1 2 3 4 5 6 7

SG3(PD)/N18R8

8 9 10 11 12 13 14 15 16 17Title: Quality management system Medical Devices Guidance on corrective 18action and preventive action and related QMS processes 19 20 Authoring Group: Study Group 3 21 22 Date: 22nd September 2009 23 24 25 26 27 28 29 30 31 32 33

PROPOSED DOCUMENT
Global Harmonization Task Force

34 35
36 37 38 39 40 41 42 43 44 45 46 47

Table of Contents
Preface........................................................................................................................................................................3 1.0 Scope.....................................................................................................................................................................4 2.0 Definitions.............................................................................................................................................................5 3.0 Overview...............................................................................................................................................................6 4.0 Phase I: Planning ..................................................................................................................................................8 5.0 Phase II: Measurement and Analysis within and across Data Sources...............................................................11 6.0 Phase III: Improvement.......................................................................................................................................14 7.0 Phase IV: Input to Management..........................................................................................................................20 8.0 Annex A..............................................................................................................................................................21 9.0 Annex B..............................................................................................................................................................23 10.0 Annex C .....................................................................................................................................................24

1Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

2 48Preface 49The document herein was produced by the Global Harmonization Task Force, a voluntary group 50of representatives from medical device regulatory agencies and the regulated industry. The 51document is intended to provide non-binding guidance for use in the regulation of medical 52devices, and has been subject to consultation throughout its development. 53 54There are no restrictions on the reproduction, distribution or use of this document; however, 55incorporation of this document, in part or in whole, into any other document, or its translation 56into languages other than English, does not convey or represent an endorsement of any kind by 57the Global Harmonization Task Force.

September 23, 2009

Page 3 of 26

4Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

5 58Introduction 59This guidance document is intended for medical device manufacturers and regulatory authorities. 60It is intended for educational purposes and is not intended to be used to assess or audit 61compliance with regulatory requirements. It is expected that the reader is familiar with regulatory 62Quality Management System (QMS) requirements within the medical devices sector. 63 64For the purposes of this document it is assumed that the medical device manufacturer has a QMS 65which requires the manufacturer to have documented processes to ensure that medical devices 66placed on the market are safe and effective. For example ISO13485 Medical Devices Quality 67Management Systems Requirements for regulatory purposes, Japanese Ministerial Ordinance 68on Standards for Manufacturing Control and Quality Control for Medical Devices and in vitro 69Diagnostics (MHLW1 Ministerial Ordinance No. 169), and the FDA2 Quality System Regulation 7021 CFR Part 820. 71 72For this purpose the manufacturer will establish processes and define appropriate controls for 73measurement and analysis to identify nonconformities and potential nonconformities. The 74manufacturer should have established processes defining when and how corrections, corrective 75actions, or preventive actions should be undertaken. These actions should be commensurate with 76the significance or risk of the nonconformity or potential nonconformity. 77 78The acronym CAPA will not be used in this document because the concept of corrective action 79and preventive action has been incorrectly interpreted to assume that a preventive action is 80required for every corrective action. This document will discuss the escalation process from 81different reactive sources which will be corrective in nature and other proactive sources 82which will be preventive in nature. The manufacturer is required to account for both types of 83data sources whether they are of a corrective or preventive nature. 84 85Regardless of the nature of the data source, if there is a decision to escalate the information to 86further evaluation and investigation, the steps of investigation, identification of root causes and 87actions needed, verification, implementation, and effectiveness checks will be similar. 88 89This guidance document will describe measurement, analysis and improvement as complete and 90integrated processes. 91 92

1.0

Scope

93This document provides guidance for establishing adequate processes for measurement, analysis 94and improvement within the QMS as related to correction and/or corrective action for 95nonconformities or preventive action for potential nonconformities of systems, processes or 96products. 97 98 99
61 Japanese Ministry of Health Labor and Welfare 72 US Food and drug Administration

September 23, 2009

Page 4 of 26

9Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

10 100

2.0

Definitions

101The references to clauses in this section refer to ISO 9000:2005. 1022.1 103 104 105 106 1072.2 108 109 110 111 112 113 114 1152.3 116 117 118 1192.4 120 121 122 1232.5 124 125 126 127 128 129 130 1312.6 132 133 Correction Action to eliminate a detected nonconformity (3.6.2) Note 1 A correction can be made in conjunction with corrective action (3.6.5) Note 2 Corrections can be, for example, rework (3.6.7) or re-grade (3.6.8) Corrective action Action to eliminate the cause of a detected nonconformity (3.6.2) or other undesirable situation Note 1 There can be more than one cause for nonconformity Note 2 Corrective action is taken to prevent recurrence whereas preventive action (3.6.4) is taken to prevent occurrence Note 3 There is a distinction between correction (3.6.6) and corrective action Data Sources The processes within a Quality Management System that provide quality information that could be used to identify nonconformities, or potential nonconformities. Concession Permission to use or release a product that does not conform to specified requirements (3.6.11). Preventive action Action to eliminate the cause of a potential nonconformity (3.6.2) or other undesirable situation Note 1 There can be more than one cause for nonconformity Note 2 Preventive action is taken to prevent occurrence whereas corrective action (3.6.5) is taken to prevent recurrence Nonconformity Non fulfillment of a requirement (3.1.2)

