Where are these Medical Device Requirements stated?

cubix rube

Involved In Discussions
1. In more than one recent audit, we were issued nonconformances for not conducting process validations. In reading both ISO 13485, as well as 21 CFR 820, it says validation must be performed n "special processes", whose output cannot be verified through subsequent monitoring and measuring", e.g. sterilization, heat treating, etc. We are a die cutting facility, and we do not have any special processes, whose output cannot be verified by subsequent monitoring and measuring. Even though we've explained this, they still include it as a nonconformance. :bonk:

2. Our change control procedure indicates that customers will be notified if a change affects cost or delivery of their product. We were issued a nonconformance on a recent audit because our procedure does not specifically state that we would notify our customer of a change that does not affect cost or delivery. For instance, a material callout that says, "black EPDM rubber sheet 40 durometer shore A". If I switch from one supplier to another, supplying identical material that indeed meets the same spec., where does the standard state that I must notify my customer?

I have looked extensively through the aforementioned standards, and have found no specific requirement for either of these. For the record, we do notify customers prior to making any changes that would affect their parts, such as materials, or such, and I understand why a customer would want such notification, but isn't that usually addressed in Terms and Conditions, or stated on a PO issued by the customer? These are QMS audits, and our QMS was developed to meet 13485, which it does.

Can somebody please direct me to the clause/paragraph/etc. where these requirements are specifically stated, i.e. process validation for a process whose output CAN be verified, and notification to a customer prior to making a change?

Thank you!
 

Wes Bucey

Prophet of Profit
Re: Where are these requirements stated??

1. In more than one recent audit, we were issued nonconformances for not conducting process validations. In reading both ISO 13485, as well as 21 CFR 820, it says validation must be performed n "special processes", whose output cannot be verified through subsequent monitoring and measuring", e.g. sterilization, heat treating, etc. We are a die cutting facility, and we do not have any special processes, whose output cannot be verified by subsequent monitoring and measuring. Even though we've explained this, they still include it as a nonconformance. :bonk:

2. Our change control procedure indicates that customers will be notified if a change affects cost or delivery of their product. We were issued a nonconformance on a recent audit because our procedure does not specifically state that we would notify our customer of a change that does not affect cost or delivery. For instance, a material callout that says, "black EPDM rubber sheet 40 durometer shore A". If I switch from one supplier to another, supplying identical material that indeed meets the same spec., where does the standard state that I must notify my customer?

I have looked extensively through the aforementioned standards, and have found no specific requirement for either of these. For the record, we do notify customers prior to making any changes that would affect their parts, such as materials, or such, and I understand why a customer would want such notification, but isn't that usually addressed in Terms and Conditions, or stated on a PO issued by the customer? These are QMS audits, and our QMS was developed to meet 13485, which it does.

Can somebody please direct me to the clause/paragraph/etc. where these requirements are specifically stated, i.e. process validation for a process whose output CAN be verified, and notification to a customer prior to making a change?

Thank you!
You can help us give you focused answers if you give us the exact quote the auditor wrote in claiming N/C.

I suppose you realize by now this was the primary question which should have been put to the auditor in the closing meeting. The mantra of the quality professional facing any N/C which is confusing or vague is
"Show me the shall!" (demanding the auditor cite chapter and verse of the internal or external Standard or Regulation which appears to be in nonconformance.)
 
G

Gert Sorensen

1. In more than one recent audit, we were issued nonconformances for not conducting process validations. In reading both ISO 13485, as well as 21 CFR 820, it says validation must be performed n "special processes", whose output cannot be verified through subsequent monitoring and measuring", e.g. sterilization, heat treating, etc. We are a die cutting facility, and we do not have any special processes, whose output cannot be verified by subsequent monitoring and measuring. Even though we've explained this, they still include it as a nonconformance. :bonk:

2. Our change control procedure indicates that customers will be notified if a change affects cost or delivery of their product. We were issued a nonconformance on a recent audit because our procedure does not specifically state that we would notify our customer of a change that does not affect cost or delivery. For instance, a material callout that says, "black EPDM rubber sheet 40 durometer shore A". If I switch from one supplier to another, supplying identical material that indeed meets the same spec., where does the standard state that I must notify my customer?

