Originally published November, 1996
Although it is still more than a year and a half away, the date of June 15, 1998, is approaching very rapidly for device manufacturers seeking to begin or continue selling in the European Union (EU). That is the day the EU's Medical Devices Directive (MDD) will become fully effective throughout the member states of the union, and when device manufacturers will have to either demonstrate compliance with the directive or cease selling in the EU.
Among the most important terms of the MDD are specific requirements for quality systems that must be observed by manufacturers. The directive does not explicitly mention any of the quality systems standards commonly used in the United States or Europe, but it is clear that the EU expects manufacturers to adopt and comply with such standards as are appropriate to their particular industry.
With the growing importance of overseas markets and the rapid globalization of the device industry, most U.S. manufacturers are faced with the task of developing and implementing a quality system that complies with both international and domestic requirements. As a guide to those who are about to undertake this daunting process, this article describes how our company, Pryon Corp. (Menomonee Falls, WI), successfully accomplished certification to the ISO 9001 and EN 46001 quality systems standards (see Figure 1, below). The article poses many of the same questions we raised during our preparatory work, and provides some resources to help obtain the answers. Although our approach cannot be expected to work for every company, our experience may benefit those who will shortly be guiding their own companies toward a certification audit.
The first step for any company preparing for its initial audit is to become familiar with the relevant standards and available resources. Since standards are revised over time, companies should be sure to obtain the most recent versions. Copies of the EU directives, relevant standards, and guidance documents are available from a number of organizations, including the American Society for Quality Control (ASQC), the Office of European Community Affairs, and the National Institute of Standards and Technology. Numerous books, videos, and software packages are also available to provide either a general overview or answers to detailed questions. Information about these resources can be found in trade publications as well as in the publicity materials issued by their publishers.
Among the most helpful sources of information is the National ISO 9000 Support Group. This group provides an independent arena for discussion, advice, and information exchange. It promotes a better understanding of the standards, the steps involved in implementation, the benefits of certification, and the process of becoming certified. Members of the group represent a great deal of ISO 9000 experience. The support group provides members with general ISO information, ideas on where to go for additional information, tutorials, the Continuous Improvement Newsletter, and discounts on publications. In addition, the support group is accessible via the Internet. The group can be contacted at 616/891-9114.
While the goal in this step is to gather as much information as possible, it's equally important not to become overwhelmed. This phase is comparable to a first semester at college, and it takes roughly the same time--three to four months--to comprehend the unfamiliar terminology and get a general sense of what lies ahead.
The second step is to determine which standards apply to the firm and its products. For device manufacturers, the most widely used quality management and quality assurance standards are those of the ISO 9000 family, compiled by the International Organization for Standardization (ISO). A virtually identical series of standards have been published as European norms under the designation EN 29000, and the requirements of the ISO standards are also reflected in FDA's revised good manufacturing practices (GMP) regulation.
The ISO 9000 series includes five parts, the first and last of which (ISO 9000, "Guide to Selection and Use," and ISO 9004, "Guide to Quality Management Elements") assist manufacturers in determining which of the remaining three standards apply to them. Pryon Corp. conducts research, development, manufacturing, installation, and servicing of CO2 monitors, so our goal was to become certified to ISO 9001, which covers design, production, and installation. Some companies approach ISO 9001 certification by first attempting certification to ISO 9002 (production, installation, and servicing) and later expanding their quality system to include design and development.
To do business in Europe, most medical device manufacturers will also have to comply with another set of European norms, designated the EN 46000 series, which translate the general requirements of the ISO 9000 series for use specifically by manufacturers of medical products. Compiled by the European Committee for Standardization and the European Committee for Electrotechnical Standardization (CEN and CENELEC), the EN 46000 standards mandate additional requirements for medical products to be sold in the European market. For example, requirements of EN 46001 include or refer to postmarket surveillance activities, customer complaint handling, advisory notices, and recalls.