September 23, 2009

Page 5 of 26

11

12Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

13 1342.7 135 136 137 138 139 140 141 142 143 144 145 1462.8 147 148 149 150 151 152 153

Verification Confirmation through provision of objective evidence (3.8.1) that specified requirements (3.1.2) have been fulfilled. Note 1 The term verified is used to designate the corresponding status. Note 2 Confirmation can comprise of activities such as: - performing alternative calculations, - comparing a new design specification (3.7.3) with a similar proven design specification, undertaking tests (3.8.3), performing demonstrations, and reviewing and approving documents prior to issue. Validation Confirmation through provision of objective evidence (3.8.1) that the requirements for a specific intended use or application have been fulfilled. Note 1 The term validated is used to designate the corresponding status. Note 2 The use conditions for validation can be real or simulated.

3.0

Overview

154The Management of any medical device manufacturer is ultimately responsible for establishing 155adequate processes for measurement, analysis and improvement within the QMS as related to 156correction and/or corrective action (action to prevent the recurrence) of nonconformities or 157preventive action (action to prevent the occurrence) of potential nonconformities of product or 158processes. 159 160A nonconformity as defined in 2.6 is a non fulfillment of a requirement. It is important to 161understand that requirements may relate to product, process or the QMS. 162 163When a nonconformity is identified, the manufacturer will determine the significance, risk of the 164nonconformity and the potential for recurrence. Once these have been determined the 165manufacturer may decide the nonconformity has little associated risk or is unlikely to recur. In 166such cases the manufacturer may decide only to carry out a correction. 167 168Should the nonconformity recur within the QMS, during manufacture or after the medical device 169has been delivered to a customer, it is an indication that improvement action is needed. In either 170case the QMS requires that corrective action should be carried out with the aim to prevent 171recurrence. The corrective action may be as simple as retraining, or as complex as redesigning 172the manufacturing process. 173 174The manufacturer may encounter situations that have not actually caused a nonconformity, but 175may do so in the future. Such situations may call for preventive action. Examples include: 176
September 23, 2009 Page 6 of 26

14

15Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

16 177 Corrective actions are taken within a QMS to eliminate observed nonconformities 178 (regardless of whether the actions are taken for more than one site or facility operating 179 within that QMS). Similar actions applied in another QMS (regardless whether it is the 180 same or a different manufacturer) that has not yet experienced these nonconformities, 181 would be considered preventive actions. 182 Production or acceptance testing trend data indicates that control limits are being 183 approached and revision of product or production (process, equipment or facilities) 184 requirements may be necessary. These revisions could constitute a preventive action. 185 Preventive action would not include planned process adjustments intended to return 186 process performance to nominal values from the edges of the process control range. 187 188Figure 1 illustrates typical Phases to be considered when planning, implementing and 189maintaining effective processes for measurement, analysis, improvement and providing input to 190management. 191 192The Management should ensure that measurement criteria are defined for identified data sources 193and communicated across the organization. 194 195As a check on the effectiveness of the processes defined, management should regularly review 196the outputs of processes and make adjustments as needed. 197 198Documented procedures, requirements and records should be maintained by the manufacturer to 199ensure and demonstrate the effective planning, operation and control of the processes. 200Documented evidence of decisions and actions taken will be a part of the QMS. 201

September 23, 2009

Page 7 of 26

17

18Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

19

202 204 205 206

Figure 1: Processes for measurement, analysis and improvement

4.0

Phase I: Planning

207The manufacturer is responsible for the implementation and maintenance of a QMS which 208enables their organization to provide safe and effective medical devices meeting customer and 209regulatory requirements. 210 211Implementing and maintaining an effective QMS is a responsibility of top management in an 212organization. The involvement of management at appropriate levels of the organization (e.g. 213review, approval) in actions taken in response to a nonconformity or potential nonconformity 214should be established. 215 216Risk Management activities are to include risk control and risk mitigation outputs should be 217considered throughout planning. 218 219 220

