Regulatory Aspects of Due Diligence

MERGERS AND ACQUISITIONS

In the financial world, due diligence is an essential part of all merger and acquisition (M&A) activities. All aspects of the target company's finances are reviewed with a goal of identifying any risks associated with the firm's solvency or its assets. In the medical device industry, these assessments must also have the added dimension of a technical and regulatory review to ensure that asset valuations are valid. A medical device company may be highly financially successful, but some portion of that success could be based on inappropriate regulatory or compliance decisions.

Regulatory characteristics can have a tremendous effect on the overall due diligence effort. Various aspects can reduce the value of a product line or of an entire organization, as follows:

Such deficiencies can also result in compliance actions occurring months or years after the acquisition is complete. The best way to deal with such problems is to understand the company that is being acquired by performing due diligence.

Approach

Due diligence reviews can arise frequently and without warning. Time­lines are often demanding and the day-to-day responsibilities of internal personnel at both the acquiring and selling organizations continue despite the due diligence process.

Frequently, one of the most difficult decisions is determining how much effort to commit to various aspects of due diligence. Complicating factors are sometimes found in seemingly simple acquisitions. Large or complex situations may require many hundreds of hours to fully evaluate all relevant factors. Often, these hours are simply unavailable, and the effort must proceed according to a plan that prioritizes by relative risk. Audit planning tools, availability of experienced internal and external personnel, and a clear understanding by management of the outputs and the due diligence effort will help maximize the results.

At the outset a plan must take into account the business goals of the review. It must also observe available resources, timing, and availability of key personnel. Review teams may have limited access to documents, facilities, or personnel, which can affect both the scheduling of the review and its scope. In some cases, the two parties may agree to share documentation on restricted-access Web sites to enable specific users to remotely access documents they need. This can make document review much easier, especially if facilities and personnel are in multiple locations. In other cases, business and legal considerations may require reviewers to evaluate documents at one or more individual sites. In all cases, there are common considerations that management should keep in mind.

Goals of the Due Diligence Process. Identification and, if possible, estimation of risk are the primary goals of the effort. This is not the time to craft formal solutions.

Timeline and Resource Allocation. Both parties should agree on realistic timelines. Adequate resources for both the audit team and the potential acquired company staff should be identified. Access to people, documents, and facilities should be specified.

Selection of Reviewers. Compliance auditors may be used, but do not assume due diligence can be done in the same manner as routine compliance auditing. External consultants with appropriate experience can be considered, especially if qualified internal resources are unavailable.

Prioritization. Frequently, time constraints do not allow in-depth reviews of every product or even every facility. Factors that are commonly prioritized include sales volumes of products, regulatory risk profile of devices, and complexity of devices. Determining whether a particular technology is considered a platform technology that can be used for additional product development is important.

End Result of the Due Diligence Process. Regulatory, business, and legal personnel involved in the process must agree on the type of report to ensure that the necessary information is generated for each functional area. In the postacquisition phase, this report can provide important information for business integration efforts.

Key Management Actions

At the outset of any due diligence effort, upper management must provide clear objectives.

Prioritize Product Lines for Review. It may be impossible to review every product line, particularly when a large organization is being acquired. Therefore, judgments must be made. Generally, the highest-risk or highest-value products should be reviewed, rather than low-priority products. Making these decisions early in the process also helps with subsequent planning such as allocation of personnel.

Establish a Timeline for Completion. Overall timing is driven by business considerations. If large organizations with multiple facilities are involved, the timing for individual site visits and coordination with all necessary participants can be a complex task. However, even if both organizations are relatively small, establishing a realistic schedule benefits all parties.

Allocate Appropriate Resources. Once it is clear what tasks need to be accomplished and when, personnel with the appropriate backgrounds can be identified and a team assembled. The acquiring company may also want to call on external resources for special assessments if its own personnel are unavailable. Other resources such as data management assistance should also be included as needed.

Coordinate Access to Facilities, Documentation, and Personnel with the Target Company. Regardless of a due diligence team's skills, it cannot function effectively without cooperation from the target company. Both sides must make a commitment to make the process work. Information and documentation consistent with existing agreements must be made available. Personnel from the selling company should also be available to explain information as necessary. However, members of the acquiring company's due diligence team must also
keep in mind that their counterparts at the target company have their own primary
job functions.

