February 4, 2012

The Top 10 FERC Enforceable Standards in 2010

Last year we blogged about the top 10 FERC enforceable actions for the NERC standards, with PRC-005-1 violations leading the pack. As you can see in the chart below, 8 out of the top 10 violations are CIP related. So, what changed?

FERC Top 10 Enforceable 2010

According to Trey Kirkpatrick, VP, Energy and Utilities Compliance for AssurX, “With the emergence of the CIP standards into the NERC and Regional Entities CMEP program, registered entities are self-reporting more CIP violations.  The entities are finding that documentation of personnel training and system security management continue to be an area for improvement. The registered entities are taking action with proper mitigation plans that are approved by the Regional Entities and NERC. They are also continuing to learn from other areas such as; nuclear power and health sciences how to instill a ‘Culture of Compliance’ in their workforce.”

And, as stated in NERC’s February 2011 Newsletter:

The Department of Energy (DOE) is launching an initiative to enhance cyber security on the electric grid. The initiative, led by the Department¹s Office of Electricity Delivery and Energy Reliability (OE), the National Institute of Standards and Technology (NIST), and the North American Electric Reliability Corporation (NERC), will be an open collaboration with representatives from across the public and private sectors to develop a cybersecurity risk management process guideline for the electric sector.

The Regional Entities and NERC are also performing more on-site audits and spot-checks. They are discovering implementation inconsistencies between entities and are sharing those lessons learned with FERC and the registered entities.  NERC has standard teams currently revising the next version of the CIP standards.  AssurX will continue to follow these revisions in updates to our readers in future blogs.

TwitterFacebookDiggDeliciousTechnorati FavoritesEmailPrintFriendlyShare

Handling a Warning Letter: If At First You Don’t Succeed…

Last year, we blogged about the most common drug and device GMP 483 items and how to respond to them in writing.  But what if your response is judged inadequate or the FDA otherwise issues a Warning Letter? First off, understand that the agency even at this point is strongly hoping you will voluntarily take the corrective action required so they can settle this case and move on to something else. They are intended to elicit voluntary correction.

However, if you fail to address the issues raised in a Warning Letter, your company can face some serious repercussions, including: recall, seizure, injunction, monetary fine, debarment, disqualification, license suspension or revocation, and prosecution.

The issuance of a Warning Letter certainly raises the stakes after a 483. The violations it contains represent concerns not only of an investigator, but of the District and/or Center Compliance Officers.

Responding to a Warning Letter

Your first action after you receive a Warning Letter should be to immediately notify top management of the letter and give them an idea of the scope of the problem. You should also contact the FDA’s District Director or Compliance Officer. In your written response to them, you should acknowledge your obligation to comply with the law, discuss the impact the issues raised will have on product quality, address any broader or systemic corrections the Warning Letter may have raised, and offer your corrective actions and timetable for completing them.

Ask to meet with the FDA. That meeting is important for a number of reasons, including:

  • Ensuring there is common understanding of GMP concerns
  • Verifying the adequacy of proposed corrections
  • Revealing if further action is planned by the FDA
  • Achieving agreement on how to proceed
  • Providing a written summary, including any clarifications and additional commitments from either side
  • Setting a timetable for periodic updates on progress

Your company can avoid “unnecessary problems” with the FDA as long as your response avoids the following: unrealistic goals, blaming everything on a lack of training, trivializing the product complaints, failing to proofread your correspondence, citing other firms’ practices as an excuse for your own, and failing to implement promised corrections.

Attorney Peter Reichard with Sheppard Mullin works closely with drug and device companies and former FDA officials. He stressed that your Warning Letter response should focus on how you are addressing the problem. “Companies have a tendency to try and explain something, but the FDA is not interested in that,” he says. “They just want to know your plan and that you followed up,” he says.

Part of that plan, Reichard says, is to put together a Warning Letter response team that goes beyond regulatory personnel. Include those involved in business and legal issues and those who keep a handle on resources and expenditures, he advised.

Avoiding Warning Letters

The only proven technique for avoiding enforcement actions [is] establishing an effective Quality System.  And the FDA defines “establish” in this instance as a Quality System that is defined, documented and implemented.

Companies that have SOPs and teams in place to handle process problems tend to do a better job of avoiding Warning Letters, agreed Adam Bloom, an attorney in Reed Smith’s Life Sciences practice.

