The Many Faces of Audits

Hello, and welcome to today's webinar. I'm Sean Smith, publisher of Medtech, leading voice. Today's Webinar is the many faces of audits with our subject matter. Expert Michelle Lott. Few housekeeping notes for everybody recording and slides will be made available to all registrants. Also an all new quality guide and checklist are available only to registrants of this webinar. So if you would like a copy of it, please write Guide, and put it in the in the chat, and we will make sure that you get a copy of the New Quality Guide and Checklist Certificates of attendance will be available. Upon request to get a certificate of attendance. Please put your name as it should appear on the certificate along with your email address in the chat, not in the Qa. In the chat. So, as I said, today's subject matter expert is Michelle Lott, founder and principal of lean Raqa.

If you have questions at any time during this call, please feel free to put them in the Q&A section. Use the chat. If you'd like to comment or request your certificate of attendance again slides and replay will be sent out tomorrow to everyone who's registered. In the event that you missed yesterday's webinar surprise IoT medical device. surprise IoT medical device, or both. What you need to know about any medical device with software. I will provide the replay link and the pass code to that as well as the link to the slides. Join us tomorrow for medtech leading voice exchange, where we're going to have a Prrc. That's person responsible for regulatory compliance Mini masterclass featuring, featuring Ronald Bowman's. That's tomorrow at 11. And it's free next week. Acro team proactive Kappa systems from compliance convention

to prevention. I'll include that as well. And lastly, if you'd like to learn more about medtech leading voice exchange, I'll put that information in the chat as well. Without further ado, I'm going to turn it over to Michelle and Michelle. What are we going to talk about today?

Today we're going to talk about the many faces of audits under the FDA. Qmsr. It will be how we close it up after we review basics about Iso 1345, and Mdsat for context of where I think the FDA is going with the Qmsr. Audits. So it's a pretty long deck. So like, Sean said, stop me if you have questions, because I will be moving kind of quickly through some some of the material, so that I can spend most of the time on the Qmsr. So, without further ado, let me start sharing my screen. Now.

Second.

Yup!

Okay. so welcome, everybody. You know. Most of you know me. But for those of you who don't. I have been doing this for over 20 years I have served a term on the FDA. Good manufacturing practices advisory committee, and then, because of all the regulatory, usually causes people a lot of grief. I make a joke, but it's not really a joke that I'm also the Master Grief Counselor. and then I have my c-suite that that keeps me company entertained and calm. So amongst all the grief counseling I have to do, they're my therapy dogs. So today we're going to touch on the FDA audit approach. Iso 1345

in this app and the audit model. We'll talk about key differences between them all. And then we're going to roll that up into looking into the crystal ball about what you might expect with the Qmsr. And then what to expect when you're inspected, which, no matter which audit methodology you're going through. These are just good audit management practices. So let's talk about the current FDA audit approach, which is kind of the oddball of the group. It's called the Quality System Inspection technique. And this is a systematic approach. It's unique to the FDA. It has been in place for almost as long as the Qsr updates have been like circa 1996, 1997.

It literally feels a bit like a merry-go-round, though, because it is an interconnected system approach with management, with executive responsibility at the center. So you can see in our merry-go-round we have got a lot of we have management at the center, and every subsystem, and some of the subsystems have got subsystems. So the style of the current Qc. Model is, it's a flow chart, if you will of questions to ask information you should be gathering at each step, and then what you should ask next. Once you answered the previous question, it kind of shows you where to go, and the best part is.

it stops at 1 point in the checklist, and it says, Now take all of this information that you gathered in this section. Say this one's management controls and take this information. Now go look at design controls and see if you see what you expect to in that design controls in the design controls area and the objective evidence about how they should be linked. And Sean, if you could just keep an eye on the Q. And a. For me, and let me know if you know if I need to stop and answer some questions because I can't. I can't really see it very well right now. So so design control. So and it just keeps going. And so design controls is going to eventually point to other subsystems. And and so the FDA. It's a very systematic inspection and audit approach. And so to me this is like the most valuable of all the types of audits, because it allows you to truly see the functionality of your quality management system. And if it's truly being interconnected

so personally, you know whatever they may come up with in terms of what they finally adopt for Qmsr. I think every time I do an audit personally, I will be think, going through at least this mental process here. because I feel like it adds so much value compared to other audits. So typically underneath the Qsr. The FDA. They can look at only your internal audit agenda. They can't look at your reports. They can look at capas. They can't look at your supplier reports, and they cannot look at your management review minutes. So for FDA, they have types of audits and inspections. Which is this is also going to be interesting for the audit methodology that they they adopt. So you types are routine. And then there are 4 calls inspections, and we'll talk about those a little bit more than in the sap section.

