Guidance Medical Device ISO 13485:2003 Voluntary Audit Report Submission

Contains Nonbinding Recommendations

Guidance for Industry, Third Parties and Food and Drug Administration Staff

Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program

Document issued on: [use release date of FR Notice]

The draft of this document was issued on May 20, 2010.

OMB control number: XXXX-XXXX

Expiration Date: XX/XX/201X

See additional PRA statement at the end of this guidance

For questions regarding this document, contact Kimberly A. Trautman (CDRH) at 301-796-5515 or by email at [email protected], or the Center for Biologics Evaluation and Research (CBER), the Office of Communication, Outreach and Development (OCOD) at 1-800-835-4709 or 301-827-1800 or [email protected].

U.S. Department of Health and Human Services

Food and Drug Administration

Center for Devices and Radiological Health

Center for Biologics Evaluation and Research

Preface

Public Comment

You may submit written comments and suggestions at any time for Agency consideration to the Division of Dockets Management, Food and Drug Administration, 5630 Fishers Lane,

rm. 1061, (HFA-305), Rockville, MD, 20852. Submit electronic comments to http://www.regulations.gov. Identify all comments with the docket number listed in the notice of availability that publishes in the Federal Register. Comments may not be acted upon by the Agency until the document is next revised or updated.

Additional Copies

Additional copies are available from the Internet at: http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm1746.htm. You may also send an e-mail request to [email protected] to receive an electronic copy of the guidance or send a fax request to 301-847-8149 to receive a hard copy. Please use the document number 1746 to identify the guidance you are requesting. Copies of the guidance are also available from:

Office of Communication, Outreach and Development (OCOD), HFM-40

Center for Biologics Evaluation and Research

Food and Drug Administration

1401 Rockville Pike, Suite 200N, Rockville, MD 20852-1448

Phone: 800-835-4709 or 301-827-1800

Internet: http://www.fda.gov/BiologicsBloodVaccines/GuidanceComplianceRegulatoryInformation/Guidances/default.htm.

E-mail: [email protected]

Guidance for Industry, Third Parties and

Food and Drug Administration Staff

Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program

This guidance represents the Food and Drug Administration's (FDA's) current thinking on this topic. It does not create or confer any rights for or on any person and does not operate to bind FDA or the public. You can use an alternative approach if the approach satisfies the requirements of the applicable statutes and regulations. If you want to discuss an alternative approach, contact the FDA staff responsible for implementing this guidance. If you cannot identify the appropriate FDA staff, call the appropriate number listed on the title page of this guidance.

Introduction

This guidance provides information on the implementation of section 228 of the Food and Drug Administration Amendments Act of 2007 (FDAAA), which amends section 704(g)(7) of the Federal Food, Drug, and Cosmetic Act (the Act) (21 U.S.C. 374 (g)(7)). Section 228 was amended to add the following provision:

“(F) For the purpose of setting risk-based inspectional priorities, the Secretary shall accept voluntary submissions of reports of audits assessing conformance with appropriate quality system standards set by the International Organization for Standardization (ISO) and identified by the Secretary in public notice. If the owner or operator of an establishment elects to submit audit reports under this subparagraph, the owner or operator shall submit all such audit reports with respect to the establishment during the preceding 2-year periods.”

This document describes how the Food and Drug Administration’s (FDA) Center for Devices and Radiological Health (CDRH) and Center for Biologics Evaluation and Research (CBER) intend to implement this provision of the law. Effective October 1, 2011 (pending OMB approval), FDA will begin a voluntary pilot program as described in this guidance document and will evaluate the outcomes of the pilot program at the end of this period.