I have looked extensively through the aforementioned standards, and have found no specific requirement for either of these. For the record, we do notify customers prior to making any changes that would affect their parts, such as materials, or such, and I understand why a customer would want such notification, but isn't that usually addressed in Terms and Conditions, or stated on a PO issued by the customer? These are QMS audits, and our QMS was developed to meet 13485, which it does.

Can somebody please direct me to the clause/paragraph/etc. where these requirements are specifically stated, i.e. process validation for a process whose output CAN be verified, and notification to a customer prior to making a change?

Thank you!

The requirement for validation is not only for special processes, but for also for processes that cannot be 100% verified by subsequent control. So, if your process cannot be verified objectively by subsequent control - i.e. inline measurement - then it needs to be validated.

Change of materials is a no-go without the legal manufacturers approval. The materials used for approval of the device may not be changed without their acceptance because of biological testing that needs to be in place (Cytotoxic testing). If you as a componentsupplier change the component, and thus the product- you place the legal manufacturer at risk for non-compliance.

You may not have an easy time finding specific references for your questions, but a good source for understanding the current interpretation of these issues are the FDA warning letters, which are free for download af FDA's website. Don't forget: there is a c in cGMP :D
 
M

MIREGMGR

if your process cannot be verified objectively by subsequent control - i.e. inline measurement - then it needs to be validated.

While I understand the spirit of "inline", I do not see that word in the actual rules. We have processes that are verifiable, and that we verify via regular sampling on an offline basis. We consider them to be compliant, and to date, so have our NB and customer auditors.

And yes, I read all the (published) medical device Warning Letters. :)

We validate a lot of processes, but...subject to Wes's comment about the actual auditor language...I don't see a need for validation of sheet-material die-cutting.
 

Ronen E

Problem Solver
Moderator
IMO the major difference between verification and validation is not about 100% vs. less. Typically, both rely on statistical considerations and techniques, and seldom provide "100.1% confidence". The requirement is many times along the lines of "high level of confidence". What is a high level? It depends on the circumstances, and could (or maybe should) be the subject of risk evaluation; the numbers must naturally be in the high quadrant. The more important difference is that validation takes place upfront, and then the (significant) process parameters are monitored and controlled, while verification is always done post-manufacturing (even when it's inline), and the manufactured article is the monitored entity.

I don't see anything non-compliant in a verification process that is based on sampling, given that it provides a high level of confidence based on the criticality of the verified requirement, that it's based on a rather-heavy sampling approach (unless criticality is low), and that the statistical analysis is rigorous.
 
Last edited:

Wes Bucey

Prophet of Profit
While I understand the spirit of "inline", I do not see that word in the actual rules. We have processes that are verifiable, and that we verify via regular sampling on an offline basis. We consider them to be compliant, and to date, so have our NB and customer auditors.

And yes, I read all the (published) medical device Warning Letters. :)

We validate a lot of processes, but...subject to Wes's comment about the actual auditor language...I don't see a need for validation of sheet-material die-cutting.

IMO the major difference between verification and validation is not about 100% vs. less. Typically, both rely on statistical considerations and techniques, and seldom provide "100.1% confidence". The requirement is many times along the lines of "high level of confidence". What is a high level? It depends on the circumstances, and could (or maybe should) be the subject of risk evaluation; the numbers must naturally be in the high quadrant. The more important difference is that validation take place upfront, and then the (significant) process parameters are monitored and controlled, while verification is always done post-manufacturing (even when it's inline), and the manufactured article is the monitored entity.

I don't see anything non-compliant in a verification process that is based on sampling, given that it provides a high level of confidence based on the criticality of the verified requirement, that it's based on a rather-heavy sampling approach (unless criticality is low), and that the statistical analysis is rigorous.
I, more than most, take an extremely jaundiced view of "mission creep." Based solely on the OP's statements, this "seems" like a case of mission creep. BUT I still reserve judgment until I see the exact quote of the auditor's statement. I don't mean to be cruel here, but over the years, we've had a lot of folks come to us with a complaint, only to find out later that, like the Gilda Radner comedy character, "Emily Litella," we hear, "Never mind!"
 
