Risk management by Regulatory Authorities, Part 2 of 2
An obvious design for the first tier would be to have the manufacturer, his representative or the importer enter data through a website. In that way the company will remain responsible for the quality of the data and it will reduce workload for the authorities. Once these data have been entered they can be checked. If designed well, part can even be done automatically. This check may result in uncertainty regarding the compliance of the device or the companies involved. In such a case, the file will be escalated to a higher level.
This next step (second tier) will involve the Regulatory Authority requesting more information from the companies involved, as well as research into other sources of data. For example, if it is not clear a product is a medical device this may be evaluated more in detail. A product status specialist may assess claims on the label or in the instructions for use, for example.
If those steps are still inconclusive, a specialist may examine the manufacturer’s technical file and request additional information (third tier). This may result in a specific decision by the Regulatory Authority regarding this particular device or company.
It is obvious that each tier demands a higher level of expertise, but that will be focussed on a smaller amount of devices. Each authority will have to develop a risk model to filter these devices for the next level of scrutiny.
Once a device has been granted market access, a manufacturer can physically place that device on the market. Imported devices usually have limited points of entry like airports and harbours. Customs checkpoints provide a good opportunity for verifying that imported devices are allowed into a particular market. Details on the label and in accompanying documents need to match those in the database. The main question is whether this device has been granted market access:
- Is it possible to identify this product as a device that has been positively assessed for market access?
- Does the information accompanying this device match with information that is already in the system?
In case this check leads to questions, there should preferably be a quick help line available to assist Customs with clearing these devices. Staff at the help desk may have access to further details in the database and have more in depth knowledge about the subject.
Should this not lead to a clear conclusion, further investigation, e.g. product testing may be necessary. That will demand more time for the whole process and there may be substantial costs involved.
Again the three tiers can be identified: from a simple 100% check to a limited check that requires high levels of expertise. All this needs to be organised well, and a central database plays a vital part.
Ad hoc cases
A vigilance case, a serious complaint, a document that is not compliant—all these are examples of special situations where an ad hoc case can occur. Regulatory Authorities often have procedures in place for these kinds of cases.
In such situations the three-tier system is also applicable. For example, there may be a vigilance procedure for situations where a medical device has been involved in accidents. The first tier would comprise the registration of the incident. The fact that a manufacturer notifies a Regulatory Authority about a reportable incident at least sends a clear signal that the firm understands this specific part of the legislation. The notification of the incident also provides a good opportunity to use a simple risk assessment tool to make a first selection of low risk cases. Of course, a first step would be to look in the database and see if this device has been granted market access, and to check other related information. More senior and experienced Regulatory Authority staff can examine high-risk cases as well as those in which it is not possible to clearly assess risk (second tier).
If a case leads to questions about the compliance of the device it may become necessary to go to the third tier and to have the technical file or other information assessed by senior staff.
Three-tier system training
The three-tier system involves several levels of expertise and often several organisations working together on a national level. Data collection, data storage and data sharing should be developed carefully. But organisations that want to start using the three-tier system should first make sure they fully understand it. Emergo Group is capable of providing this training and help with developing the systems behind the three-tier approach. By helping authorities to understand all the aspects of this approach, it becomes possible for them to develop their own dedicated systems and procedures. Training for the three-tier system will not lead to a finished system, but is a good start toward developing one.
Ronald Boumans is Senior Global Regulatory Consultant at Emergo and formerly a senior inspector with the Dutch Healthcare Inspectorate. He has been involved in developing risk models for supervision of medical devices.