MANUFACTURING

Medical Device & Diagnostic Industry
Magazine | MDDI Article Index

Originally published March 1996

Glen Paul Freiberg

Joint ventures and comanufacturing agreements are becoming increasingly common in the medical device and diagnostic industries. In this new environment, device companies need to find an effective means of conducting speedy good manufacturing practices (GMP) assessments of regulated vendors that are under consideration for joint ventures or as suppliers of finished products, accessories, or significant components. Additionally, companies should be prepared to address situations in which selecting an alternative vendor is not an option.

Many well-run device companies have already audited their vendors. Nevertheless, FDA has found sufficient deficiencies in this regard among device companies to specifically address the topic in its proposed revision to the GMP regulation.¹ At the same time, the agency has taken great pains to harmonize the revised GMP regulation with the family of quality systems standards compiled by the International Organization for Standardization (ISO)--commonly known as ISO 9000--and with similar documents in preparation worldwide. All of these factors favor a greater emphasis on vendor auditing.

PLANNING THE AUDIT

FDA's traditional practice has been to conduct GMP inspections without prior notice--an investigational approach that is generally confrontational and often puts companies on the defensive. This model--which even the agency may be changing in the near future--is not one that device companies should seek to emulate.

Instead, manufacturers have an advantage in being able to secure the cooperation of prospective vendors in advance and to plan the course of the audits. Advance planning in conjunction with the vendor to be inspected can help ensure that the device company is able to assess the vendor's GMP compliance efficiently.

In its initial correspondence with the vendor, the manufacturer should communicate its desire to conduct a site visit at a mutually convenient time, and should outline the goals of the visit. The letter should detail the policy issues to be discussed, the records to be reviewed, the qualifications of the auditor, and the expected time required for the audit. These elements of the audit are discussed in greater detail below.

Although the initial correspondence may take the form of a standard letter, it should be customized as much as possible. For instance, the list of policies to be reviewed should be tailored so that it focuses on relevant product lines and processes. Similarly, standard requests for certain types of information, such as information about sterilization processes, should be omitted if they do not apply to the vendor. Customizing the letter in this way will help the device manufacturer establish a closer working relationship with the vendor.

Since vendors can sometimes be resistant to audits, the manufacturer's correspondence should take pains to explain that the purpose of the visit is to review the vendor's GMP compliance cooperatively, noting that a confrontational approach is seldom useful for either party. The letter should explain that it is the manufacturer's policy to verify that quality systems are in place to ensure product quality and reproducibility, and that an independent assessment is considered appropriate due diligence.

The manufacturer should also request a letter of confirmation from the vendor indicating that it agrees to undergo the audit and to provide whatever records may be requested. Such a letter is valuable for confirming that the person serving as the vendor's representative has the authority to grant a record review and to produce the requested records.

In some cases, it may be necessary for the device manufacturer's representative to sign a confidentiality statement indicating that information provided by the vendor will not be disclosed to unauthorized persons or companies. Unless the device company's policies prohibit this, signing such a statement can help to smooth the way toward a successful audit. However, the manufacturer should ensure that the terms of the document cover only confidentiality and do not otherwise restrict or obligate the company in any way.

If a vendor raises objections to the audit because it has already been ISO 9000 certified, it is appropriate for the device manufacturer to point out that there is no assurance of a correlation between such certification and a successful GMP inspection. If the vendor objects because it has recently undergone a successful GMP inspection, acknowledge this success and repeat that the visit is required for the device company's due diligence. It may be helpful to indicate to the vendor that the audit can provide education and assistance in the areas to be reviewed.

SETTING THE AGENDA

Once the manufacturer and vendor have agreed to the general outline of the audit, the manufacturer should finalize its preparations. As noted above, it is the device manufacturer that must take the initiative in establishing the goals of the audit, and it is therefore important that the auditor be thoroughly prepared to handle all of the inspectional areas previously identified. Following are the key elements that the manufacturer and vendor should agree upon in order to make the audit as productive and efficient as possible.