INVOLVING EXECUTIVE MANAGEMENT
Once the company has determined which of the various types of quality certification will be required, it is important to ensure that executive management is fully involved in the process. Even though company executives may have identified the need for certification and may have recommended creation of an audit team or committee, they may still require some education about the complexities of the certification process.
Some of this education takes place gradually, as managers observe preparations and are given updates on the company's progress. But it is also necessary to conduct meetings with executive management apart from the training classes held for all staff. At Pryon, management was supplied with an outline of the audit and certification process, and was continuously updated on schedules, activities being performed, and tasks still remaining to be done.
At most companies, the individual or committee coordinating the certification process is also responsible for establishing the company's training requirements. But to ensure that executive managers are fully engaged in the process, it is a good idea to involve them in this process and to update them regularly. Executive management can provide valuable assistance in developing the company's training programs, and in supporting travel to training seminars for key employees.
Without executive management's continuing commitment and support, it will be difficult to achieve successful completion of the certification program. But since preparation for the certification audit is complicated and time-consuming, commitment may wane at times. To keep managers motivated, it may be helpful to remind them that registration is intended to ensure that the company's products will have ready access to important markets. At Pryon, management's commitment was evidenced by its support of all activities, and its active participation in the design and conduct of internal audits and employee training.
After completing the initial phase of information gathering described above, companies must undertake the more difficult task of understanding and interpreting the materials. Even with many books and videos in hand, company staff will still need help interpreting portions of the standards and answering questions from their fellow employees. A number of resources can help to resolve such difficulties.
One good approach is to ask other firms how they had addressed shortcomings in their quality systems. Peers and business contacts within the medical device industry can be invaluable sources of information. If they have already completed an audit, they speak the language, know the process, and may be willing to share their experiences, problem-solving methods, and advice. When making these contacts it is best to start with friends and then branch out to peer companies, and always ask for recommendations of additional contacts. Also, callers should have ready a list of detailed questions; people are rightfully reluctant to take time from their schedules to answer vague or open-ended questions.
Another resource is FDA's Division of Small Manufacturers Assistance (DSMA), which can supply copies of key agency documents related to quality systems. One such document is the "Working Draft of the Current Good Manufacturing Practices (CGMP) Final Rule," [Now superseded by the October 7, 1996 Final Rule--Ed.] which was released by the agency in July 1995. It includes a preface that summarizes comments from device industry experts about the proposed regulation as well as FDA's position toward those comments. Because it offers insight into the ways the agency has adapted elements of ISO 9001 and EN 46001, the July 1995 draft is still useful even now that the revised GMP regulation has been issued. Experts at DSMA are also available to answer questions regarding the revised GMPs.
Although our company elected not to retain a consultant, there are many such companies and individuals that can answer questions and provide information and assistance. Lists of such service providers are available through many sources, including the National ISO 9000 Support Group and the Internet. Before Pryon decided to conduct its own preparatory work, the company obtained quotes from several consulting services. Our research indicated that the average fee for conducting an ISO 9001 gap analysis for a single-site company of 100 employees was approximately $6000; the average fee for a certification audit was $19,000. Totaling $25,000 (excluding traveling and lodging expenses), these fees did not include certification to EN 46001 or the MDD. Our approach enabled us to limit expenses to about two-thirds of the prices quoted, and also to include certification to EN 46001 and annex II of the MDD.
SELECTING A NOTIFIED BODY
Just as the regulatory regime in the EU differs from that of the United States, so also does the structure of authoritative bodies that administer it. Each member state of the union has a competent authority, usually a governmental agency, which is charged with carrying out the requirements of the EU directives. Competent authorities determine whether a certification organization is qualified to act as a notified body, and they also oversee the auditing of notified bodies to ensure that they remain qualified.
A notified body is a certification organization that has been designated to carry out one or more of the audits described in the annexes of the directives. There may be more than one notified body in any given member state. In many cases, independent European test agencies have achieved qualification to serve as notified bodies. However, an organization's designation as a notified body may be restricted to specified types of devices, so companies must be sure to choose only those that are notified for their products. The EU's Delegation of the European Commission maintains a list of all notified bodies (currently about 34 organizations), which includes their names and addresses; their identification numbers; and the products, procedures/modules, and annexes of the directives for which they are notified.