But the absolute “worst-case” scenario is to become a repeat offender in the eyes of the FDA, he said. “If you said you would fix something, and they come back a year or two later and find the same problems,” they will view you harshly, he added.

TwitterFacebookDiggDeliciousTechnorati FavoritesEmailPrintFriendlyShare

The Top 10 FERC Enforceable Standards in 2009

We knew it was coming. FERC enforcement actions picked up significantly in 2009. But what surprised us most was the eye-popping 214 violations for PRC-005-1.

Top 10 FERC Enforceable Standards of 2009

So, what exactly is PRC-005-1?

Simply put, the NERC PRC-005-1 standard says (but is not limited to the following – see below for link/download of standard):

  • Owners of generation Protection Systems shall have a maintenance and testing program for all protection devices that affect the reliability of the Bulk Electric System (BES).
  • The program must include a maintenance and testing interval for each type of device and the basis used for determining that interval.
  • The owner must provide documentation of its system maintenance and testing program and the implementation of that program to its Regional Reliability Organization on request within 30 calendar days.
  • The program must provide the evidence that each Protection System device was maintained and tested within the defined intervals including the last tested/maintained date.

You can download the NERC PRC-005-1 Standard here.

Why has complying with PRC-005-1 been such a challenge to utilities?

The legacy of the unregulated past of both small and large utilities has left them with islands of disconnected data related to physical devices and assets that have an affect on the BES. This data consists primarily of work orders, maintenance activities, test results and supporting evidentiary documentation. Unfortunately, all of this data tends to reside in disparate systems such as ERP, spreadsheets, hard copies, custom databases, test systems, etc., and are typically spread across various departments and facilities in the enterprise. If a utility is found in non-compliance with the NERC Standard during an audit, it can result in fines from the tens to hundreds of thousands of dollars.

Achieving compliance with PRC-005-1

As daunting a challenge this might sound, there is a cost effective and simple solution that provides a central hub for real-time visual compliance to NERC PRC Standards. CATSWeb ER seamlessly integrates data from dozens of differing sources into a single repository and creates logical relationships amongst this data to perform measurements and analytics in real-time dashboards. This provides a visual status of PRC compliance of all devices and assets across the enterprise. Users also get real-time alerts and notifications as trends towards non-compliance occur, well before a state of non-compliance happens. The system also maintains a complete auditable history that’s ready for an audit of all devices, issues and actions in maintaining control and compliance.

Visit the NERC website to view enforcement actions, settlements and penalties.

TwitterFacebookDiggDeliciousTechnorati FavoritesEmailPrintFriendlyShare

Part II: Former FDA Inspector Miles | Key to Avoiding More Trouble with the FDA is Identifying Root Cause

Ken Miles, Former FDA Inspector

Ken Miles, Former FDA Inspector

Ken Miles, a 28 year veteran of the FDA, is today a widely-respected industry consultant to the medical device industry. He draws on his extensive experience to help firms effectively and efficiently comply with FDA requirements. Ken’s expertise includes evaluating Good Manufacture Practice (GMP) and Good Laboratory Practice (GLP) compliance, Quality System Regulations, and QSIT certification inspections (Management, Design, Process Controls, and CAPA).

In this multi-part series, we talked with Ken about FDA medical device inspections, CAPA, quality systems, audits, training and more.

Q: Where do you think companies fall short when it comes to implementing CAPA systems?

A: Some companies have a great CAPA program that is tied in with metrics, management reviews, etc., but ultimately may be only looking at trend analysis studies of post-production products. Unfortunately, they neglect trends with suppliers and internal production operations, or visa versa.  Valuable data can be obtained for correcting problems in their factory by looking at all trends: suppliers’ and in-house non-conforming materials and components, scrap rates, training issues, complaints, competitors’ non conformances (ie Warning Letter), etc.  Sometimes they’ll discover ”a peak in noncomformance with a certain product line”, but they fail to break it down to reveal that the nonconformance(s) only involve one or two models within the product line which is often the real culprit.

Company managers need to ask themselves, is it one model or all models? A certain shift? A certain part of the plant? Finding the root cause is very important in order to effectively resolve the problem(s). Companies need to isolate the problem and find out if it’s widespread, model specific, or a component. The big picture of using metrics is great, however, if you can’t drill down to the specific problem and root cause, then it’s really not solving the problem.

Q: Can you give us some examples of what you saw as an FDA inspector?

