Can Inspection Time Be Reduced?: Developing a HACCP Plan

FDA's Office of Compliance is evaluating several inspection approaches to the quality system regulation, one of which is the Hazard Analysis of Critical Control Points (HACCP) pilot program. Driven by budgetary constraints, the Office of Compliance is looking for ways to conduct short, highly focused quality system inspections. Cyberonics, Inc. (Houston), volunteered to participate in the pilot program because of the potential benefits for both FDA and industry—a shorter, more predictable inspection process.

A HACCP inspection would follow a predefined plan, prepared by the manufacturer with the goal of being able to complete an inspection in three days; this time frame should suffice for most small or mid-sized firms. Only if problems were found would the procedure be expanded to a complete investigation.

The HACCP plan is intended to focus on the critical control points (CCPs) most likely to affect product safety. This approach allows regulators to evaluate CCPs over time by examining a firm's monitoring and corrective-action records. The investigator will verify the HACCP plan by confirming that significant product-safety hazards have been properly identified and that the proper controls are in place.

The HACCP program incorporates elements of the ISO standards and the quality system regulation, such as management review, process and change controls, quality planning, corrective and preventive actions, process monitoring, verification, and validation. However, a HACCP inspection, though in harmony with the quality system regulation, is not part of a GMP inspection. HACCP is intended to serve as a stand-alone program.

The basic elements for HACCP already exist in many device manufacturers' quality system procedures and only need to be repackaged into the HACCP format. Class III device manufacturers have already developed much of the information necessary for HACCP while preparing their premarket approval (PMA) submissions, since investigational device exemption (IDE) and PMA rules and HACCP programs all require the identification of critical operations.

Because of the program's pilot status, the Office of Compliance has not issued any formal plans on how the HACCP program would be implemented in the device industry. Given Cyberonics' experience in the pilot program, we can offer insights on how we think this program would be approached, based on our results and discussions with FDA. However, FDA can change any of the details as it sees fit, so nothing presented here should be viewed as a final policy. Nonetheless, at this time the following basic concepts prevail:

A company that follows the steps above would be eligible for shortened HACCP inspections every two years in place of the current GMP process, which can take several weeks. It is undetermined at this time how many consecutive HACCP inspections a company could go through before having to submit to a full-scale investigation to ensure that the company remains in good standing and can requalify for HACCP inspections. Significant GMP violations discovered during a HACCP inspection could result in the forfeit of a company's HACCP-inspection status. New companies would not be able to apply for HACCP benefits until they had been through a comprehensive initial GMP inspection. New facilities would also be ineligible for immediate HACCP privileges, regardless of the company's record.

In all likelihood, companies will desire to participate in the HACCP program because of the shorter, more predictable nature of these inspections. Inspectors will focus on the essential elements of the HACCP plan produced by the company. Since the manufacturer will have identified CCPs in its HACCP plan, it will know what supporting documentation will likely be audited during the inspection.

The inspection would probably start with a complete facility tour, pointing out the critical processes as defined by the HACCP plan, followed by a brief review of the complaint system and its files. The complaint system evaluation would likely not last more than a few hours since the company—by virtue of participating in HACCP—will have already been deemed to be in substantial compliance based on previous comprehensive inspections. Next, the inspector would likely conduct a front-to-back review of the HACCP plan for each product. Any changes to the plan since its original submission would be considered and evaluated. The remainder of the inspection would focus on the documentation and critical processes as defined by the plan.

It's interesting to note that the efficiency and speed of the HACCP inspectional approach has not gone unnoticed by a separate FDA team working on the Quality Systems Inspection Technique (QSIT) pilot program. This group is now trying to match HACCP's predictability, uniformity, and speed, with particular but limited focus on a few production and process controls and corrective and preventive actions in these areas.

IMPLEMENTING HACCP

The HACCP approach has been adopted from the food industry and is designed to identify safety hazards and establish controls to prevent them. In the early 1960s, Pillsbury, Inc., applied the HACCP concept to the production of foods supplied to the U.S. space program and determined that the approach provided assurance against contamination during food production. In the early 1970s, FDA required HACCP controls for processing of canned foods to protect consumers from botulism.

