Bryan joined Mitch Robbins on the RA/QA Today podcast to discuss “dark corners” in RA/QA - areas where RA/QA involvement is late or lacking. Bryan and Mitch discuss mergers, acquisitions, product development, change control, and other activities where involvement of qualified RA/QA professionals is critical in the early stages to ensure success.
Trust but Verify: It’s OK to Ask Questions
From due diligence for investments and M&A to internal and supplier auditing, being bold enough to ask questions may ultimately save your organization and reputation.
In the medical device and biologics industries, there is a lot of pressure to keep the ball rolling while also keeping it in bounds. Navigating financial progress must be made while remaining compliant to regulatory requirements and ensuring safety for the patients and users of your products. Such a tightrope is a challenge but is also certainly possible with the right resources and skills. This article evaluates one approach that individuals can take in any role and at any level in an organization: asking questions.
I continue to marvel with disgust at the massive ruse Theranos management deployed against patients, medical professionals, investors, business partners, regulators, and the public at large. This was one of several recent debacles that stain the reputation of a largely compassionate and honest industry. As I learn more about the Theranos debacle, my curiosity digs at the endless stream of lies perpetuated (whether intentionally or naively) by Elizabeth Holmes, her executive leadership, and top shareholders. How could they have such audacity and fearlessness in leveraging such lies to advance the company? Why did investors, potential business partners, and more media outlets not question the many claims that have now been exposed as total lies? Why were outsiders so accepting of Theranos’ inability to offer concrete evidence of any claims? In my own work, I’ve instantly identified more subtle cases of false and misleading information – why did it take so long for that to happen with Theranos? Let’s probe some examples so you understand my bewilderment and how I would’ve responded as a certified auditor and experienced due diligence professional.
First, Elizabeth Holmes claimed that the Theranos diagnostic device was deployed in medevac helicopters in Afghanistan by the Department of Defense. A second whopper was that the Theranos device did not need FDA approval to be marketed in the US. To her credit, Ms. Holmes stated that although the device did not require marketing authorization, they would seek FDA approval (actually, this supposed strategy highlights the possibility that Theranos had no regulatory affairs staff or consultants). The final fib we’ll discuss is how Theranos convinced potential investors that pharmaceutical companies were using the device in clinical trials. I understand the need for tact during discussions regarding acquisitions, mergers, or investment and the hesitation to appear incredulous. But these are perfect opportunities to probe for information simply on the grounds of genuine curiosity! If the negotiations are so fragile that asking legitimate questions will jeopardize the deal, that may highlight the suspect nature of the idea or organization for sale.
As an auditing and executive professional, some questions I would’ve asked when faced with the claims of medevac use would have been:
· What is the use and even advantage of the technology on a medevac helicopter? How does the technology in this application meet user needs?
· What feedback has the company received from combat zones on the advantages compared to other methods of testing?
· How is a precision instrument running 200 tests on two drops of blood validated to function in such a rough environment?
· What documentation is available demonstrating DoD or FDA approval for such use of the device?
· Do you have a photograph or video of the product being used in this application?
· What training was provided for use of the device?
Regarding the claim that FDA approval is not required for such a device, did anyone question such a definitive statement lacking any supporting detail? As a regulatory expert, I understand I approach this with much more knowledge than the average individual. However, did such a bold claim with such serious financial and safety implications not warrant some insistent questioning or background investigation? During due diligence, taking information at face value is a dangerous gamble. In this situation, I would’ve asked for:
· An FDA response to a 513(g) Request for Information;
· FDA pre-sub meeting minutes;
· Even informal documentation from FDA such as email correspondence; or,
· A regulatory strategy or rationale from a qualified regulatory affairs professional.
When Theranos implied the device was being used by pharmaceutical companies in clinical trials, were no follow-on questions posed by these investors? At a minimum, some additional information or verification would have been possible if this claim was true and asking for confirmation would not be out of line. If presented with papers documenting clinical performance of the device and branded with the logos of major pharmaceutical companies implying a partnership, I would ask:
· Which of the 200 tests performed by the Theranos device were being used in each study and why? Any investigational use (drug or device) should correspond with an entry on clinicaltrials.gov (hint, hint!).
· What feedback did Theranos receive from the investigators?
· Most importantly, would Theranos provide references or contacts at the pharma companies?