A: One time I was at a large global manufacturer and they had a lot of returned motherboards for ultrasound systems (hundreds of boards returned per month.) Instead of analyzing and finding the root cause of the problem of all these returned boards, they would simply rework and repair them – over and over again. These boards had a very high rate of return, but they would all just go into a big hopper for rework. They should’ve taken the time to do a root cause analysis, but they didn’t, preferring to continue to fix them. None of this was logged into a system, and no failure investigations were ever conducted.  Think of the risk to consumers and to the companies’ reputation and earnings! Think of the enormous waste in time and funds and other resources used for fixing the same problems over and over again.

This firm ended up having a major investigation by the FDA with recalls and monetary fines in the millions of dollars. If they had an effective CAPA system in place with root cause and failure investigations, they could’ve fixed the problem once and for all instead of reworking hundreds of motherboards per month.

Q: Why do you think medical device companies have such a problem with CAPA?

A: The biggest problem I see has to do with a lack of human resources. Typically a person in charge of CAPA has too many tasks and things tend to fall through the cracks. This generally happens to smaller companies with growing pains. That said, it also happens with the biggest ones, too. Bottom-line: the failure is about not devoting enough resources to CAPA, and letting other issues distract them because they are overworked.

Click here to learn more about CAPA Systems.

TwitterFacebookDiggDeliciousTechnorati FavoritesEmailPrintFriendlyShare

FDA CDRH Electronic Submissions Up Significantly in 2009

fda-logoNumbers don’t lie. Reviewing the year-end numbers for FDA’s CDRH electronic submissions (AS2 Electronic Submissions Gateway) provides some eye popping stats.  This is an early indicator that electronic medical device reporting submissions have significantly increased over 2008, and certainly suggests they’ll rise even faster this year after the final rule is published.

Comment period on the draft guidance ended November 2009. The final ruling is expected within weeks. According to some FDA insiders, many were relieved the agency wasn’t overwhelmed with comments (slightly over two dozen comments were filed), and the ones received were definitely “workable”.

So, what did 2009 numbers look like?

Source: FDA

Source: FDA

As the chart shows, early 2009 got off to a slow start, but picked up significantly in the fourth quarter of the year.

CDRH Year over Year Submissions Stats

Source: FDA

But when comparing 2008 vs. 2009, total submission numbers jumped from 4,619 to 21,296. It’s apparent that the device industry has picked up the pace when it comes to electronic submissions to FDA. And if this isn’t a wake up call for device companies to move away from paper 3500A submissions to eMDR, we don’t know what is.

We’ll be keeping a close eye on this through 2010.

TwitterFacebookDiggDeliciousTechnorati FavoritesEmailPrintFriendlyShare

Angiotech Leverages SaaS Model for Global Complaint Handling System to Standardize and Improve Efficiency

AngiotechThe concept of implementing SaaS is moving ahead quickly, especially in the medical device arena. Perhaps that shouldn’t be surprising; most industry experts say that device firms tend to be a bit more innovative when it comes to embracing new technologies.

That may be why Angiotech made the decision to go with AssurX’s OnDemand (SaaS) model as opposed to on-premise implementation for their global complaint handling system. Angiotech is a global specialty pharmaceutical and medical device company that discovers, develops, and markets innovative technologies and medical products primarily for local diseases or for complications associated with medical device implants, surgical interventions and acute injury.

AssurX’s CATSWeb system is already rolled out across four facilities – three in the US and one in Puerto Rico – with Europe expected by the end of 2009.

Larry Murphy, Senior Manager, Corporate Quality, was part of the team that made the decision to go with the SaaS model because they needed to get up and running quicker.

“We got the blessing of the IT group after they reviewed the AssurX system and were able to get answers quickly about the level of security and support,” Murphy said. “As far as the users are concerned, they really like having everything centralized, including the reporting capabilities. We have significantly improved our efficiency and productivity,” added Murphy.

Prior to implementing an automated complaint handling system, various divisions of Angiotech were using either paper-based systems or homegrown Access database applications. Now the company-wide system using CATSWeb allows them to process complaints in a more structured and standardized manner that provides a much higher level of quality of information as well as the ability to track progress using metrics and dashboards.

Future plans include expansion of the current process and perhaps implementing electronic medical device reporting (eMDR) somewhere down the line.