so they can be unannounced or announced with very short notice. So you need to be prepared for for either, and you know, you just have to stay audit ready, basically. So what happens? Currently, when the FDA comes into your facility, they issue a form called 482, which is their notice of inspection, and they show you their badge or credentials. And you. You are required to give them access to the records that includes allowing the copying of the records. So this is all things that we need to think about. When what is, what is all these things going to look at when they transition to the Qmsr audit methodology. This is all the things we have to think about in the ecosystem that might change

so pre-market consequences with the FDA. If you fail to follow the Gmps and be compliant with either the Qsr. Or Qmsr. Is that you could have increased submission, testing and cost and delay to your submission up to even being considered not substantially equivalent. because you can make the bad decisions in testing and acceptance criteria that make these error that lead to you have to redo testing. And then the FDA might still not be happy with it. And then, worst of all, you have a bad 1st impression with the FDA. So for post-market consequences with the FDA that you have again failure to follow the Gmps could result in you could be inspected more often it can escalate to a warning letter, and there are other legal actions that include fines, forfeiture, seizure, not fun activities.

So what to expect after the inspection. Currently, there are 3 classifications, and that is no action indicated, voluntary action indicated or official action indicated. and then this is kind of the flow post. Post inspection is that they expect a response in 15 business days with a plan. and then you have to provide regular updates, and then FDA re-inspects for formal closure of of the 483 s. In the in the subsequent audit. But you can end up on the highway to hell. So this can mean that you get that form 4, 83, which is their form for writing up their inspections.

they give you an opportunity to respond. Now, if you have a adequate response versus an inadequate response, these stop like on adequate response. It it kind of ends there. But the buck keeps passing on inadequate response. Because then you entered into discussions with FDA. They give you an opportunity to respond again. You can have an adequate response, or if you continue to give them an inadequate response that they don't feel like truly addresses, either directly the 43 s. Or the systemic systems behind. Why, you got the 43 s. That can escalate to a warning letter. This is public information is published. They're published weekly. So it's visible to the public.

And then you can have an initial adequate response, and that can close out the warning letter. Or, if you can continue to give FDA inadequate responses, they can issue a consent decree. So then, if you have a problem with the audit, there is a way to appeal with the advocate between industry and the reviewer. So this is a interesting and the other unique thing about about the the FDA processes. So I just wanted to review about what is like. Currently, because you can see there are a lot of moving pieces and and just a very bigger system and ecosystem that the FDA is going to have to address about. How are these things going to flow? How is it going to be escalated? How are you going to communicate expectations to industry. So

That that was my purpose in reviewing all the the current stuff under Q. So I'm going to pause here before we go on? John, if you want to do a poll question now.

Yes. Sorry.

Yeah.

You seeing it.

Yes.

Great. We'll just let this run for a couple minutes.

yeah, and I've been keeping an eye on the participants. And I see several of my long term friends andre and Cynthia, and just want to appreciate that all you guys who've known me for so long are not tired of hearing me talk yet and get on my soap boxes so.

I'm just gonna repeat the announcement that anybody that would like a copy of the all new quality guide and checklist that is available only to registrants of this webinar to write guide in the in the chat, and we'll send it to you tomorrow, and if you have any questions for Michelle. Please put them in the QA. And we will try to get to as many of them as possible, although the we've got a lot of ground to cover today, so that may or may not happen. and then the

and please check out the other announcements. That were posted. Oh, yeah, everybody wants the guide. It looks like so I'm going to go ahead and end the poll in just a minute. Let's just less than 10 seconds. Lot of respondents. Okay, share results and stop sharing. Okay, they should be gone. Let's go forward.

