Originally Published MDDI March 2005

Guide to Outsourcing



Nearly every aspect of a medical device business can be outsourced, but to satisfy FDA, one company has to be accountable for the finished product.

Ellen Esterline and Floyd Larson

Contract manufacturing has become an important part of industry. So much so that many companies could operate a successful business by contracting out nearly every function, from soup to nuts. In the medical device industry, many entrepreneurs begin with an idea or design for a device. Instead of taking years to develop a design team, a factory, and a marketing group for the product, the entrepreneur may choose to hire well-established companies to assist in getting the product out in a matter of months. Contracting out much of the production has the allure of saving time and the promise of saving money, especially for start-ups, for whom seed capital is at a premium.

These so-called virtual manufacturers may be on to something. But there are still many issues to address before such a company can succeed. This article will explore the regulations and quality systems that can help a virtual manufacturer comply with the law and begin a successful business.

Let's assume that you are just beginning in the industry. You're developing an innovative medical device and you have decided that the most cost-effective and rapid way to market is to set yourself up as a virtual manufacturer. You plan to outsource everything, or nearly everything, involved in manufacturing your device. You want to limit the financial resources needed as you start this company and begin operations with only a few employees, maybe even just yourself. Now is the time to find out what you need in a quality system.

What Is a Quality System?

The U.S. FDA's Code of Federal Regulations defines a quality system as “the organizational structure, responsibilities, procedures, processes, and resources for implementing quality management.”1 As are many FDA regulations, this definition is vague enough to leave manufacturers wondering what a quality system should look like. In practice, a quality system is a compilation of documents that describe the procedures to follow in order to comply with the regulations. It usually consists of a quality manual, a few standard operating procedures (SOPs), forms, audit records of suppliers, and training files. Most of the governing requirements for this system are found in FDA's quality system regulation (QSR), published in 21 CFR 820.

The QSR requirements are intended to ensure that finished devices are safe and effective. A quality system governs methods, facilities, and controls. It is meant to establish the ways in which the company will comply with applicable regulations. The documents are developed specifically for the ways in which manufacturers actually do business. In short, they are guides to day-to-day operations.

FDA and, in some cases, parallel organizations in certain states, routinely audit a firm's quality system. These audits determine whether the system is consistent with the regulations and whether it describes actual operations. The quality system is the yardstick against which regulatory authorities measure compliance.

Although the primary definition of the content of a quality system is found in 21 CFR 820, other FDA regulations that must be taken into account include those governing labeling, medical device reporting, and reports of corrections and removals (recalls).

Who Needs a Quality System?

If a company is planning to sell a finished device, chances are it will need a quality system. FDA's definition of a finished device is given in 21 CFR 820.3, which says, “A finished device means any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.”1 The QSR establishes basic requirements for manufacturers of finished devices.

But I Don't Plan to Do Any Actual Manufacturing Operations. The first step in understanding the company's responsibility is to understand FDA's definition of a manufacturer. In 21 CFR 820.3, a manufacturer is defined as “any person who designs, manufactures, fabricates, assembles, or processes a finished device.”¹ The term includes but is not limited to firms that perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, and initial distributors of foreign entities performing these functions. Therefore, even if others perform the physical manufacturing operations, you are responsible to see that the operations are carried out appropriately. That responsibility requires that you develop and implement a quality system.

What Is a Virtual Manufacturer According to FDA? FDA has no definition of a virtual manufacturer; in practice the concept is closest to that of a specification developer. Sections of the Code of Federal Regulations include specification developer within the definition of a manufacturer. For example, 21 CFR 807.3 states, “a manufacturer is one who initiates specifications for devices that are manufactured by a second party for subsequent commercial distribution by the person initiating specifications.”²

A virtual manufacturer may choose to outsource product logistics and even commercial distribution of the device. Regardless of how the manufacturing process is defined or whether the company performs any physical manufacturing operations, it still needs a quality system. The manufacturer is responsible for the complete process from design through receipt by a customer. Every step in this process must be conducted in what is termed a state of control. The quality system and all related documentation are designed to provide this control. The procedures that are set down in the SOPs will govern relationships with suppliers—those who will do the actual manufacturing.