September 23, 2009

Page 8 of 26

20

21Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

22 2214.1 Planning for Measurement, Analysis and Improvement Processes 222Factors to consider during this planning phase should be aligned with the manufacturers overall 223business planning and as a minimum include the type of device being manufactured, intended 224markets and users, and regulatory requirements. As part of planning, management should review 225the processes critical to the operations with regard to quality and regulatory requirements and 226select relevant data sources to measure, analyze and facilitate improvement as necessary. 227 228In the process of planning, measurement and analysis, a manufacturer needs to take into account 229data sources, the measurement of the data elements within each data source, the frequency of 230monitoring, and the analysis to be performed within a data source, or across data sources. 231 232The measurement of data elements should be done in a way that ensures the organization will be 233effective in managing the operations and having an effective QMS. Each of the data elements 234should be planned and established with specific requirements for measurement that are 235monitored routinely. 236 237The scope of the QMS and the scope of the measurement, analysis and improvement processes 238will provide the boundaries as to whether the data source is reactive/corrective or 239proactive/preventive. 240 241The planning phase should ensure the following: 242 243 1. Identification of relevant internal and external data sources that are indicators of process 244 and product performance. 245 246 2. Provision for adequate resources and establish responsibilities and authorities to enable 247 the necessary actions. Resources may include technical experts, testing laboratories, data 248 management, infrastructure, training, etc. 249 250 3. Definition of requirements for each identified data source, including limits, acceptance 251 criteria, escalation criteria and mechanisms for reporting of nonconformities or potential 252 nonconformities. 253 254 4. Analysis of data elements within data sources. 255 256 5. Coordination and analysis of data across data sources. 257 258For each data element individual criteria should be defined, however criteria may be defined for 259a combination of data elements. Criteria should be quantitative whenever possible in order to 260maximize consistency and reproducibility for subsequent analysis. If the criteria and data are 261qualitative, subjectivity should be eliminated or minimized. 262 263Acceptance criteria should be based on system, product and process specifications or 264requirements which are typically identified during design and development activities. This 265includes the design of the Quality Management System, development and maintenance of 266assembly processes, delivery processes, servicing and installation processes.
September 23, 2009 Page 9 of 26

23

24Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

25 267 268Escalation criteria used for the purpose of initiating the improvement process (see 6 Phase III: 269Improvement) may often be called action levels, trigger points, thresholds, etc. In particular, 270criteria should be established for immediate escalation. These criteria would be identified from 271risk management activities. For new technology and existing technologies with new intended 272uses/applications, initial escalation criteria may be difficult to define for the monitoring process. 273Therefore a manufacturer should plan for resources to analyze information in order to confirm 274initial assumptions and establish or revise escalation criteria. 275 276 Planning should provide for confirmation that the defined limits, acceptance criteria, escalation 277 criteria and mechanisms for reporting of nonconformities or potential nonconformities for the 278 original data sources and data elements are still appropriate. Where new data sources need to be 279 established, confirm that they have been identified and their criteria defined. 280 2814.2 Establish Data Sources and Criteria 282The manufacturer should identify and document relevant data sources and their data elements, 283both internal and external to the organization. Data elements provide information regarding 284nonconformities, potential nonconformities and the effectiveness of the established processes 285within the data sources. Consideration should be given to the management review data and 286regulatory requirements. 287 288Examples of data sources can be, but are not restricted to: 289 290 Supplier 291 Performance/Controls 292 Complaint Handling 293 Adverse Event Reporting 294 Process Controls 295 Finished Product 296 Quality Audits (internal/external) 297 Product Recall 298 Spare Parts Usage 299 Service Reports 300 Returned Product 301 Market/Customer Surveys 302 Literature 303 Management Review 304 Product Realization (Design, Purchasing, Production and Service and Customer 305 information) 306 307For further examples of data elements see Annex A. 308 309When action taken is limited to the specific area where the data has come from, correction of a 310significant situation may be delayed. It is important that the manufacturer reviews the
September 23, 2009 Page 10 of 26

26

27Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

28 311information that is being identified across the organization. When the information is reviewed 312across data sources it is clear what needs to be done. A manufacturer should look for common 313factors across the data sources. Doing so will lead to an effective corrective action. 314 315 316

5.0 Phase II: Measurement and Analysis within and across Data Sources

317Once data sources, data elements and acceptance criteria have been specified, as part of the 318planning process, the manufacturer is required to perform measurement, monitoring and analysis 319processes to determine conformity or nonconformity. 320 321Software used in measurement, monitoring and analysis, whether purchased (Off-The-Shelf) or 322custom developed, should be validated for its intended use. 323 3245.1 Measurement 325For the purposes of guidance, measurement is a set of operations to determine a value of a data 326element (i.e. quantity, quality). 327 328Data collected from the measurement of product, process and QMS are acquired throughout the 329life-cycle of the product. The manufacturer should define for example frequency of the 330measurement, precision and accuracy of the data. The manufacturer should also ensure that the 331data collected is current and relevant. 332 333Measurement data should be retained as a quality record. The manufacturer should maintain the 334data in a form that is retrievable, suitable for analysis and meets both QMS and regulatory 335requirements. 336 337Monitoring is the systematic and regular collection of a measurement. The manufacturer should 338define during the planning phase what, when and how data should be monitored. The data should 339be defined such that it can be analyzed for further action. The monitoring of data may be 340continuous or periodic, depending on the type of data source and elements. The monitoring 341processes should be periodically reviewed for their continued suitability. 342 3435.2 Analysis 344For the purpose of this guidance Analysis is a systematic review and evaluation of data from 345measurements to derive a conclusion. 346 347The manufacturer should have documented procedures for the analysis of data against the 348established criteria. Analysis is performed to identify nonconformity or potential nonconformity 349or identify areas where further investigation should be initiated (see 5.2 Analysis). In addition 350analysis is used to demonstrate the suitability and effectiveness of product, process and QMS. 351Analysis can be performed utilizing analytical tools, a team of experts, process owners or
September 23, 2009 Page 11 of 26