Assembling the Regulatory Due Diligence Team

Most due diligence efforts are both brief and intense. Business needs require clear lines of communication, effective preparation, rapid assessments, and reports that address management's specific needs. Time constraints can be a significant challenge. The acquiring company usually has its own aggressive timeline. The selling company also faces constraints such as accommodating external auditors and maintaining day-to-day operations. Due diligence team members with multidisciplinary expertise can help to maintain schedules and to make the best use of all parties' valuable time.

One key factor that must be kept in mind by all team members is that a due diligence effort is intended to gather information that management can use to assess risk. It is not a regulatory compliance audit.

The Due Diligence Approach

Cooperation is the key element for a successful due diligence effort. Business, legal, and time constraints can strain the cooperative spirit, and parties should try to understand these factors. Confidentiality regarding the prospective transaction and discussion of proprietary technology and methodology needs to occur in an effective manner. Upper management should establish clear ground rules; otherwise, the review effort could stall. Of course, the review team for the acquiring company should be respectful and professional.

Confidentiality is a paramount consideration in any due diligence effort. Upper management needs to establish a process that preserves confidentiality while permitting the due diligence effort to proceed in an efficient manner. Frequently, during the planning stages, trade-offs must be made between involving greater numbers of people in interviews versus limiting those involved to a smaller core group. These can be difficult choices, and they require weighing the benefits of more information against the risks of increasing the number of people aware of the possible acquisition.

Checklists can be used by organizations to guide the audit process. Even though such documents can be useful to ensure that key points are not forgotten, they can also limit the audit scope to specific items. During a due diligence review, resources are frequently reallocated dynamically, depending on both interim results and business needs.

Cross-functional expertise for members of the review team is a great asset. If one individual can review the same information from both a technical and submission compliance perspective, new insights may be gained and time can be saved. Also, the regulatory review cannot take place in isolation from other due diligence activities. Good communication from the business, legal, and regulatory teams is essential to keep the effort focused and on time.

Key Regulatory Aspects

There are common themes for many due diligence efforts in the medical device industry. These themes mostly relate to the regulatory side of medical device acquisitions.

FDA Compliance Status. Evaluating the compliance status of the organization being acquired is often the first regulatory due diligence task that upper management considers. It is a key task that almost always requires team members to visit the manufacturing site and review the operation first hand.

Although it is a positive finding if FDA has never issued a warning letter or a Form-483 to the manufacturing operation, it does not mean that major near-term operations reviews are
unnecessary. For example, perhaps the most recent FDA inspection reviewed a relatively simple product development effort and since that inspection, a far more complex product has been developed. Was the design control process appropriate for that more complex design effort? Was the process followed and were all steps documented as specified in the procedures?

Frequently, some or all aspects of the design process are outsourced to contract service providers. In these cases, the vendor selection process should be reviewed. More importantly, the components of the design history file prepared by the contractor should be reviewed to determine whether they conform to either the contractor or company procedures, as specified in the design plan.

Such reviews provide executive management with information on the systems currently in place at the company being acquired. They enable management with initial judgments on the process of integrating the two companies. But other systems must also be evaluated. Historically, complaint handling and medical device reporting (MDR) systems generate substantial regulatory compliance costs long after the acquisition is completed. When involved in a due diligence effort for an implantable or other high-risk device, it is important to review a representative sample of complaint files and MDRs to confirm that adequate procedures are in place and that those procedures are followed.

The value of cross-functional teams is significant. A team member can examine a process and evaluate parameters such as device history records and in-process testing, as well as more technically demanding areas including product and process validation.

Product Approvals and Clearances. As a result of an acquisition, one or more technologies or products are transferred to the purchasing company. If marketed products are involved, many business concerns such as sales volume, reimbursement status, and distribution channels are carefully reviewed outside of the regulatory review. In addition, there are important regulatory considerations that should be examined. Has the target company's change control system appropriately evaluated product modifications? Have special 510(k)s or premarket approval (PMA) supplements been filed where appropriate? Audit team members with understandings of both the submissions process and the change control process in design controls are particularly suited to this evaluation.

Labeling Review. Careful reviews of cleared or approved indications for use and a comparison to current advertising and promotional materials will help executive management better understand how to integrate the acquired products into the combined company's portfolio. It is vital to confirm that the current claims made in promotional materials are consistent with the indications for use specified in 510(k)s, PMAs, or CE marking technical files. Unless tightly controlled, there can be indication creep. That is, over time, functionalities identified by users may be incorporated into promotional materials and user manuals without appropriate regulatory review. The due diligence review should confirm that all intended uses mentioned in the promotional material are cleared or approved.