In the eyes of FDA, a virtual manufacturer is still a manufacturer of medical devices. The compliance responsibilities for a device manufacturer are explained in the QSR.

The elements of the QSR determine several steps for compliance. First, in defining the scope of the requirements in 21 CFR 820.1, FDA says, “if a manufacturer engages in only some operations subject to the requirements in this part, and not in others, that manu-

facturer need only comply with those requirements applicable to the operations in which it is engaged.”³ The question about quality systems isn't tied to performing the physical manufacturing operations, it's determined by whatever functions you are doing with a finished device, whether it be design, assembly, or labeling.

Examining the operations you will perform and determining the quality system elements that are needed help define the virtual manufacturing role.

Systems for Design

The design process is a good illustration of an operation that requires quality system documents. Different SOPs may be required for varying operations. For example, if an outside contractor is being used to design a device, the SOP needed is design controls. If someone is making an engineering drawing or creating a prototype, an SOP for supplier controls will be needed, in addition to that for design controls. An SOP for controlling the documentation of the design control process is also required. It would be covered by an SOP for document and data controls. Design control records must be kept for a certain period of time, and an SOP for quality records would govern this aspect (see sidebar).

If a manufacturer has a design and is ultimately planning to sell a finished device, in addition to the procedures listed above, the manufacturer must have procedures for complaint handling, medical device reporting, recalls, and management responsibility. To support those activities, measures for traceability, corrective and preventive actions, and more, must also be incorporated. A quality system will need to incorporate many elements, depending on the company's operations.

Outsourcing a Quality System

Along with everything else, it is possible to outsource the development of your quality system. Of course, the manufacturer must be involved in the process and ensure that the system fits its particular operational needs. During the initial review, a quality systems consultant will ask appropriate questions to ensure the SOPs meet those needs. The consultant should also take steps for training and implementation. The virtual manufacturer or the quality system consultant should follow these five steps.

Evaluate the Scope. Determining the scope of a quality system is step one. The lists given in this article can serve as a guide; however, every situation is different. Determine the types of documents that are needed immediately, those that might be deferred for a short while, and those that will be needed eventually, as production, operations, or marketing expands.

Design and Write the Documents. FDA's QSR is not very prescriptive; it requires that companies establish systems but it does not explain exactly how to do it. Designing and writing the documentation needed for even a basic quality system requires an understanding of all the appropriate requirements. Part of the design process includes decisions about how documents are organized, numbered, and controlled. Other factors included in the quality system include decisions about the device, such as how it is identified, what its lot number is, or where it will be stored. The entire system should be brief and include room for changes and additions as they are needed. Following this advice will ensure a quality system that is manageable and functional.

Participate in Document Training. Training is required by the QSR. Staffs need to be trained in the regulations as well as in the implementation and maintenance of the quality system. Even if you are the only person involved in your virtual manufacturing company, you need to be trained and have training records on file for yourself.

Participate in Implementing the Quality System. Implementing the system begins with the approval of the initial quality system documents. The various activities required by the quality system, such as beginning the design control process, executing change control logs and forms, training staff, and qualifying suppliers, are all a part of the implementation process.

Maintain the Quality System. Records generated during production must be maintained and archived. In addition, you will sometimes need to make changes. The quality system will describe the way those operations are carried out, but it is critical that they be done as described, without delays or backlogs.

Conclusion

In today's manufacturing environment, it seems that anything can be outsourced. Ultimately, however, the responsibility lies with the one who plans to sell the finished product. Although operations can be delegated, the responsibility for those operations cannot be delegated. It is the ultimate responsibility of the manufacturer, virtual or otherwise, to ensure that the manufacturing operation is carried out in a state of control. The quality system that is developed, implemented, and practiced on a daily basis helps ensure that the control is maintained.

Virtual or not—physical manufacturing or not—an effective quality system needs to be an integral part of every medical device business.

References

1. Code of Federal Regulations, 21 CFR 820.3.
2. Code of Federal Regulations, 21 CFR 807.3.
3. Code of Federal Regulations, 21 CFR 820.1.

Ellen Esterline and Floyd Larson lead the regulatory, quality systems, and clinical trials specialists at PaxMed International (San Diego).

Copyright ©2005 Medical Device & Diagnostic Industry