Overview of the Quality System Regulation

Slide 1
Hello, my name is Tonya Wilbon. I'm the Branch Chief for the Postmarket and Consumer Branch in the
Division of Industry and Consumer Education. Welcome to CDRH Learn, the Center's resource for
multimedia industry education. The title of this presentation is "Overview of the Quality System
Regulation."

Slide 2
Do you want to improve processes? Reduce waste? Facilitate and identify training opportunities?
Engage your staff? Set organizational-wide direction? And even lower costs? Then you want an
effective Quality System! After viewing this presentation, you will have a general understanding of the
Quality System Regulation requirements codified in Title 21 Code of Federal Regulations Part 820, or 21
CFR 820.

Slide 3
The learning objectives are to summarize the background information and history related to the Quality
System Regulation, define key terminology used in the regulation, explain the purpose of a quality
system, and explain the quality system regulation using the 7 major sub-systems approach.

Slide 4
Let's start with some background information and history about the Quality System Regulation.

Slide 5
In 1976, FDA's medical device authorities were initially enacted under the Medical Devices Amendments
to the Federal Food, Drug, and Cosmetic Act, or FD&C Act. In 1978, current good manufacturing practice
requirements, or CGMPs, were established to guide manufacturers in producing safe and effective
medical devices. In the late 1980s, FDA conducted an analysis of voluntary device recalls that took place
from 1983 through 1989, and determined that approximately 44% of these recalls were due to faulty
device design. Potentially, these recalls could have been prevented if the manufacturers had adequate
design controls.

Slide 6
Following this analysis, Congress passed the Safe Medical Devices Act of 1990, which, among other
provisions, provided FDA with the authority to add pre-production design controls to its regulation.
FDA then revised the CGMP regulation to incorporate this authority. This also allowed for consistency
with applicable international standards that addressed quality system requirements. This resulted in the
new regulation titled, Quality System Regulation, or QS Regulation, that replaced the 1978 CGMP
Regulation. The QS Regulation became effective on June 1, 1997, and is found in 21 Code of Federal
Regulations, or CFR, 820. A link to this regulation is found on the bottom of this slide.

Slide 7
The QS Regulation was initially harmonized with the 1996 version of the International Organization for
Standardization (or ISO) 13485 which was based on ISO 9001 of 1994. The QS Regulation remains
harmonized with ISO 13485:2016 version to date. This means the requirements may be similar, but are
not the same, and there are no conflicting requirements. The QS Regulation requirements are not
prescriptive, meaning they do not provide in detail how a manufacture must implement the
requirements. The regulation applies to several thousand different types of medical devices, so it

1
provides a framework of the basic or minimum requirements that a manufacturer must follow to have
an effective quality system. This ensures that devices are safe and effective and provides greater
flexibility to achieving quality requirements. Finally, the Preamble to the QS Regulation is very
important.

Slide 8
The Preamble provides understandable guidance and practical advice on how to adhere to the
regulation, thus revealing FDA's intent and interpretation of the regulation. The Preamble addresses a
total of 204 comments received from 175 individuals or industry stakeholders submitted in response to
the proposed rule. For each comment, FDA provides a response, including a rationale for agreeing or
disagreeing with the comment, and describes any changes made to the regulation as a result of the
comment.

Slide 9
On this slide, you see an example of a comment and FDA's response. This is Comment 64, which
addresses the concept of retroactive design controls.

Slide 10
I thought it would be helpful to define some key terminology included in the QS Regulation and used
throughout the presentation.

Slide 11
A very important term to start with and define is the term "Establish." Establish is defined in 21 CFR
820.3(k) and means to define, document, in writing or electronically, and implement. We typically refer
to these activities as the 3 Ds - define, document and do. You will see the term "establish" most
frequently throughout the regulation and to be in full compliance, you must do all 3 activities.

Slide 12
Another term that is very important is "Finished device." This is important because the QS Regulation
applies to manufactures that design, manufacture or produce finished medical devices. So, a finished
device is defined in the regulation at 21 CFR 820.3 (l) as any device or device accessory suitable for use
or capable of functioning, whether or not it is packaged, labeled, or sterilized. That means that the
device is considered a finished device and thus subject to the regulation, even if it has not yet been
sterilized or packaged. Please note that the term, "accessory" is also defined as a finished device. The
picture on the bottom left of this slide is a Continuous Positive Airway Pressure, or CPAP, device. This is
an example of finished device. To the right, we depict tubing, which serves as an accessory to the CPAP
device. The tubing supports the performance of the CPAP device, the labeling specifies that the tubing
is to be used with the CPAP device, and the tubing is shipped directly to the end user. Thus, the tubing is
an accessory to the CPAP device.