Okay? So now we're going to shift gears and talk about the current methodology for the Is013-45-2016, approach. So the iso audit approach has 2 main components. There is usually a documentation review that happens remotely where they ask for like a quality manual and specific procedures, they will review those in advance, and then they come on site to physically. Look at the objective evidence that is outlined in your documentation. The auditors are going to follow the sections of Is013-45-2016, and they gather evidence of compliance as they go.

So the goals of the the iso audit is to determine the extent that the Qms. Is established. then determine if the audit criteria are being met from various Iso standards and applicable regulations determine if the Qms. Has effectively been implemented and determine whether or not if the Qms. Is being maintained. So it's a multifaceted approach. But it's not necessarily systemic, like the the Qsit model. So the audit workflow they review again, usually off site, the audit criteria. They will look between the standards. Any contracts you might have regulations and define the scope

that. And then they move into saying, Okay, for these criteria do. Does the documented system in terms of sops and etc, meet all the requirements of the audit criteria. then they move into practices. And this is where your records and observe behavior and interviews, and they're gathering your their objective evidence about whether or not you fulfill 1st your own procedures, and then if your procedures fulfill the audit criteria. So it's a it's a flow down, and then they link it all back up. So getting to Iso 1345, sort of initial certification. So there is an optional optional pre stage, one assessment there. And it stage one, the actual stage one is document focused again, like quality, manual reporting those kinds of things, and then stage 2 is the how you're implementing those things.

Now, it's important to know if you are going to get an iso certification. You have to have enough objective evidence, enough records executed to your procedures to be audited. So usually, I tell people you need to have the quality management system compliant with the Iso 1345 for at least 3 months before you schedule your iso audit so that they have records to look at. and then that starts the whole certification cycle. The initial certification initial audit ends in a certification decision. If you get your certificate, then you move into surveillance audits where these are not full certification audits.

They're smaller in scope and in time. And so you year one, you get a surveillance. Audit year 2, you get a surveillance audit. Then you go through a full recertification in year 3, and then it starts all over again. So it's important to know FDA is not accepting Iso 1345 certification reports in lieu of facility audits. And we're gonna talk about this in detail again and and this app and the expectations up here.

There's a question, what criteria does the FDA use to select foreign companies for inspection is that is that God's own personal mystery.

Yeah, that's a, that's a hot topic right now. Technically, it's supposed to be risk based. And that is either based on actual, you know, risk that the company has created in terms of you know, warning letters recalls adverse events, those types of things. But then it can also be things internally, like risk based, like FDA, you know, has a big agenda with devices that can be reprocessed. And they went. And they did a lot of audits on endoscope companies because they were working on formulating policy because of the overall risk of the product type. So I have also seen those types of audits internationally.

Very interesting. Thank you.

Okay. So the medical device, single Audit program or Mdsat includes the the main members is, are Japan, Canada, the United States, Australia, and Brazil. So it is based on an audit sequence or model. So the audit model is interchangeable with the sequence, the term sequence. And it's a single audit across multiple markets, those 5 that you saw. So their goal is to obtain that single quality management system audit for multiple markets. It was originally developed by the Imdrf or the International Medical Device Regulatory Forum.

There are different types. So you've got the 5 main members. But then there are also a set of observers which include the EU, and there are 4 4 of those you know, notwithstanding all the countries counted within the EU, and then there are 7. What's called affiliate members. So it's definitely getting a lot of traction internationally. So every country and either the observer or affiliate might have different rules or criteria about if they're going to accept the mdiceps, or how they're going to do it. So it's it's going to be really interesting to see as it continues to roll out

the the as the Qmsr continues to roll out like how it's gonna impact members, observers and affiliates. So the scope can be quite large. If you have all the countries within your scope, because you're going to have the basics of Is013-45-2016 is going to be the overarching tie that that ties all the other countries together. But then they go and start getting country specific. and then the country specific stuff will become subtasks under a major task. So you've got the Us. You've got Australia. You've got Brazil and Canada, and so all all of these are wrapped up into the mdice app audit model. If you are marketing in these countries or intending to market in these countries

so similarly to the the iso certification? And is that it has that 3 year audit cycle for your initial certification, your 2 surveillance audits, and then your 3rd year for starting the full recertification. Now, FDA does accept Mdicep audit reports themselves, not the certificates. So FDA will only They're they're only gonna accept M. This app for routine audits. or they're not going to accept any of those 4 cause audits. Which means they're actually have a concern about your risk.

