How to Pass a Medical Device Audit
Full transcript below:
Welcome Message:
Welcome to this webinar. Before we begin the presentation, I want to provide you with a few housekeeping items. On your screen, you will see a task bar with icons. Each icon is assigned to a particular element of today’s webinar. After the webinar is over please take our survey to tell us how we’ve done. Throughout the presentation, you can network with others or submit questions to the speakers in the box next to the slides. Download resources from the folder icon. Today’s event is being recorded and archived and will be available within 24 hours for on-demand questions or comments—send us an email by clicking “email us.” If you experience any technical issues today, please refresh your browser by hitting F5 for PC, or command+R for Macs, or email [email protected] for one-on-one support. And now I’m excited to turn over to today’s moderator.
Moderator:
Good afternoon, and welcome to the webinar, “How to Pass a Medical Device Audit.” This event, brought to you by Quality, is sponsored by Arena. I’m your moderator, Terrell Sealant, Editorial Director of Quality. Thanks for joining us. Today’s presenters are Kim Khoe, Director of Regulatory Affairs and Quality Assurance at Apical Instruments, and Yelena Bolton, Director of Compliance, QMS, at Arena. Kim has over 25 years of experience in the medical device, regulatory affairs, and quality assurance fields. Kim’s quality experience includes working as a lead auditor for a notified body in the medical device arena, setting up the quality system at several medical device startups, as well as hosting FDA and third-party audits. Yelena has over 15 years of experience in design verification and validation, development, process improvement, and project management, including eight years in the medical device, FDA-regulated environment. Prior to joining Arena, Yelena was the project manager at Boston Scientific and has also worked as a proton therapy system validation global project manager at Varian Medical and as a clinical database and validation manager at Accurate Inc., along with many others.
Don’t forget to submit your questions. And later in the program, our presenters will address as many as possible. Today’s event is being recorded and archived on qualitymag.com. And now I’m excited to turn it over to today’s first presenter, Kim Khoe.
Kim Khoe:
Good morning, and welcome to the webinar hosted by Arena. I want to thank the Arena staff for inviting me here to speak to you with regards to our success using the Arena system during our third-party audits. Just a bit about myself: I work for Apical Instruments, a contract manufacturer specializing in the design and manufacture of RF generators for the medical device industry. With multiple customers, Apical is subject to numerous audits. We have customer audits, notified-body audits from our customers, FDA audits, product safety audits, as well as our own ISO 13485 registration audit. In the next few slides, I will try to show you how our Arena has streamlined our audit process here at Apical and tell you just a few of the benefits that we have experienced using Arena.
So, on this slide, you can see the benefits. Some of the benefits I mentioned. Access to documents is at your fingertips. Everyone is working from the released or current document. It’s a well-organized system. It’s part 11 compliant, and there’s easy trending. Having Arena in place has made our multiple third-party audits more workable. Apical prides ourselves in ensuring our documentation is well organized so that the audits go smoothly. Arena ensures that the documents needed are at our fingertips. With our current numbering system, we can pull up documents specific to one client [although] used for many clients. Recently, we had a scheduled FDA audit due to a customer PMA submittal. However, the morning of the second day, BSI showed up for another customer. This was one of their unannounced audits. We tried to request that BSI return the following week, however, they refused.
So, here we are with two audit bodies at our facility. Had it been a paper-based system, we would have been shuffling between conference rooms with binders. However, with Arena, each [auditee] had access to current documentation. The documents, again, were at our fingertips. The organization of the documents allowed each audit to proceed smoothly. Another benefit of Arena is that it is part 11 compliant and every audit that we’ve been in since we had the implementation of Arena, each auditor has asked me for the validation of the system, and this has been easily provided to them based on what Arena has given me. Finally, the last benefit that I will briefly touch on during this webinar later on is that we do trending of issues and the Arena system has made it an easier task. On this slide you see the audit areas where we use Arena—that would be document control, the design history files, the device master record, corrective and preventive action forms and records, nonconforming, product reports, device returns, training, and software issue tracking.