29

30Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

31 352independent reviewers. The results of the analysis should be documented. 353 354After it is determined what will be measured, statistical techniques used should be identified to 355help understand variability and thereby help the manufacturer to maintain or improve 356effectiveness and efficiency. These techniques also facilitate better use of available data to assist 357in decision making. Statistical techniques assist in identifying, measuring, analyzing, interpreting 358and modeling variability. 359 360For the analysis of nonconformity, appropriate statistical and non-statistical techniques can be 361applied. Statistical techniques are for example: 362 Statistical Process Control (SPC) charts 363 Pareto analysis 364 Data trending 365 Linear and non-linear regression analysis 366 Experimental design (DOE Design of Experiments) and analysis of variance 367 Graphical methods (histograms, scatter plots, etc.) 368 369Non-statistical techniques are for example: 370 Management reviews 371 Results from quality meetings 372 Safety committees (internal or external) 373 Failure Mode and Effect Analysis (FMEA) 374 Fault Tree Analysis (FTA) 375 376Analysis will likely occur at several different points (time and/or organizational level). For 377example, a certain amount of analysis and possible failure investigation (where there is evidence 378of a nonconformity) will occur for each data source. 379 380In addition to the analysis within the data sources there should also be a level of analysis across 381data sources to determine the extent and significance of nonconformity or potential 382nonconformity. The linkage of data from different data sources will be referred to as horizontal 383analysis. The horizontal analysis may: 384 385 1. determine that the action proposed from the data source analysis is appropriate without 386 further progress into Phase III (see 6); or, 387 2. provide additional information warranting progress into Phase III (see 6 ), regardless of 388 whether the data source analysis escalated the nonconformity or potential 389 nonconformity. 390 391For example, the data source market/customer survey may indicate a general dissatisfaction with 392the performance of a kind of product. When investigated further and reviewed with other data 393sources such as complaints, returned product and if applicable, service reports, a significant 394nonconformity becomes evident in the product or family of products and for which corrective 395action is required. Thus, the necessary escalation to Phase III (see 6) for corrective action occurs. 396Integral to this escalation is the determination of the Scope of the investigation, including the 397determination of whether the nonconformity arises from a systemic issue.
September 23, 2009 Page 12 of 26

32

33Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

34 398

399 400 Figure 2: Outcomes of measurement and analysis 401 402The outcome of the analysis would lead to one of the following decisions (see Figure 2): 403 404 A. No correction required, continue measurement and monitoring 405 The decision is made not to take any correction nor escalate the handling of the 406 nonconformity to Phase III (see 6). 407 408 B. Correction required, continue measurement and monitoring 409 The decision is made to perform a correction but not to escalate the handling of the 410 nonconformity to Phase III (see 6). 411 412 C. Correction and escalation to further investigation under the improvement process. 413 The decision is made to perform a correction and to escalate the handling of the 414 nonconformity to Phase III (see 6). 415 416 D. Escalation for further investigation under the improvement process because there is not 417 enough information at this time to determine the required action. In addition there may be 418 predefined events that due to the significance of the risk will automatically be escalated 419 to Phase III without an immediate correction. 420 421 In the event a potential nonconformity is identified, it may be escalated into Phase III (see 422 6) for consideration of actions to prevent the occurrence of the potential nonconformity. 423 424For Options A, B and C, both the data source analysis and the horizontal analysis, continue to 425occur on a monitoring basis to ensure risk and frequency assumptions remain valid. 426 427For Options A and B the activities described in Phase III can be accomplished within certain 428processes (e.g. Change Management Process) if it is predefined and described in documented 429procedures. In addition there needs to be a process monitoring or analysis (i.e. trending) of the 430corrective actions to determine if additional escalation is necessary. Otherwise the activities in 431Phase III will be escalated as part of the improvement process. 432 433When a nonconformity or potential nonconformity is escalated into Phase III (see 6), the 434nonconformity or potential nonconformity will undergo additional analysis and possible 435investigation. 436 437Typically manufacturers have functional groups or processes surrounding some of their main 438data sources (e.g. Complaint Handling, handling of nonconformities, Material Review Boards,
September 23, 2009 Page 13 of 26

