Issue Tracking and CAPA (Corrective and Preventive Action) Management

I would appreciate your comments and suggestions on the following topic: we have a robust CAPA system in place (we are a medical device company) and we use a rigorous issue assessment process that rates issues for severity and occurrence (modelled after ISO14971). This assessment then assigns a risk rating to the issue, which in its turn drives the CAPA process. All good so far.

As in any organisation there are many issues that continuously occur, most of which would never make it to the level of a CAPA, even if rated. In fact, most issues do not get rated and are handled by the professionals in who's area the issue occurs.
And this is the concern: once a decision has been taken that an issue is important enough the formal process kicks in, but what about all those cases where we make informal decisions not to initiate the CAPA assessment process?

In other words, I am considering if there would be a need to have an issue tracking system that would log a larger volume of issues and require a quick assessment to:
1) further assess the issue for CAPA
2) not assess the issue for CAPA and allow a local correction of the issue
In case of no CAPA assessment, a justification would be required.

The advantages of tracking issues would be, amongst others:
- better visibility of non-conformances within the organisation (in addition to e.g. existing MRB and concession systems)
- having a recorded justification to NOT start a CAPA for a larger amount of issues.
The main disadvantages are increased complexity and the resource claims that such a system would bring with it.

I would like to get feedback from those of you in either medical device or pharmaceutical industry who has gone through similar evaluations and learn from you.

Thanks!
Paul

Paul,

Hopefully others will chime in with feedback. However, I can at least provide one positive datapoint... in our quality system software we implemented an independent "issue management" process similar to what you described. Issues of all types are fed in through there, and triaged to different processes (complaint handling, CAPA, etc.) In the case where an issue is addressed locally rather than by one of those downstream processes, the user is required to provide a justification.

We also use the software internally for our own quality system, and employ that practice effectively. All customer interaction is fed in through the issue management process. Feature requests become CAPAs, potential defects become complaints (which may also result in CAPAs), and so on. However, we also keep track of questions that customers ask (e.g. "How do I establish a periodic review schedule for specific documents?") as issues, even when they're resolved immediately by answering the question via email or phone. Then later we can easily review/trend issues and see if there are areas that do warrant a CAPA from a usability perspective (e.g. "Looks like we've had seven customers in the past month with questions about periodic document review, let's initiate a CAPA to investigate ways we can reduce or eliminate confusion").

The approach has worked well for us internally. It allows us to easily capture all customer interaction, focus on the immediate problems, and not lose track of opportunities that might surface in an analysis of the remaining issues.

From what we've seen across our customer base this type of approach is becoming much more common in the medical device industry (where previously issues were almost always identified and handled locally). Hopefully others will contribute more direct experience.

Good luck,

Jim Ivey

what you must do is dependent on your customer requriements and industry requirements...

that said what we do is track 'issues' in several different databases but in similar ways.

For product nonconformances that cannot be handled via standardized rework procedures, we issue an NCR (Non conforming material report). The great majority of NCR events are corrected and documented on the NCR report without a Corrective Action. However, we track the number and type of NCRs and may issue a corrective action if a systemic cause is detected, a high repeat occurence rate or if a specific NCR has a severe effect.

For nonconforming product that can be reworked with standard rework processes, we record each failure and track the failure rates (using SPC). We issue corrective actions for the top 3 occuring failures by effect on the organization (cost or cycle time)

For field failures, we track both customer calls and service events (some field problems can be resolved via the phone and do not require a service event). Again we track using SPC, issue corrective actions on the top pareto items AND because they are field problmes we also issue corrective actions when a failure mode exceeds an SPC signal that the rate has increased. The only exception to this is for low severity failures and we set an upper threshold limit instead of an SPC limit for these...

This way we know what our problems are and we attack them in an organized prioritized fashion...

Indeed you need to record and analyse your product non-conformances, but also process non-conformances identified.

In the non-conformity handling you need to assess the need for CAPA. If the observed risk is equal or less than the risk identified in your product risk management report you do not need to issue a CAPA. This means that the harm was identified and the frequency of occurance in the last specified period (e.g. year, 20 batches) is equal or less than the frequency in the risk management report. For any new risk, which was not identified previously, you need to determine the risk and evaluate whether is acceptable or not (according ISO 14971). If not, a CAPA is required. Obviously, you need to update your risk management report to add the new risk.

Commonly, compagnies only raise a formal CAPA when the handling of the non-conformance requires management oversight, e.g. when it involves distributed products, the non-conformance is critical to the business, additional resources are required to execute the actions. Straightforward non-conformities that can be fixed easily at operating level are handled within the NCR.
I consider this practice only acceptable when the actions required for non-confomances not raised to a formal CAPA are still tracked until closure at operational management level, e.g. by NCR tracking. Performance data of NCR occurance and NCR handling must be communicated to senior management, e.g. through Management Review. This provides senior management the opportunity to initiate preventive actions at their descretion.

My organization's Environmental Engineer and I worked out an internal nonconformance tracking process and log that he uses to record, track and look for patterns independent of the Internal Audit process. I have attached the Tracking Log in the PA, CA and Risk-Based Decision Making - Need Input thread.

I have read-only access to this log on an ongoing basis, and use it to plan audits, as well as look for issues that have something in common with the quality, safety and Process Safety Management systems so as to identify areas of opportunity beyond the process.

In this way, issues don't get forgotten as soon as they are resolved. If the Environmental Engineer finds repeats, he can ask for a resolution from the next management level up from the last time, and press for a more systemic solution.

I don't know if this would help you and I do not work in medical devices - thought I'd offer just in case.

Thanks for all your valuable feedback!

I see that most of you have a more elaborate issue tracking system in place that is preceding the CAPA process. I am concerned about the impact on the resource that is required to actually log, review and arrive at a disposition about the issues. I would appreciate your further comments and sharing about this aspect of issue management.

Thanks!!

Paul

I consult to the FDA regulated industries (Pharma, bio, device, API) and capturing, analyzing/investigating (as required), tracking, trending, corrective and preventive actions are a must. It is one of the highest 'problems' in the industry, just take a look at the warning letters on the FDA web site. There are many challenges to a successful system, including identifying observations, reporting them, time lines, incorrect metrics etc. The one thing that is absolute key to success is total executive management support. They or for medical devices the Management Representative are the ones named in the warning letters. I know from first hand knowledge of running workshops, performing investigations, running a CAPA system, reporting metrics etc that it's not easy but it is possible !!!!! thanks