How to deal with FDA after not reporting anything for several years

[kreid]

As has been said earlier, unfortunately this type of situation is not uncommon.
I would combine some of the advice above.
Collate your observations and findings into an internal report. Distribute it to your manager and other key people in the organisation that would understand the implications of what your report says. You may want to use careful wording in the report so as to describe the situation and the relevant regulations without making accusations.
In this way you begin the discussions about the issues and also give responsibility for taking actions to those that have authority in the company, obviously I am assuming you are not Head of QA or RA!
If this does not provide the necessary support you need then you should consider your next move, maybe to the next company.
If you go forward with the 510k, do it as a catch-up submission and include all of the changes. Again you can be careful with how you present the information, in a way that you do not deceive the regulator, but also do not advertise the companies lack of rigour, the FDA will probably work out what has gone on and act accordingly without you jeopardising you position.

 

[MDD_QNA]

Oops, forgot to consider that. A bit safer if the OP (and the org) are not USA-based.

It's not US based thank god, but still tricky!

 

[Watchcat]

Is the company participating in MDSAP?

 

[Watchcat]

If you go forward with the 510k, do it as a catch-up submission and include all of the changes. Again you can be careful with how you present the information, in a way that you do not deceive the regulator, but also do not advertise the companies lack of rigour, the FDA will probably work out what has gone on and act accordingly without you jeopardising you position.

I agree and will add that here is another place I would address preventive action, again being careful with how you present the information I would not describe it as preventive action, because that would draw attention to the fact that something happened that needs to be prevented. I might try to drop in some subtle language about how the 510(k) is being filed "in accordance with our current procedures, attached). Don't worry that you wouldn't normally include this information in a 510(k) submission. I agree with kreid, FDA should be able to work out what has gone on (because it's not like it's never seen this before) and understand why you are including this additional information. Otherwise, the first question it will ask itself is whether the company has really gotten its act together.

 

[Ronen E]

I would not describe it as preventive action, because that would draw attention to the fact that something happened that needs to be prevented.

"Something happened that needs to be prevented" is more along the definition of a Corrective Action. A Preventive Action is about preventing something that one concludes may happen, but never actually did.

Otherwise, the first question it will ask itself is whether the company has really gotten its act together.

To me the description provided in the OP is of a company that has clearly not gotten its act together. FDA decisions and actions aside for a moment, I don't think that this can be hidden from anyone taking the effort to look.