So if we look at the the Mdsep audit model. It's based off major subsystems. And then the major subsystems lead into related or secondary subsystems. and and they're broken down into chapters. and then some of them go across multiple chapters. It's very interesting. So, and it's a bit redundant because you might have a question in Chapter one. And it might be linked to multiple other tasks. And they're asking you what appears to be the exact same question. But underneath each task. But the answer is supposed to be like. If you answer, something under management is supposed to be

that that question is supposed to be focused on that subsystem, and if they ask the same question in a related task later, then those are supposed to be answered like underneath the concept of that particular subsystem. So there's a lot of redundancy where they could have just asked. You know all the questions about that in one place as opposed to going back and forth so indisap. It's really kind of important for efficiency to notice all the interrelated tasks so that you can answer it all kind of in one whack, instead of going back and forth between that same concept. and then, importantly, that they are expecting to see risk management throughout all of the subsystems. And so this moves risk management past just the concept of 1, 4, 9, 7, 1 to what Iso 1345 calls the risk-based quality management, risk-based thinking throughout the quality management system as a whole.

Here's a question about Mdsab. So who are what organizations? Audit for Mdsab.

Yep, that's a great question, and that is coming up in the next slide or 2, be sure to address it. And so the way the the Embassapp is currently structured. There are chapters which are those main subsystems. We just talked about. The chapters are broken down into tasks. They start with tasks that are applicable to all the markets. So this is the overarching Iso, 1345 checks the box, and then they get into iso specific requirements very like line item. and then they, the task, can have some subtasks in that that you now you get into country specific, like, well, in the FDA. You need to look at this, you this difference in the the U.S.A,

so this is going to impact the the Qmsr will impact the structure of the Mdsap audit model. Should they adopt this? Well, whether they adopt Mdsap or not, it's going to impact the audit model, because now all the tasks are going to have to be rewritten about right now. You're gonna have some that still apply. You're gonna have others that go away. You're going to have to have others that are added based off of the differences in the Qmsr. And the way that FDA has adopted the Iso. 1345. Another interesting thing about the grading scale for not for non-conformances under Mdisap is that they've got kind of this heat map risk based approach for classifying different observations. And it's funny because this is like, right out of the guidance document for Mdisap.

But and they but they have 5 levels and 5 is just burning down house because it's not even on their heat map. So how is FDA currently seen and involved in the Mdsap audit model? So 1st off, the FDA accepts only the audit reports. They do not accept the certificates. And so what happens is they get the report from the audit organization, and they look at the. They read the report for themselves, and they say, Okay, do we agree that 1st off this covered all, checked all of the boxes for things we expected to see documented for the Us. And secondly, do they agree with the grading system about how the audit organization classified the observation?

You can. So again, full support report not just the certificate and the FDA. It's only for the FDA routine inspections. And so again, we have routine can be abbreviated or comprehensive. This is what the FDA will accept the reports, for if you have any type of compliance related special issues or a Pre. Or post market issue. The FDA. Will not accept the the Mdsap audit report for those under the the Mds. App, like FDA can see management reviews, supplier audits, etc, that were excluded before, because they they get the entire report. So that was a fun fact.

So before we move on and we're going to talk about the the audit organization things in this section. Are there there any questions about Mds app.

This is a this is a question about FDA audits. Actually, has FDA recently introduced unannounced audits? Or is this something for the future?

I know that's been. That's that's been a very long time that they've had unannounced audits.

Right? And they're more rigorous. Yeah.

I had the pleasure of. I already had my FDA, my my iso certification audit, you know, scheduled. and I got called, you know, called from the lobby, Hey, the auditors here! And so I went and got my. What I thought was the Iso, 1345 or inspector, but both he and the FDA were there. because the FDA came in unannounced on this at the same day, at the exact same time that my iso auditor did. And boy. I was scrambling to to make ends meet on that one, but then they felt bad for me, because, you know, it was, they knew it was a lot to manage, because it was a really small team. So.

