Guidance for Industry, Third Parties and Food and Drug Administration Staff - Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program

Guidance for Industry, Third Parties and Food and Drug Administration Staff - Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program

¹Document issued on: March 19, 2012

The draft of this document was issued on May 20, 2010.

OMB control number: 0910-0700
Expiration Date: 02/28/2015
See additional PRA statement at the end of this guidance

For questions regarding this document, contact Kimberly A. Trautman (CDRH) at 301-796-5515 or by email at Kimberly.Trautman@fda.hhs.gov, or the Center for Biologics Evaluation and Research (CBER), the Office of Communication, Outreach and Development (OCOD) at 1-800-835-4709 or 301-827-1800 or ocod@fda.hhs.gov.

U.S. Department of Health and Human Services Food and Drug Administration Center for Devices and Radiological Health Center for Biologics Evaluation and Research

Preface

Public Comment

You may submit comments and suggestions at any time for Agency consideration. Submit e lectronic comments to http://www.regulations.gov². Submit written comments to the Division of Dockets Management, Food and Drug Administration, 5630 Fishers Lane, rm. 1061, (HFA-305), Rockville, MD 20852. Identify all comments with the docket number listed in the notice of availability that publishes in the Federal Register. Comments may not be acted upon by the Agency until the document is next revised or updated.

Additional Copies

Additional copies are available from the Internet. You may also send an e-mail request to dsmica@fda.hhs.gov to receive an electronic copy of the guidance or send a fax request to 301-847-8149 to receive a hard copy. Please use the document number 1746 to identify the guidance you are requesting. Copies of the guidance are also available from:

Office of Communication, Outreach and Development (OCOD), HFM-40
Center for Biologics Evaluation and Research
Food and Drug Administration
1401 Rockville Pike, Suite 200N, Rockville, MD 20852-1448
Phone: 800-835-4709 or 301-827-1800

Internet: http://www.fda.gov/BiologicsBloodVaccines/GuidanceComplianceRegulatoryInformation/Guidances/default.htm³.
E-mail: ocod@fda.hhs.gov

Guidance for Industry, Third Parties and Food and Drug Administration Staff - Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program

This guidance represents the Food and Drug Administration's (FDA's) current thinking on this topic. It does not create or confer any rights for or on any person and does not operate to bind FDA or the public. You can use an alternative approach if the approach satisfies the requirements of the applicable statutes and regulations. If you want to discuss an alternative approach, contact the FDA staff responsible for implementing this guidance. If you cannot identify the appropriate FDA staff, call the appropriate number listed on the title page of this guidance.

Introduction

This guidance provides information on the implementation of section 228 of the Food and Drug Administration Amendments Act of 2007 (FDAAA), Public Law 110-85, which amended section 704(g)(7) of the Federal Food, Drug, and Cosmetic Act (the FD&C Act) (21 U.S.C. 374 (g)(7)). Section 228 was amended to add the following provision:

“(F) For the purpose of setting risk-based inspectional priorities, the Secretary shall accept voluntary submissions of reports of audits assessing conformance with appropriate quality system standards set by the International Organization for Standardization (ISO) and identified by the Secretary in public notice. If the owner or operator of an establishment elects to submit audit reports under this subparagraph, the owner or operator shall submit all such audit reports with respect to the establishment during the preceding 2-year periods.”

This document describes how the Food and Drug Administration’s (FDA) Center for Devices and Radiological Health (CDRH) and Center for Biologics Evaluation and Research (CBER) intend to implement this provision of the law. Effective June 5, 2012, FDA will begin a voluntary pilot program as described in this guidance document and will evaluate the outcomes of the pilot program.

Specifically, a device manufacturer whose establishment has been audited under one of the regulatory systems implemented by the Global Harmonization Task Force (GHTF) founding members¹ using International Organization for Standardization (ISO) 13485:2003 Technical Corrigendum 1:2009, “Medical devices – Quality management systems – Requirements for regulatory purposes,” (or a national adoption of this standard, e.g., EN ISO 13485:2003/AC:2009, CAN/CAS ISO 13485 13485:2003) may voluntarily submit the resulting audit report to FDA. If, based on that report, FDA’s analysis or compliance decision meets the requirements of the FDA’s Medical Device Compliance Program 7382.845 for “Situation II,” that there is minimal probability -- in light of the relationship between the quality system deficiencies observed and the particular device and manufacturing processes involved -- that the establishment will produce nonconforming and/or defective finished devices,² then FDA intends to use the audit results as part of its risk assessment to determine whether that establishment can be removed from FDA’s routine inspection work plan³ for one year from the last day of the ISO 13485:2003 audit. The effect of removal from the routine inspection work plan is that FDA intends to postpone the establishment’s bi-annual inspection for that one-year period. The voluntarily submitted ISO 13485:2003 audit report provides FDA some information on the conformance of the manufacturer with basic and fundamental quality management system requirements for medical devices. Inspections conducted “For Cause” or “Compliance Follow-up” by FDA will not be affected by this pilot program.⁴ Moreover, this pilot program would not apply to any necessary pre-approval or post approval inspections for Premarket Approval (PMA) applications or to decisions under section 513(f)(5) of the FD&C Act (21 U.S.C. 360c(f)(5)) concerning the classification of a device.

