The idea of having a resource-starved FDA use internationally-accepted ISO 13485 audit reports in place of its own foreign facility inspections is gaining traction in Washington.

But FDA insiders, while not dismissing the idea, note that it is fraught with complications.

The FDA Amendments Act of 2007 directs FDA, for the purpose of setting risk-based inspection priorities, to accept voluntary submissions of International Organization of Standardization (ISO) quality system audit reports.

Device industry lobbyists now say FDA should go a step further.

At a recent hearing of the House Energy and Commerce health subcommittee, AdvaMed President Steve Ubl urged Congress to amend the law to allow FDA to accept the ISO 13485 international quality system standard as equivalent to the agency's own Quality System Regulation (QSR) (¹ Also see "Industry Opposes Idea Of New FDA Inspection Authority, Fee At House Hearing" - Medtech Insight, 19 May, 2008., p. 4).

"Doing so would allow FDA to use a company's compliance with the ISO standards in place of an FDA inspection," Ubl said. "This also would bring FDA into harmonization with the internationally recognized and accepted quality systems."

Some experts suggest that FDA could save its resources for "for-cause" and follow-up inspections of non-compliant companies, and let third-party ISO 13485 auditors handle the numerous, routine surveillance inspections.

"FDA ... can spot check it, they can provide oversight of the groups that they certify," David Feigal, former director of FDA's center for devices, told "The Gray Sheet."

"It would be a huge benefit because FDA will probably never have the resources, even with the current Congressional proposals, to do the statutorily mandated biannual inspections."

Further, if FDA had open access to the auditors' reports, as it does under its current third-party auditing program, it could view the notified bodies "as simply an extension of [itself]," he said.

FDA says the policy change could ultimately apply to foreign and domestic facility inspections alike, but before it becomes a reality, the agency will need to overcome some significant hurdles.

ISO And QSR Standards: Close, But Not The Same

Although FDA helped develop the ISO 13485 standard, and experts agree that it and FDA's Quality System Regulation are very similar, there are still some key differences, FDA says.

Notably, ISO 13485 does not address complaint investigation and complaint handling in enough depth, says Larry Spears, deputy director of regulatory affairs in CDRH's Office of Compliance.

ISO 13485 covers complaint procedures in terms of following up on non-conforming products, but FDA's regulation "gets into much more in terms of complaint investigation and ... failure investigation, which can lead to the whole discussion about whether the company needs to recall or take other corrective action," Spears said in an interview.

In addition, Spears said, FDA cannot get as much information out of ISO 13485 audit reports, because from what he's seen, they are not as thorough as FDA's facility inspection reports. He acknowledged, however, that FDA has not received many ISO 13485 audit reports so far.

ISO 13485 certifications are valid for three years, with interval inspections occurring about every six to 12 months. If FDA decides to take the next step and accept ISO audits in place of its own inspections, the benefits of inspecting more facilities, more frequently, would be "pretty significant," Spears said.

But, he explained, FDA will want to see greater alignment between the standards first.

FDA Is Just One Voice In ISO 13485 Dialogue

FDA's good manufacturing practice requirements and the ISO 13485 standards have both undergone changes over the years, and the two have gradually become more similar.

Some stakeholders hope ISO 13485 will be bulked up in the next round of review to bring it even closer to FDA's regulation. The ISO standard, reviewed every five years, was last updated in 2003.

According to FDA GMP/quality systems expert Kim Trautman, who also works on international standards efforts, the ISO 13485 standard writing group voted last fall not to consider revising the standard until the next review cycle in 2013.

In addition, Spears points out, "the FDA - the U.S. - is only one player looking at ISO." Many other countries sit on the writing committee, each with its own agenda.

ISO Audits Sub-Par, Says Former FDA Investigator

Equally important questions remain as to whether ISO audits are as rigorous as FDA inspections. In fact, some people doubt whether a third-party system that relies on the audited companies to pay the bill for inspections can ever be unbiased.

According to Denise Dion, senior regulatory consultant at Maryland-based Eduquest and former FDA investigator: "ISO audits primarily focus on whether or not you have procedures in place, and don't always focus on whether those are the appropriate procedures. I think they're not as stringent as an FDA inspection could be."

ISO certification doesn't mean much to an FDA investigator, she suggests. According to Dion, the standards may be similar, but they are not enforced with the same rigor.

ISO expert Christian Lupo, of NSF International Strategic Registrations, a notified body that conducts ISO 13485 certification audits, agrees.

"There's a difference in approach to auditing," Lupo explains. "QSR audits are more like ... negative insurance audits, where they're looking for something wrong," while ISO 13485 auditors are looking primarily for evidence of compliance. "We tend to give the client the benefit of the doubt."

The auditors can issue a document analogous to an FDA warning letter if they find evidence of violations, and may even revoke ISO certification, but "it doesn't happen very often," Lupo added. Among notified bodies, some are stricter than others, he noted.

The system could work, Dion and Lupo say, if FDA had some oversight over the third-party auditors. It's an unlikely scenario, Dion admits, but Lupo says some notified bodies would be amenable to it.

"If they qualified us, if they audited us as well, which of course we'd be open to because we have a lot of confidence in our system, I think it could work," he concluded.

- Jessica Bylander (j.bylander@elsevier.com)

Regulatory Experts Note Wrinkles In FDA Accepting ISO 13485 Quality Audits

More from Archive

More from Medtech Insight