For document control pre-Arena, everything was paper-based and looking through binders that we needed to search for documents was time-consuming. However, during an audit now, if an auditor requests a software document, a risk management document, a hardware document, I can easily access all these documents. There’s no delay in getting the documents. And it seemed that the auditors did appreciate this. When document control is audited, for example, our ISO auditor wants to review an ECO. They like to review the revision history and see that the customer has signed the release of certain documents. With Arena this is easily accessible. I have access to the revision history, the ECO content, redline procedures and BOM, redlined BOM, and also the approvers.
Again, everything is at my fingertips. During the recent FDA audit, the auditor went through our design control procedure and requested the software protocols and reports, software development plan, just to name a few of the documents. It was very important that our system was organized so that we could easily access these documents. This organization needs to make sense to you when you do this in Arena. That way you’re not searching online with the auditor there.
So, during our FDA audits, which usually occur due to PMA submittals by our customer, we provide the auditor with a table of contents of the design history file. They review it and they ask for certain documents on that list. It has stated many times before. And that must be my theme for today—that the documents on Arena are so easily accessible. I have no issue providing the documents requested in a timely manner and the current revision. However, the auditor has asked for in the past, and these are also readily available on Arena. With regards to the device master record, the way that Apical has set up the device master record, we have linked all the required documents that are stated per the FDA QSRs. And so, each time one of these documents is revised in the system, the DMR is automatically updated.
This slide shows the records that we maintain in Arena. It’s the corrective and preventive actions, nonconforming product reports, customer complaints, device returns, software issue logs, as well as the software issue reports, and the training records. These forms are all online. And so, every employee has access to them. And when they need to fill out a portion of it, they are prompted by the Arena dashboard. During our audits, there never is a time when they don’t, the auditor does not want to see the CAPA system. So, in the case of our ISO audit, where they can take a look at the CAPA generated from internal audits, they go through our CAPA and they are able to see the issue, the root cause analysis, curative, and corrective action, and the dates and sign-off of the sections.
This is the same for our NCMR system and the device returns system—in each case whatever the auditor asked for, they were provided with, from the Arena system. And then for the trending, with the CAPA systems, and the NCMR, and the device returns we can do trending. The Arena system has made it easy to sort on keywords. Apical does trending on a semiannual basis. And then we record these statistics. During the audit, I’ve had it that the auditor has asked for the trending, and we provide this—a report that comes from Arena to the auditor. And there has never been an issue brought up based on that.
So, finally, in summary, overall our audits seem easier for us. We have always had the required documentation and records with the Arena system in place. We aren’t piling up all the binders in the conference room, having various employees be the runners to get the info. It just seems a bit calmer and more put together. So, with that, I’m going to now pass it on to Yelena. Thank you very much.
Yelena Bolton:
Thank you very much, Kim. Hello, everyone. And thank you for joining us today. My name is Yelena Bolton and I work for Arena where I manage QMS compliance. And as Kim already mentioned, Arena provides a cloud-based enterprise, product lifecycle management and quality management solution suite. And during today’s presentation I would like to discuss a few quality management challenges medical devices are facing today and explain how exactly the product-centric quality management system can help you to streamline required regulatory compliance and reduce the cost. But before I move to the main presentation, I would like to clarify a few acronyms and definitions. As Kim already mentioned in her presentation: PLM is product lifecycle management. QMS is quality management system, and we’re going to be used in DHF, which is design history file, device master record, DMR, and of course, bill of materials [BOM], and corrective and preventive action (CAPA).
It’s the product-centric quality management system where PLM and QMS are combined into a single cloud solution. So, you can manage all your product quality processes in the same place as your product lifecycle processes—specifically, the product-centric quality management system, or combined PLM/QMS system, provides you with product management functionality, quality record management functionality, including change control, document control, quality process management, training issues, and supplier management functionality. So, you can establish and maintain your design history file, your DMRs, BOMs, CAPA processes, training, all in the same system. In other words, this single cloud solution enables you to manage your entire product records in context—there’s critical quality processes, CAPA processes, and business processes. All right, excuse me, going back to the main agenda. As I mentioned earlier, I’m now part of the Arena team, but before joining Arena, I worked as the program manager for a medical device company.