Vendor Policies and Procedures. The manufacturer should provide the vendor with a general list of the policies it wishes to review. Such a list can be used as the basis for the agenda of the introductory meeting at the vendor's facility, and might include any or all of the following:

* Structure of the vendor's quality systems organization.

* Product development policy and process (e.g., does the vendor use project management or Gantt-charting software?).

* Document-control policies.

* Policies for handling complaints and complying with requirements of the medical device reporting (MDR) regulation.

* Procedures for handling nonconforming materials.

* Procedures for conducting failure investigations.

* Procedures for statistical evaluation of in-process and final release rejections.

* Procedures for software quality assurance.

* Procedures for validation of design and manufacturing processes.

* Policies related to recalls.

* Calibration programs.

* Policies and procedures related to clinical trials.

Record Inspections. A thorough review of key documents is essential for conducting a timely GMP review and state-of-control assessment. In order to enable the vendor to prepare for the audit, the manufacturer should provide advance notice of all documents it intends to inspect, and should ask that all of them be made ready for inspection on the day of the audit.

The following list can serve as a guideline for the types of documents that the manufacturer should request. While their exact number and the periods of time they cover may vary, the documents listed here can generally provide a fairly accurate snapshot of a vendor's performance.

* Engineering change notices (product- or process-change documents); request the last 10 consecutive orders implemented by the vendor.

* Materials review board (or rejection review meeting) documents; request the last 10 consecutive reports.

* Complaint investigation documents; request a copy of the vendor's complaint-handling procedure, copies of the last 10 consecutive closed complaint investigations, and copies of any MDR filings sent to FDA (if more than 10 have been filed, ask for the last 10 consecutive filings).

* For each of the record types noted above, request the first 5 consecutive records for a period beginning 8 to 10 months prior to the audit.

* Copies of any FDA-483s given to the vendor during the past three years, and the vendor's responses to those notices.

* Complete information about any FDA action related to the company in the past three years.

* All validation records generated during the past year.

* Specific batch records or laboratory notebooks for the product or process to be reviewed. If no products or pilot production lots have yet been manufactured, request a consecutive series of batch records from a relevant process (the auditor should determine how many).

Before inspecting the documents, the auditor should confirm that all of the requested items have been supplied. Requesting such a large volume of records, of course, creates a lot of paperwork. By assessing the first few documents of each type, however, the auditor may in some cases be able to determine that not all the records require close scrutiny.

It is important to verify that the vendor has provided the full set of consecutive records requested. In cases where it is difficult to determine whether records are, in fact, consecutive, the manufacturer should request printouts or other documentation indicating the lot numbers or shipping records for the product lots in question. Missing records should induce further investigation.

The Auditor. The manufacturer should describe for the vendor the auditor's role in the company and provide background material to establish his or her general qualifications. A blend of technical expertise, conceptual expertise, and interpersonal skills beyond diplomacy are the optimal characteristics of an auditor. Since the goal of the audit is merely to establish that the vendor is GMP compliant and that its processes are in a state of control, it is not essential that the auditor have expertise in the particular product or process being audited. If such expertise is thought to be necessary, the lead auditor could have a specialist accompany him or her during the site visit. In general, however, the tenets of the GMP regulation have been designed to transcend any particular product, process, or specialty; the necessary level of product or process expertise should be determined on a case-by-case basis.

Audit Time Frame. Historically, FDA will not commit to a specific time frame for its GMP inspections. This is because the results of an ongoing inspection can lead to areas requiring greater depth of examination. However, by planning their audits in advance, manufacturers again have an advantage in being able to predict more accurately how long the audit should take. In general, the type of vendor audit outlined here can be completed in two days for a small- to medium-size facility--especially if only a few products or processes are being audited. Examination of a major product line or a large facility would take more time.