It is important to note that participation in the Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program is entirely voluntary.

FDA's guidance documents, including this guidance, do not establish legally enforceable responsibilities. Instead, guidance documents describe the Agency's current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited. The use of the word should in Agency guidance documents means that something is suggested or recommended, but not required.

Background

Inspections conducted by third parties and other regulators have been utilized by FDA in different circumstances. The Medical Device User Fee Modernization Act of 2002 (MDUFMA), P.L. 107-250, authorized a third party inspection program under which FDA trains and accredits third parties to perform inspections of eligible establishments that manufacture Class II or III devices. This third party inspection program, commonly referred to as the "Accredited Persons (AP) for Inspections" program, is a voluntary program. While all firms remain subject to inspection by FDA, eligible manufacturers have the option of requesting an inspection by an AP. FDA has committed significant resources to creating the AP for Inspections program and continues to maintain it.

In addition, on September 7, 2006, FDA and Health Canada (HC) mailed a letter to third party auditing organizations that had previously been trained and accredited by FDA under its AP for Inspections program. These organizations are also recognized by HC under the Canadian Medical Devices Conformity Assessment System (CMDCAS). The letter announced a pilot multi-purpose audit program (PMAP) that allows third party auditing organizations that are both a qualified accredited person and a recognized registrar to perform a single inspection that both FDA and HC could accept and utilize. The purpose of the PMAP was to evaluate the effectiveness of performing single third party inspections of medical device manufacturers' establishments that would meet the regulatory requirements of both countries. Under the PMAP, third parties are accredited by both FDA and HC and the establishment is evaluated for compliance with the Quality System regulation under 21 CFR Part 820 and CAN/CSA ISO 13485:2003, as well as other regulatory requirements such as FDA Medical Device Reporting (21 CFR Part 803), HC post market reporting, FDA Corrections and Removals (21 CFR Part 806), and HC licensing requirements. If FDA’s assessment of the audit report indicates compliance, then the establishment is removed from the routine FDA work plan for two years. FDA and HC on November 1, 2010, published “Final Joint Report of the Pilot Multipurpose Audit Program (PMAP).⁵” The report concluded:

Based on this review of ten multipurpose audit reports a qualified/competent auditing organization can perform a single audit/inspection of a medical device manufacturer's quality management system (QMS) in order to satisfy the regulatory requirements of Health Canada and FDA.

In addition, when a manufacturer undergoes a multipurpose type audit, Health Canada and FDA have confidence in the ability of a qualified and competent auditing organization to plan, carry out, and report on the audit/inspection according to basic Health Canada and FDA requirements. Informal and anecdotal comments received by FDA and Health Canada personnel from the participating manufacturers and auditors have been positive.

The report states benefits to HC and FDA as well as to manufacturers:

This pilot program provided both regulatory bodies the chance to compare processes and prepare for future best practices in the area of medical device manufacturing regulatory oversight. There is potential for convergence in the areas of audit/inspection best practices. Potential benefits for manufacturers for a future single audit program include:

• saving of audit/inspection time in person days (and associated costs) and less disruption of the manufacturer's day-to-day operations; and,

• greater control over the scheduling of regulatory audits/inspections.

The regulators benefit from a single audit process through the leveraging of resources and sharing of information from a single audit process. This was a limited sample size, however, it shows the ability to perform a single audit including not only FDA and Health Canada but potentially other regulatory partners.

FDA is currently working with HC to implement a single audit program over the next few years and is also looking forward to expanding this single audit program in the future to other GHTF partners.

The medical device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program outlined in this guidance is another way in which FDA may leverage audits performed by other GHTF regulators and their accredited third parties in order to assist the agency in setting risk-based inspectional priorities.

Under the Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program, regulators or third parties conducting the ISO audit do so under ISO 13485:2003 for non-FDA regulatory purposes and these audits are not conducted under the FDA AP or FDA/Health Canada Multipurpose or Single Audit Program. Therefore, these ISO 13485:2003 regulatory audits do not evaluate the establishment for compliance with FDA’s QS regulation and other FDA regulations. For this reason, under the Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program, FDA intends to remove eligible establishments from the routine inspection work plan for only one year following an ISO 13485 audit that meets FDA’s Situation II criteria as described earlier.

Who is Eligible to Participate?