Theranos may very well have responded citing a cloud of secrecy and insisting confidentiality. Which in turn would prompt another question – given the supposed confidentiality, why leverage the relationships in the first place? Without a reference or some evidence of legitimacy, I would treat that information as null and possibly counterfeit. To proponents of a deal, this may seem extreme but skepticism is entirely reasonable without evidence.
Why was there seemingly such eagerness to patently accept the claims made by Holmes et al.? Why did such shallow and unsubstantiated lies prop up Theranos so long and enable them to receive billions in investments? It seems that the answer to this question is that the right questions were not asked or there was no persistence in the line of questioning. In my extensive history of auditing and performing due diligence assessments, I’ve never regretted asking questions, I’ve only regretted not. At the worst, my research and analysis were ignored. But even in those situations, the pressure test I applied to the organization was suitable to have identified any egregious violations.
Ensure you have the right team involved in auditing and assessing target companies and recipients of your investment funds; qualified quality and regulatory personnel are essential. During acquisitions and investment due diligence, don’t let the excitement blind you to reality. When auditing, hold firm on your line of questioning and don’t allow yourself to be distracted or placated. The sting of regret from poor due diligence outlasts and outweighs the excitement of the accomplishment. As stewards of the finances, safety, and well-being of so many, we must ask questions even if it’s uncomfortable. As penned by Suzanne Massie (Ronald Reagan’s adviser on Russian affairs) and stated often by President Reagan during diplomacy with the Soviet Union, “Trust, but verify.” No one should criticize you for asking legitimate questions; if verification were not necessary, due diligence and audits wouldn’t be performed in the first place.
Brosseau Consulting is available to assist your organization with due diligence, auditing, or other business matters requiring keen evaluation and analysis. Please contact Bryan here for more information and a complimentary initial consultation on how Brosseau Consulting can assist you in meeting goals and minimizing risk.
Acquisitions and Investment: Quality and Regulatory Due Diligence
Two activities regularly follow an acquisition or investment with inadequate quality and regulatory due diligence or no due diligence at all: recalls and remediation. Medical device manufacturing firms eager for investment or acquisition may be taxed for resources and eager to present a rosier picture than truly exists. This can lead to quality and regulatory breakdowns with little or no visibility to the investor or buyer. This article reviews three of the significant breakdowns I’ve observed and how these complications went unnoticed with inadequate quality and regulatory due diligence.
REGULATORY RISKS
In seeking to increase market share and win over key opinion leaders to champion their products, an implant manufacturing firm expanded several product lines. Several of these product line extensions were outside of the scope of FDA clearance. Letters to file were written to justify only some changes to products that were implemented without refiling. In some cases, the changes were arguably within the scope of the original clearance but nonetheless challenging to defend in an FDA inspection. Other product line extensions included significant dimensional and geometry changes well outside of the bounds cleared by the FDA in the 510(k) applications for the product lines. Furthermore, these parameter changes resulted in new risks and exceeded parameters of other existing products marketed by other companies. This oversight resulted in significant regulatory and legal liability for the new owners of the company. The resulting recall of unapproved products impacted the company’s reputation and resulted in scrutiny by the Food and Drug Administration.
How did this happen? The target company was careless in extending product lines and changes were made without the appropriate authorization from the company’s regulatory department. The due diligence team of the buyer reviewed regulatory submissions and letters to file but did not review the product technical documentation for regulatory compliance. Since no submission was filed and no letter to file was generated for the product family in question, the team did not identify this non-compliance.
PROCESS FAILURES
A company with a seemingly lucrative contract for OEM manufacturing was an appealing target for acquisition due to the high revenue generated in part by the contracted products. The OEM products were all single-use, sterile surgical instruments. The due diligence team evaluated samples of finished, packaged product provided by the acquiree and reviewed some technical documentation including product specifications. The products and product packaging appeared appropriate and equivalent to similar, competing products. However, multiple problems were identified after acquisition:
- Inappropriate packaging material selection resulting in packaging debris within some packages
- Improperly designed packaging systems resulting in packaging damage during shipping and thus non-sterile product
- Sterile packaging process errors resulting in non-sterile product
- Improper sterilization validations possibly resulting in inadequately sterilized product
- Erroneous labeling due to inadequate labeling controls
The cost of the resulting recall, redesign and testing of the packaging, labeling corrections, and sterilization validation resulted in a substantial loss immediately after acquisition. The products were backordered for months during these product remediation activities. Furthermore, the related quality system remediation significantly tied up internal human resources. Lastly, the relationship with the own-branding company was damaged and the revenue calculated during due diligence decreased significantly.