And because of my project management work, I end up at a lot of conferences, mainly on product lifecycle and quality management best practices. So, medical device professionals would get together and exchange ideas on program management, endless cycle management in a regulated environment. And I remembered that one of the very first questions my medical device co-workers would ask each other, “Well, what do you use with change control?” And the main questions were, “What system do you use to manage your CAPA and how do you manage your employee training records?” And those were indeed very important questions because your product lifecycle duration, your time to market, your product quality or compliance, and just overall project costs directly depend on PLM and QMS system that you and your teams are using on daily basis. And, obviously, your goals are to decrease your time-to-market, product lifecycle duration, and budget cost, while you improve in your product quality and maintaining required regulatory compliance.
And in the next few slides, I would like to illustrate exactly how the product -centric quality management system can help you to achieve these goals. All right, let’s take a look at a few action items that you or maybe your team would typically perform on daily basis, right? And let them analyze bid time and cost to complete these daily actions, using product-centric quality management system. So, let’s say today you have to complete the following three tasks. Tell me one, you have to release an approved updated bill of materials, updated version of your risk management report, and updated version of your design control. Number two, you have to update your employee training plan to add this updated design control. Because the design control is part of your required QMS training. Number three, you have to update CAPA to reference the bill of materials because this bill of materials happened to be part of your corrective action step.
All right, let’s start with the first task. We need to release and approve BOM and SOP and report, and then put the new one there. You don’t just go and release your quality and product records ad hoc. Instead, you have to follow your established design control and change control procedures and SOP to approve and release your quality records. The product-centric quality management system provides you with a framework that helps you to manage all your design changes using your quality system framework. In other words, it helps you to manage your DHF records, BOM, DMR, quality records, and changes for your procedures and SOP. For instance, you can actually map your PLM/QMS system workspace configurations to your quality processes, to ensure that you and your team follow applicable quality procedures on daily basis, the product-centric quality management system also provides you with a very effective change control functionality.
It starts with nice descriptive change notifications for all your required and optional approvers. And you also can configure your change routings to match your quality SOPs. So, when you create a new change, the system will automatically select appropriate change routing, change approval board based on the change type that you created. And, of course, the change management cycle significantly reduced with electronic signatures functionality. So, to complete the first task, it will only take us a few minutes to create change orders based on already pre-configured change routings, attach correspondence records to change others, and submit change for approvals. Next, the system defines all approvers or required action items. And the best part is that with this cloud system, your approvers can review the change at any time, 24/7, anywhere in the world, and they can approve or reject the change just by providing an established electronic signature as required by 21 CFR part 11.
Of course, the system also captures and maintains complete decision history and change is free for all your documents, product records, and quality records. And again, it’s important because, as you know, change control is required by multiple regulations and product-centric quality management system helps you to demonstrate compliance in a systematic way. All right, now we’ve done this task, number one, and I’ll update a bill of materials risk management report and SOP now approved and effective and be ready to move to the next task—task number two, where we have to add an updated version of the design control SOP to the employee training plans, the same as would be, we just released this morning. Of course, we also need to make sure that our employees will actually complete required training on time as required, stated in our training procedures. All right, let’s see, what did they have to do to complete this task?
If we are using product-centric quality management system, it is nothing, it is actually really nothing because your product-centric quality management system includes training management functionality. So, your training records and quality records of course. And when things are in the same centralized systems, which means that your quality records are linked to the required training plans. And then when you released your next version, as we just did this morning, your applicable training plans will be automatically updated to include this revised version of the SOP. At the same time, this system will notify all the required employees that they have to complete training on this revised the SOP, and since training due dates are already configured in your workspace training plan configurations to match your training procedures, the training due dates will also be communicated to all required trainees.
