Last month the US Food and Drug Administration hit the pause button on on-site quality systems inspections as the COVID-19 pandemic rolls on. One tool the agency has in its compliance arsenal, however, are so-called “desk audits” that it can conduct in lieu of an in-person inspection.
Below, Ricki Chase – compliance practice director for Lachman Consultant Services and a former FDA investigations branch director – explains how a desk audit would unfold.
Chase became a consultant in 2016 after spending 16 years at the FDA, where she was also an investigator, medical device specialist and supervisory investigator. Her conversation with Medtech Insight was lightly edited for clarity.
Qu: Medtech Insight: The FDA, as you know, has suspended quality systems inspections domestically and abroad. But the agency can still conduct paper-based desk audits. What advice do you have for firms that might have to undergo such an audit?
Ricki Chase: Before I give out tips, I think it’s important to note that the only companies that would be subject to that kind of experience would be lower risk. I can’t imagine a world where if you’re up for a PMA inspection on a class III device, that the FDA is going to desk audit you. I also can’t imagine that a firm would have a desk audit if it was previously violative and/or is trying to clear a warning letter, or something like that.
Having said that, the point of a desk audit is to see if you have the basic elements of the quality system in place. So I would say, if you’re subject to a desk audit, first off, make sure you clearly understand what you’re being asked for. And if the FDA isn’t clear on what’s being asked for, ask them to refine the question, because the question could be very broad – “Send me a list of all your complaints for the last two years, or send me a list of all your complaints.” Make sure that the FDA narrows the scope so you don’t overprovide information.
“It is a rare, rare, rare instance that the FDA ever does a desk audit.”
Second, be cautious, because there can be a lag time. This isn’t being done via a Zoom meeting. So firms need to be really careful that they’re not making adjustments to their documents before they turn them over to FDA. It will give a very, very bad impression if firms make document changes or they suddenly have a brand-new revision of an SOP [standard operating procedure] a day after the FDA announces they need them to send in documentation. So they need to be very careful to resist the urge to correct or change records before sending them in.
Third, companies need to make sure they ask the agency for feedback in real time, and they need to make sure they’re having a conversation with the FDA up front to say, “If you’re seeing things, given that you’ll be reviewing them without being at the firm, will we have an opportunity to discuss any observations you might have before you would issue an FDA-483 [inspectional observation form]?” In the normal course of action, you have a face-to-face interaction opportunity to explain and discuss. But when it’s a desk audit, you don’t.
So firms need to determine what the rules of engagement are going to be from the very beginning. For example, will they meet just at the end of the review? Will they meet halfway through the review? What will be the situation? And they should also ask if the desk audit will be considered their formal inspection. Will they be receiving a notice of inspection through email or other media, to make it official under the same scope and rules that a notice would normally be issued?
Fourth, manufacturers need to be very conscious of how the FDA wants them to communicate. I have seen companies communicate via email back and forth to the FDA all of the time. And that is a real slippery slope because it’s not an official communication. So how does the FDA really want them to communicate? Does the agency want firms to collate the documents and mail them overnight to the FDA for review? Does the FDA want them uploaded to a secure server or downloaded onto a thumb drive? How does the agency want to receive that information? Because normally firms do not release original documentation – they release copies, photocopies. And companies should make sure that if they’re transmitting their documents electronically that their data’s secure.
Qu: What kind of documents should manufacturers have on hand? The same documents they would have ready if the investigator was actually coming on-site? And will the FDA tell them in advance what kind of documents they want?
Chase: If they’re going to do a desk audit, then the FDA will send the firm a list of what they want them to provide. But there are key things that they should have ready for a desk audit, including making sure they have their quality manual up-to-date and that they’re ready to provide the quality manual, because it gives a top level of review of the organization. They should also make sure they have their metrics up-to-date and ready to provide – that’s your complaint trending, your nonconformance trending, how many CAPAs [corrective and preventive actions] you have open, and what your CAPAs look like.
“If they’re subjecting you to a desk audit, you do not want to ask for an extension. You do not want to delay. The impression that gives is terrible.”
Also, have you reported any MDRs [Medical Device Reports]? Have you had any field actions? Have you made any changes – or what’s the most recent change to your device – particularly if it’s a class II or class III. Those are very common things, and that’s usually where the FDA starts. And then once they take a look at those things as good indicators of where you are, then they’ll usually ask for specifics.
Another thing I really recommend is that manufacturers take a look at what’s in their most recent history. So, for instance, if they’ve filed a bunch of MDRs this year, if they’ve had a recall this year, and if they got a new 510(k) in the last two years, those are areas where the FDA will typically look and ask questions. So firms should make sure they’re ready with answers to those types of things, and they’re prepared ahead of time with an explanation of what happened, why those things are occurring and what they’ve done to correct them.
Qu: How long do desk audits typically take? About the same amount of time as an on-site visit?
Chase: Well, first of all, it is a rare, rare, rare instance that the FDA ever does a desk audit. I mean—
Can you think of the last time—
Chase: I can’t. I can’t even think of the last time. I literally cannot think of a time in probably 16 years that I’ve known them to do this as a routine course of business. Of course, we’ve not been in a pandemic like this as a routine course of business in the last 16 years. So I can’t say that it’s off the table, and it’s not novel thinking.
If I were still at the agency, if I were still a director there, here’s what I would do: I’d try to knock out as many desk audits for lower-risk companies that will count toward my work plan obligation, so that when we do come back to work, I only have to focus my resources on those highest-priority, highest-risk inspections that haven’t been done. I’m obviously not going to perform a desk audit for my highest-risk firms because that’s dangerous.
So I would imagine that that’s what the FDA is going to do, that they’re going to go for the lowest risk, biggest bite out of their work plan, and get them done as quickly as possible. I could imagine that if a firm has an established quality system, and it provides the documentation, that the FDA could get through a review of that documentation in two or three days.
Qu: What are some pitfalls for manufacturers that undergo a desk audit?
Chase: Not having current data, and then therefore not being able to hand over the documents in the timeframe in which the FDA establishes. Particularly, if they’re subjecting you to a desk audit, you do not want to ask for an extension. You do not want to delay. The impression that gives is terrible. Also, don’t get nervous, because this is a new process, and when people get nervous, they tend to like to talk. Don’t get nervous, and don’t start bombarding your investigator with emails and telephone calls. Just let them do their process. And when they’re ready to talk to you, they’ll talk to you. Don’t bombard them with communication. Let them do their job.
And don’t get defensive, because you have to remember that they’re doing a review in a vacuum. They don’t have the ability to converse with you while they’re doing it. If they come back at you with a concern or an observation, try to take a calm approach to discussing it, particularly if you feel like they don’t have the entire picture because it is a desk audit. And try to talk through those in a calm, collected way, and not let the situation and the newness of the situation put you on edge. That won’t be perceived well, either.
Qu: How would the FDA give out a 483, if it had to?
Chase: Well, the FDA has mailed 483s before, so I would hope that if there were going to be a 483 observation, that they would at least have a conference call, talk through the 483 observation, and give the company the opportunity to respond to those observations as they would in any other case. And then the agency, if necessary, would send the 483 to the firm for it to sign, and then it would be sent back.