QSR Q&A: 5 Top Medtech Experts Answer 6 Burning Questions About FDA’s Coming Quality Reg Redo

Medical device manufacturers and other industry stakeholders are waiting for the draft harmonized Quality System Regulation from the US Food and Drug Administration with breath that is bated. The agency has been working on the QSR redo – which better aligns the decades-old rule with international quality systems standard ISO 13485:2016 – for more than three years now.

The draft QSR, which will become the bedrock rule for manufacturing safe and effective devices in the US when finalized, is expected to come this year. (Also see "After QSR Delays, ‘It’s Full-Steam Ahead With That Proposed Regulation,’ FDA’s Shuren Vows" - Medtech Insight, 6 May, 2021.)

In the meantime, Medtech Insight rounded up a handful of top medtech experts to answer six questions about the upcoming draft regulation, including:

• Vincent Cafiso, senior director of regulatory compliance & global audit at device maker Smith & Nephew;

• Kwame Ulmer, principal consultant at Ulmer Ventures and cofounder of MedTech Color;

• Kim Trautman, longtime medical device, IVD and combination product expert, and an ex-FDA official who was the lead author of the current Quality System Regulation (21 CFR Part 820) in the 1990s;

• Josh Levin, director of quality assurance and regulatory affairs at device company ASELL LLC; and

• Steve Niedelman, lead quality systems and compliance consultant at the law firm King & Spalding, and a 34-year veteran of the FDA.

The questions and answers are below. Trautman and Niedelman were interviewed by Medtech Insight, while Cafiso, Ulmer and Levin provided written responses.

Vincent Cafiso

Is there anything specific you’re hoping to see in the new draft QSR rule?

Vincent Cafiso: Yes, [I’m] hoping to see complete alignment with ISO 13485:2016! Also, it would be excellent to see FDA’s acceptance of notified body audits to satisfy FDA inspectional requirements (akin to the MDSAP [Medical Device Single Audit] program).

What sections of the current Quality System Regulation do you believe will be most impacted by the harmonization with ISO 13485?

Cafiso: Since the concept of “risk” is not addressed within the QSR (except for one mention in Sec. 820.30 [g]), the following sections will need to be revised to incorporate risk management in accordance with [international risk management standard] ISO 14971: definitions, quality system, management responsibility, quality audit, design controls, purchasing, receiving/in-process/finished device acceptance, process validation, and training.

Vincent Cafiso

Do you have any concerns about the forthcoming draft rule?

Cafiso: No concerns other than the lack of transparency around the timing of its release.

How are you as an industry expert preparing for the draft rule?

Cafiso: At this point [I’m] trying to stay abreast of the timing so when the rule is published [I] can assess potential QMS [quality management system] impacts.

What are one or two ways device manufacturers can prepare for the eventual rule?

Cafiso: [Companies that don’t follow ISO 13485] in particular should perform thorough gap assessments of their current non-13485-certified QMS against the requirements of the current ISO 13485 standard. Most likely, even full compliance to 21 CFR Part 820 will mean these gaps will be considered noncompliances against the new rule. Would be best [for companies] to establish a quality plan to comply fully with ISO 13485 to get a head start to compliance with the new rule. 

Looking down the road a bit, how much time do you think industry will need to comply with a final rule, and what type of enforcement do you foresee from the FDA once the rule is implemented?

Cafiso: If firms proactively perform thorough gap assessments and establish quality plans as mentioned above, there should not be a long process to comply. As with any new regulation, waiting until the rule is published will put firms behind. From gap assessment to full compliance (assuming starting with full compliance to 21 CFR Part 820) should not be more than one year depending on resources/size of operation to revise procedures, perform personnel training, and then perform a full, independent cycle of internal audits against the new rule. 

As for enforcement, aside from a standard inspection of the revised QMS against the requirements of the new rule, 483 [the FDA-483 inspection observation form], WL [warning letter], et cetera, if there are expectations on firms to perform gap assessments to legacy quality records (process validations, device acceptance, training and design history files especially) this will certainly add to the complexity and duration of the project, and depending on FDA’s expectations could take inspections and enforcement actions in a new direction. Also, if legacy documentation is expected to comply, will this impact current market approval status if noncompliances are found? 

Kwame Ulmer

Is there anything specific you’re hoping to see in the new draft QSR rule?