Review of Investigational Products. Products that are still in the development process present special challenges during the due diligence review. Often, these are the products that drive the acquisition effort. However, enthusiasm over initial encouraging results must be tempered by a careful review of the development effort. Complex products such as implantable devices must first undergo biocompatibility testing. Were the appropriate tests conducted? Given subsequent design or materials changes, are they still valid?

Many other types of preclinical testing for both safety and efficacy may be necessary, depending on the type of device. There should be a rationale present in the design history file for conducting particular tests. In addition, such testing should be conducted in appropriate facilities under controlled conditions and following relevant FDA guidance documents and applicable international standards.

If clinical trial data must be generated for regulatory purposes, the clinical research documentation should be reviewed to ensure appropriate regulatory compliance, including institutional review board and ethics committee approvals, as well as device adverse-event processing. Such a review should also attempt to confirm stated results for both safety and effectiveness and to determine whether the data support marketing applications. These tasks require reviewers well-versed in both regulatory and clinical research.

It is especially important when reviewing significant-risk investigations conducted under investigational device exemptions (IDEs) to examine FDA communications. The acquiring firm should understand the detail of those discussions and FDA's data expectations. It is possible to perform extensive reviews of clinical data and case report forms such as those normally conducted in a GCP audit. However, such a detailed review is frequently beyond the scope and time limits of due diligence
review.

Finally, if multinational clinical trials are generating data in support of an FDA market application, it is vital to confirm that FDA has agreed to accept the international data. Differences in standards of care, study populations, concomitant medications, and even surgical methodology can affect the weight of international data.

International Matters. Most device companies, even those that are quite small, look outside the United States for a considerable portion of sales volume. A regulatory due diligence effort should review the status of marketing authorizations in major markets. Have products been CE marked? If so, what notified body was involved? Who serves as the authorized representative? What actions do the notified body require on completion of the acquisition?

Some notified bodies require considerably more information than others if ownership of a medical device manufacturer changes. For other international markets, are product approvals held directly by the device manufacturer or are they held by local distributors? If distributors hold the approvals, the contractual relationship between the parent company and the distributor becomes a critical issue.

Due diligence efforts also need to recognize the less tangible, but significant effects of interpersonal relationships between distributors and the parent company. Of course, management will need to use its own judgment to anticipate the effects of ownership change on the distribution relationship.

Assessment of Risk

All observations included in a due diligence report must be associated with an explanation of risk. This is not the usual goal for a more traditional compliance audit. Due diligence observations that reveal high-risk situations can influence the value of the transaction. Therefore, these assessments need to be carefully considered and clearly stated so that the information contributes to upper management's understanding.

This assessment is perhaps the most difficult task in this process. There is no universal standard for assessing such risks. Due diligence team members need to draw upon their experience to make these judgments and communicate them to management in a clear manner.

Reporting to Management

The end result of the due diligence effort is a report to management that lists findings and evaluates risks. It is vital that, from the beginning, members of the due diligence team have a clear understanding of the data that are needed by upper management and that they remain focused on those needs throughout the course of the effort. One useful technique is to have upper management and the leaders of the assessment effort agree in advance on an outline for the final report. Such an outline should list key areas of interest and include brief descriptions of the necessary data and specific questions that must be addressed. Due diligence team members responsible for sections of the report can then refer to this template and better direct their efforts. Another option, especially for organizations that expect frequent M&A efforts, is to prepare a more formal procedure describing how such an effort should be conducted.

Conclusion

Financial, business, technical, and market factors all contribute to the value of any potential acquisition in the medical device industry. Regulatory and compliance factors can also significantly affect value and influence future product development efforts. Regulatory input is a vital component of the due diligence process. Upper management must provide adequate resources in the form of personnel, time, and administrative systems to facilitate such a review. Finally, setting a positive and productive tone during the due diligence process can help to promote the effective integration of both organizations in the postacquisition phase and help to maximize the value of the acquisition.

Barry Sall is a principal consultant specializing in medical devices at Parexel Consulting (Waltham, MA). He is also a member of MD&DI's editorial advisory board. Sall can be contacted at [email protected].

Copyright ©2008 Medical Device & Diagnostic Industry