35

36Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

37 439Change Management Process). Within these functional groups or processes certain activities 440described in Phase III (see 6 Phase III: Improvement) can implement immediate corrections. 441These immediate corrections, or the decision to not implement an immediate correction, 442(described in Figure 2 - Options A, B and C) can occur without or before the escalation to Phase 443III as long as the functional groups or processes, and their documented procedures, clearly 444delineate and define the activities that can be accomplished without or before escalation to Phase 445III. 446 447As discussed above, when no correction or immediate correction are taken within these 448functional groups or processes, there needs to be data source monitoring and analysis (trending) 449to determine if escalation to Phase III may be necessary from accumulated information. 450Whenever an issue is escalated to Phase III, any information gained within the defined activities 451of these functional groups or processes should be fed into the Phase III activities such as 452Investigation (see 6.1) or Identified Actions (see 6.3) 453 454

6.0

Phase III: Improvement

455The improvement phase of a corrective action process or preventive action process is designed to 456eliminate or mitigate a nonconformity or potential nonconformity. 457 458The improvement activities are tailored to the specific nonconformity or potential 459nonconformity. The amount of work in Phase III is therefore dependant upon the risk and 460significance of the nonconformity or potential nonconformity. 461 462The improvement process and the activities described in Figure 3 shall be documented. 463Improvement generally involves the following activities that the manufacturer would take 464sequentially or sometimes simultaneously: 465 466 A thorough investigation of the reported nonconformity; 467 An in-depth root cause analysis; 468 Identification of appropriate actions; 469 Verification of identified actions; 470 Implementation of actions; and 471 Effectiveness check of implemented actions. 472 473

September 23, 2009

Page 14 of 26

38

39Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

40

474 475 476 4776.1 Investigate

Figure 3: Phase III - Improvement

478The investigation documentation should include a statement of the nonconformity expressed as a 479problem statement. In addition the documentation should include the extent of the nonconformity 480or potential nonconformity, the conduct of the investigation, the method, resources, timeframe 481and records to be used and generated. From the information obtained throughout the process the 482problem statement should be reviewed and refined as appropriate. 483 484The conduct of the investigation should: 485 Determine the extent of the nonconformity or potential nonconformity; 486 Acknowledge that there is likely to be several causes of an event, hence the investigation 487 should not cease prematurely; 488 Require that symptoms be distinguished from root causes and advocate the treatment of 489 root causes rather than just the symptoms; 490 Require that an end point be defined for the investigation. (An exhaustive investigation 491 may unduly delay the correction of non-conformity or unnecessarily incur additional cost. 492 For example; if removal of the causes identified so far will correct 80% of the effects 493 then it is likely that the significant causes have been identified (Pareto rule)) 494 Take into account the output of relevant risk management activities; 495 Agree on the form of evidence. For example, evidence should support: 496 - the seriousness of the event; 497 - the likelihood of occurrence of the event; 498 - the significance of the consequences flowing from the event; 499 500A recognized method for the investigation should include the collection of data and the 501organization of that data to allow analysis. The majority of time spent analyzing an event is spent 502in gathering data. 503 504The investigation should build upon any analysis, evaluation and investigation that were 505previously performed (see 5). This will require the investigator to identify, define and further 506document the observed effects / non-conformity, or already determined causes, to ensure that the 507investigator understands the context and extent of the investigation. It may be necessary to: 508 Review and clarify the information provided;
September 23, 2009 Page 15 of 26

41

42Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

43 509 Review any additional information available from an horizontal analysis; 510 Consider whether this is a systemic issue/non-systemic issue. 511 Gather additional evidence, if required; 512 Interview process owners / operators or other parties involved; 513 Review documents; 514 Inspect facilities, or the environment of the event; 515 516Previous investigations should be reviewed in order to determine if the event is a new problem or 517perhaps the recurrence of a previous problem where, for example, an ineffective solution was 518implemented. The following questions will assist in making the determination: 519 Is the nonconformity from a single data source? 520 Does the current nonconformity correlate with nonconformities from other data sources? 521 Are multiple data sources identifying the same nonconformity? 522 Do other nonconformities have an effect on the problem investigated here? 523The systematic recording of observations, and the relationship between observations, will 524support a cause and effect analysis, and will assist to identify gaps in an understanding of the 525nonconformity. 526 527Many of the tools used in investigations rely upon a cause and effect relationship between an 528event and a symptom of that event. To ensure that causes are identified, not symptoms, the 529following should be considered: 530 There must be a clear description of a cause and its effect. The link between the root 531 cause and the undesirable outcome needs to be described. 532 Each description of a cause must also describe the combined conditions that contribute to 533 the undesired effect. 534 Each deviation from a procedure should have a reason. Therefore the reason for the 535 deviation (root cause) should be identified, not just the symptom (occurrence of a 536 deviation). 537 A failure to act is only considered a cause if there was a pre-existing requirement to act. 538 The requirement to act may arise from a procedure, or may also arise from regulations, 539 standards or guidelines for practice, or other reasonably expected actions. 540 541Some of the more common tools and techniques include: 542 Cause and effect diagrams 543 5 whys 544 Pareto Charting 545 Fishbone cause and effect diagrams 546 Change analysis 547 Risk analysis techniques 549The outcome of an investigation should include: 550 Clearly defined problem statement 551 What information was gathered, reviewed and/or evaluated 552 Results of the reviews/evaluations of the information 553 Identification of possible root causes of the nonconformity or potential nonconformity
September 23, 2009 Page 16 of 26