Specifically, a device manufacturer whose establishment has been audited under one of the regulatory systems implemented by the Global Harmonization Task Force (GHTF) founding members¹ using ISO 13485:2003 Technical Corrigendum 1:2009 (or a national adoption of this standard, e.g., EN ISO 13485:2003/AC:2009, CAN/CAS ISO 13485 13485:2003) “Medical devices – Quality management systems – Requirements for regulatory purposes,” may voluntarily submit the resulting audit report to FDA. If, based on that report, FDA’s analysis or compliance decision meets the requirements of the FDA’s Medical Device Compliance Program 7382.845 for “Situation II,” that there is minimal probability -- in light of the relationship between the quality system deficiencies observed and the particular device and manufacturing processes involved -- that the establishment will produce nonconforming and/or defective finished devices,² then FDA intends to use the audit results as part of its risk assessment to determine whether that establishment can be removed from FDA’s routine inspection work plan³ for one year from the last day of the ISO 13485:2003 audit. The effect of removal from the routine inspection work plan is that FDA will postpone their bi-annual inspection for that one year period. The voluntarily submitted ISO 13485:2003 audit report provides FDA some information on the conformance of the manufacturer with basic and fundamental quality management system requirements for medical devices. Inspections conducted “For Cause” or “Compliance Follow-up” by FDA will not be affected by this pilot program.⁴ Moreover, this pilot program would not apply to any necessary pre-approval or post approval inspections for Premarket Approval (PMA) applications or to decisions under section 513(f)(5) of the Act (21 U.S.C. 360c(f)(5)) concerning the classification of a device.

It is important to note that participation in the Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program is entirely voluntary.

FDA's guidance documents, including this guidance, do not establish legally enforceable responsibilities. Instead, guidance documents describe the Agency's current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited. The use of the word should in Agency guidance documents means that something is suggested or recommended, but not required.

Background

Inspections conducted by third parties and other regulators have been utilized by FDA in different circumstances. The Medical Device User Fee Modernization Act of 2002 (MDUFMA), P.L. 107-250, authorized a third party inspection program under which FDA trains and accredits third parties to perform inspections of eligible establishments that manufacture Class II or III devices. This third party inspection program, commonly referred to as the "Accredited Persons (AP) for Inspections" program, is a voluntary program. While all firms remain subject to inspection by FDA, eligible manufacturers have the option of requesting an inspection by an AP. FDA has committed significant resources to creating the AP for Inspections program and continues to maintain it.

In addition, on September 7, 2006, FDA and Health Canada (HC) mailed a letter to third party auditing organizations that had previously been trained and accredited by FDA under its AP for Inspections program. These organizations are also recognized by HC under the Canadian Medical Devices Conformity Assessment System (CMDCAS). The letter announced a pilot multi-purpose audit program (PMAP) that allows third party auditing organizations that are both a qualified accredited person and a recognized registrar to perform a single inspection that both FDA and HC could accept and utilize. The purpose of the PMAP was to evaluate the effectiveness of performing single third party inspections of medical device manufacturers' establishments that would meet the regulatory requirements of both countries. Under the PMAP, third parties are accredited by both FDA and HC and the establishment is evaluated for compliance with the Quality System regulation under 21 CFR Part 820 and CAN/CSA ISO 13485:2003, as well as other regulatory requirements such as FDA Medical Device Reporting (21 CFR Part 803), HC post market reporting, FDA Corrections and Removals (21 CFR Part 806), and HC licensing requirements. If FDA’s assessment of the audit report indicates compliance, then the establishment is removed from the routine FDA work plan for two years. FDA and HC on November 1, 2010, published “Final Joint Report of the Pilot Multipurpose Audit Program (PMAP).⁵” The report concluded:

Based on this review of ten multipurpose audit reports a qualified/competent auditing organization can perform a single audit/inspection of a medical device manufacturer's quality management system (QMS) in order to satisfy the regulatory requirements of Health Canada and FDA.

In addition, when a manufacturer undergoes a multipurpose type audit, Health Canada and FDA have confidence in the ability of a qualified and competent auditing organization to plan, carry out, and report on the audit/inspection according to basic Health Canada and FDA requirements. Informal and anecdotal comments received by FDA and Health Canada personnel from the participating manufacturers and auditors have been positive.

