Converting CAPA to an Advantage

For two years running, corrective and preventive action (CAPA) problems have been the most cited FDA Form-483 deficiency during inspections of medical device manufacturers (see the “Recent FDA Inspection Trends” sidebar). CAPA violations continue to generate the single largest number of medical device warning letter citations. It is in a company's best interest to improve its CAPA and investigations systems to prevent problems from recurring, to avoid wasting employee time and company funds in repeatedly investigating the same issue, and to avoid compliance problems with FDA.

Medical device companies should ensure that their procedures are compliant with regulations and standards such as CGMPs and ISO 13485 and then work on improving their systems. In addition, manufacturers should ensure that investigations are thorough and timely and that executives stay informed about them. Finally, companies should look for areas of improvement, such as root cause analysis and quality and supplier audits. The following tips were gained over eight years of research and study as well as teaching CAPA, investigations, root cause analysis, and writing reports for failure investigations.^1,2

Start with the Regulations

Medical device manufacturers selling product to the U.S. market are required to implement a CGMP CAPA system with specific features, including having a CAPA standard operating procedure (SOP).³ FDA expects every device company to also have an investigation SOP. Whenever a procedure is created or revised, the company should review the applicable regulations and international standards to ensure that all requirements are included in its procedure.

Consider rereading the preamble to the device CGMPs (comments 158–166) to better understand FDA's expectations.³ FDA states in the preamble that

It is essential that the manufacturer establish procedures for implementing corrective and preventive action...The procedures must include provisions for the...requirements in the section. These procedures must provide for control and action to be taken on devices distributed, and those not yet distributed, that are suspected of having potential nonconformities.³

To sell medical devices in Australia, Canada, and Europe, manufacturers must adhere to ISO 13485, “Medical Devices—Quality Management Systems—Requirements for Regulatory Purposes.” It requires performing both corrective action and preventive action and defines the terms.

Having a CAPA system is not a requirement to meet GLP regulations (21 CFR 58, which governs the conduct of nonclinical laboratory studies that will be submitted to FDA in research or marketing permits)⁴, or to comply with the regulation governing clinical research for specific devices (21 CFR 812)⁵. However, the GLPs require taking corrective action, and taking effective corrective action is implied in the GCPs. It has always been either an FDA expectation or requirement that organizations take effective corrective action. A CAPA system may be useful in helping to track identified corrective or preventive actions to completion. On the clinical side, a great place to start a CAPA system is by tracking recommended corrective and preventive action from on-site monitoring visits or site audits. (See the “For Further Reading” sidebar.)

Remember the Basics

The depth and intensity of any investigation should match the risk to the patient. When in doubt, it is better to conduct an investigation than not. Your SOPs should provide guidance on when investigations are required. The final decision on whether to investigate should be made by an experienced quality assurance professional. In our business, patient safety should always be the primary concern.

When assessing potential risk, all decisions should be made by properly qualified and trained staff. The risk to the patient should be supported by a documented product risk assessment. Clinical or medical staff may need to be rapidly consulted in determining the risk. The determination of risk, the rationale for performing an investigation (or not), and the criteria used should all be documented.

Finally, CAPA SOPs should include links to the company's medical device reporting (21 CFR 803)⁶, recall (21 CFR 7)⁷, and corrections and removals (21 CFR 806)⁸ SOPs. Those SOPs should also include all the regulatory requirements. Companies should prepare themselves through timely and effective identification, communication, and investigation of events that may require FDA notification.

Ensure Timely and Thorough Investigations

All problem investigations should be performed in such a way to correct existing problems and to prevent related future problems. From the Barr decision (U.S. v. Barr Laboratories)came a timeline that has become industry practice in the pharmaceutical industry even though it is not specified in regulation. ⁹ (The famous court case concerned a pharmaceutical company that was repeatedly testing product until it received a passing result, i.e., testing product into compliance.) What is the timeline? To complete problem investigations in a timely manner not to exceed 30 days from the discovery of the problem, unless additional time is required for activities such as regulatory submissions. Of course, all problems implicating distributed devices or a company's ability to supply acceptable devices (or to conduct clinical or nonclinical studies) must be investigated with the utmost urgency.

The Barr ruling also provided guidance on what the U.S. government would consider a thorough investigation. Although the elements of a thorough investigation will vary depending on the problem, “the government argues that an adequate failure investigation requires” the following details:

•The reason for the investigation.

•A summary of process sequences that may have caused the problem.

•Corrective actions necessary to save the batch and prevent recurrence.

•A list of other batches and other products possibly affected along with their investigation results.

•Comments and signatures of production and quality control personnel regarding approval of any material reprocessed after additional testing.

There is no substitute for hard work, thought, and time. Every employee should know how to do a preliminary investigation (i.e., document the problem observed, record key information, etc.) and should be able to complete a simple investigation. More-serious or follow-up investigations should be assigned to more-experienced lead investigators.

Keep Senior Management Informed

Senior management must be informed about CAPA issues. Management with executive responsibility must be aware of and review CAPA results. Every organization must take prompt action when violative products or situations are discovered.

