A growing trend in US Food and Drug Administration (FDA) warning letters has been citations for “no justified rationale.” Since 2004, warning letters taking companies to task for poorly documented decision-making and risk-assessment practices has more than doubled — from two in 2004 to four in 2008 and five in 2009. These citations are always in relationship to risk-based decisions: sampling (what, how often, and how much), nonconformances and corrective/preventative actions (when is “root cause” actual root cause, when and why should an open nonconformance investigation be closed out), and clinical data decisions (what data to include or exclude, what patients to include or exclude).

As the FDA continues to cajole companies to adopt risk-based quality systems, such citations are becoming more common. One area increasingly coming under fire for poor decision-making is supplier oversight. Of the eleven warning letters noted above, 30% are directly related to supplier selection, qualification, and control. Unfortunately, try as you might to nail down your supplier quality management standard operating procedures and forms, poor documentation and records will betray you.

In an interview for my client newsletter, former FDA prosecutor Nancy Singer noted, “Companies are full of what I call document ‘land mines,’ written statements in the company's paper or electronic files that create havoc when uncovered in an inspection” (1). Such land mines can be found in a company where decisions about product safety and quality intersect with supplier management.

Regulatory Expectations: When it comes to controlling risk and documenting decisions related to supplier management, FDA officials expect you to balance safety and quality with your available resources and time. As CDRH quality systems expert Kim Trautman put it in August at the Supplier Quality Management Congress, 20 August 2009 in Washington, DC, “You can't put the same level of scrutiny on all your suppliers as you do on your critical suppliers. There has to be a balance. It's up to you define what the appropriate balance is for your company based on risk to patient, product quality, efficacy, and other such factors. You have to use risk management principles like those in ICH Q9 (2). You have to assess your risks, decide on controls, and document this.”

Outside the context of a conference, risks are not so neatly assessed, and decisions are not so nicely documented. This is where companies get into trouble.

Document Land Mines

Over the course of several days in August and September, I interviewed Singer for my SmarterCompliance FDA regulatory intelligence newsletter concerning mistakes companies continue to make that get them in trouble with the FDA (1). During her time with the US Department of Justice, she prosecuted seven medical device and biopharmaceutical companies and their executives for violating FDA statutes and regulations.

Singer is now president of the Compliance Alliance consultancy (www.compliance-alliance.com) and spends a significant portion of the year providing corporate workshops to executive teams and companies on document land mines that can get them into trouble. When it comes to supplier oversight and risk-based control records, she noted three common types of document land mines: meeting minutes, memos to files, and documents stamped CONFIDENTIAL or FOR INTERNAL USE ONLY.

In meeting minutes, companies too often capture what each individual at a meeting says. For instance, “Mary said we should ask the distributor to recall the product. John said that he was concerned about the effect of a recall on the bottom line. The decision was not to recall the product.” When found in your product or supplier files, all such meeting minutes do is give inspectors ammunition to dig deeper and question individuals about off-the-cuff remarks they make at meetings when they might not have all of the facts. To eliminate this type of land mine, it is better to state the overall conclusion alone: “The team decided not to recall the product when a health hazard analysis revealed that there would be no harm to patients.”

Memos to files can be tricky. FDA inspectors tend to take a negative view of them. A positive use of a file note can be when executives realize their company has a gap in its compliance program and decide to take action to resolve it. For instance, after an FDA inspection of supplier controls one of my clients realized that it did not have any real integration among the quality management team, the regulatory affairs group, and the supply chain management staff. As a result, the company brought me in to conduct a full gap analysis and present a set of recommendations and options. It then used the memo-to-the-file format to document that process, including decisions made on which recommendations to undertake and the priorities and timelines for each activity.

According to Singer, where companies get into trouble with file memos are when the memos are clearly written in an attempt to protect the company or its employees from legal and administrative penalties, criticism, or other punitive measures. In the situation above, after FDA inspectors uncovered the lack of integration among compliance teams, the executives might have written self-justification memos stating their views about solving the issue and pointing fingers at who or what got in the way — or noting that the inspectors had exceeded the scope of their inspection in pointing out the lack of a holistic compliance strategy. Such a memo to the file would be classified as a document land mine that would give future inspectors impetus to dig deeper. If the company were ever sued, that file memo would give ammunition to opposing counsel for painting a picture of executive ineptitude and self-interest.

Stamping CONFIDENTIAL or FOR INTERNAL USE ONLY on documents is a subtler land mine because it gives employees a false sense of security. Here my experiences in defending quality systems and internal corporate documents to outside litigators back up Singer's explanation. Just because something is stamped CONFIDENTIAL or FOR INTERNAL USE ONLY does not keep it from being subject to review and public disclosure in the event of a lawsuit — nor does it mean FDA inspectors will ignore the document.