The report notes benefits to HC and FDA as well as to manufacturers::

This pilot program provided both regulatory bodies the chance to compare processes and prepare for future best practices in the area of medical device manufacturing regulatory oversight. There is potential for convergence in the areas of audit/inspection best practices. Potential benefits for manufacturers for a future single audit program include:

• saving of audit/inspection time in person days (and associated costs) and less disruption of the manufacturer's day-to-day operations; and,

• greater control over the scheduling of regulatory audits/inspections.

The regulators benefit from a single audit process through the leveraging of resources and sharing of information from a single audit process. This was a limited sample size, however, it shows the ability to perform a single audit including not only FDA and Health Canada but potentially other regulatory partners.

FDA is currently working with HC to implement a single audit program over the next few years and is also looking forward to expanding this single audit program in the future to other GHTF partners.

The medical device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program outlined in this guidance is another way in which FDA may leverage audits performed by other GHTF regulators and their accredited third parties in order to assist the agency in setting risk-based inspectional priorities.

Under the Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program, regulators or third parties conducting the ISO audit do so under ISO 13485:2003 for non-FDA regulatory purposes and these audits are not conducted under the FDA AP or FDA/Health Canada Multipurpose or Single Audit Program. Therefore, these ISO 13485:2003 regulatory audits do not evaluate the establishment for compliance with FDA’s QS regulation and other FDA regulations. For this reason, under the Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program, FDA intends to remove eligible establishments from the routine inspection work plan for only one year following an ISO 13485 audit that meets FDA’s Situation II criteria as described earlier.

Who is Eligible to Participate?

A domestic or foreign device manufacturer that is subject to the requirements in 21 CFR Part 820, Quality System (QS) regulation is eligible to participate in the ISO 13485:2003 Voluntary Audit Report Submission Pilot Program under the following circumstances:

1. The audit report is submitted to the FDA within 90 days from the last day of the most recent ISO 13485:2003 audit;

2. The audit is performed using ISO 13485:2003: “Medical devices - Quality management systems – Requirements for regulatory purposes;” and

3. The audit was performed by an auditor under one of the GHTF founding members regulatory systems:

1. The Canadian Medical Devices Conformity Assessment System (CMDCAS);

2. The European Union medical device Notified Body system;

3. The Therapeutics Goods Administration of Australia, Office of Manufacturing Quality; or

4. The Japanese Ministry of Health, Labour and Welfare system for Medical Devices and In-vitro Diagnostics.

In order for FDA to have confidence in the validity of the audit report and the competence of the auditors, FDA is limiting this pilot program to audits conducted under the regulatory scheme of one of the founding partners in the GHTF. FDA has over 18 years of experience working with these founding regulatory members and believes that the auditors under these programs can give FDA the assurances and information necessary to assist FDA in making important risk-based decisions for FDA inspections.

Accredited Persons under FDA’s AP for Inspections program should also be accredited by one of the above programs in order to audit conformance to the ISO 13485:2003 standard and for their audit report to be accepted under the ISO 13485:2003 Voluntary Audit Report Submission Pilot Program.

What are the Criteria for Eligibility in the Program?

FDA intends to consider submissions under the pilot program as long as the following criteria are met:

1. The ISO 13485:2003 audit and the resulting audit report conform to the GHTF Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers⁶:

• Part 1: General Requirements Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers;

• Part 2: Regulatory Auditing Strategy Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers; and

• Part 3: Regulatory Audit Reports.

2. The most recent eligible audit report conforms to HC’s GD211: Guidance on the content of quality management system audit reports.⁷ GD 211 is based on the work of Study Group 4 of the GHTF, and in particular on the technical content of GHTF document SG4/N33R16:2007 Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers - Part 3: Regulatory Audit Reports.

FDA has worked with HC and the CMDCAS Auditor Working Group for the past several years on developing this document. In 2009, HC initiated a pilot project to determine whether the application of GD211 would standardize minimum audit report content, reduce variability in report content among registrars, and increase the usefulness and reliability of audit reports. The results from report evaluations and feedback obtained from auditors, certifiers, and registrar representatives indicated that the GD211 would successfully standardize the minimum content of audit reports and facilitate the preparation of more useful and reliable audit reports.