44

45Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

46 554 555

Possible solutions to address the causes

5566.2 Identify Root Cause 557Causes of detected nonconformity or potential nonconformity should promptly be identified so 558that corrective action can be taken to prevent recurrence, or preventive action taken to prevent 559occurrence. The process to identify the root cause should start with the output(s) of the 560investigation (see 6.1). 561 562When assessing relevant data, the following should be considered: 563 564 Systematic generation of cause and effect conclusions supported by documented evidence 565 Evaluate significant or underlying causes and their relationship to the problem 566 Ensure that all causes are identified, not the symptoms 567 Check for more than one root cause (above processes if necessary) 568 569Causes of nonconformities or potential nonconformities may include the following: 570 571 Failure of, or malfunction of, incoming materials, processes, tools, equipment or facilities 572 in which products are processed, stored or handled, including the equipment and systems 573 therein; 574 inadequate or non-existent procedures and documentation; 575 non-compliance with procedures; 576 inadequate process control; 577 inadequate scheduling; 578 lack of training; 579 inadequate working conditions; 580 inadequate resources (human or material); 581 (inherent) process variability. 582 583For further details on aspects to be considered when doing the root cause analysis see Annex B. 584 585The output of the root cause analysis should be a clear statement of the cause(s) of the 586nonconformity. 587 5886.3 Identify Actions 589Once the root cause(s) has been determined, the manufacturer should identify and document the 590necessary corrections and/or corrective actions or preventive actions. These should be reviewed 591to ensure that all necessary actions are identified. This review may benefit from a cross 592functional approach. 593 594The following outcomes are possible and should be documented: 595
September 23, 2009 Page 17 of 26

47

48Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

49 596 1. No further action necessary. 597 (provided that no safety issue exists and regulatory requirements are met) 598 a. With continuous monitoring 599 b. Acceptance under concession and continuance of monitoring 600 601 2. Corrections or additional corrections. 602 It may be necessary to take immediate or short term corrections (e.g. containment, stop of 603 shipment/supply, issuance of advisory notice) in order to address an immediate risk or 604 safety issue. This may be necessary before investigation has been completed and root 605 cause has been determined. However, after investigation and root cause determination, 606 additional and/or possibly different corrections may become necessary. 607 608 3. Corrective Actions 609 Corrective actions must encompass the need to correct the nonconformity and in addition 610 address systemic problems. Changing and training of personnel to a new procedure may not, 611 by itself, be appropriate or sufficient to address all identified root causes. 612 613 4. Preventive action 614 By its very nature preventive action can not follow a nonconformity. 615 616As a result of this step, a list of action items to address the root cause(s) should be documented. 617These would typically include: 618 619 Detail method of implementation; 620 Applicable regulatory requirements; 621 Identification of the responsibilities during execution; 622 Identification of the necessary resources, including the human resources; 623 Verification and/or validation protocols of the action(s) with acceptance criteria; 624 Implementation schedule, including timelines. 625 Method or data for the determination of effectiveness 626 Identify the starting point of monitoring, and end point of correction and/or corrective 627 action or preventive action as described above 628 6296.4 Verification of identified actions 630Before the implementation of action(s), a manufacturer should verify the identified action(s) and 631approve their implementation. In addition validation may be required where process validation or 632re-validation may be necessary, or where user needs or intended uses are changed and design 633validation will be required. The decision as to the necessity for validation is influenced, among 634other things, by the risk associated with the nonconformity, the complexity of the corrective or 635preventive action, and the costs associated with the implementation of the corrective or 636preventive action. 637 638Verification activities are to ensure that all the elements of the proposed action (documentation, 639training etc) will satisfy the requirements of the proposed action (see 2.7). These activities should 640be performed by persons who are knowledgeable in the design or use of the product or process
September 23, 2009 Page 18 of 26