Notified bodies assume full and final responsibility for the performance of audits, but they may subcontract with a registrar to perform the actual work of the audit. Registrars are organizations that assess and certify companies to the appropriate ISO 9000 and EN 46000 standards. While there are many registrars in North America that can provide ISO 9000 certification, not all are recognized in Europe, and not all can certify companies to the EN 46000 series of standards. In the United States, registrars are accredited by the Registrar Accreditation Board (RAB) using criteria based on internationally recognized standards and guides. The RAB is a private, not-for-profit organization that can provide manufacturers with a list of registrars; it can be contacted at 800/248-1946.
To avoid the possibility of working with a registrar whose accreditation might prove unacceptable in Europe, our company determined to select a notified body that would be responsible for the competence and qualifications of its auditors. We first determined which notified bodies subcontracted with or accepted audits by registrars located in the United States. Then we again contacted our peers to ask them about the notified bodies they were working with. Companies that elect to use this approach should be sure to have a set of short and direct questions that will elicit the information they need, such as the following:
- What is the company's impression of its notified body?
- Is the company satisfied with the notified body's services?
- Has the company encountered any difficulties with its notified body?
- How responsive is the notified body?
Once the answers to these questions have been digested, the company should then prepare to contact various suitable notified bodies. Not every notified body is a candidate; a company may decide to interview only those located in the country where it does the most business, or only those in a country where it has an office. With the help of feedback from its peers, the company should be able to narrow its list to about 10 notified bodies of interest.
When the manufacturer begins to interview notified bodies, it is important to conduct information gathering according to a well-structured process so that each firm can be compared with the others. There are two reasons for contacting notified bodies. The first is to obtain a detailed quote and related information, including answers to the following questions:
- Does the notified body have one or more U.S. offices? If so, do those offices have personnel knowledgeable about your company's type of products?
- How many clients has the notified body audited? Does it publish a list of these clients?
- How many people will the notified body send, and from where?
- How long does the notified body anticipate its auditors will be on-site?
- Will the notified body try to combine the auditors' visits with those to other customers? (If so, it may be possible to divide travel costs with them.)
- How often does the notified body perform follow-up audits?
- What are the costs for the initial audit and for follow-up audits?
- What is the margin of error on the costs the notified body quotes?
Overall, the manufacturer should try to determine how well the notified body's personnel know and understand the directives and standards that relate to its products. It is also important to ask how backlogged the notified body is with audit requests; the closer we come to June 1998, the greater the likelihood that such firms will be inundated with requests.
The company should request an informational package and an application package from the notified body. The former should provide data regarding the certification process and some background about the notified body; the latter should include forms for the manufacturer to use in supplying general information about itself and its quality systems.
The second reason to contact notified bodies is to enable the manufacturer to get a feel for its potential business relationship with each firm. To determine this, the manufacturer should make careful observations of the body's professionalism in every contact. Some areas that might be worthy of note include the following:
- How timely is the notified body in responding to inquiries?
- How does it handle phone calls? Frequent transfers to staff members throughout the organization quickly become tiresome.
- Does the notified body make a practice of assigning one contact person to handle a manufacturer's project? If so, is there a back-up in case that contact is ill or on vacation?
- Does the notified body view questions as criticisms or honest inquiries?
- How well does the notified body seem to understand your company, its products, and its operations?
- Is the notified body genuinely interested in learning about your company and helping with its audit?
- How well do the notified body personnel speak English?
Feedback from peers can help a manufacturer to determine whether a given notified body has good depth of knowledge and expertise about its products, but if the manufacturer fully understands the directives and standards it should be able to reach its own conclusions early on. A notified body whose customary response sounds like "We'll get back to you," may be going through a learning process or may not have time for manufacturer questions. In either case, such a firm may not be the best choice, especially if the manufacturer has an aggressive audit schedule.