A domestic or foreign device manufacturer that is subject to the requirements in 21 CFR Part 820, Quality System (QS) regulation, is eligible to participate in the ISO 13485:2003 Voluntary Audit Report Submission Pilot Program under the following circumstances:

1. The audit report is submitted to the FDA within 90 days from the last day of the most recent ISO 13485:2003 audit;

2. The audit is performed using ISO 13485:2003: “Medical devices - Quality management systems – Requirements for regulatory purposes ;” and,

3. The audit was performed by an auditor under one of the GHTF founding members regulatory systems:

   1. The Canadian Medical Devices Conformity Assessment System (CMDCAS);

   2. The European Union medical device Notified Body system;

   3. The Therapeutics Goods Administration of Australia, Office of Manufacturing Quality; or

   4. The Japanese Ministry of Health, Labour and Welfare system for Medical Devices and In-vitro Diagnostics.

In order for FDA to have confidence in the validity of the audit report and the competence of the auditors, FDA is limiting this pilot program to audits conducted under the regulatory scheme of one of the founding partners in the GHTF. FDA has over 18 years of experience working with these founding regulatory members and believes that the auditors under these programs can give FDA the assurances and information necessary to assist FDA in making important risk-based decisions for FDA inspections.

Accredited Persons under FDA’s AP for Inspections program should also be accredited by one of the above programs in order to audit conformance to the ISO 13485:2003 standard and for their audit report to be accepted under the ISO 13485:2003 Voluntary Audit Report Submission Pilot Program.

What Audit Reports are Eligible for Submission Under the Program?

FDA intends to consider the following submissions under the pilot program:

1. The ISO 13485:2003 audit and the resulting audit report that satisfy the GHTF Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers.⁶

• Part 1: General Requirements Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers;

• Part 2: Regulatory Auditing Strategy Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers; and

• Part 3: Regulatory Audit Reports.

2. The most recent eligible ISO 13485:2003 audit report submitted will also need to be consistent with HC’s GD211: Guidance on the content of quality management system audit reports⁷. GD211 is based on the work of Study Group 4 of the GHTF, and in particular on the technical content of GHTF document SG4/N33R16:2007 Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers - Part 3: Regulatory Audit Reports.

FDA has worked with HC and the CMDCAS Auditor Working Group for the past several years on developing this document. In 2009, HC initiated a pilot project to determine whether the application of GD211 would standardize minimum audit report content, reduce variability in report content among registrars, and increase the usefulness and reliability of audit reports. The results from report evaluations and feedback obtained from auditors, certifiers, and registrar representatives indicated that the GD211 would successfully standardize the minimum content of audit reports and facilitate the preparation of more useful and reliable audit reports.

FDA and HC have produced a web based training module for auditors on the GD 211 guidance document, which is available on FDA’s webpage under the CDRHLearn Modules.⁸ Auditors under the HC CMDCAS program, as well as auditors working for other GHTF regulators, should view this training module for assistance in writing an audit report that is consistent with the GD 211 guidance document. This will allow the audit report to be eligible for submission under this FDA Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program.

Manufacturers should make arrangements with their regulatory third party auditors prior to the scheduled audit to ensure that the audit and its report will be eligible for the pilot program. During the FDA electronic submission process, the manufacturer will be asked to attest that arrangements for such eligibility have been made with the regulatory third party auditor prior to the audit and that the appropriate guidelines were followed during the audit and in the drafting of the audit report submitted to the FDA.

All information submitted under this program should be written in or translated into English. If the original documents are not in English, the manufacturer should provide a copy of the originals, as well as the English translation.

How Should the Manufacturer Submit the Eligible ISO 13485:2003 Audit Reports?

1. FDA will consider for eligibility under this pilot program ISO 13485:2003 audit reports sent to the FDA within 90 days from the last day of the most recent audit. Reports can be either a full assessment of the establishment’s Quality Management System (QMS) or a surveillance audit of the establishment’s QMS. In addition, all related responses or communications between the auditor who conducted the ISO 13485 audit and the manufacturer regarding corrections or corrective actions to audit findings for a specific establishment (manufacturing site, facility, or multi-site firm) should be included in the submission. The audit report will be required to be associated with a specific FDA registered facility (Firm Establishment Identifier (FEI) number) with names and addresses that are clearly expressed in the audit report. There can only be one FEI number associated with a single eligible ISO 13485:2003 audit report submission.

2. The manufacturer will submit all reports of audits under ISO 13485:2003 of the relevant establishment that were issued during the preceding 2-year period. The preceding 2-year period should be determined based on the last day of the most recent ISO 13485:2003 audit.

3. The manufacturer should submit the most recent copy of the ISO 13485:2003 certificate. The ISO 13485:2003 certificate should clearly state the scope of the certification (i.e., types of devices and process controlled by the QMS) in order for the FDA to fully understand the scope of the audits.