50

51Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

52 641that is the subject of corrective or preventive action. Verification of a preventive action can be 642accomplished by introducing the conditions that would induce a nonconformity and confirming 643that the nonconformity does not occur. 644 645Validation activities generate data and information that confirm the likelihood of the 646effectiveness of the corrective action to eliminate the nonconformity or proposed 647noncomformity. 648 649Examples of items to be considered when planning the verification / validation activities include: 650 651 Does the action(s) eliminate the determined root cause(s)? 652 Does the action(s) cover all affected products/processes? 653 Does the action(s) adversely affect the final products? 654 Is it possible to finalize the actions timely in planned schedule 655 (resources, materials/kits, logistics, communications, etc.)? 656 Is the execution of the action commensurate with the degree 657 of risk previously established? 658 Are new risks or nonconformities derived from the action? 659 6606.5 Implement Actions 661 662The following items that may be considered at implementation should be documented: 663 parties involved, 664 materials, 665 processes, 666 training, 667 communications, 668 tools and 669 timelines for the implementation of the approved action. 670 671Verify that the implementation has been completed.
672

6736.6 Determine Effectiveness of Implemented Actions 674The manufacturer should gather data over a period of time related to the effectiveness of the 675implemented action. The manufacturer confirms that actions taken were effective as to the 676intended purpose of the action and did not introduce new issues or concerns. 677 678If the manufacturer finds the actions are not effective, the manufacturer should re-initiate Phase 679III activities (see 6). If the manufacturer finds the actions create a new issue or a new 680nonconformity then the manufacturer needs to initiate Phase II (see 5 ) activities.
681

September 23, 2009

Page 19 of 26

53

54Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

55 682

7.0

Phase IV: Input to Management

683Management at different levels in the organization should be involved in each improvement 684action either through approval of the improvement steps or reporting. The Management Review 685is the overall mechanism for management to ensure that the Quality Management System as a 686whole is effective.
687

6887.1 Reporting to Management 689The manufacturer should have a mechanism/procedure that expeditiously raises safety related 690issues or other high risk issues to management. These issues can be identified in the data sources, 691the improvement process (see 6), or originate from other sources external to the Quality 692Management System. In addition to this expeditious escalation mechanism, the manufacturer 693should define the management responsibilities (i.e. process owner) of the measurement, analysis 694and improvement processes to ensure that the processes and the actions being implemented are 695effective. For this purpose there needs to be a mechanism for management at different levels to 696stay informed of the information or data from: 697 698 the measurement and analysis activities from the individual data sources; and 699 the investigations, actions, implementations, etc. from the improvement process 700 7017.2 Management Review 702The manufacturer has procedures for what is provided as input for the management review, 703including relevant information from the improvement process, such as improvement actions 704(corrective actions, or preventive actions) as well as important corrections. 705 706The manufacturer needs to define what meaningful data is to be reported for a management 707review. Data should be specific to the quality objectives of the manufacturer and be reported 708regularly. Merely providing the number of improvement actions or the number of how many 709improvement actions are opened or closed to the management review process are not sufficient 710in assessing the effectiveness of the processes. 711 712Included in this review would be an assessment of any opportunities for improvement of the 713device, manufacturing process, QMS or the organization itself. 714 715An outcome of the review could be the allocation of funding or personnel to a particular area, 716project or device that the review has identified as not meeting customer and regulatory safety and 717effectiveness expectations. 718 719 720 721 722 723 724
September 23, 2009 Page 20 of 26

56

57Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

58 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742

8.0

Annex A

743Examples of data sources and their data elements can be, but are not restricted to: 744 745
DATA SOURCES Supplier Performance/Controls DATA ELEMENTS Number of batches received Batch and/or shipment Inspection and test records Quantity of rejects or deviations Reason for rejection By supplier, if more than one supplier Use in which product or service Supplier problems Quantity By product family By customer (physician, healthcare facility, patient, etc.) Reason for complaint Complaint codes Severity Component involved Event Quantity By product family By customer (physician, healthcare facility, patient, etc.) Type of event (death or serious injury, etc.) Component involved By product
Page 21 of 26

Complaint Handling

Adverse Event Reporting

Process Controls
September 23, 2009

59

60Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

61
Operator Work shift Equipment and/or instruments used Inspection and test records In-process control results Process control parameters Inspection process Final acceptance Rejects Special process Validation study results Process monitoring observations Inspection and test records Observations (number, category, corporate policy, regulatory requirements, significance, etc.) Repeat observations (indicative of effectiveness) Closure times Overall acceptability of contractor or supplier Compliance to audit schedule Audit personnel Recall report DATA ELEMENTS Frequency of replacement Batch number of spare part By supplier of spare part, if more than one supplier By customer By location or area of customer Installation First use of equipment Frequency of maintenance visits Types of repairs Frequency of repairs Usage frequency Parts replaced Service personnel Quantity Reason for returning product By customer Types of defects identified on returned product Customer preferences Customer service response time Solicited information on new or modified products Published reports of failures of similar products Management review output Design and development review results
Page 22 of 26