And while your employees are completing the required training, you or maybe your training manager can view the real-time training status for all your employees. So, you can see who is late, who completed training on time and so on. You can also run complete training import and generate training records at any time. And again, it’s important because, as you know, training records are required by multiple regulations and training is often part of your internal and external audit agenda. All right now, moving on, since the system completed the second task for us, we actually saved a few hours of time today and we’re ready to move to our very last action item, where we have to update the CAPA corrective action step to reference the bill of materials that we just released this morning. And if you’re using a product-centric quality management system, it will only take you a few seconds to search and display our CAPA process with corrective action step.
And then if you move the item to search for the bill of material and reference the bill of material on the CAPA corrective action step. And it is really fast because this product-centric QMS system, all your quality processes, your product records, your documents, your quality records, training records, and changes are stored and managed in this all-in-one centralized system. So, you can reference any product record, quality record, changed training plan, document, external links, or process under any quality object, similar to how we just referenced our bill of materials on the CAPA step. And this also means that all your cross-functional teams have complete visibility into quality processes. For example, let’s say you [engineered] and Kim is working to build the next version of your product. When they display for the bill of materials, they will see all the past and current quality issues associated with this bill of materials.
So, they can incorporate this quality knowledge into the future product design early on in the product lifecycle. And if you have more points on compliance with a product-centric quality management system, the quality management system also provides configurable quality process templates. So, you can map your CARS, SCARs and NCMRs, 8D, CAPAs or workspace template to your quality process, which again helps you to achieve and maintain regulatory compliance. This system also provides considerable quality steps approval, functionality with electronic signatures, and, last but not least, the system generates complete quality process history for you. All right, now we are officially done with all the required action items, and you probably noticed that we managed to save a few hours of time today by using the product-centric quality management system—and to conclude, the PLM and QMS systems that you and your team are using on a daily basis have direct impact on your compliance and cost.
So, instead of using multiple discrete systems, for example, one system to manage changes, another system to manage product records, different systems to manage CAPA, another system to manage and sort your documents, and a separate training management solution. Today, we used a cloud-based product-centric quality management system to complete our daily tasks, and this all-in-one combined system streamlines your regulatory compliance and enables you to operate within your quality system framework. By following your design control procedures, it helps you to improve product quality and reduces product lifecycle duration and project cost. And this concludes my portion of the presentation today. And I would like to thank all of you for joining us today and be ready to move to Q&A session.
Moderator:
Yes, indeed. Thank you, Yelena, and thanks to Kim as well for their presentation. As promised, we’re going to go through and answer some of the questions that have come in throughout the presentation. So, first question is going to be, “Do you feel that showing Arena to the auditor opens you up to more questions because they see more? In essence, does it open up a can of worms?”
Kim Khoe:
This is Kim. No, it didn’t in our case. So, what happens is we had the Arena open on my computer, not on the screen. And so, whenever they ask for something, I could certainly do my minor search on my computer. And then I highlighted it on the screen in the conference room so they could see it. And if they wanted it printed it out, it was printed out. So, there was no issue with that for the actual Arena records, like the CAPA records, they were the, it was the ISO auditor. They didn’t have the savvy of knowing what buttons to push for Arena. So, they had to go with what I had out there. And it was just one screen that I would show them. There was never an issue that they were curious about what was the next screen or anything like that. There was no issue with that.
Moderator:
Okay. Sort of along the same line. So, the next question is “How do you keep the auditor from seeing internal audit records if you are online with them in Arena?”
Kim Khoe:
So, the way we set up our CAPA are internal audit records. It’s a keyword so that we only do a report on non-internal CAPAs, or I can do it on only internal audit, et cetera. So, it depends on what report I will provide. And based on that, it depends on who the auditor is. Our FDA auditor does not see our internal audit CAPA. So, they don’t even have access to that on the Arena screen. So, it depends on how you set up the reports in Arena. And, of course, this is something you do in advance, but it’s very handy.
Moderator:
Okay, next question is simply on “How do you attach documents?”
