Risk Management an “Ever-Evolving Responsibility”: Thomas

CDRH associate director for compliance and quality Keisha Thomas told the RAPS Quality Conference that medical device companies need to treat risk management as an ever-evolving responsibility. Her presentation covered FDA’s new compliance program under the new Quality Management System Regulation, according to a RAPS online post.

“Our inspection approach is risk-based, not only the selection model for determining who gets inspected, but also the approach itself,” Thomas said. She noted that element selection is based on firm-specific risks. Investigators also review pre-inspection information, such as medical device reports, recalls, and complaints, and there are no standardized sampling tables.

Based on the latest inspections and form FDA-483s, Thomas said the top QMSR issues cited against firms are risk management, followed by corrective action, risk-based approach, complaint handling, and purchasing process. She noted that it’s a little early to draw any conclusions about trends, but said the agency is seeing the same citations it saw before QMSR was implemented, although in a different order.

In terms of risk management, RAPS says, Thomas reported that investigators are citing firms for a lack of processes and evidence that demonstrate that risk management is rooted in their decision-making. She said they are finding that companies may have risk management files and processes, but aren’t applying them holistically or systematically across all QMS areas.

One attendee noted that it’s been difficult to define risk for every QMSR area at their firm and asked how they should approach the issue, RAPS reports. The post says Thomas said that while FDA hasn’t stated an explicit regulatory requirement in the past to consider risk in every category, the agency expected companies to treat each category that way. With that in mind, she emphasized that risk shouldn’t be treated as a single incident but rather as something that constantly evolves as part of the company’s quality management.

“Your risk management system should be fluid, living, breathing, moving, evolving constantly; it should be in a state of continuous improvement all the time, because there are risks introduced, whether it’s system risk, whether it’s product risk, whether it’s clinical risk, those things are there,” said Thomas. “It should be fluid and evolving, and I think that’s the message that you take back.”