The seven HACCP elements are as follows:

Prior to developing Cyberonics' HACCP plan, company personnel attended a seafood industry HACCP course to obtain a general understanding of the concepts. Although the course was specific to the prevention of seafood processing hazards, the curriculumwas beneficial and educated the attendees on the basic principles of HACCP, including how to conduct a hazard analysis and prepare the HACCP plan.¹ Each HACCP plan is tailor-made to a specific product, manufacturing equipment, and the firm's experience, so it is not realistic to expect FDA to publish a list of critical processes for a given product.

The Cyberonics HACCP team developed comprehensive flowcharts of the manufacturing process for two implantable components of the company's NeuroCybernetic Prosthesis (NCP) system, a nerve stimulator developed for treating epilepsy and other central nervous system disorders. The product is similar to a cardiac pacemaker, except that the lead portion wraps around the left vagus nerve in the neck. Critical components include the Model 100 NCP pulse generator and Model 300 NCP bipolar lead. The HACCP requirements for these two components were evaluated separately because of differences in their manufacture.

HAZARD ANALYSIS

Fundamental to a HACCP system is a hazard analysis of each manufacturing process to determine potential product safety hazards and the measures to control them. The analyses should be performed by individuals familiar with the process, product, and quality characteristics. The Cyberonics team included quality, engineering, and manufacturing personnel.

The team conducted an analysis of each manufacturing process step to evaluate each identified product safety hazard based on its likelihood of occurrence and its severity. A hazard is defined as a biological, chemical, or physical property that may make a product unsafe. The estimate of risk is usually based on technical experience and manufacturing history, which is why a hazard analysis and plan are living documents, subject to changes or improvements. For example, what may be considered a critical process when a 510(k) or PMA application is submitted may not prove to be so a year later when production begins. Conversely, a critical process may be added to a plan if complaints or production experience reveal a hazard not envisioned early in a product's development. Presently, it is not expected that FDA will require a company to submit or obtain advance approval of a change to a HACCP plan, but rather that changes will be considered and evaluated as part of a routine HACCP inspection. The original HACCP submission will likely serve as a guide against which all changes would be measured.

One approach to hazard analysis is to divide it into two activities—brainstorming and risk assessment. Brainstorming should result in a list of potential hazards for each operational step (creating a flow diagram can help with this process). During a brainstorming session, people should not be concerned about deciding how likely a particular hazard is to create a safety concern; the risks and severity of each hazard can be analyzed later to determine their significance. Many points in the manufacturing flow diagram may not be identified as CCPs; however, they may be considered control points that address quality factors or non-HACCP regulatory requirements. A HACCP plan will be ineffective if control points are unnecessarily identified as CCPs. Critical control points are only those points where significant product-safety hazards can be controlled. A HACCP program's goal is to focus solely on significant hazards that are reasonably likely to occur and that would likely result in an unacceptable health risk to the patient or health-care provider. Identifying all product hazards would be an overwhelming and inefficient process. Cyberonics used a hazard-analysis worksheet based on the seafood HACCP curriculum to brainstorm, organize, and document the identification of product-safety hazards (Figure 1).

Figure 1. Hazard-analysis worksheet, based on the seafood HAACP curriculum, to help identify product-safety hazards in conjunction with the process flow diagram.

Preventive Control Measures. Preventive measures are actions or activities that can prevent or eliminate a product-safety hazard or reduce it to an acceptable level. For each significant hazard identified, there must be one or more CCPs in the process where a preventive measure can effectively control the hazard. Although it may not be possible to fully eliminate a significant hazard, minimizing the hazard may be an acceptable goal.

Figure 2. The HACCP decision tree developed by the seafood industry. The authors used this version as a model but modified it to better serve the medical device industry (Figure 3).

To view figure at 100%. File size is 63k.

Figure 3. The modified CCP decision tree created by Cyberonics' HACCP team after the seafood HAACP model proved to be too simplistic.

To view figure at 100%. File size is 63k.