A colleague recently pointed out that a surveillance system is only as good as the information it receives—we all must be able to rapidly pick up on important signals. Follow-up is critical, and that may include providing input into design control and R&D requirements for some problems. Nonconforming product must be identified, documented, evaluated, segregated, and accurately dispositioned.

Improve Root Cause Analysis

Work with everyone in your organization to improve their root cause analysis skills. Use brainstorming techniques with a group to determine possible root causes. Always look for at least two causes, in the form of preexisting conditions and actions (or catalysts), that when combined with the conditions, caused the event to happen. The effort should extend beyond the effects of the problem to discover its most fundamental cause. Based on the root cause analysis evaluation, prepare an investigation plan.

Before selecting solutions (or CAPA), work from confirmed root causes and brainstorm possible solutions. Coach everyone not to go for the quick fix such as retraining the operator. Apply criteria to select the best solution. The solution should include the following factors:

•Prevent recurrence of the problem, including at another location.

•Avoid creating problems that are unacceptable.

•Be within the organization's control to implement.

•Provide good value for its cost.

Keep in mind that FDA requires CAPA to be verified or validated, both before and after the actions are implemented.

Improve Quality and Supplier Audits

FDA considers quality audits to be one of the most important systems. In the Guide to Inspections of Quality Systems (QSIT Manual), FDA writes that “without an effective quality audit function, the quality system is incomplete and there is no assurance [that] the manufacturer is consistently in a state of control.” Current industry practice is to audit each area at least once a year, or more frequently if problems are observed. And although the following is not stated in a regulation, supplier audits should also be conducted on a frequent basis, such as auditing critical suppliers every 12–18 months. In the CGMP preamble, FDA explains that

Internal audits are valuable and necessary tools for the manufacturer to evaluate the quality system. The audit reports should be used to analyze the entire quality system and provide feedback into the system to close the feedback loop, so that corrective or preventive actions can be taken where necessary.

Although FDA will not request quality audit reports, supplier audit reports, or management review minutes during routine inspections, they do expect to see CAPA and documented activities resulting from internal audits and management reviews. No CAPA or other activities are exempt from the agency's review during an inspection.

Better Manage the Process

In the book Managing the Investigative Unit, Daniel McDevitt recommends having a system to screen or prioritize cases and says that without case screening and prioritization, all investigations are assigned for follow-up and a great deal of time is wasted in investigating cases that have little or no impact. He recommends better managing the investigation process. He adds that

An investigation is a process. The importance of viewing it as such, rather than as a single event, cannot be overstated. Some investigative managers see their responsibility as merely assigning cases and forgetting them until they are concluded. Nothing could be further from the truth. Every element in the process is critical not only to the success of the individual investigation but also to the overall success of the investigative unit.¹⁰

He recommends that everyone be able to do a preliminary (or simple) investigation, and that more experienced investigators perform the follow up investigations.

Investigations should be planned, with identified tasks and a timetable. Managers should review the initial report and should at least require a written investigation plan, with logical detail, from new investigators. In addition to initial report review, management responsibilities for this process include case screening, case assignment, case review, and case referral.

Case Screening. Case screening involves determining which cases should be assigned for follow-up investigation, because no one has unlimited numbers of staff.

Case Assignment. In assigning cases, managers must analyze the aptitude of investigators, the complexity of the investigation, and the special interests of the investigator.

When selecting the investigators for each case, consider the economy of manpower so that your staff is used in the most responsible, efficient, and effective manner possible. It is helpful to consider who is immediately available because time is critical; the chances of success in a follow-up investigation depend heavily on how quickly the investigation begins. In the medical device industry, it makes good business sense to begin investigations quickly so that all the necessary information and resources are still available.

Finally, McDevitt recommends making assignments to individuals or departments best qualified to perform the task. A two-tiered approach may be used for investigations: a preliminary investigation, which everyone should be able to do, and a follow-up investigation.

Case Reporting. The reporting aspect involves having a set format (such as an investigation report format) to ensure that the finished package is complete, organized, and clear, and includes root causes, individuals interviewed, a table of contents, listing of evidence or information learned, and recommended corrective and preventive action.

From a practical point of view, companies should have a robust filing system such that all investigation documents are filed in the right folder, the system is easy to understand, and secure. Remember that the goal of filing is not filing. The goal of filing is retrieval.

For very sensitive investigations, only selected personnel may be able to view and work with the material. There should be limited access—which may require locked filing cabinets and password-protected computer systems—to documents concerning cases that are in progress. Depending on the severity of the issue, it may be useful to consult with an attorney experienced in food and drug law.

Case Review. Case review involves reviewing cases as they come in, discussing the cases with the investigators, and, if appropriate, with the quality assurance or CAPA department. Case reviews should be conducted on a regularly scheduled basis. Case reviews should also be done when significant events occur and before referring or closing a case. Case status should be documented and current at all times.

Managers may benefit from having regular meetings with their investigators. These meetings can be used to get caught up on ongoing investigations. Ongoing case reviews confirm the work is being done and ensures accounting for investigators' time and the currency of the reporting. Such reviews also keep managers abreast of priorities, aid in the proper expenditure of resources, identify potential training needs, and provide a way for the manager to answer inquiries regarding ongoing investigations. A manager is also responsible for assigning additional resources to important investigations that are floundering.