When all of the above information has been gathered, the manufacturer should be in a position to make its final selection. At Pryon, the factors that were weighed in making that selection were ranked as follows: reputation, past relationship, expertise, cooperation, response time, and availability. Depending on the structure and size of the company, that decision may be made by one person or a committee. Whenever possible it's a good idea to use a committee, in part because it is another way of keeping executive management involved.
U.S. manufacturers often select as their notified body a firm that previously served as their European test agency. Such a body's prior knowledge of the company and its products can be invaluable in expediting the certification process; in addition, the manufacturer is able to take advantage of the business relationships and good rapport that have already been formed. Ultimately, this was the course that Pryon elected to follow. The company's experience with its European test agency offered evidence that the firm's personnel intensely review products; carefully scrutinize documentation; and thoroughly evaluate product design, manufacturing processes, quality systems, and company facilities. Meeting that notified body's criteria would solidly underscore the company's confidence that its quality system was adequately designed, implemented, and controlled to meet ISO 9001 and EN 46001 requirements.
Even after the manufacturer has made its selection, it should not rush into making a commitment to the notified body. Problems can arise unexpectedly that might make it im-possible to work with the selected firm. If the manufacturer must make a commitment at this point, it should be sure that the agreement between the two firms has an exit clause.
PERFORMING A GAP ANALYSIS
The next step is for the manufacturer to begin working on an internal quality system audit called a gap analysis. A properly conducted gap analysis will identify areas in which the company's quality systems do not meet the requirements and where corrections must be implemented in order for the company to pass the certification audit. Gap analyses can be conducted by consultants, by an in-house committee, or by a peer company. Since Pryon wanted to speed the audit process and save money, it used an in-house committee to perform the gap analysis.
If the manufacturer has sufficient expertise in-house, using a committee to perform the gap analysis can provide employees with a better understanding of the firm's internal systems. One risk in conducting a self-directed gap analysis is that members of the employee committee may overestimate their ability to interpret standards and their intent.
To help design its gap analysis, the manufacturer should request certification audit questionnaires from several notified bodies. The company should ensure that it understands the questionnaires, and should contact the relevant notified body if it requires a more detailed interpretation. However, if it must frequently ask a notified body for more background or interpretation, it is probably not ready for the certification audit. If this is the case, perhaps attendance of appropriate personnel at an ISO 9000 seminar or auditor class would be helpful.
The questionnaire from the company's notified body of first choice should be used as the basis of the gap analysis questionnaire, but it should be amplified with questions from other questionnaires and with the manufacturer's own questions. When the questionnaire has been developed, the manufacturer should appoint a gap analysis team to conduct the internal audit of its quality systems. At Pryon, this phase of the project was spearheaded by the directors of quality assurance and regulatory affairs. They provided relevant excerpts from the questionnaire to the department heads, and asked them to prepare for the internal audit.
Throughout the internal audit, the gap analysis team should be objective, carefully scrutinize each area to establish compliance, take notes, review the results, and start corrective action immediately. A graph of the audit results can be a useful tool for identifying compliant areas, distinguishing areas in which further work is required, and communicating those results to executive management and appropriate staff. Notified bodies can supply the manufacturer with their grading systems, which manufacturers can apply to their audit results to determine their level of compliance. Companies shouldn't expect 100% compliance at this point, since the gap analysis is specifically intended to identify discrepancies.
When the internal audit is completed, its results should be shared with executive management and with department heads, to ensure that all key personnel understand the gaps. Colleagues can help to determine the costs and timelines for correcting these gaps. If the company finds that discrepancies cannot be fixed within its projected timelines, it should reassess the schedule for the certification audit. When it believes its quality systems are fully in compliance, it can send the completed gap analysis questionnaire, application package, and supporting documentation, along with a commitment letter, to the notified body of its choice.