HACCP Decision Trees. A HACCP decision tree lists questions that can help identify CCPs for a particular process. The Cyberonics HACCP team began by using the seafood HACCP decision tree (Figure 2) but modified it to make it better suited for evaluating medical device components. For example, in step 2 of the seafood HACCP decision tree, if the answer is "yes" to the question "Does this step eliminate or reduce the likelihood of occurrence of this hazard to an acceptable level?" then the step is a CCP. However, in medical device manufacturing, there are many inspections, verifications, and tests in place to prevent the occurrence of a hazard. Using the seafood decision tree could lead to the classifying of many manufacturing processes as CCPs, whether or not they were in fact critical operations. The Cyberonics HACCP team adapted the decision tree to make it more appropriate for their use, but it should be noted that this decision tree is also imperfect, and a good deal of practical experience is necessary for assessing which process steps are true CCPs (Figure 3). For example, the Cyberonics HACCP team determined that the final electrical test for the Model 100 pulse generator could be classified as a CCP because of its significance, even though it was unlikely that the test itself would affect the operation of the device to make it perform in an unsafe manner.

DEVELOPING THE HACCP PLAN

The HACCP plan can be started after the hazard analysis worksheet is complete. Cyberonics also adapted its plan format from the seafood HACCP plan. The plan worksheet should be self-explanatory. Each CCP must have one or more critical limits for each significant hazard. A critical limit represents the boundaries or parameter tolerances used to ensure that equipment or an operation is functioning properly or that the product meets specifications. When the process deviates from the critical limit, a corrective action must be taken. The rationale and reference material used to establish a critical limit should become part of the support documentation for the HACCP plan; this information usually comes from the firm's validation documentation. Operating limits should not be confused with critical limits; operating limits are triggers that are reached before a critical limit is violated and present an opportunity to correct the problem and stabilize the process.

Process Monitoring. Process monitoring shows when there is a loss of control at a CCP or a deviation from a critical limit. If monitoring shows a trend toward lack of control at a given CCP, the CCP should be brought under control before the critical limit is exceeded. When a critical limit is compromised, corrective action is needed, the extent of which can be determined by reviewing the monitoring records and finding the last recorded value that meets the critical limit. Monitoring also provides a record of those products that were produced in compliance with the HACCP plan—information that is useful in the plan's verification. The preventive measures and the critical limits are intended to control the hazards at each CCP.

Corrective Actions. When critical limits are violated at a CCP, predetermined and documented corrective actions should be followed to restore process control and determine the safe disposition of the affected product. The primary objective is to establish a HACCP program that permits rapid identification of deviations from a critical limit. The sooner the deviation is identified, the more easily corrective action can be taken and the greater the potential for minimizing product nonconformance. Documentation of corrective actions will identify recurring problems so that the HACCP plan can be modified.

Corrective actions must bring the CCP back to a state of control. The objective is to implement a short-term correction so that control can be reestablished and the process restarted as soon as possible without further deviations. It may be necessary to determine the underlying cause of the deviation in order to prevent recurrences. A critical limit failure that was not anticipated or that reoccurs should result in an adjustment to the product or process or a reevaluation of the HACCP plan.

Recordkeeping Procedures. Several different types of records are required to demonstrate compliance with the HACCP system. These records include:

Verification Procedures. Verification procedures are the methods, procedures, tests, and audits conducted in addition to monitoring in order to validate and determine compliance with the HACCP plan and ascertain whether the plan needs modification. Verification activities may include equipment calibration, product inspection testing steps, process audits, and other activities implemented to verify that the manufacturing process is under control.

THE ROLE OF REGULATORY AGENCIES IN HACCP PLAN VERIFICATION

The primary role of regulatory agencies in a HACCP system is to verify that HACCP plans are effective and are being followed. Verification normally will occur at the inspected facility; however, some aspects of verification may be conducted at FDA's district offices or Rockville, MD, headquarters.

HACCP plans are unique, tailor-made documents prepared by a manufacturer to ensure the control of a specific process or procedure. These plans are likely to contain proprietary information and should be protected appropriately by the regulatory agency. Agency personnel must have access to records that pertain to CCPs, deviations, corrective actions, and other information pertinent to the HACCP plan, and that may be required for verification and determination of the manufacturer's state of control.

Our position is that the agency need not extend or make the regulatory product approval process more involved by formally approving HACCP plans. Since HACCP plans represent an upside potential for shorter, more predictable inspection for firms with a good compliance history of comprehensive inspections, the plans should be voluntarily submitted and only receive a cursory review for completeness. The normal manufacturing section review process (when applicable) should still remain the pivotal focus of the product approval review. The plan should be submitted to FDA to serve as a measurement tool for changes in manufacturing and should be easily available to headquarters personnel if a local inspector needed to confer with them or a member of the district office on any issue. We feel that a HACCP plan should be updated as part of the annual report or any other time a supplement is warranted. Minor changes or improvements to the plan should be made on an as-needed basis and should not require submission to or approval by FDA. Instead, these should be disclosed and discussed with a local inspector as part of the regular HACCP inspection.