Finished Product Quality Audits (internal/external)

Product Recall DATA SOURCES Spare Parts Usage

Service Reports

Returned Product

Market/Customer Surveys Literature Management Review Product Realization

62

63Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

64
( Design, Purchasing, Production and Service and Customer information) Verification of design and development to ensure output meets input requirements Validation results Design and development changes (reason or cause for change) Where changes effective Note; each of the above has specific data that is generated from performing the activities as a result the data should be monitored and results reviewed on a regular basis to ensure the processes and the product are effective. Purchasing- Supplier controls Controls on purchased products or services (See above Supplier Performance/Controls) Verification results of purchased product Inspection and testing data of purchased product Production and Service processes- Cleaning operations of product and facilities Sterilization Installation results Servicing and Maintenance if required (See also: Service Reports) Verification and Validation results of processes used in production and service. Including approval of equipment and qualification of personnel Traceability Data Controls of monitoring and measuring devices Calibration and maintenance of equipment Customer Information- New or repeat customer Customer feedback maybe in other forms than complaints or returned product (Customer Service call data, repeat sales , delivery/distribution data)

746 747

9.0

Annex B

748Checklist for aspects to be considered when doing the root cause analysis: 749 750Materials 751 Defective raw material (does material meet specification?) 752 Batch related problem 753 Design problem (wrong material for product, wrong specifications) 754 Supplier problem (lack of control at supplier, alternative supplier) 755 Lack of raw material. 756 757Machine / Equipment 758 Incorrect tool selection suitability 759 Inadequate maintenance or design calibration? 760 Equipment used as intended by the manufacturer? 761 Defective equipment or tool 762 End of life? 763 Human error inadequate training? 764
September 23, 2009 Page 23 of 26

65

66Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

67 765Environment 766 Orderly workplace 767 Properly controlled temperature, pressure, particulate, cleanliness 768 Job design / layout of work 769 770Management 771 Inadequate management involvement 772 Stress demands 773 Human factors 774 Hazards not properly guarded 775 Were management informed / did they take action? 776 777Methods 778 Procedures not adequately defined 779 Practice does not follow written method 780 Poor communications 781 782Management system 783 Training or education lacking 784 Poor employee involvement 785 Poor recognition of hazard 786 Previous hazards not eliminated 787 788Measurement, monitoring and improvement 789 Inadequate measuring and improvement 790 791 792

10.0

Annex C

793List of Activities corresponding to phases in the processes 794 795The following is an outline / aid memoir of the main points described in SG3 N18. It is not 796intended as a box ticking exercise and should not be used as such, but used purely to 797summarise and align the steps in the process described in N18. The activity numbers do not 798imply sequential steps some steps may take place in parallel. 799 800Steps 20 to 22 are not described in N18 but are added as reminders of general management 801responsibilities in this area of the QMS. 802 PHASE ACTIVITIES 1 Planning 1. Identify all data sources (internal & external) by product type (Clause 4.1) 2. Identify resources required and individual personnel responsibilities for measuring each data source (Clause 4.1)
September 23, 2009 Page 24 of 26

68

69Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

70 PHASE ACTIVITIES 3. Define the requirements for each data source and the data elements within each data source that will be measured, and analysed (Clause 4,1) 4. Define requirements for escalation to the Improvement process (Clause 4,1) 5. Define requirements for monitoring the measurements in the data sources (Clause 5.1 6. Establish data sources (Clause 4.2) 7. 8. 9. 3 Improvement Measure and analyse all data sources for nonconformities and potential nonconformities (Clauses 5.0, 5.1 and 5.2) Have reports of nonconformity or potential nonconformity come from more than one data source? Is the nonconformity or potential nonconformity systemic?

2 Measuring and Analysis

10. Determine scope and required outcome of investigation (Clause 6.1) 11. Investigate nonconformity or potential nonconformity (Clause 6.1) 12. Analyse nonconformity or potential nonconformity for root cause(s) (Clause 6.2) 13. Identify actions ( correction, corrective action or preventive action) (Clause 6.3) 14. Verify proposed actions before implementation (Clause 6.4) 15. Implement proposed actions (Clause 6.5) 16. Determine effectiveness of actions (validate if possible) (Clause 6.6) 17. Report investigation and outcome to management (Clause 7.1) 18. Review investigation, analysis and outcome and sign off (Clause 7.2) 19. If not satisfied return to step 10 20. If required, report to regulator (note: reporting may be required earlier depending on severity) 21. Audit system at determined intervals 22. If numbers of nonconformities or potential nonconformities exceeds targets, review
Page 25 of 26

4 Management

September 23, 2009

71

72Guidance on corrective action and preventive action and related QMS processes

SG3(PD)/N18R8

73 PHASE 803 ACTIVITIES all QMS processes

September 23, 2009

Page 26 of 26

74