Kwame Ulmer: I'm interested in the more granular requirements in general, and specifically the increased accountability for senior leaders during management review found in ISO 13485. The responsibility for leaders to be fully engaged in product development can dramatically and positively impact compliance and quality. The need for clinical support to staff clinical evaluation and validation is something emerging companies may struggle with at first.

What sections of the current Quality System Regulation do you believe will be most impacted by the harmonization with ISO 13485?

Ulmer: Increased management responsibility for corrective actions performed in a timely manner will be a clearer leading indicator and has the potential to decrease future internal and external audit findings.

Kwame Ulmer

Do you have any concerns about the forthcoming draft rule?

Ulmer: In general, the increased requirement for written quality agreements with suppliers is good. However, it needs to be calibrated commensurate with the risk and tier of the supplier. The harmonization has the opportunity to address digital health solutions in more detail, yet be flexible enough to allow further development as the FDA continues to refine it's thinking on regulation of SaMD [software as a medical device].

How are you as an industry expert preparing for the draft rule?

Ulmer: I take a two-pronged approach: First, I remained focused on the core elements of the QSR that drive quality and are the most frequent subject of inspection (for example, CAPAs [corrective and preventive actions] and complaints), and second, I help companies interpret the FDA regulatory framework, QSRs and ISO 13485 for digital health solutions.

What are one or two ways device manufacturers can prepare for the eventual rule?

Ulmer: First, develop a tiger team of quality and regulatory staff and prepare template SOPs [standard operating procedures] for drafting and identifying the SOPs that need updating; second, draft internal training after the FDA training is promulgated; and third, Incorporate a regulatory intelligence scan into the company's regular cadence of activities.

Looking down the road a bit, how much time do you think industry will need to comply with a final rule, and what type of enforcement do you foresee from the FDA once the rule is implemented?

Ulmer: I envision a transition period of three to 12 months for companies to update their quality management system while the regulation is draft or final. The final rule may include a grace period, where it will go into effect after a set number of months. The FDA will roll out training and we will see fewer 483s associated with this rule in the first year as the FDA trains its investigators and companies get used to expectations associated with the harmonized regulation. In short, regulatory leaders should plan for a one- to two-year transition. Companies should proactively update and internally audit prior to FDA virtual or in-person audits.

Kim Trautman

Is there anything specific you’re hoping to see in the new draft QSR rule?

Kim Trautman: I think there are areas that are well harmonized and remain well harmonized. For example, in the design and development control section, that’s pretty good. There might be some additions on the interactivity between different parts that are in ISO 13485 that are not as explicit. But for the most part, design and development is still very nicely harmonized.

The one area I would really like to see separated out better is the separation of corrective action and preventive action, and a better laying out of the measuring, analysis and escalation as to what has to be – or should be – escalated up to the improvement process. That whole concept, which was subsequently in the GHTF guidance document and articulated in 13485, is something that industry and regulatory authority auditors continue to struggle in implementing and evaluating and enforcing those requirements. So that is the key area – the whole concept of CAPA. I know many of us old-school people would like to throw that “CAPA” term out the window to get rid of some of the preconceptions, and some of the ill-conceived conceptions, and to really flesh that out better. And I think 13485 has a framework that allows for improvement, as compared to back when I wrote it, and I was harmonizing against [international quality management standard] ISO 9001:1994, which had the two sections combined. And we’ve seen 20-plus years later how that hasn’t necessarily played out as well as we had hoped.

Kim Trautman

What sections of the current Quality System Regulation do you believe will be most impacted by the harmonization with ISO 13485?

Trautman: Again, that measuring, analysis and escalation to an improvement process, versus just the old Sec. 820.100, corrective and preventive action – I think that’s where the biggest change can be achieved from a harmonization perspective.

There are things I know from having done this 20-some years ago that the FDA won’t be able to change because of aspects that are predicated in law – the Food, Drug, and Cosmetic Act, as well as other laws. So terms like “record,” which is based in US law as the big broad term – a record is basically anything and everything, where in ISO 13485, documentation is conceptually more procedures, and records are more the recording of the results. That terminology harmonization will likely not be possible by FDA because of other legal reasons within US law.

Do you have any concerns about the forthcoming draft rule?