BENEFITS SUMMARY

HACCP plans provide a consistent, predictable format for review of high-risk areas in the manufacturing process, identifying the verification/validation documentation as well as preventive action controls and documentation. Because a HACCP plan is predefined by the manufacturer and subsequently shared with the inspector, it should help improve their communication during the inspection. This benefit should also enable the facility inspection to be completed within three days for most small and mid-sized firms. Unless a problem is uncovered, there is no need for a lengthy or involved inspection under HACCP. The company and inspector both know ahead of time what needs to be audited and what documentation will be reviewed. Since the inspection focuses on processes critical to producing a safe medical device, the inspector can leave a facility with a good overall assessment of whether a facility is operating in a state of control as required by the quality system regulation.

The HACCP approach would also complement third-party inspections because it provides a well-defined plan for conducting facility inspections and could be used to credential third-party inspectors.

This HACCP approach is an excellent tool for a manufacturer to use in focusing on the significant areas of the manufacturing and quality system processes, and it makes the CCPs visible from a monitoring and corrective-action standpoint. Companies that are already ISO- and quality system regulation—compliant should not have to expend tremendous resources in developing the plan, and whatever time is spent will pay dividends later. Regulatory agencies will like the program since it is straightforward, easily understood, and, if done correctly, will not involve adding another volume to a company's submissions. The Cyberonics plan, in which we covered the two key implantable components of our device, was fewer than 35 pages long.

To arrive at an effective and consistent HACCP program, Cyberonics believes that some additional guidance documents will be needed to help define an acceptable risk analysis technique. A method that incorporates a combination of risk analysis of the manufacturing process and hazard analysis to determine potential adverse product-safety effects should be considered. Also, guidance is needed to help limit the scope of the hazard and risk analyses to only the manufacturing process and its essential supporting systems, since the tendency is to apply the HACCP concept too broadly, rendering it cumbersome and inefficient.

While industry will have an additional cost burden in developing and maintaining HACCP plans, most of the elements of HACCP already exist in a manufacturer's quality systems. Some companies with many different products might benefit somewhat from economies of scale if they have similar product types.

CONCLUSION

The HACCP pilot program is intended to gather information that will determine whether this program can be effective for conducting medical device company inspections in an efficient and timely manner. Cyberonics' perspective is that this approach can benefit both industry and FDA. HACCP would allow FDA to "do more with less," provide a substantial benefit to participating companies, and reassure the public that industry is meeting regulatory requirements. The HACCP program also has the potential to complement other FDA initiatives such as third-party inspections, product development protocol manufacturing submissions, and IDE/PMA manufacturing section submissions and inspections.

As with any new regulatory approach, there will be those who see it as an intrusion into their traditional way of doing things and thus view it as an added burden. The Cyberonics managers involved in this pilot program each had more than 15 years of GMP compliance experience and know that the program is neither overly intrusive nor burdensome. FDA is to be complimented for its initiative in out-of-the-box thinking on this project. Now industry needs to join FDA in further refining this program so both sides can exploit it to full advantage.

If you are interested in learning more about HACCP, visit the UC Davis seafood network Web site at http://www-seafood.ucdavis.edu; FDA's new Web page discussing the pilot program, http://www.fda.gov/cdrh/gmp/haccp.html; contact the authors at [email protected] or [email protected]; or read the publication cited below.

REFERENCE

1. HACCP: Hazard Analysis and Critical Control Point Training Curriculum, 2nd ed, publication UNC-SG-96-02, National Seafood Alliance, North Carolina Sea Grant, 1997.

Steve Maschino is director of quality assurance and William Duffell, Jr., PhD, is vice president of clinical and regulatory affairs and a corporate officer for Cyberonics (Houston).

Photo by Michael Hart, courtesy of Intermedics, Inc. (Angleton, TX)

Copyright ©1998 Medical Device & Diagnostic Industry