Slide 13
The term "Component" is another key term even though it's not referenced in the regulation as
frequently as other terms. Component is often confused with the definition of accessory, so it's
important to understand the difference. "Component" is defined as any raw material, substance, piece,
part, software, firmware, labeling, or assembly which is intended to be included as part of the finished,
packaged, and labeled device. The key distinction of the definition is that it is "PART of the finished,
packaged, and labeled device." So, a component must be shipped with the finished device. For

2
example, in vitro diagnostic kits with several vials containing reagents for performing the test, those
reagents are components in that test kit.

Slide 14
"Manufacturer" is defined as any person who designs, manufactures, fabricates, assembles, or processes
a finished device. A manufacturer includes, but is not limited to, those who perform the functions of:
contract sterilization, installation, relabeling, remanufacturing, repackaging, or specification
development, and initial distributors of foreign entities performing these functions. In today's global
market, manufacturers commonly contract out activities to other facilities.
If your establishment is contracted out to sterilize a medical device, you meet the definition of a
manufacturer and you'd be responsible for complying with applicable regulatory requirements that
pertain to the finished device.

Slide 15
Since this presentation is an overview of the Quality System Regulation, it is appropriate to define the
term "quality system." Quality System means the organizational structure, responsibilities, procedures,
processes, and resources for implementing quality management. It refers to the design and
manufacture of quality into products. So, all of your procedures documented to manufacture a device
are part of the quality system, as well as the documents of the roles and responsibilities of those
performing the procedures, and the individuals assigned to those roles.

Slide 16
Finally, the last 2 terms I'll define are "Quality Control" and "Quality Assurance." "Quality control" refers
to testing and inspecting component or finished products against the approved specifications. The goal
is to assess the physical characteristics of the device. For example, does the red light appear when you
press the power button as specified? "Quality Assurance" refers to the manufacturing of quality into the
product or testing the design of the product. It covers all activities from design to production and
includes quality control. It assures that these activities ae planned and systematic.

Slide 17
Before I explain the Quality System Regulation, I will explain the purpose of a quality system, also
referenced as the quality management system.

Slide 18
A Quality System governs the methods used in, and the facilities and controls used for, the design,
manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for
humans. And we know that includes accessories based on the definition of a finished device. The
activities and buildings or facilities required to design, produce, package, and label the finished device
have to be controlled, maintained, documented and considered to ensure the safety and effectiveness
of the device.

Slide 19
The bottom line is that it's your Quality System and you - the manufacturer - must develop a Quality
System appropriate to the risk presented by your device. The risk of the device will determine the depth
and level of actions completed and impact the decision-making processes.

3
Slide 20
Your Quality System should also consider the complexity of the device, complexity of manufacturing
processes, and both size and complexity of the manufacturing facility. The quality system for one
organization will not be the same as the quality system for another organization. The medical device
industry is comprised of companies with as few as 5 to 50 employees and with as many as 500 to 1,000
employees. The quality system at these organizations will be different and will depend on the
organization, the complexity of the device, the manufacturing processes involved in making the device,
as well as the risk presented by the device to the public health.

Slide 21
Let's now review the Quality System Regulation, 21 CFR 820.

Slide 22
As depicted in this diagram, the requirements of the Quality System Regulation may be grouped into 7
Major subsystems. These are: Corrective and Preventive Action, or CAPA, Production and Process
Controls, Equipment and Facility Control, Records, Documents, and Change Controls, Material Controls,
Design Controls and Management. Notice Management is in the center of the diagram and connects to
each of the other subsystems.

Slide 23
I cannot stress enough how management is key to the quality system and processes. I have witnessed
first-hand where management was held responsible for premarket as well as postmarket activities
regardless of whether or not they performed the activity that did not comply with the regulation. They
can delegate the performance of the quality activities to others, but they cannot delegate out the
responsibility. Management is ultimately responsible for ensuring that the Quality System is being
implemented and that it's effective. All the subsystems are interrelated and should be linked as depicted
by the lines connecting each subsystem.

Slide 24
Quality system processes are continuous and closed loop. Information obtained from each subsystem
should be fed back into the entire quality system. You should plan, do, check, act, and repeat.

Slide 25
Manufacturers should plan to define and implement effective procedures. Do what they say they are
going to do and have it documented in their procedures. They should check the system and make
necessary changes - corrections, corrective actions, and preventive actions. And then act upon those
changes and ensure they are implemented.

Slide 26
Of the 7 subsystems, four are considered major and are highlighted in yellow on this slide. These major
subsystems are CAPA, design controls, management controls, and production and process controls.