FDA and HC have produced a web based training module for auditors on the GD 211 guidance document which is available on FDA’s webpage under the CDRHLearn Modules.⁸ Auditors under the HC CMDCAS program, as well as auditors working for other GHTF regulators, should view this training module for assistance in writing an audit report that will conform to the GD 211 guidance document. This will allow the audit report to be eligible for submission under this FDA Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program.

Manufacturers should make arrangements with their regulatory third party auditors prior to the scheduled audit to ensure conformance to the criteria listed above. During the FDA electronic submission process, the manufacturer will be asked to attest that arrangements for conformances to these criteria have been made with the regulatory third party auditor prior to the audit and that the appropriate guidelines were followed during the audit and in the drafting of the audit report submitted to the FDA.

3. All information submitted under this program is written in or translated into English. If the original documents are not in English, the manufacturer should provide a copy of the originals, as well as the English translation.

How should the manufacturer submit the eligible ISO 13485:2003 audit report?

1. FDA will consider for eligibility under this pilot program ISO 13485:2003 audit reports sent to the FDA within 90 days from the last day of the most recent audit. Reports can be either a full assessment of the establishment’s Quality Management System (QMS) or a surveillance audit of the establishment’s QMS. In addition, all related responses or communications between the auditor who conducted the ISO 13485 audit and the manufacturer regarding corrections or corrective actions to audit findings for a specific establishment (manufacturing site, facility, or multi-site firm) should be included in the submission. The audit report will be required to be associated with a specific FDA registered facility (FEI number) whose names and addresses are clearly expressed in the audit report. There can only be one FEI number associated with a single eligible ISO 13485:2003 audit report submission.

2. The manufacturer will be requested to submit all reports of audits under ISO 13485:2003 of the relevant establishment that were issued during the preceding 2‑year period. The preceding 2-year period should be determined based on the last day of the most recent ISO 13485:2003 audit.

3. The manufacturer will be requested to submit the most recent copy of the ISO 13485:2003 certificate. The ISO 13485:2003 certificate should clearly state the scope of the certification (i.e., types of devices and process controlled by the QMS) in order for the FDA to fully understand the scope of the audits,

4. The eligible ISO 13485:2003 audit reports, any related responses or communications (regarding the corrections or corrective actions to audit findings) between the manufacturer and the auditor, and the copy of the ISO 13485:2003 certificate should be scanned into PDF files and submitted to the FDA through the “FDA eSubmitter” system.⁹ In order to utilize the FDA eSubmitter system or any FDA electronic submission process, the manufacturer must first set up an account and receive the electronic verification certificate with WebTrader in order to go through the Electronic Submissions Gateway.¹⁰ Manufacturers should set up the WebTrader account¹¹ ahead of time if they do not already have one, because setting up the account and receiving full verification can take approximately 3-4 weeks. This account is required in order to utilize the eSubmitter system.

5. In the eSubmitter system, the manufacturer will also be prompted to provide additional information such as:

1. The name, title, address, telephone number, fax number and email address of the manufacturer’s correspondent who is authorized to act on behalf of the manufacturer in the US on issues related to the audited establishment;

2. The FDA registration number or FDA Federal Establishment Identifier (FEI) number, in order for FDA to relate the audit report to the specific manufacturing establishment registered with FDA;

3. The full mailing address of the establishment that was audited and for which an audit report is being submitted; and

4. Information about the ISO 13485:2003 audit, including: the name of the auditing organization and the auditors that performed the audit and prepared the audit report; the start date and the completion date of the most recent audit; and the names of the regulatory authorities for which the ISO 13485:2003 audit was performed.

What will FDA do with the Submissions?

