Management of Nonconforming Products

This article examines the management of nonconforming products in medical device manufacturing.

First, it is essential to distinguish between nonconformity and nonconforming product.

Nonconformity refers to the failure to fulfill a specified requirement. This term applies broadly to any instance where established requirements—whether from regulations, standards, procedures, or specifications—are not met within a quality management system.

Nonconforming product, on the other hand, specifically refers to a product (including components, materials, or finished devices) that does not meet its specified requirements or specifications. This distinction is critical because while nonconformities can occur at various stages and levels of the quality system (such as documentation errors, process deviations, or training gaps), nonconforming product specifically relates to physical items that fail to meet product acceptance criteria.

ISO 13485:2016, Section 8.3 “Control of nonconforming product” addresses this topic in two distinct subsections: “8.3.2 Actions for nonconforming product detected before delivery” and “8.3.3 Actions for nonconforming product detected after delivery or use.” These sections recognize the fundamental difference in risk and required response between pre-delivery and post-delivery nonconformities.

This article focuses on the former: Section 8.3.2, which addresses actions for nonconforming product detected before delivery.

8.3.2 Actions for Nonconforming Product Detected Before Delivery

According to ISO 13485:2016, the organization shall deal with nonconforming product by one or more of the following methods:

a) By taking action to eliminate the detected nonconformity (rework)

b) By taking action to preclude its original intended use or application (disposal or return to supplier)

c) By authorizing its use, release, or acceptance under concession (also known as special acceptance or use-as-is)

The organization shall ensure that nonconforming product is accepted by concession only if justification is provided, authorization is obtained, and applicable regulatory requirements are met. Records of the concession and the identity of the person(s) authorizing the concession shall be maintained (refer to 4.2.5).

When nonconforming product is detected during manufacturing—that is, before delivery to the customer—one of these three dispositions must be selected and implemented.

Rework

When nonconforming product is discovered within the manufacturing process, rework (reprocessing or remanufacturing) may be performed to bring the product into conformance with specifications.

ISO 13485:2016, Section 8.3.4 “Rework” establishes specific requirements:

8.3.4 Rework

Rework shall be performed in accordance with documented procedures that take into account the potential adverse effect of the rework on the product. These procedures shall be subject to review and approval equivalent to those for the original procedures.

Following completion of rework, the product shall be verified to ensure that it conforms to applicable acceptance criteria and regulatory requirements.

Records of rework shall be maintained (refer to 4.2.5).

In the course of auditing medical device companies, I frequently encounter organizations performing rework without established documented procedures. This constitutes a regulatory violation.

Rework procedures must be created for each type of nonconforming product and must include detailed instructions for disassembly, reassembly, and any additional inspection or testing procedures required. Simply put, components or assemblies should not be disassembled without a documented procedure.

Furthermore, since the act of disassembling and reassembling components or devices that were previously assembled may introduce potential damage to the product, additional inspection and testing beyond the routine procedures must be performed to verify that the rework has not adversely affected product quality, safety, or performance.

These rework procedures must be reviewed and approved by the same level of authority responsible for reviewing and approving the original manufacturing procedures. This requirement ensures appropriate oversight and technical evaluation of the rework process.

It is also important to note that under FDA’s 21 CFR Part 820.90(b)(2), rework procedures must include provisions for retesting and reevaluation of the nonconforming product after rework to ensure that the product meets its currently approved specifications. Rework and reevaluation activities, including a determination of any adverse effect from the rework upon the product, must be documented in the Device History Record (DHR).

Disposal

For example, when incoming materials or components fail receiving inspection, they must not be introduced into the production line and should either be disposed of or returned to the supplier.

Similarly, for certain devices, if nonconformity is detected during final inspection, disposal rather than rework may be the appropriate disposition. The decision between rework and disposal typically depends on factors such as the nature and severity of the nonconformity, the economic feasibility of rework, and the potential risk that rework could adversely affect product quality or safety.

Concession (Special Acceptance or Use-As-Is)

In medical device manufacturing, concession can only be applied when both the customer has agreed to accept the nonconforming product (customer requirements are met) and all applicable regulatory requirements are satisfied.

During my consultation and audit activities, I occasionally observe organizations repeatedly using concession for the same recurring nonconformity. While regulatory requirements do not explicitly prohibit repeated use of concession, this practice is strongly discouraged and represents poor quality management.

Repeatedly granting concession for the same issue indicates one or both of the following problems:

The design specifications are being disregarded or are inappropriately strict. The manufacturing process has not been adequately improved or controlled.

To eliminate the need for repeated concessions, organizations must take one of the following corrective approaches:

Revise the design specifications to widen the acceptance criteria, if technically and clinically justified and properly validated. This approach requires careful consideration through design change control processes and may necessitate regulatory submissions depending on the significance of the change.

Implement Corrective and Preventive Action (CAPA) to improve process capability and prevent recurrence. This may involve process optimization, equipment upgrades, enhanced process controls, improved training, or changes to materials or methods.

The fundamental principle in medical device quality management is that customer requirements should typically be broader than design specifications, and design specifications should be broader than manufacturing control limits. This hierarchical approach, sometimes referred to as “specification stacking” or “tolerance allocation,” helps ensure that normal manufacturing variation does not result in products that fail to meet design requirements, and that design specifications provide adequate margin to consistently meet customer expectations and regulatory requirements.

It is worth noting that ISO 13485:2016 requires that when concession is granted, records must include the identity of the person(s) authorizing the concession. This requirement ensures accountability and traceability. Additionally, organizations should establish clear criteria and authority levels for granting concessions, typically requiring involvement of quality assurance, engineering, and when appropriate, regulatory affairs personnel.

Relationship to FDA Requirements

FDA’s 21 CFR Part 820.90 establishes requirements for nonconforming product control that are harmonized with ISO 13485:2016 but include additional specific provisions. The regulation requires that procedures address the identification, documentation, evaluation, segregation, and disposition of nonconforming product. Importantly, FDA requires that the evaluation of nonconformance include a determination of the need for an investigation and notification of the persons or organizations responsible for the nonconformance. This investigation requirement emphasizes the importance of understanding root causes and implementing appropriate corrective actions, not merely dispositioning individual nonconforming items.

Best Practices and Recommendations

Effective nonconforming product management requires:

Documented Procedures: Comprehensive procedures covering identification, segregation, evaluation, disposition, and any required investigation of nonconforming product.

Clear Authority and Responsibility: Well-defined roles and authority levels for reviewing and dispositioning nonconforming product, with appropriate technical expertise involved in disposition decisions.

Proper Segregation: Physical or electronic segregation of nonconforming product to prevent inadvertent use or delivery.

Root Cause Analysis: Investigation and analysis of significant or recurring nonconformities to identify and address systemic issues.

Traceability: Maintenance of complete records linking nonconforming product to its evaluation, disposition, and any follow-up actions.

Training: Ensuring personnel understand how to identify, handle, and document nonconforming product according to established procedures.

Trending and Analysis: Regular review of nonconformity data to identify patterns, trends, and opportunities for process improvement.

Organizations should view nonconforming product management not merely as a compliance activity but as a valuable source of information for driving continuous improvement in product quality and process performance. Each nonconformity represents an opportunity to enhance the quality system and prevent future occurrences, ultimately contributing to improved patient safety and product reliability.