Selecting Investigators

When recruiting investigators, it may be helpful to look for individuals who have certain qualities. For example, success often depends on verbal communication skills and is affected by a display of genuine sensitivity and concern throughout the interviewing and information-gathering process. McDevitt recommends evaluating candidates as follows:

•Do listeners willingly provide information to them? Are they comfortable interviewing line personnel, supervisory personnel, and executives?

•Is the individual capable of preparing professional reports? Reports must be legible, concise, accurate, comprehensive and complete.

•Can the individual successfully interact with people without repeatedly being conned?

•Do they have stamina? Are they willing to work long hours?

•What is the quality of their work?

•What is their work behavior? Do they demonstrate motivation, stability, street knowledge, persistence, intelligence, judgment, teamwork, reliability, and dedication?

•Are they punctual? Do they have a professional appearance and demeanor, good verbal communication skills, and ability to follow directions?

Managers can also present an example scenario and ask potential investigators for an analysis of the scenario and how they would plan the investigation (what their basic investigative steps would be). If they already work for your organization, you can also ask them to provide sample nonconformance reports or CAPA requests that they have written, or sample investigation reports. McDevitt recommends asking the candidates to be prepared to discuss the mock case scenario during the interview, and suggests applying the following criteria:

•Thoroughness of their review of the scenario.

•Logical sequence of their proposed investigative steps.

•Knowledge of the regulation(s) and/or the law(s) involved in the scenario.

•Knowledge of interviewing and evidence gathering and procedures.

•Creativity of their proposed investigative efforts.

•Strengths and weaknesses of their proposal.

•Thoroughness of the proposed investigative steps.

Improve the Training of Investigators

Spending time developing a new investigator can increase new investigator competence and morale. Begin with formal training to prevent having to learn the hard way by making mistakes, and managers should also consider having a probational period for new investigators.

What do you train them on? High-frequency tasks that they will be expected to do daily, such as

•Investigation techniques and planning; root cause analysis.

•Your CAPA and investigation SOPs, investigative reporting, and administrative paperwork (or computerized) systems.

•All applicable regulations and standards.

•Report writing. New investigators are moving from simple report format to pure narrative format. All key information should be contained in the first few lines of the report, with detail provided later in the report. Everyone needs to quickly grasp the issue or problem and the author's conclusions.

•Interview techniques. Some line personnel have limited experience participating in a lengthy interview. Interviewing can be difficult.

FDA uses the Reid Technique to train its investigators on interviewing skills and the program may be purchased to show your employees. Alternatively, many local colleges offer journalism or interviewing classes to which employees can be sent.

A final tip on training reviewers of investigation reports is to recommend that they first identify the issue or problem and the author's conclusion, and then drill down to evaluate the report. Other items to look for include the stated reasons, whether any words or phrases are ambiguous, whether there are any value conflicts, assumptions, or fallacies in the reasoning, and the quality of the evidence. Based on that, reviewers can determine whether there may be rival root causes, whether the statistics are being used in a deceptive fashion, what significant information is omitted (if any), and what reasonable conclusions are possible.

FDA trains its investigators to review data, too, to see if they are being used in a deceptive fashion and to determine if the data are accurate, legible, contemporaneous, original, and attributable (ALCOA).

Conclusion

CAPA deficiencies are one of the most common items cited in warning letters to medical device manufacturers. Therefore, it is critical for manufacturers to understand how to develop a CAPA system and how best to use it. The best place to start is with current regulations, including CGMPs. But a company should also ensure timely and thorough investigations and keep senior management informed of CAPA-related actions. Improving the staff's root cause analysis skills and performing more-robust quality and supplier audits can also help a device manufacturer avoid CAPA compliance problems.

References

1.BK Immel, “Going Where the Shoe Pinches: CAPA and Investigations,” FDA Inspections Summit, Bethesda, MD, October 2008.

2.BK Immel, “Best Practices: Managing a CAPA System,” Medical Device & Diagnostic Industry 28, no. 6 (2006): 48–57.

3.Code of Federal Regulations, 21 CFR 808, 812, and 820, Medical Devices: Current Good Manufacturing Practice, Final Rule, FDA, October 7, 1996. Available at www.fda.gov/cdrh/fr1007ap.pdf

4.Code of Federal Regulations, 21 CFR 58, “Good Laboratory Practices for Nonclinical Laboratory Studies.”

5.Code of Federal Regulations, 21 CFR 812, “Investigational Device Exemptions.”

6.Code of Federal Regulations, 21 CFR 803, “Medical Device Reporting.”

7.Code of Federal Regulations, 21 CFR 7, “Enforcement Policy.”

8.Code of Federal Regulations, 21 CFR 806, “Medical Devices; Reports of Corrections and Removals.”

9.United States v. Barr Laboratories Inc., 812 F. Supp. 458 (D.N.J. 1993).

10.DS McDevitt, Managing the Investigative Unit (Springfield, IL: Charles C. Thomas Publisher Ltd., 2005).

Copyright ©2009 Medical Device & Diagnostic Industry