James R. Ravitz and Amy Swift04.12.07
Better Safe Than Sorry: Why OEMs Must Keep Tabs on Outsourcing Partners
By James R. Ravitz and Amy Swift
This column previously has discussed the US Food and Drug Administration’s (FDA) efforts on the postmarket safety of medical devices. The FDA’s Center for Devices and Radiological Health (CDRH) recently adopted the Postmarket Transformation Initiative (PTI), which is intended to assist the agency in improving the identification, evaluation and response to potential device problems. As part of the PTI, the CDRH proposed to adopt a risk-based approach for field inspections that would focus limited resources on devices considered to pose the greatest risk to patients.
Original equipment manufacturers (OEMs) that outsource should pay particular attention to the FDA’s increased focus on postmarket safety. In general, the agency regards a contract manufacturer as a mere extension of the OEM. While contract manufacturers are required to have the facilities, personnel and controls necessary to maintain compliance with all of the FDA’s quality system regulations (QSRs), the OEM ultimately is responsible for ensuring the safety and effectiveness of its finished device. Partnering with the wrong contractor quickly can reduce any expected savings, trigger FDA enforcement actions and, most important, place patients at risk. If your company is assessing whether to start outsourcing, or you already partner with a contract manufacturer, then you should consider the following factors to help improve device safety and reduce regulatory risk.
Enter Into a Detailed Written Agreement
Regulatory problems with contract manufacturers often begin with the lack of a detailed written agreement between the OEM and the contract manufacturer. When entering into an outsourcing partnership with a contract manufacturer, the OEM must have a comprehensive, written agreement that clearly defines each company’s responsibilities. The FDA generally initiates regulatory action against the company primarily responsible for that area under the agreement.
The agreement should include procedures for device assembly, testing, sterilization and validation to meet the OEM’s quality requirements and acceptance specifications. It should state the method and frequency of the OEM’s evaluation or audit of the contract manufacturer. In addition, the agreement should address whether the OEM must approve or receive notification of any change implemented by the contract manufacturer that could affect the finished device, such as components, equipment, personnel or procedures. These changes could result in the need for a premarket approval (PMA) supplement or a new 510(k) submission. Such changes also could result in a device considered to be adulterated because it violated the QSRs.
Inspection by the FDA is an area often overlooked in agreements between contract manufacturers and OEMs. Such an oversight can have serious consequences. The agency generally notifies the OEM that it has audited the contract manufacturer only if it uncovers significant compliance issues; thus, an agreement must require the contract manufacturer to provide notice to the OEM of any FDA inspection relating to its devices. To the extent possible, a representative from the OEM should be involved in the inspection to ensure that the contract manufacturer discloses to the FDA only that information required by the agency’s regulations or which it has explicit permission from the OEM to reveal. In addition, the OEM should have the opportunity to review the 483 observation response before it is sent to the agency. The FDA’s regulations do not require the agreement between the OEM and the contract manufacturer to be disclosed.
Visit and Audit Partners Regularly
The FDA requires each OEM to evaluate its contract manufacturers on the basis of their ability to meet specified requirements, especially QSRs. Before signing any agreement, the OEM must visit the contract manufacturer’s facilities to determine whether it has the appropriate resources, including equipment and personnel, to perform the manufacturing operations. For example, in one warning letter, the FDA found that the OEM had contracted the manufacturing of its device to a foreign broker, who then acted as a middleman and outsourced the actual device manufacturing to another foreign firm. The OEM did not know the name of the foreign contract manufacturer. An initial visit will provide the OEM with a better understanding of the contract manufacturer’s actual manufacturing capabilities.
The OEM must regularly visit the contract manufacturer’s facility throughout the partnership. In fact, the FDA requires the OEM to periodically audit the contract manufacturer and evaluate its ability to meet the OEM’s quality system requirements. OEMs that visit and audit their contract manufacturers on a regular basis will catch serious deficiencies before they are found by FDA inspectors. Site visits are the best way to determine if the facility manufactures the device in accordance with the written procedures and the supervisory and operating personnel are qualified and competent.
Document Everything
It is not enough for the OEM to audit its contract manufacturer or discuss deviations occurring in some devices. The OEM must document the audit results and all design issues discussed between the companies, as well as maintain these files in accordance with its record retention policy. As the FDA instructed in one warning letter, the OEM should establish a formal design review record or meeting minutes to document what design issues discussed in e-mails and during telephone calls and site visits were reviewed, discussed, approved and implemented by both companies.
The agency has issued numerous warning letters to both OEMs and contract manufacturers because of their failure to record certain issues and changes associated with their devices. In one case, the FDA cited a contract manufacturer of certain enzymatic tablets for failing to establish and maintain procedures for non-conforming products, as well as for failing to thoroughly investigate and document any instances of nonconformity. In its warning letter, the agency noted that the contract manufacturer suspected metal contamination during the production of certain lots of tablets. The contract manufacturer, however, did not have any record of the investigation or analytical testing to determine if the suspect lots were suitable for release and distribution. The FDA also found that the company had failed to indicate in the batch records or incident reports that production personnel observed tablets with metal fragments during production or that adjustments were made to the table press in order to correct the problem.
In another instance, the FDA cited an OEM for failing to identify those actions required to correct and prevent recurrence of nonconforming product and other quality problems. In an evaluation report of its foreign contract manufacturer, the OEM had indicated that the contractor often “reworked” the rejected devices until they passed the OEM’s acceptance specifications. Neither the OEM nor the contract manufacturer, however, kept records of the reworked devices or documented the reason for the work and any potential adverse effects from such work. According to the FDA, failure to maintain these records prohibited the OEM from analyzing the trend of device rejects or quality issues experienced during the device assembly process.
* * *
While partnering with the right contract manufacturer is important, actively overseeing the facility’s manufacturing processes is essential. The costs associated with fixing deviations could exceed any expected savings from deciding to outsource operations. The FDA’s discovery of QSR violations at the contract manufacturer’s facility could delay the approval of the OEM’s pending PMA applications or the clearance of its 510(k) notifications. Most important, serious deficiencies could result in health risks to patients.