Ideally, the audit would be planned for a time when the manufacturing of the product in question can be observed. If it is not possible for an auditor to view the entire process, the manufacturer should identify and audit those portions that will be most useful for determining the vendor's GMP compliance and state of control. If the vendor is unable to manufacture or test the product in time for the audit, the manufacturer should ask to inspect the vendor's procedures for similar products or processes. If even that is not possible at the time of the audit, the manufacturer should arrange with the vendor to have an auditor return to the facility at a time when such manufacturing can be observed.

The plant tour should take place after the manufacturer and vendor have conducted the introductory discussion about the audit. Here, the audit will have much in common with FDA's GMP inspections. The auditor should examine areas where in-process and rejected goods are stored. If a significant number of rejected goods are kept in storage, the auditor should attempt to determine the root causes of the rejections. If in-process goods such as reagents stay in that disposition for an extended period, the auditor should closely evaluate the vendor's planning processes--especially if the goods carry expiration dates based on their ultimate release dates.

OUTCOMES AND OPTIONS

Aside from the best possible result--finding the ideal vendor--an audit may result in several other outcomes that the device manufacturer should be prepared to handle. In the worst case, significant findings of noncompliance should be considered cause to reject the vendor. However, there may be instances when it is best not to do so, or when rejecting the vendor is not an option. For example, the vendor may be a sole-source supplier, or a contract may have already been approved before the vendor was audited (a situation that is unlikely to occur once FDA's revised GMP regulation takes effect). Several options are available when considering a vendor that fails an audit or is found to be significantly deficient in its GMP compliance.

First, if a contract has not already been approved and the audit findings suggest only minor deviations from vendor policy or procedure, the manufacturer can take direct steps to ensure that necessary improvements are handled within a reasonable period. These can be included as stipulations to the contract under negotiation. Such stipulations might require a return audit by the manufacturer, a return audit by an independent third-party auditor, consulting assistance by a third party, or a combination of these.

Second, depending upon the amount of time and degree of help the manufacturer's auditor can provide, the manufacturer can prepare a list of goals and agree to work with the vendor to improve its compliance. In this case, it is essential that the manufacturer and vendor arrive at a mutually agreed upon time limit for meeting the goals. Otherwise the manufacturer can find itself indefinitely obligated to an unacceptable vendor.

Third, if assisting the vendor is either infeasible or undesirable and it is too late to amend the contract, the manufacturer should recommend that the vendor obtain third-party assistance. In cases where the manufacturer wants to use the vendor's services but lacks the time or resources to be of assistance, splitting the fees of a third-party consultant can be a useful solution. Depending on the financial arrangements between the manufacturer and vendor and the costs of developing an alternative vendor, such a fee-splitting agreement can actually result in cost savings to the device company. Splitting the fees also entitles both the device company and the vendor to full and regular reports.

When a vendor accepts this third option, it is imperative that it and the manufacturer agree on an experienced consultant who has documented expertise in the areas of concern. FDA has been clear on this issue in its draft of the revised GMP. When retaining a consultant, the manufacturer and vendor should first request that he or she conduct an independent assessment of the vendor. Although the consultant may find additional items requiring correction, the independent assessment must concur with the general findings of the manufacturer's audit if change is to be brought about successfully. The findings of the independent assessment should determine the full list of areas to be corrected and the necessary time to completion.

CONCLUSION

As strategic partnerships and comanufacturing agreements become more common in the device industry, manufacturers will experience increasing pressure to ensure that their vendors are in full compliance with FDA's GMP regulation. While a history of GMP compliance and products of high quality can be good indicators of a vendor's ability to meet the needs of the manufacturer, they are of little help in assessing new vendors.

Following the process outlined above will help manufacturers to provide a solid foundation for conducting an efficient audit of a regulated vendor. Under the revised GMP regulation such audits will certainly become more common. Device manufacturers should work now to have such a process in place.

REFERENCE

1. "Working Draft of the Current Good Manufacturing Practice (CGMP) Final Rule," Rockville, MD, FDA, Center for Devices and Radiological Health, Office of Compliance, July 1995.

Glen Paul Freiberg is vice president for Bard Diagnostic Sciences, Inc. (Redmond, WA).