On the Mdsap Point, someone commented. Mdsap appears to be convoluted. I thought it was to simplify things. Could you comment on that.

So a. What? To simplify things.

Mdsop was created to simplify things.

Yeah. yeah, no, it's very circular. I don't think it's it. Simplifies things at all. And I think the yeah, it, and again, is so convoluted. Not only does it not simple, simplify things, there's really not a lot of value added in the audit methodology. So let's talk about some of the differences now. So I don't. I think this is something that's not going to change. Is that for FDA it is an inspection. If FDA comes to your facility. These are usually badge carrying, or they have other, you know, FDA credentials. And so they there's more weight in the inspection. So, and even either an Iso or Mdsap audit. These are conducted by registrars, notified bodies or audit organizations. These are private and for profit

inspections. And so that's important to keep in mind, because, of course, the FDA is the government. They can't charge you for the inspections, because supposedly your your Medufa and annual establishment is supposed to pay for that. So currently, FDA does not have an agenda per se because they use that Qc approach. So they just follow where the systems and the evidence take them. It is currently conducted to 21 cfr. 8, 20. That is going to be expanded, obviously to include clauses of 1345. They document their results in form 483 for inspectional observations. Under the Mdsap. They do have a formal audit agenda. They break down which tasks they're going to cover. On what days and at what times

the auditor follows this ordered, task-based audit model that has a total of 7 chapters with recommended linkages, and that's where the convolution comes in. So again, scope is 1345 plus the 5 select country requirements. and the results get graded into, get graded as opposed to. Just. Okay, here's your observation and in notified body. For a ce mark or iso certification. If they do have audit agendas. The auditor typically follows a clause structure of the standard which does not have tasks. It is audited t013-45-2016 at present, and the results are categorized in major or minor findings which can impact your ability to obtain your certification. If you have too many majors, or if you have too many minors that was unaddressed from the previous audit, they get automatically upgraded to majors in subsequent audits.

So let's look at the differences in the types of audit organizations for all these non FDA inspection methodologies. So 1st off for the medical device single audit program, you have what is called an audit organization. This is they. They are designated by different bodies to conduct. Iso 1345. Compliance audits in the context of the Mdsat program. So Mdsap in and of itself does not register your products in the country in the particular country. But again, if you're if you're already selling or planning to sell into the country. You have to have it included in your Mdsap audit scope.

and then, if you but but it does not confer any kind of registration. Different countries take the indisap certificate different ways like I said, FDA does not accept the certificate, but and only the report Canada only look, get only looks at the certificate and cares about the certificate. So And so then for a registrar. So you you need to know there's 2. See, there's 2 types of Iso 13, 4, 85 certificates that are issued by different organizations. So there is a registrar that is faster, much more economical. They cannot that any. The certificate you get from them is usually more purposeful for business applications like to be able to show your customers that you've got an Iso. 1345. Certification which gives them confidence.

To give yourself confidence that you're going to meet all the requirements or most of the requirements for the Qmsr. Those kinds of things. But you can't take this certificate from a registrar, and then go and try to use it in, say, Europe or some other geographies generally so. and the reason why registrars are different from notified bodies, notified bodies, even though they, though they are a private organization, they have to be designated by competent authorities, and competent authorities are like the in-country FDA, and every country in the European Union has at least one, if not more competent authorities.

So this results in an Iso 1345, certification that will be recognized in within the EU. It is recognized if you want to apply for a ce mark under Mdr. now, in in the Indus app audit model, you kind of get you get your Iso 1345 certificate, and you get like your certificates for the scope of your certificate can also add in specific countries. But right now they are accepting Mdsap certificates, but not for the purpose of Mdsap. Just because it just so happens that they cover all of 1345. So generally a notified body, Iso, 1345. Certificate is going to be much better. If you're planning on multiple markets, it can be expensive and slow.

So now let's take a look into the the Qmsr. Into the crystal ball about what I think all of these different implications are going to be on what the FDA might actually adopt as audit model. So, Sean, if you want to put up another poll question.

Yes.

And let's see if I've missed any questions.

