Validation Expectations for Sub-Contract Companies.
We are entering into a contract to supply machined parts to a medical device manufacturer. Do we have to validate our machine shop?
You have no direct requirements from the FDA. It is the company that uses your facilities and abilities that must ensure your company practices and procedures (with regard to the subcontract work) are compliant with all the relevant FDA and cGMP requirements and guidelines (not withstanding Utah Medical).
However it can only be highly beneficial for your company to be able to state that you operate within the requirements of 21 CFR Part 820 and indeed have been independently audited for compliance with cGMP and Part 820. It is; at the end of the day, a good and rigorous QA and QC system. For the busy procurement manager to find a subcontractor who is compliant is a real-time bonus. It also greatly enhances his standing with all the QA/QC staff who are relieved of the unenviable task of trying to whip a none compliant contracting company into some degree of often reluctant compliance. Download a copy of the Part 820 requirement here.
So where does one start. In your case I would start by purchasing from us a Vendor Audit document and executing against your facility. This will give you a basic indication of what a major company is ideally looking for in selecting a subcontracting company.
The work (from here on we mean the regulated medical device work) you contract to execute on behalf of your client must be fully specified and formally documented in a format that can be reviewed by the regulatory authorities (contract / specifications / drawings / processes / tests / inspections). Costs and or prices may be obscured or deleted as required. No loose ends are permissible.
You need to put a Validation Master Plan (VMP) for your facility in place. This document must outline (for a visiting auditor/regulator) how you have integrated cGMP into all your controlled activities. Also details of job title responsibilities, scopes and organograms. Along with details of product and personnel ingress/egress flows, drawings and specifications for all plant facilities/utilities/processes/testing/storage. This is the first document an auditor will ask for. It is a live document and must reflect all things to all people.
All work must be carried out using approved documented procedures (live controlled SOP’s or method statements subject to QA/QC control amendment and cancellation). All production and test equipment must be risk assessed and validated accordingly. (validation automatically includes calibration, maintenance and many other considerations). All personnel (and contracting staff) require training records that indicate they are competent for the tasks they perform (no one is exempt from this requirement not even the CEO).
In validation it is essential that time is not wasted on frivolous activities. This is where you must use a Validation Risk Assessment (VRA) to document your justification for the scope of validation that you intend to use. The FDA now requires a written justification for all validation scopes. All process equipment from tumbling barrels to multi-axis machining centres must be validated. What do you validate; everything and anything that could affect the quality and or efficacy of the final product.
The Importance of Correct Procurement.
When an analysis of the end user's priorities, in procurement priorities, is made the importance of the equipment / programs being validateable ranks at number two out of ten. Second only to delivery; with cost ranking around sixth. This has been true in over 80% of all cases we have been involved with.
For the-would-be purchaser, it gives enormous reassurance to know that regulatory compliant validation protocols and plans are supplied. They are often willing to pay a 15 to 30 percent surcharge for these documents. If a consultant is hired to produce the full suite of validation documents (8/9 documents) considerable costs are involved. However it is the question; is the system / program actually capable of being validated? That makes people hesitate. I doubt (after over twenty years as an auditor) if there is any pharmaceutical company that has not at some time had to abandon new programs or equipment for these reasons.
The FDA have actually stated that 70% of validation problems are directly related to none compliant procurement methods.
Your comments about you having to validate the equipment or program are completely erroneous. The end user has that task; your task is to ensure that your product is validatable. That means in all ways it must be compliant with the applicable directives in cGMP. On our site we carry further details of all these requirements.
Some of Our Current Fast Moving Documents.
Software Validation SOP (Issue-2) -- $22.00
Software Validation Master Plan (issue-2) -- $115.00
Software Validation Risk Assessment (Issue 2) -- $125.00
Software User Requirements Specification. (Issue 2) -- $115.00
Software Validation Plan (Issue 2) -- $89.00
Software Design Qualification. (Issue 2) -- $89.00
Software Installation Qualification. (Issue 2) -- $89.00
Software Operational Qualification. (Issue 2) -- $89.00
Software Performance Qualification. (Issue 2) -- $89.00
Software Validation Package (Issue 1) -- $699.00
A recent warning letter demonstrates just how few companies use a Gap Analysis to validate that they are compliant. CAPA discrepancies continue to be the biggest single source of problems. However the daddy of them all recently has been a well known company that had carefully documented the levels of experience and educational standards required for various GMP sensitive roles (In accordance with GMP), only for the FDA to find the persons in these jobs were not qualified properly. (click here to read)
Do use a Gap Analysis and avoid these embarrassing events. Gap Analysis Tool (Issue 2.) -- $115.00
Validation Risk Assessment (Issue10.) -- $125.00
This popular Validation Risk Assessment (VRA) has now been edited and enlarged to include Part 11 assessment tables for you to use in classifying which of your predicate records require to be stored in compliance with 21 Part 11, and which do not. It also includes an Excel spreadsheet to allow you to establish a permanent record of all such judgements, as is now mandated by the regulatory authorities.