TwitterFacebookDiggDeliciousTechnorati FavoritesEmailPrintFriendlyShare

Don't Ignore 483s…it's in Your Best Interest to Respond in Writing

fda-logoEven though there’s no regulatory requirement to respond to an FDA 483 inspectional observations report, it’s in your best interest to do so in writing, according to FDA sources. In a recent presentation by Anita Richardson, Associate Director for Policy Office of Compliance & Biologics Quality, she outlined four reasons for submitting a comprehensive 483 response, and eight suggestions for an effective response.

Four reasons for submitting a well-prepared and timely 483 response:

  1. Could possibly mitigate an FDA compliance decision for further action (warning letter, etc.) “As a general rule, a Warning Letter should not be issued if the agency concludes that a firm’s corrective actions are adequate and that the violations that would have supported the letter have been corrected.”
  2. Demonstrates to the FDA (and other stakeholders) an understanding and acknowledgement of the observations
  3. Demonstrates to the FDA (and other stakeholders) a commitment to correct, i.e. the intent to voluntarily comply
  4. Establishes credibility with FDA

Eight suggestions for an effective 483 response

  1. Include a commitment/statement from senior leadership
  2. Address each observation separately
  3. Note whether you agree or disagree with the observation
  4. Provide corrective action accomplished and/or planned; tell FDA the plan
    • Be specific (e.g. observation-by-observation)
    • Be complete
    • Be realistic
    • Be able to deliver what you promise
    • Address affected products
  5. Provide time frames for correction
  6. Provide method of verification and/or monitoring for corrections
  7. Consider submitting documentation of corrections where reasonable & feasible
  8. BE TIMELY

Good advice. And remember…

“A well-reasoned, complete, and timely 483 response is in your best interest.”

TwitterFacebookDiggDeliciousTechnorati FavoritesEmailPrintFriendlyShare

Royal Bank of Scotland uses CATSWeb OnDemand for Managing Quality and Compliance Activities

rbslogoThe Royal Bank of Scotland (RBS Group) is one of the top 10 banking groups in the US and a principal supplier of corporate finance and debt capital markets services, with retail banking franchises stretching from New England to the Midwest.

In 2005, Juel McQueen, Assistant Vice President, Compliance, and her team in quality assurance needed a solution to track all corrective actions, periodic reviews and verification documents. Since resources for IT were already stretched, they decided to pursue a solution that was available as SaaS (Software as a service). After researching numerous vendors, Ms. McQueen and her team selected CATSWeb OnDemand with the blessing of their IT department because it suited their needs for security, functionality and versatility. CATSWeb is hosted at a SAS 70 Type II certified facility.

Prior to CATSWeb, the QA department was using Microsoft Word and Excel and routing files by email to solve their corrective actions and sign off on documents. Some of these attachments ended up being accidentally deleted or overlooked.  Now, instead of relying on file attachments in email, all users log into the CATSWeb system, view the tasks and documents assigned to them, and electronically sign off on them in a much more accurate and timely manner.

“AssurX helped me get started on the system with initial training, and now I do the necessary configuration changes myself,” said McQueen.

In addition to providing a centralized system for users, CATSWeb also generates executive reports for test results, findings and corrective actions.

TwitterFacebookDiggDeliciousTechnorati FavoritesEmailPrintFriendlyShare

From Fax to SaaS: How Oliver Medical Cut the Cord on Paper and Increased Productivity by 80%

oliverlogo1Three years ago, Oliver Medical, a leading medical packaging provider developing innovative sterile-grade packaging materials headquartered in Grand Rapids, MI, set out to find a solution to their ever-growing paper problem.

Lora Keena, Vice President of QA/RA, understood the importance of operating at the highest possible level of efficiency while not sacrificing safety, so she set out a goal to find an electronic solution to help establish real-time procedures that were easy to understand, train and update anywhere, anytime Oliver Medical personnel needed to do so.

She knew they had to move everything – forms, testing, and all quality systems – from paper to electronic. “Our old way was time consuming and cumbersome…we were faxing hard copies back and forth and it took forever,” Lora recalls.

There were four key requirements for a new electronic system:

“We didn’t have 12 – 18 months implementation time. I didn’t want that kind of delay” said Keena.

Lora and her team narrowed down their search to four vendors and AssurX’s Software as a Service (SaaS) solution quickly rose to the top.

Read the entire story about Oliver Medical.

TwitterFacebookDiggDeliciousTechnorati FavoritesEmailPrintFriendlyShare