I think I ran the wrong poll earlier. So I'm going to launch this one. which is really just a question. If you've already said, that you want a copy of the Guide in the other channel. Then you don't need to.

Do we have a another question more like on topic.

So we have questions. Yes. Show. Do we need an Mdsap certificate to sell class one medical devices to in Canada and Australia. I think I'm not sure if Mdsap covers class one in Canada, but Canada requires Mdsap.

It. I I don't think that they do for class one devices, but I think Australia does. I'm not a hundred percent on that.

We can check on that. do. Registers registrars also audit for Mdsap as well as Iso, 13 or 85.

It's only 1345.

Okay, And the person who asked the question about unannounced audits said I should have said unannounced audits for foreign establishments.

That that is new. and the reason for that is that they used to require. And I still don't know how they're going to work around this because it requires our government and the inspector that's coming to work with their government and tell them that they're coming and coordinate a whole visa situation. When they announce an audit, they ask, Okay, what hotels are close to your facility? What? How should I get around like? These are all important things that I don't necessarily, I mean, I understand the concept and why it's important for F for foreign inspections to be unannounced. But there are actual physical logistics and safety issues, even in a lot of these countries. That the FDA should not, you know, need to be mitigated, and they can only be mitigated by direct conversations with the both the country and the

the audit audit, or the facility continue to be inspected. So okay, moving on so, as you all know, the Qmsr. Was finally published on February second, 2024, and we have until 2020 February of 2026 for full implementation. So you know, on the surface, your, my 1st thought was that, okay, we're going to have a challenge because they've got all this staff to train in a totally different inspection approach, and it's going to require them to think outside of their you know. Qsr. 8, 20 box, if you will.

They're going to have to like move from a true process related to something that's more of a checkbox activity because they have to focus on like powering through, like, you know, the entire scope of the standard as opposed to following where the gaps take them. The FDA had, you know, said that they were going to start getting ready by sending inspectors to Asq. Certification audits. And so, you know, it's not but it. When I thought about it more given Covid, and some subsequent changes. I don't really think it's like teaching a dog new tricks because you have ongoing FDA Turnover since the pandemic. Still 5 years later.

and even in the the pandemic, you know, we saw a mass exodus from the FDA of people just say, taking their retirement, and, you know, going to live their life. So I also know several. You know, people on the inspection side that have been doing this, you know, 20 plus 30 plus years, and they're all talking about retirement instead of learning this new, whatever the methodology is going to be. So this is really making room for, you know, new auditors that may, or new inspectors that may have never even known what Qsr. Really was.

So it's really become a revolving door now, underneath the current administration which is still affecting the but the good news is, it's not necessarily affecting the reviews, and supposedly not the inspections, but I do know for a fact that we may or may not know how it's going, because the entire Communications Department expired anyhow. So it's just still a constant revolving door, you know. I think every week you see, somebody high up and leave leadership. You know. Just hey, we're I'm just leaving or retiring. So we've got similar things that are happening now that were happening in Covid in terms of staffing.

So this is so. The the FDA has determined these sections between the current. Qsr and the Iso clause clauses as substantially similar. Which I think is not confusing at all. If you think about substantial equivalence, which is the bar you have to meet for 5, 10 k. So there are some key differences. Those are mainly in the area of document control, because the FDA expects that there is a signature and date that is compliant to 21 cfr. Part 11. They say. Obviously, you know, our reporting procedures and complaint and servicing activities need to be still compliant with the actual Cfrs under which those were issued for reporting purposes.

They still are going to require the Udi. So you still have to maintain that system, and then they retain clarification on language from a part 108. Regarding the confidential confidentiality that of the records FDA receives. and then they are going to retain their existing requirements from 8 20 around label control and packaging. So these are, if you think about in terms of Mdsat. These are all the areas where the tasks are going to have to be rewritten. And so that also means on February second, Mdsap is going to also need to have issued their updated audit methodology with these changes.

Similarly, if you do have a Iso certificate from either a notified body or a registrar, you know it's not going to cover these things. You have to make sure that these are in your procedures so that you can meet the F. The what remains of the seat, the 8 20 section. So we are at the known unknowns. I love that Donald Rumsfeld quote, so we know that the Qsip will retire as an audit technique. We expect FDA inspectors are trained to a new standard. FDA is going to inspect new types of records, because now they have purview to management, review internal audit and supplier audit.