A

abigailt

While I understand the spirit of "inline", I do not see that word in the actual rules. We have processes that are verifiable, and that we verify via regular sampling on an offline basis. We consider them to be compliant, and to date, so have our NB and customer auditors.

And yes, I read all the (published) medical device Warning Letters. :)

We validate a lot of processes, but...subject to Wes's comment about the actual auditor language...I don't see a need for validation of sheet-material die-cutting.

I am involved with Process Validation of a number of different processes and can see parallels to our system.

One of our key areas is our liquid dispensing line - we have decided that the critical items here 1) the amount dispensed, 2) how tight the cap is on the bottle and 3) the label.

We do off line QC of these 3 criteria every 15minutes but this only verifies 1 sample every few hundred therefore is not 100% verifiable. We therefore carried out validation trials to show that the process was consistent and reproducible and met the required limits throughout any 15minutes session. You do not need to validate across the entire length of a production run as long as the verification is stipulated at regular points within the process. We used statistical tables to decide how many samples to take from the 15minutes worth of product and showed that all samples met the required criteria. All of this is on top of equipment validation and ensuring maintenance, calibration and set up meets acceptable parameters.

This would seem to be similar to your die cutting line. If however you are able to check the items you decide are critical to your product quality on every example that comes off the line then you do not need to validate that process. i.e. if the only criticals are 2 key dimensions and a weight and these are checked in line then you dont require the validation.

However the recommendations we have received from trainers, consultants and ISO13485 auditors is that your rationale for why you are not validating - because it can be fully verified - are documented within a Company wide Validation plan. If you can show it has been considered and there is a well thought out explanation then this will be viewed more positively than what could be considered to be 'thinking on your feet'
 

Wes Bucey

Prophet of Profit
thi
I am involved with Process Validation of a number of different processes and can see parallels to our system.

One of our key areas is our liquid dispensing line - we have decided that the critical items here 1) the amount dispensed, 2) how tight the cap is on the bottle and 3) the label.

We do off line QC of these 3 criteria every 15minutes but this only verifies 1 sample every few hundred therefore is not 100% verifiable. We therefore carried out validation trials to show that the process was consistent and reproducible and met the required limits throughout any 15minutes session. You do not need to validate across the entire length of a production run as long as the verification is stipulated at regular points within the process. We used statistical tables to decide how many samples to take from the 15minutes worth of product and showed that all samples met the required criteria. All of this is on top of equipment validation and ensuring maintenance, calibration and set up meets acceptable parameters.

This would seem to be similar to your die cutting line. If however you are able to check the items you decide are critical to your product quality on every example that comes off the line then you do not need to validate that process. i.e. if the only criticals are 2 key dimensions and a weight and these are checked in line then you dont require the validation.

However the recommendations we have received from trainers, consultants and ISO13485 auditors is that your rationale for why you are not validating - because it can be fully verified - are documented within a Company wide Validation plan. If you can show it has been considered and there is a well thought out explanation then this will be viewed more positively than what could be considered to be 'thinking on your feet'
This is an excellent synopsis of "validation." The most important point in "validation" is that the validation process must be DOCUMENTED, because anecdotal conversation does not deliver assurance the validation plan is consistently applied.
 

Chrisx

Quite Involved in Discussions
One possible solution to the issue might be to document in the quality manual that clause 7.5.2 process validation is not applicable. The quality manual should include a justification for this non-applicability. In otherwords, document that the organization does not have any special processes and that existing manufacturing processes are verifiable.

Typically, auditors have to gather objective evidence for implementation of all applicable clauses. By taking non-applicability to the clause, the auditor no longer has to look for the evidence. This approach does require a documented justification for the non-applicability or the auditor should question this.
 
Top Bottom