Trautman: Always. Whenever you open any regulation, as much opportunity as there is to further harmonize – and this is the standard too, so it’s an equal concern every time ISO 13485 is revised – you have the opportunity to either do better in harmonization, or you can have divergence – and sometimes unintended divergence. So my hope is that the agency gets good, thorough comments back when the draft is published from those of us who will analyze it, to try to make sure that it is all toward the positive, toward the harmonization and convergence side. And if there are really good reasons as to why those convergences can’t be obtained, then that’s where the next preamble will be really, really important to explain those reasons and rationales.

How are you as an industry expert preparing for the draft rule?

Trautman: As an expert I continue to hone my quality management system knowledge against the consolidation of the MDSAP consortium and not just focus on any one particular jurisdiction, so I’m not preparing anything specifically for the US change in 820.

What are one or two ways device manufacturers can prepare for the eventual rule?

Trautman: First of all, a draft regulation is just that, and it’s not enforceable. So there’s nothing industry can and has to do right now to prepare for a draft regulation. If you want to anticipate, you can anticipate by making sure that you’re compliant with QMS requirements that are the consolidation of MDSAP.

If companies have focused on the conglomerate of requirements for MDSAP, that’s where they need to continue to focus, and the revision to 820 will inherently fall into place within that realm. And if there are differences, I think they will be very, very specific for very specific regions that won’t necessarily conflict or cause industry major heartache. So if companies are focusing on the consortium of requirements under the MDSAP program, I think they will be fine going forward.

Other than that, industry is not preparing. Their focus is really across the pond in coming up to  the new requirements of the [EU’s new Medical Device Regulation], and until there’s a [QSR] draft on the street, people aren’t even worrying about it, to be quite frank.

Looking down the road a bit, how much time do you think industry will need to comply with a final rule, and what type of enforcement do you foresee from the FDA once the rule is implemented?

Trautman: Under the assumption that FDA is successful in their intended purpose of further harmonizing 820 to match 13485, then industry should need little time to transition. I think the transition time needed will be greater within FDA. There are literally so many documents that have to be updated, even if it’s just tweaking guidances to have certain references, et cetera, et cetera. So there are a lot of documents that will need to be reviewed and possibly revised. The compliance program will have to be reviewed and possibly revised, depending on the changes. Guidances like the guidance on what to in a PMA for your quality management system section. In addition to the training and rolling out in a consistent manner to this whole inspectorate, the new requirements, that’s where there’s going to be more time needed and training needed, and it’s going to be on the FDA side more than on the industry side.

From an enforcement perspective, you have seen a trend over the past seven-plus years of a decrease in enforcement side – not necessarily the pharma side. FDA articulates that they’re using other means like regulatory meetings and so forth that are not as visible to the general public as warning letters, but it will be interesting to see. But I don’t see any indication at this time with the current administration and leaders of that drastically changing.

Josh Levin

Is there anything specific you’re hoping to see in the new draft QSR rule?

Josh Levin: I’m primarily concerned with how the new draft QSR rule will be implemented in terms of the new QSIT [Quality System Inspection Technique] process. FDA has been very transparent about the QSIT process under 21 CFR 820. What changes can manufacturers expect when FDA inspects to the ISO 13485:2016 standard? How will this change when the ISO standard is revised?

What sections of the current Quality System Regulation do you believe will be most impacted by the harmonization with ISO 13485?

Levin: Several systems have additional specified requirements under ISO 13485 as compared to the QSR, including management review, design inputs (which has an explicit requirement for inputs from risk management under ISO 13485), and complaint handling. The device master record – DMR – is now defined as the medical device file under ISO 13485. It’s not clear how 21 CFR 803 [for Medical Device Reporting] and 806 [for recalls] will be impacted. And of course a quality manual will now be required.

Josh Levin

Do you have any concerns about the forthcoming draft rule?

Levin: As mentioned above, my most significant concern is how ISO 13485 will be implemented from an FDA inspectional perspective and how different this will be from current ISO registrational audits.

How are you as an industry expert preparing for the draft rule?

Levin: I am encouraging my company, and companies that I advise, to build their FDA-compliant QMS to also be consistent with ISO 13485 to the extent possible.

What are one or two ways device manufacturers can prepare for the eventual rule?

Levin: The best way to prepare for the rule is to familiarize yourself with ISO 13485 and upgrade your QMS to be consistent with the standard to the extent possible.

Looking down the road a bit, how much time do you think industry will need to comply with a final rule, and what type of enforcement do you foresee from the FDA once the rule is implemented?