And we know FDA is going to focus on areas that are already an issue underneath. Qsr. Because there's known compliance issues, known safety issues and where industry is already not doing them correctly to meet FDA inspections. So this is again, and what we what they were allowed, were, and we're not allowed to look at. But now it's open kimono, and FDA says that's because all these other. All the iso audits all these other regulatory agencies. They audit management, review all these things, and so therefore we don't think it's a bigger burden for FDA to be able to audit them and then. Now we've got more transparency and visibility.

So if we look at the top 5, 4, 83 s. For the last 2 fiscal years, and this goes back way more than just 2 fiscal years. But it's you is almost always the top 5 in some order is capa complaints, design controls, purchasing controls and nonconforming product. And all of these can be mapped to different sections in the Iso, 1345. So you know. Just imagine what fy 26 findings are going to look like, you know is that that these could still, since there have been the top 5. Now, it's just going to, you know, shift to these areas of the Iso 1345 that are not being met.

So again, the big 5 Kappa complaint design controls, purchasing and supplier controls and nonconforming product. So if you look at how FDA currently writes observations or 4, 83 s. And this is going to be important because this is another area that we don't know how they're going to address, because currently they use standard language and they use it that falls in basic 2 basic categories. And that is either lack of procedures or it's being documented inadequately. So so you get verbiage like procedures for correct procedures have not been adequately established, or actions have not been adequately documented.

And that's pretty standard across the board. I'm not going to read all of these to you, but these are from this last fiscal year, the exact wording that was given, and you can see it is like a generic opening statement. And then after you, when you see specifically comma, the next thing you should expect is that is, now the FDA is going to outline their objective evidence. That shows how you have not or have inadequately demonstrated things. So you just you can look these up in the slides later. What is significant about design controls is that if you look at

you know the 820 Cfr. Says, risk one time, and it's very ambiguous. But if you look at, where are they giving 43 s. For risk? They call it out very specifically in their standard language. Risk analysis as it relates to this risk analysis that relates to that. So these are things because this is going to be a big paradigm shift for industry is a growing intention. Attention on risk analysis, and 1, 4, 9, 7, 1. i even recently saw a warning letter that specifically called out Iso 1, 4, 9, 7, 1. And then all the observations were very obvious that the

the the inspector understood 14, 9, 71 deeply so these are purchasing and controls and supplier controls. And again, the unique thing here is outlining the requirements that must be vet by the suppliers, and then the type and extent of control to be exercised for nonconforming product. This again, this is a a heavy one, but you know they call out the need to define the responsibility for review and authority. And then also in context of rework and adverse effect on the product.

So in a Biblical context, the regulation begat expectation, and that begat prescription, and by that we start with the Qmsr. And the FDA. Basically said, and this is on their FAQ page. I'm not making this up. I've had people argue with me about it. That's why I'll put this in here, you know. Michelle's not making this up is that the FDA starts with the Qsr. They said. 8 20 is now titled quality management system regulation. the. And then then it talks about. If you want to understand what we're talking about, you need to read the Practical guide for the standard which, oh, by the way, is when I purchased it way back was about $400, and the

the standard is 2228 pages long, and the Practical Guide is 230 pages of interpretation and expectation. And then there's other levels. Amy has 2 or 3 papers out that map. the 21 Cfr. Existing 8 20 to the the standard. So.

Somebody.

Make sure you check these out.

Somebody had a comment. Question about that. How can the FDA require manufacturers? Purchase Qma Iso. 13.

Oh, well, Iso, 1345 is available view only for free. This is like, not codified. So because it's not codified. Then you don't have. They don't have. Say it's not a requirement, because it's not a regulation. But if you want to understand what we think about that clause in in Iso, 1345. Then you need to read these other 2 documents.

And they cost money.

