Q: I’d like you to clarify whether or not we should include verification and validation (V&V) information within the Device Master Record (DMR) for each of our products.
21 CFR 820.181(c) says the DMR should include quality assurance procedures, including acceptance criteria. The Preamble to the Quality System Regulation (QSR) further states that V&V requirements pertaining to device processing should be included within the DMR.
Currently, our DMRs contain all device labeling, parts, and quality system documents specific to a device. But we don’t reference any V&V test procedures, because we believe only tests of the final device (which in our case would be conducted during installation when the hardware and software are installed and certified) should be included in the DMR. Instead, we only reference V&V testing within the Design History File (DHF).
Is this sufficient? Should we also include a reference to the V&V test procedures for the software being manufactured — because in some ways this could be viewed as acceptance criteria, i.e. final testing/acceptance of the software design?
In other words, for software manufactured, should our DMRs reference the V&V test procedures used during system testing, or is it OK just to maintain those tests in the DHF?
A: According to the Device Master Record requirements under 21 CFR 820.181(a), final software specifications should be transferred into production. So that means the final software specification for a particular device or type of device should be located or referenced in the Device Master Record, while any earlier version should be located or referenced in the Design History File.
The DMR is set up to contain or reference the procedures and specifications that are current on the manufacturing floor. In contrast, the DHF is meant to be more of a historical file for use during investigations and continued design efforts.
[pullquote align=”left” cite=”” link=”” color=”” class=”” size=””]FDA believes it’s more important to construct a document structure that is workable and traceable than to worry about whether something is contained in one file or another.[/pullquote]
But here’s a key point based on my experience: FDA believes it’s more important for manufacturers to construct a document structure that is workable and traceable than to worry about whether something is contained in one file as compared to another.
Let me expand on what you found in the QSR Preamble. The V&V results FDA is expecting in the DMR (or at least referenced in the DMR) are those pertaining to processes, not product. The V&V for product software should be in (or referenced in) the DHF. If it is production software or quality system software, then it should be in or referenced by a DMR or be a quality record.
What’s considered device processing? In the case of product software, the process is the copying of that software to media — hard drive, flash drive, CD, DVD, server, chip, etc. The validation of that process should be referenced in the DMR. The acceptance criteria is not for the software itself but for the copied version. Was it correctly and adequately copied?
Because they pertain to more than one device, there may be many documents that are part of a DMR that will not be stored or referenced there. Many of these you will keep as quality records.
To reiterate: FDA doesn’t really care where something is stored or even from where it is referenced — as long as you can locate it for your use and can produce it when requested by an auditor or regulator.
Answered by Denise Dion, Vice President of Regulatory & Quality Services at EduQuest (18 years as an expert FDA investigator and a member of FDA’s Design Control Inspection Strategy Team). Denise also is the lead instructor for EduQuest’s Design Control for Medical Devices training class.