4. The eligible ISO 13485:2003 audit reports, any related responses or communications (regarding the corrections or corrective actions to audit findings) between the manufacturer and the auditor, and the copy of the ISO 13485:2003 certificate should be scanned into PDF files and submitted to the FDA through the “FDA eSubmitter” system.⁹ In order to utilize the FDA eSubmitter system or any FDA electronic submission process, the manufacturer must first set up an account and receive the electronic verification certificate with WebTrader in order to go through the Electronic Submissions Gateway.¹⁰ Manufacturers should set up the WebTrader account¹¹ ahead of time if they do not already have one, because setting up the account and receiving full verification can take approximately 3-4 weeks. This account is required in order to utilize the eSubmitter system.

5. In the eSubmitter system, the manufacturer will also be prompted to provide additional information such as:

   1. The name, title, address, telephone number, fax number, and email address of the manufacturer’s correspondent who is authorized to act on behalf of the manufacturer in the US on issues related to the audited establishment;

   2. The FDA registration number or FEI number, in order for FDA to relate the audit report to the specific manufacturing establishment registered with FDA;

   3. The full mailing address of the establishment that was audited and for which an audit report is being submitted; and

   4. Information about the ISO 13485:2003 audit, including: the name of the auditing organization and the auditors who performed the audit and prepared the audit report; the start date and the completion date of the most recent audit; and, the names of the regulatory authorities for whom the ISO 13485:2003 audit was performed.

What Will FDA Do With the Submissions?

FDA intends to review the submission, including the audit reports from the preceding two years, the ISO certificate, the most current audit report, and any responses or communications with regard to corrections or corrective actions to audit findings from the most recent audit, as part of the compliance decision (as described in the CP 7382.845 Part V referenced earlier in this guidance) and risk assessment. If FDA determines the compliance decision with respect to the audit of the establishment to be a Situation II, as described in CP 7382.845 Part V, CDRH or CBER, as appropriate will recommend that the establishment be removed from the routine work load plan for one year from the last day of the most recent ISO 13485:2003 audit. Once a determination has been made, FDA intends to respond electronically to the manufacturer and electronically copy the appropriate district office for domestic establishments or the respective Center’s Office of Compliance for foreign establishments.

Paperwork Reduction Act of 1995

This guidance contains information collection provisions that are subject to review by the Office of Management and Budget (OMB) under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3520). The time required to complete this information collection is estimated to average 42 hours per response the first year and 3 hours per response in subsequent years, including the time to review instructions, search existing data sources, gather the data needed, and complete and review the information collection. Send comments regarding this burden estimate or suggestions for reducing this burden to:

Department of Health and Human Services

Food and Drug Administration

Office of Chief Information Officer

Paperwork Reduction Act (PRA) Staff

PRAStaff@fda.hhs.gov

This guidance also refers to currently-approved collections of information found in FDA regulations. The collections of information in 21 CFR part 820 have been approved under OMB control number 0910–0073 and the collections of information for the Inspection by Accredited Persons Program have been approved under OMB control number 0910–0569.

An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. The OMB control number for this information collection is 0910-0700 (expires February 28, 2015).

¹ The GHTF founding members auditing systems include: the Canadian Medical Devices Conformity Assessment System; Notified Bodies designated by member states of the European Union.; Australian Therapeutics Goods Administration, Office of Manufacturing Quality; and the Japanese Ministry of Health, Labour and Welfare system for Medical Devices and In-vitro Diagnostics.

² See February 2, 2011, Compliance Program (CP) 7382.845 Inspection of Medical Device Manufacturers Part V ⁴

³ The Annual Field Inspection Work Plan is developed through a collaborative effort between FDA’s Office of Regulatory Affairs (ORA), the Centers, and the Center-ORA Field Committees. The routine inspection work plan is developed to meet FDA’s requirement of biannual inspections of certain medical device manufacturers, in conjunction with the risk-based work load planning that is discussed in CP 7382.845 Part II. Routine inspections do not include For Cause inspections, Compliance Follow-up inspections or Pre and Post Approval inspections.

⁴ For Cause and Compliance Follow-up inspections are dictated by the previous FDA 483 findings and other regulatory information and may differ from typical routine inspections. See CP 7382.845 Part III.

⁵ Health Canada: Final Joint Report of the Pilot Multipurpose Audit Program (PMAP)⁵

⁶ These guidelines can be found at GHTF: SG4 - Final Documents⁶.

⁷ Health Canada’s GD211: Guidance on the content of quality management system audit reports⁷

⁸ CDRH Learn Course List (English) - Global Harmonization⁸

⁹ FDA eSubmitter - CDRH ⁹

¹⁰ For instructions and information on the Electronic Submission Gateway please see Electronic Submissions Gateway¹⁰

¹¹ For additional information and help desk information see Electronic Submissions Gateway - Setting up a WebTrader Account Checklist¹¹