At least this the practical guy does. This Tir, I believe, is free. I know that there's a handful of them on the on the Amy website. Not all of them are free, but some are so. I have other presentations that we can talk about which ones are free. If we, we need to follow up. So the devil is in the details, speaking of things that begat things. So again, this is how you end up between regulation and expectation. But then also the language in 1345 is much more prescriptive of how the of how your procedures need to be worded.

and it it seems like very nitpicky. But if you don't have certain terms, certain key buzzwords in there, the at least a registrar and a notified body and an Mdisap auditor, inspector would write would write that up. So just be aware that even if you think you're kind of overall in compliance, you need to double check just right down to that verbiage. So I'm just going to pause here we do. And this is the guide that Sean's been mentioning. We have a free ebook that is going to be like a general overview. And then we also have a masterclass that we're giving you guys a discount on to 4, 49, that is, goes through quite extensively. It's about an hour and a half to 2 h worth of training with quizzes, and you get a certificate.

and it's broken down into 10 to 15 min intervals. So it's digestible. So check both of those out. I think you'll find them very helpful, particularly the class has got a lot of unique insights. So I'm going to try to go through this fairly fast because we have about 5 min left. But will the FDA adopt the Mdsat audit model? Don't know. They're going to have to republish into sap either way. I can't imagine that the FDA is not going to adopt it. But we still have a lot of trickle down things about the ecosystem after they adopt that about what it means like in terms of are they going to adopt the grading methodology? How does that impact that highway to hell? 483, escalation? Are they going to even still issue? 4, 83 s.

Big one. When is it going to be published? Is it going to be published before or after the Qmsr. Actually goes into effect. And then again, just like we talked about with the Is013-45-1497, one is not codified, but not only is it referenced in a warning letter I saw it is also mentioned in the the Qmsr. Like, if you want to know what we mean when we say, risk related to product. Then you need to read and understand 14, 9, 71. So this might be a good place to to stop and take any last questions. This last is just kind of really best practices for audit management.

so if we have any last questions, I'll answer those first, st and then I'll go through here just really quickly, for those of you who who want to stay a few minutes. You're muted.

So this is more of a comment than a question, but you can comment on it as well. Does anyone feel that the FDA does not have control of their internal system. We think so.

For sure, and so I managed FDA inspection earlier this year. That was almost unannounced. It was like, I think they got less than a week. And it was from an inspector I've worked, worked with several different times across a couple of clients here in in town. I asked him about Qmsr. What are they doing to prepare him? He's 1 of those ones that has been around 30 years, and he was like, he's like, it's a mess like it's. It's a mess, he said. I've been doing this a long time. I'm I'm at it. He said. We're we're getting communications, and then next month we'll get a different. It'll it'll say something different. We'll get a timeline. They don't get pushed back. There's no, you know, there's been no real training for anybody. We don't even know what the inspection methodology is. Gonna be so

yeah, just imagine chaos will ensue. And on February second.

Lots of people, lots of people agreeing with you in the chat. So last question, is, what's your advice for manufacturers that are already Qsr. And 1345. Compliant. What extra measures can we take? Etc.

I think you know first, st obviously do a gap analysis, but but not even if you're already compliant, probably high level you have got, you can check most of the concepts, but drill down to the wording and to all those innuendos drill down to the things that FDA is keeping that are different from Iso, 1345, definitions there you really need to understand which definitions apply where? Because there is a hierarchy of the the definitions and which take precedence. So all of those things are really important to understand.

Okay on that note we are going to sign off. I'd like to thank everybody for sharing their time with us today and attention. I'd like to thank Michelle for an excellent presentation, and I would like to remind everybody for the last time that yes, the slides and recording will be made available tomorrow. Thank you. If you requested a certificate, you will receive it by email in a day or 2. We have to make those manually. So please be patient. Oh, and sign up for Michelle's class. Bang!

Will, will they be getting a discount code? In part of the the email, you package, you send out.

I will make sure that Dylan includes that.

Okay, so be looking for the the discount code in your emails. When you receive this the slides here.

Yeah.

And then also, if you have, it wouldn't get the slides. If you've got questions on that last section about audit management, just be sure to reach out to me, and I'm happy to answer any questions directly about that.

Okay, yeah. Feel free to reach out to Michelle or me. If you have any questions, we'll make sure that your questions get answered. one way or another, and thank you very much. Everyone until tomorrow or next time we see each other. Take care. Thank you.