FDA intends to review the submission, as well as the audit reports from the preceding two years, the ISO certificate, the most current audit report and any responses or communications with regards to corrections or corrective actions to audit findings from the most recent audit, as part of the compliance decision (as described in the CP 7382.845 Part V referenced earlier in this guidance) and risk assessment. If the establishment is determined to be a Situation II, as described in CP 7382.845 Part V, the establishment will be recommended to be removed from the routine work load plan for one year from the last day of the current audit submitted. Once a determination has been made, FDA intends to respond electronically to the manufacturer and electronically copy the appropriate district office for domestic establishments or CDRH’s Field Operation Program for foreign establishments.

Paperwork Reduction Act of 1995

This guidance contains information collection provisions that are subject to review by the Office of Management and Budget (OMB) under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3520). The time required to complete this information collection is estimated to average First year, 40 hours for the WebTrader system plus 2 hours for the eSubmitter submission process, resulting in 42 hours per response. Second year, only 1 hour will be necessary for the WebTrader system plus the 2 hours for the eSubmitter submission process, resulting in 3 hours per response. Third year, only 1 hour will be necessary for the WebTrader system plus the 2 hours for the eSubmitter submission process, resulting in 3 hours per response. With an estimated 1,600 total annual responses, the total reporting burden hours is estimated to be 67,200 hours for the first year and 4800 hours each subsequent year. For a total of 76,800 burden hours

The total burden hours includes the time to review instructions for electronic submission, set up of the WebTrader account and receipt of the verification certificate for the Electronic Submissions Gateway, gather the audit data and correspondence needed, scan the required document into PDF electronic format and complete the eSubmission process. Send comments regarding this burden estimate or suggestions for reducing this burden to:

Kimberly A. Trautman,

Center for Devices and Radiological Health,

Food and Drug Administration,

WO 66-3422,

10903 New Hampshire,

Silver Spring, MD 20993

This guidance also refers to currently approved collections of information found in FDA regulations. The collections of information in 21 CFR part 820 have been approved under OMB control number 0910–0073 and the collections of information for the Inspection by Accredited Persons Program have been approved under OMB control number 0910–0569.

[An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. The OMB control number for this information collection is XXXX_XXXX (expires XXX XX, 201X).]

1 The GHTF founding members auditing systems include: the Canadian Medical Devices Conformity Assessment System; Notified Bodies designated by member states of the European Union.; Australian Therapeutics Goods Administration, Office of Manufacturing Quality; and the Japanese Ministry of Health, Labour and Welfare system for Medical Devices and In-vitro Diagnostics.

2 See February 2, 2011, Compliance Program (CP) 7382.845 Inspection of Medical Device Manufacturers Part V http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm072753.htm

3 The Annual Field Inspection Work Plan is developed through a collaborative effort between the Field, the Centers, and Field Committees. The routine inspection work plan is developed to meet FDA’s requirement of biannual inspections, in conjunction with the risk based work load planning that is discussed in CP 7382.845 Part II. Routine inspections do not include For Cause Inspections, Compliance Follow-up Inspections or Pre and Post Approval Inspections.

4 “For Cause” and “Compliance Follow-up” inspections are dictated by the previous FDA 483 findings and other regulatory information and may differ from the typical routine inspection. See CP 7382.845 Part III.

5 http://www.hc-sc.gc.ca/dhp-mps/alt_formats/pdf/md-im/activit/int/md_pmap_rep_im_ppafm_rap-eng.pdf

6 These guidelines can be found at http://www.ghtf.org/sg4/sg4-final.html.

7 Health Canada’s GD211: Guidance on the content of quality management system audit reports can be found at http://www.hc-sc.gc.ca/dhp-mps/consultation/md-im/consult_draft_ebauche_md_im_gd211-eng.php

8 http://www.fda.gov/Training/CDRHLearn/default.htm

9 http://www.fda.gov/ForIndustry/FDAeSubmitter/ucm221506.htm

10 For instructions and information on the Electronic Submission Gateway please see http://www.fda.gov/ForIndustry/ElectronicSubmissionsGateway/default.htm

11 For additional information and help desk information see

http://www.fda.gov/ForIndustry/ElectronicSubmissionsGateway/ucm114831.htm