By Mark McCarty
OXON HILL, Md. Depending on how one measures the Medical Device Single Audit Program, it is either coming along nicely or is in danger of dying on the vine, but Kim Trautman, the former FDA liaison for the MDSAP program, told attendees at a conference held just outside the American capital that these inspections will include a much closer examination of purchasing controls in the future.
Trautman, who left the agency after 28 years to serve as executive VP for med tech international services at NSF International of Ann Arbor, Mich., addressed an audience at the 2017 annual meeting of the Regulatory Affairs Professional Society (RAPS), and she noted that the MDSAP administered by the International Medical Device Regulators Forum does not change regulatory requirements for device makers. Still, she said, "The biggest surprise is that you are actually audited for some requirements you have not traditionally been audited for."
Trautman said purchasing controls "will be touched on in every single MDSAP audit," including for initial certification and recertification, and for every surveillance audit as well. She said a failure to have procedures up to speed could have "huge consequences, especially for internal suppliers," adding that if a device maker and/or its suppliers are not up to speed on the latest edition of ISO 13485, "it will be exposed."
A recent meeting between participant device makers and auditing organizations disclosed a few interesting developments, but Trautman told the audience, "the shock factor came in from Australia." She said many device makers may never have seen an inspector from Australia's Therapeutic Goods Administration in person, partly because TGA now has far fewer than the 25 med-tech inspectors the agency once employed, and many devices are on the Australian market via a mutual recognition agreement revolving around the CE mark. Ergo, Trautman said, "There are a lot of Australian requirements . . . that you have not really had anyone checking specifically," a predicament that may lead to some difficulties for MDSAP audits that are geared toward compliance with TGA's mandates.
Trautman advised those in attendance that there are a number of converging timelines that will apply a lot of pressure on device makers doing business in multiple regulatory jurisdictions. Health Canada announced two years ago that device makers doing business in that nation will have to go through the MDSAP program, which converges with the timelines associated with the ISO 13485 quality management framework in a potentially nettlesome fashion. While the International Standards Organization decreed that the 2016 update to 13485 is not mandatory until March 1, 2019, MDSAP auditors may be looking for compliance with the latest edition at the beginning of that year. Hence, a device maker that has to demonstrate that its quality management system hews to the ISO standard might want to avoid waiting until the last minute to upgrade.
The World Health Organization is "actively participating as an observer" in the MDSAP program, Trautman said, adding that the Association of Southeast Asian Nations (ASEAN) is also interested in establishing how its member nations can make use of MDSAP audit reports. She said ASEAN is still working on its own set of medical device directives despite the seeming disappearance of any news on that front, adding that the U.K.'s Medicines and Health Care Products Regulatory Agency is cobbling together its own device-specific regulatory regime, necessitated by the Brexit. MHRA is working with the European Union and the FDA to keep things as tightly aligned as possible, but Trautman noted, "you can see this truly is a perfect storm" of converging regulatory timelines.
Consequently, any device maker that anticipates it will file an MDSAP certificate any time in the last quarter of 2018 may want to have the latest version of 13485 in place as of the date of that audit despite the existence of what seems a grace period. Otherwise, that company may face a large volume of regulatory headaches that could impede market access in a number of jurisdictions.
Trautman said the MDSAP mock audits are not entirely benign despite the innocent-seeming moniker, explaining that a violation disclosed in a mock audit that resurfaces in the real audit may appear on the inspection report as a repeat violation. However, a finding from any auditor in a previous non-MDSAP review will not be treated as a repeat finding in a full-blown MDSAP review.
MDSAP needs more industry participation
Patricia Murphy, director of the MDSAP program at BSI Group America of Herndon, Va., told attendees at RAPS 2017 that the number of device makers who have taken the MDSAP plunge has tripled in the past two years, but added, "that's not going to get us to where we need to be" to make the program a success.
The number of participating manufacturing sites has ballooned to 417, and Murphy said device makers are not uniformly prepared for MDSAP audits, although auditors have their own approaches to these audits. Murphy said some auditors are fairly rigid in terms of the sequence of events, while others are more flexible. An auditing organization (AO) may send only a single auditor or as many as four, a factor device makers must take into account when preparing for an MDSAP audit.
Murphy acknowledged that best practices are evolving at these AOs, and advised that MDSAP audits may include unannounced follow-up audits for problems disclosed in the first go-round. These audits are likely to entail a deeper dive into processes than has been the case up to now, Murphy said, noting that product risk will be the subject of greater focus going forward, although she did not specifically cite ISO 14971 in this context.
Murphy said the audit of a single-site manufacturer "is one we love to go on," a comment that drew laughter, but she ticked off several considerations that complicate multiple-site audits. Among these is the number of certificates the manufacturer wants to obtain from the audit, but she added that participating auditors may have to treat multiple sites separated by more than a kilometer as separate sites.
Published September 12, 2017