QSR/cGMP Compliance, the Failure to Document, and “A Few Good Men”

By Mark I. Schwartz –

One of the pre-eminent rules in QSR and cGMP compliance is to document one’s activities. In the eyes of FDA, the “failure to document” is often equated with the failure to perform the underlying regulated activity. FDA takes this position principally because the failure to document denies the firm, and hence FDA, of the evidence needed to determine the adequacy of the underlying activity. The requirement to document one’s activities is repeated over and over again throughout the QSR and the cGMP regulations.

A case in point is 21 CFR 820.100, which outlines the requirements for corrective and preventive actions, or CAPAs, in the medical device regulations. In 21 CFR 820.100(a)(1) through (a)(7), there are a wide range of requirements, including investigating the cause of a non‑conformity, identifying the actions needed to correct and prevent recurrence, verifying or validating the effectiveness of the corrective actions and ensuring that they do not adversely affect the finished device. Importantly, arching over all of these requirements is subsection (b) of 21 CFR 820.100, which states that “[a]ll activities required under this section, and their results, shall be documented” (emphasis added). Thus, CAPA documentation is itself a regulatory requirement.

In discussing the evidentiary basis of this documentation requirement, we are reminded of a soliloquy from the movie, A Few Good Men, when Lieutenant Daniel Kaffee chastises Lieutenant Commander JoAnne Galloway, by saying: “You and Dawson, you both live in the same dreamworld. It doesn’t matter what you believe. It only matters what I can prove! So please, don’t tell me what I know, or don’t know; I know the LAW.”

In other words, if you have not documented the QSR or cGMP compliant steps that you have taken at your facility, it is as though the QSR or cGMP compliant activity itself has not taken place. There is no better example of this observation than a recent 483 issued to a device manufacturer, where virtually all the observational comments by the investigator reference the firm’s lack of documentation of various QSR activities, rather than the lack of performance of the underlying QSR activities themselves.

Interestingly, even some trade press confounded the 483 observations involving “failures to document” as “failures to investigate”: “[t]he post-inspection finding for [the firm] concluded that the devicemaker did not adequately investigate reported product variances and did not fully investigate multiple complaints about product failings.” International Devices & Diagnostics Monitor, March 4th, 2016, “Form 483 Hits the SweetSpot for Alleged Follow-Up Issues” (emphasis added).

According to Observation #1 in the 483, three of the nineteen CAPAs that the investigator reviewed had allegedly failed to include some type of documentation relating to the investigation into the cause of the nonconformities.

For example, at some point the firm allegedly determined that the release of a version of their Diabetes Data Management System had resulted in certain customers not being able to use the device, presumably leading to this CAPA. However, the firm allegedly failed to document certain portions of the investigation into this nonconformity, specifically documentation into the investigation relating to the failure of the system to produce PDF reports, as well as documentation into the root cause of the failure. Despite these alleged inadequacies, the firm allegedly closed the CAPA, and signed it as having been reviewed and approved.

In the world of FDA, if a warning letter were to be issued regarding this Observation, it would be cited as a violation of 21 CFR 820.100(b) relating to the requirement to document, not as a violation of 21 CFR 820.100(a)(2), relating to the underlying requirement of “…investigating the cause of nonconformities relating to product, processes, and the quality system….”

Next, the investigator noted that the firm allegedly had not documented verification and/or validation of the corrective actions to ensure that such actions were effective and had not negatively affected the finished device, in accordance with both their internal SOPs and 21 CFR 820.100(a)(4). One of the examples cited in this regard relates to the same CAPA referenced above, and was stated as follows:

CAPA – 30 – Your firm identified corrective actions including release of …Diabetes Data Management System, r152, backwards compatibility testing for future releases and creation of a test plan for automated and manual tests. Your firm did not document verification by examination and provision of objective evidence [that] these corrective actions were effective. Your firm closed this CAPA on [September 2, 2014] and signed this CAPA as reviewed and approved on [December 14, 2015]…. (emphasis added).

According to Observation #2, the investigator claimed that for two of the 16 complaints reviewed during the inspection, the firm allegedly did not document the complaint investigation into possible failures of the firm’s devices. For example, Complaint #379 was created on July 29, 2015 to address a report of a customer receiving blank and erroneous data on reports generated by the firm’s device. The customer identified an upload which contained numerous readings of mostly out-of-normal range values, and these values were dated prior to the patient in question having received the device.

Among other things, the investigator alleges that the firm closed the complaint ticket and signed the complaint as having been reviewed and approved, allegedly without the firm documenting the investigation into the possible report of erroneous data.

So to summarize, if one is required to perform some task under the QSR/cGMP regulations, absent specific regulatory language to the contrary, FDA generally expects the documentation of steps taken in the performance of that task. (We will leave for another day the issue as to whether FDA’s broad expectation in this regard is supported by the relevant statutory and regulatory provisions.) Failure to do so effectively negates the underlying QSR or cGMP compliant activity that has been taken, at least in the eyes of FDA.

For those in the drug or medical device industry who are bold enough to ignore this admonition, another quote from A Few Good Men comes to mind, when Colonel Jessep excoriates Lieutenant Kaffee with the following diatribe: “I run my unit how I run my unit. You want to investigate me, roll the dice and take your chances. I eat breakfast 300 yards from 4000 Cubans who are trained to kill me, so don’t think for one second that you can come down here, flash a badge, and make me nervous.”

Reminder: Register now for the May 3, 2016 Virginia Tech and HP&M Conference on Effective Documentation.  Information on the conference is available here.