Slide 27
These 4 subsystems are the focus of an FDA medical device inspection. They are considered key quality
indicators of a quality system. Due to time restraints and resources, FDA investigators are unable to
inspect every aspect/subsystem of the manufacturer's quality system.
By inspecting these 4 subsystems, one can get a pretty good idea of how effective the quality system is.
The Division of Industry and Consumer Education (DICE) provides additional detailed information on

4
these major subsystems and other subparts of the Quality System Regulation as CDRH Learn educational
modules. A link to CDRH Learn is on this slide.

Slide 28
To provide you with an overview of the Quality System Regulation, I will briefly describe the purpose of
each of the 7 subsystems.

Slide 29
Let's start with the Corrective and Preventive Action Subsystem or CAPA. Its purpose is to collect and
analyze information, to identify and investigate nonconforming products and quality problems, to
identify the causes of nonconforming products, and to take effective correction and preventive actions.

Slide 30
Various sources can help identify quality problems and nonconforming product. These include the
results of monitoring manufacturing processes, inspection and testing of incoming product and
complaints.

Slide 31
Moving to the left of CAPA in the diagram is Design Controls. Requirements for design controls are
found in 21 CFR 820.30.

Slide 32
The purpose of Design Controls is to control the design process. This assures that user needs and
intended uses are met and that the design is adequately transferred into manufacturing. Make sure you
identify any applicable conformance standards when developing design inputs.

Slide 33
Moving to the center, I will next review the Management Subsystem, whose requirements are found in
21 CFR 820.20, .22, and .25.

Slide 34
Management Controls provide adequate resources for operations, monitor the quality system, make
necessary adjustments, and assure the quality system is functioning properly. Adequate resources
include qualified people, training for staff, and appropriate space and environment. Manufactures can
monitor the quality system through periodic reviews. Management commitment is key because
management ensures resources are made available.

Slide 35
To the top right of our diagram, we have the Production and Process Controls Subsystem. This
subsystem encompasses several requirements of the Quality System regulation including 21 CFR 820.70,
.72, and .75, to name a few.

Slide 36
The Purpose of Production and Process Controls is to manufacture devices that meet specifications.
Controlling and monitoring manufacturing processes is essential in achieving the goal of manufacturing
product that meets specifications.

5
Slide 37
I will next review the Equipment and Facility Controls Subsystem.

Slide 38
Equipment and Facility Controls ensure that devices are not adversely affected by the manufacturing
environment, buildings or equipment. You want to make sure buildings are adequate for the operation
being conducted. If you require a specified cleanroom for manufacturing, make sure that that the room
meets those requirements so that it does not adversely affect the device.

Slide 39
Now, I will explain the Records, Documents and Change Controls Subsystem.

Slide 40
This subsystem has several key purposes. It ensures specifications and procedures are adequate and
that only current documents are used. It ensures changes are reviewed, approved and incorporated
into documents and that documents are maintained for the required length of time. It is important you
have a system in place for controlling your documentation and retrieving out-of-date documents. This
system may be manual or electronic.

Slide 41
Finally, I will briefly review the Material Controls subsystem.

Slide 42
Material Controls ensure that all products that are accepted, used, and distributed meet specification.
Products may be components, manufacturing materials, in-process devices, finished devices, as well as
returned devices. The Material Controls subsystem includes both identification and traceability
requirements.

Slide 43
The QS Regulation requires manufacturers to identify product throughout its life, including
manufacturing materials. Manufacturers are required to establish and maintain procedures for
identifying product during all stages of receipt, production, distribution, and installation to prevent mix-
ups. This ensures that appropriate product is used each time and throughout the manufacturing
processes.

Slide 44
You may identify product in various ways. Examples include electronic systems that use bar codes or
other methods where you list part numbers, describe the product, or use a revision number.

Slide 45
To meet the regulatory requirements for traceability, manufacturers must establish and maintain
procedures for identifying finished devices or, where appropriate, components, with a control number.
To ensure traceability, manufacturers must identify each unit, lot or batch of the finished device.
Traceability is required for devices intended for surgical implant or that support or sustain life.
Traceability procedures must facilitate corrective action and can be electronic or manual.

6
Slide 46
Let's review what we covered in this introduction to the Quality System Regulation. First, medical
device manufacturers must comply with the Quality System Regulation. Next, FDA has identified 7
subsystems of a Quality System. Four of the 7 subsystems are considered key quality indicators and all 7
subsystems are interrelated. And finally, we learned that the Quality System is a continuous system.

Slide 47
Your call to action is to review the quality system regulation and ensure you have implemented
applicable requirements. Demonstrate the interfaces between the subsystems and close the loop by
feeding information back into your system. Establish your Quality System!

Slide 48
We encourage you to use other industry education resources we've developed especially for you, as
shown on this slide. Of note, for comprehensive regulatory questions, please contact CDRH's Division of
Industry and Consumer Education using the information provided on this slide. We look forward to
helping you. Thank you for watching this program.

END