Kim Khoe:
Yelena, you want to take that one …
Yelena Bolton:
Sure, yes. I could take it. Ah, well, it’s very easy. I mean everything in the PLM/QMS system is stored in one centralized location. So, you can easily cross-reference all the documents and records as far as attaching specific documents. You could just attach any file to the item. And it’s, it’s very simple. It’s really literally one click to attach the document through the interface on the Arena application.
Moderator:
Okay, great. Next question. “Does a product-centric QMS system maintain a history for training activities so that it can be leveraged for an ISO audit?”
Yelena Bolton:
Yes. When I was talking about training, I did not mention that, but yes, the system maintains a complete history. Of course, it’s computer-generated history for all training activities. For example, when you create training plans for your employees, that you’re going to have history on when training plan was created, what type of documents, the part numbers and names, titles, and revisions has been attached. And, of course, complete training history as well. For example, when user access the documents, when user has signed the training document, and so on. So, basically, complete history and each history event has also computer-generated timestamp, of course, and the user, they ask them who actually performed this action. And you can run the history report and obtain the history at any time from your application.
Moderator:
Okay, next question is actually a two-parter. The first, “Our auditors are required to keep old records, but they must be marked as not current. Does your system keep older versions? And if so, how do users know that they are old and not the current version?” And, secondly, “Can the old records that were approved be modified?”
Kim Khoe:
So, in our case at Apical, yes, we can keep old records there. I want to say the earliest revisions, no, they cannot be modified. So, how it comes up on our screen is the current revision will come up, yet, depending on your access, you can access down revs. And so, I can hit the down rev., I have access to it, but they were, they’re always in the Arena system.
Yelena Bolton:
Yes. And to add that the superseded version, local documents, and records are clearly marked as not effective or superseded. And all the current effective documents and records are marked as effective. This corresponds with activity, date, and version that linked to the change approval/changes in history.
Moderator:
Okay. Our next question, “What is included in Arena’s validation services and do they provide validation of the latest version of Arena or upcoming versions?”
Yelena Bolton:
Oh, that’s a good question. Arena validation maintenance service is ongoing software validation, which means that Arena will validate, the application for each major update release. So, it is ongoing. And again, we share the complete software validation with our customers for every major update in a PLM release. And there is also validation included in the validation requirements, executed OQ IQ validation protocol test cases, with all the objective evidence that prove that the test case has passed. And, of course, we have traceability matrix system that’s, again, maintained and updated for every single release. The traceability matrix of course, traces a map, all their requirements to correspondent OQ or IQ test cases. Also, there’s also a validation file that we share with customers and includes validation, test plans, and validation reports.
Moderator:
Okay. And the next question is quite simply, “Can I see who is accessing my workspace?”
Yelena Bolton:
Yes, yes you can. So, Arena application administrator can run different types of reports on what we call recent activities. So, you could see, for example, you can run report on all users who have access workspace, and it’s not just that, but also you can run reports on file access, and exports, and so on. So, yes you can.
Moderator:
Okay. Our next question is “How much information is required in a design history file?”
Kim Khoe:
So, for that question, it’s all based on what the FDA QSRs are requiring. So, you need to make your list of what is needed for your product. But what is nice about Arena is when I enter a document into the Arena system, I have a question that says, is it a DHF document or not? Yes or no. If I hit the yes, it automatically gets assigned to my DHS file so that when I do the report for DHF, it comes up with all the documents for that particular DHF for that customer. But the actual contents of that DHF, that’s up to the type of product you have, the FDA requirements for that, and your design control.
Moderator:
Okay, great. Thank you. That is just about all we have for questions today. So, please join me in thanking Kim Khoe and Yelena Bolton for their presentation as well as our sponsor, Arena. If you have any additional questions or comments, please don’t hesitate to click the “email us” button on the console. As you exit today’s webinar, please take a couple of minutes to complete our survey. We strongly welcome your detailed comments. Please visit webinars.qualitymag.com for the archive of this presentation, as well as information about our upcoming events. We appreciate your time and hope you found this webinar to be a valuable experience.