Levin: In general, I don’t think there are large differences between the current QSR and ISO 13485. However, I would expect the intensity level of FDA enforcement of ISO 13485 to be much more significant than the oversight currently provided by the notified bodies. I would expect more 483 findings and warning letters in the near future until things shake out a bit and industry becomes more comfortable with the ISO 13485 requirements.

Steve Niedelman

Is there anything specific you’re hoping to see in the new draft QSR rule?

Steve Niedelman: I hope for the sake of clarity that there’s sort of a side-by-side comparison so people can relate to what they have been doing under 820 and how they would comply under the ISO requirements. A side-by-side comparison so industry – and FDA I might add, FDA being the investigators – all are baseline with the same interpretation of what the expectations are. I think it’s only fair to do that. I think there are independent parties that are going to do that, but at the same time I think it would be fair for the agency to sort of show where the equivalencies are. Are there any gaps that need to be addressed, and if so, where they are.

What sections of the current Quality System Regulation do you believe will be most impacted by the harmonization with ISO 13485?

Niedelman: I think the biggest difference has always been in the complaint area – the complaint investigation side. But the MDR [Medical Device Reporting] has strengthened some of this stuff too, so I don’t know at the end of the say that there will be too many challenges. Let’s look at this realistically: Industry has been complying with ISO for the sake of notified bodies, and increasingly more are MDSAP-accredited firms. Industry has been playing more and more in the international space and are more familiar with ISO than they were more than a decade ago. And they’ve been compliant for the sake of getting their CE mark.

Steve Niedelman

I think there’s shouldn’t be too much of a challenge traversing between the two. Like I said, historically complaint investigation has been one of the soft areas, but overall I don’t think there should be too many huge impacts.

Do you have any concerns about the forthcoming draft rule?

Niedelman: How much time are they going to give for implementation? Will they give them the opportunity for a soft landing when it becomes implemented, or are they going to be aggressive – sort of like the MDR [EU’s Medical Device Regulation] is doing [where] there is no grace period? There is no grandfathering. Will FDA accept grandfathering on certain things? Are firms going to have to go back and redo certain things or it going to be from this point forward? Are there any changes that are necessary to comply with ISO?

Those are the kinds of things that manufacturers need to be articulate about.

How are you as an industry expert preparing for the draft rule?

Niedelman: At King & Spalding we’re prepping by becoming much more familiar with ISO 13485, although most of us already are. We’re getting our hands in developing some side-by-sides so we can provide guidance to our clients and show them the similarities and where the differences are, to show how they can comply at least in the interim on both sides and be prepared. We’ve been preparing firms for MDSAP audits for a long time, so we are pretty well positioned, but we continue to fine-tune and always look for new avenues to make that transition even smoother.

What are one or two ways device manufacturers can prepare for the eventual rule?

Niedelman: They should start becoming more familiar with ISO 13485. They should start attending training if they’re not already familiar with it. A lot of industry is already playing in this space, but if they are uncomfortable, there are training courses that are available. They also should become more conversant in terms and terminology. And doing mock audits and gap assessments will be critical for some firms, and it’s something we would strongly suggest.

Looking down the road a bit, how much time do you think industry will need to comply with a final rule, and what type of enforcement do you foresee from the FDA once the rule is implemented?

Niedelman: Industry is probably better prepared for this than FDA will be prepared? Their investigators need to learn how to do an ISO audit compared to a quality system audit. I think that’s a factor that will probably take longer than industry, based on the scope and volume of industry already playing in the globalized environment. I think an FDA investigator will now have to do an ISO 13485 audit, and I think there’s going to be a learning curve associated with that. So I don’t think people should be dismissive of understanding that. There’s a little bit on both sides of the street. And that’s why I think there’s value in what I’m calling a cross-reference checklist between the two [the QSR and ISO 13485] so everybody on both sides of the coin are baseline as far as understanding 13485 in the same vein.

You also have to consider that while most firms are in a globalized environment, many aren’t. A lot of small mom-and-pops may not be, and that is a large percentage of the industry. I would think they would need two or three years to comply. I think FDA has shown historically that they have patient when new regulations do evolve and I would imagine there would be several bites at the apple before enforcement does kick in. Unless there is something of imminent public health or imminent concern, I think there would be opportunities for voluntary compliance given by the agency. And I would hope that would be articulated somewhat in the draft rule.