How did this happen? Egregious lack of basic quality management at the target company resulted in failures with process validation, process control, design control, and packaging validation. The company maintained the required procedures for these activities, but employees did not follow them. No employees had undergone training in these areas and there was absentee management across all quality and regulatory areas. The due diligence team reviewed product documentation and high-level process documentation but did not probe records generated through these activities. No assessment of training records or on-site evaluation of operations was performed by individuals with quality or operations experience. When product samples were requested, they were “cherry-picked” to provide the best-looking packaging. An auditing approach to due diligence may have prevented this acquisition or, at least, resulted in a more appropriate valuation of the target.
PRODUCT PERFORMANCE & POST-MARKET SURVEILLANCE
During due diligence for an acquisition, the acquiring company requested complaint files and adverse event reports (both terms having specific definitions in the medical device world). The target company provided records which demonstrated that few complaints were reported and very few adverse events had occurred during the use of the device.
After acquisition and during integration of quality system processes into the parent company, the quality personnel discovered that numerous reports alleging product failures were received by the company but were not categorized as “complaints” or “reportable adverse events”. Due to the use informal and incorrect terminology, these events were categorized as:
- “pre-complaints” indicating that the information may constitute a complaint, but a final determination was not pursued
- “non-complaints” because the company erroneously determined the information did not constitute a complaint
- “non-events” because the company’s regulatory consultant falsely determined that the adverse event did not meet the criteria for reporting
Furthermore, most product failures were associated with one accessory – the top selling accessory used in each surgery. Numerous adverse event reports were filed with the FDA by one user facility, prompting an investigation by the FDA into the reported events. The following activities were required to rectify the situation:
- Retrospective reporting of adverse events to the Food and Drug Administration
- Customer advisory notice (classified as a recall) to prevent product failures during use of existing hospital inventory
- Quality system corrective and preventive actions with the resulting actions reported to the FDA per their mandate (including the revision of procedures and retraining of all employees)
- Redesign of the accessory to prevent failures
- Revisions to the instructions for use to prevent failures and adverse events
How did this happen? The target company was eager to stifle bad news about their products and was fearful of action by FDA in response to reporting product issues. The company attempted to be creative with the regulatory definitions and requirements (not an altogether uncommon practice) to justify decisions and developed their own terminology to skirt requirements. The due diligence team, blinded by optimism and eager to close the deal, did not delve further and trusted that the provided information was the totality of information regarding product failures. The due diligence team specifically requested product complaint files and adverse event reports. Since they inadvertently limited the scope of their request, not all information related to the performance or product in the field was divulged. Auditing techniques that would have identified this information were not employed by the due diligence team.
RECOMMENDATIONS
As you can imagine, the case studies above do not represent the only problems in each target company. However, these situations were chosen to succinctly highlight the importance of thorough due diligence using publicly available information to maintain confidentiality. In performing due diligence for an acquisition or investment, I recommend the following:
- Hire a quality and regulatory consultant and auditor with experience working with numerous and varied companies to ensure adequate investigation and probing. If you have had some exposure to quality and regulatory matters, don’t assume a basic understanding is adequate to identify risks like those described above.
- Ask open-ended and general questions to avoid receiving limited information, be mindful of any inadvertent restrictions in how you phrase requests.
- Use a top-down assessment of the Quality Management System in addition to product-specific reviews. Quality processes can have a substantial impact on product.
- Perform a checklist and process-based assessment of the quality management system and regulatory files to ensure a thorough assessment.
- Don’t let the excitement of the acquisition or investment prevent you from investigating adequately. Identifying compliance or liability issues won’t necessarily terminate the deal; it will allow a fair valuation.
If you would like expert quality and regulatory support for due diligence, contact Brosseau Consulting LLC by email to bryan@brosseauconsult.com or by telephone at 770-855-7372. I can help prevent buyer’s remorse by providing experienced quality and regulatory support during due diligence.