COMMITTING TO A NOTIFIED BODY
The commitment letter should state that the firm has been chosen to serve as the manufacturer's notified body and should request a final, firm quote. Approximately four weeks after receiving and reviewing the commitment letter, supporting documentation, and the completed gap analysis questionnaire, the notified body should provide the manufacturer with several dates of its availability and an estimate as to how long the auditors will be on-site. It may be several months from the time of submission before a notified body can actually visit. It's a good idea to have a backup date, even though it might be months from the original date. Again, the closer the 1998 deadline approaches, the less scheduling flexibility notified bodies will have.
Supporting Documentation. A general rule of thumb is that the better a submission is structured, the sooner a response can be expected. The company's quality manual must be included in the submission. It has embedded in it both quality procedures and policies. As supporting documentation, Pryon also furnished its notified body with a copy of the company's regulatory master. This contained a table of contents, procedures and policies that helped show compliance, and process and production flowcharts. Above all, the submission must prove that quality systems are in place that meet the requirements of the chosen standard.
Submission Review by the Notified Body. The notified body will conduct an extensive review of the company's questionnaire and supporting documentation to determine if its quality systems meet the standards. It may provide feedback on many points of the questionnaire, and may also request clarification of some of the company's responses. Such clarification can be provided in writing or on the phone. At Pryon, we found that a combination of the two worked best. In a few instances, further documentation was required; in others, the notified body just had to be directed to a certain procedure or section of the quality manual. The manufacturer shouldn't attempt to create additional documents in response to every question, but should seek to understand the notified body's concerns and then clarify the needed information. The manufacturer should be honest and open, and should prevent discussions about interpretations from evolving into arguments.
After completing its review, the notified body will create a summary report showing the company's compliance level point by point. From this report, it will establish a general rating. At Pryon, the summary determined that the company's quality systems were sufficient to undergo the certification audit.
In addition to examining the issues raised by the notified body's summary, it is a good idea for the manufacturer to prepare its own list of issues that still need attention. The summary report and list can then be distributed to executive managers to enlist their help with final preparations for the certification audit.
THE CERTIFICATION AUDIT
At Pryon, we started preparing for the certification audit by providing all employees with in-house courses on ISO 9000 and EN 46000. Staff were given a general introduction that included handouts explaining the upcoming audit and its purpose. We suggest that two such classes be held, one about three months before the scheduled visit, the other three to six weeks before. The latter serves as a refresher course to ensure that all employees understand the purpose, scope, and importance of the audit and are committed to its positive outcome.
During this period, the manufacturer's quality systems should be monitored continuously. However, no major changes should be put into effect, because the systems should be operating a solid three months before the auditors arrive. If a significant change must be made, the manufacturer should be sure to inform the notified body. But it's best not to overwhelm it with numerous new or rewritten procedures, since this would make its initial review of the documentation null and void. At Pryon, we used the list of issues prepared earlier to correct minor discrepancies, and provided our notified body with corrected documentation when warranted.
Preparing the Audit Team. As the date of the audit approaches, the manufacturer should ask the notified body to provide an audit agenda, which may or may not follow the same sequence as the audit questionnaire. The notified body should indicate how much time it intends to spend in particular areas and to whom the auditors expect to talk. Based on the agenda, the manufacturer can then identify the employees who must be present during each session.
At Pryon, we conducted a dry run of the audit, which helped determine how much time would be spent in each area, gave employees a better understanding of the audit proceedings, and established a level of comfort for those areas not frequently audited. It also ensured that all necessary staff would be available and on standby during the entire audit or visit.
Tips for the Actual Audit. As final preparations, the company should be sure a meeting room is set up and available throughout the audit. Writing materials, protective garments, and other supplies should all be ready. Such preparations enhance the auditors' confidence in the company.
Essentially, the auditors are looking to see how well the company's documented quality control systems are followed. There are several common audit paths. The auditors may choose to follow any one of these or a combination of several. One path begins with an order for materials and follows those materials through the system to the point of their being shipped as a finished product. Another starts with a finished product and works backward. Or the auditors might evaluate how the company's quality systems work across the organization.