an audit. Corrective and Preventive Action (CAPA) is one of these. Year after year, CAPA is the top item that companies struggle with, so you can expect it to continue to be a hot button for the FDA.
Some people say that companies struggle with CAPA because the QSIT audit includes CAPA every time. In other words, if the FDA is looking, they will find something.
CAPA is really a gateway to the overall health of your quality system though, so it makes sense to look at it closely. You can expect an FDA inspector to “follow the thread” when it comes to any CAPA. What I mean by that is that they will explore all directions of the systemic issue that you captured, to ensure that you have left no stone unturned. They want to know that you’ve actually completed a root cause and don’t have any returning issues out of things that you’re supposed to have resolved already.
If you have products on the marketplace already, you can expect a fair amount of time to be spent on evaluating your complaint records. Bear in mind that part of the FDA’s job is to ensure that devices on the market aren’t a menace to health. They specifically want to ensure that your products aren’t causing health issues or injuries for the patients who are using them.
The FDA is interested in seeing your decision trees, and how you determine whether a complaint should be designated as an adverse event. If you should have submitted a report to the FDA, they’re going to be checking that you’ve done so and followed correct procedures.
In my experience (having gone through dozens of audits), an inspector will always start with either CAPA or complaints when they come in. These are a primary focus, but of course, you can expect they’ll look at other areas too. For example, if you’re in manufacturing, they may look at manufacturing processes
Management control
When you look at the QSIT diagram pictured above, management sits at the center of the QSIT. The expectation is that executive management is engaged, involved with and aware of the company’s quality management system.
I’ve seen it all too often where companies want to outsource quality management to a third party. This is a terrible idea for a number of reasons. From the FDA’s point of view, the quality management system is the pulse of your business. When structured properly, it’s a series of business practices that you’ve implemented to ensure that the medical devices you’re bringing to market are safe and effective.
If you as an owner or executive remove yourself from that quality management system, in the eyes of the FDA it appears that you don’t care about the pulse of your business. By extension, perhaps you don’t care about the safety and effectiveness of the devices you are manufacturing.
You don’t need to be an expert in every area yourself, but you do need to have oversight. You need to know the systemic issues that are being addressed and what’s happening with any CAPAs.
Production and process controls
From a production and process control standpoint, it's not uncommon for FDA to include sterilization process controls as part of their scope of inspection. Basically, they want to know that the products you produce on a regular basis are safe, reliable, reproducible and of high quality.
It’s often surprising to early-stage companies when there is a lot of focus put on manufacturing. This is usually the case when you’re new because it’s a “baseline” for the FDA. They haven’t seen you before so they want to make sure you have the proper controls in place. This will pull in things like supplier management, as well.
An inspector will usually choose one manufacturing process within your company at their discretion and conduct a full inspection of that specific process based on several criteria:
- There must be procedures for controlling and monitoring the process, and they must be implemented on an ongoing basis.
- The process must have been validated at some stage by conducting a validation study.
- If the process is controlled by software, the software must have been validated at some stage by a validation study.
- Only qualified and adequately trained personnel are involved in implementing validated processes.
Design controls
Design controls are the bread and butter of medical devices. Your design history file (DHF) and other documentation determine whether you’ve properly vetted and validated your product, which is critical during a QSIT inspection.
Auditing your design controls is a complex, multi-step process that takes time, even when your data access and organization are impeccable. Your inspector will select a single design process and ensure that the corresponding design control process addresses the requirements of Section 820.30 of Title 21, before reviewing the associated documentation for their presence and completeness.
Final thoughts
Don’t put off preparation any longer. We had a customer recently tell us that FDA was planning to do an inspection that following week. They had five days to “prepare” for an FDA inspection. If you’re not ready now, you’re not going to be ready in five days!
Unfortunately for this particular company, they had put a number of things on the back burner related to the actual management aspect of their quality system. No internal audits had ever been done by the company leading up to this QSIT inspection so they would be essentially going into the QSIT inspection blind.
And to set the record straight--FDA can, in fact, show up at any time! They don’t have to give you a call first, that’s just a courtesy that they sometimes extend.
If the FDA were to knock on your door today, would you be ready? One of the great things about the QSIT guidance that's available is that you already know what they’re looking for and how they’re going to do it. Prepare now and enjoy the peace of mind that comes with knowing you are ready for whenever that time comes.
Looking for an all-in-one QMS solution to advance the success of your in-market devices and integrates your quality processes with product development efforts? Click here to take a quick tour of Greenlight Guru's Medical Device QMS software →
