Latest / Let's Talk Risk! Podcast / Deep Dive: When the Risk Baseline and the QMS Both Break Down

Transcript

Deep Dive: When the Risk Baseline and the QMS Both Break Down · Let's Talk Risk! Podcast

• 0:00
  SPEAKER_01: Imagine authorizing your engineering team to push an update to a life support device
• 0:05
  SPEAKER_01: and the work order literally just says, clean up all code.
• 0:09
  SPEAKER_00: Oh, yeah.
• 0:10
  SPEAKER_00: Terrifying.
• 0:11
  SPEAKER_01: Right.
• 0:11
  SPEAKER_01: I mean, no record of what was actually changed.
• 0:14
  SPEAKER_01: No testing.
• 0:15
  SPEAKER_01: Just, you know, a blind software update pushed out into the wild.
• 0:19
  SPEAKER_00: Just crossing your fingers and hoping for the best.
• 0:21
  SPEAKER_01: Exactly.
• 0:21
  SPEAKER_01: And today we are doing a deep dive into an FDA warning letter
• 0:26
  SPEAKER_01: that shows exactly what happens when a medical device company treats safety like
• 0:32
  SPEAKER_01: a rough draft.
• 0:33
  SPEAKER_00: Which is unfortunately more common than you'd think.
• 0:35
  SPEAKER_01: Yeah.
• 0:35
  SPEAKER_01: And for you executives listening,
• 0:37
  SPEAKER_01: here is the absolute strategic bottom line
• 0:39
  SPEAKER_01: on quality management system risk governance.
• 0:43
  SPEAKER_01: Compliance is not a regulatory tax on your business.
• 0:46
  SPEAKER_00: Right.
• 0:46
  SPEAKER_00: It's not just a hoof to jump through.
• 0:47
  SPEAKER_01: It's routine operational systems design.
• 0:50
  SPEAKER_01: I mean, it as is what gives you speed to market,
• 0:53
  SPEAKER_01: predictable product performance,
• 0:54
  SPEAKER_01: and ultimately it protects your long term enterprise value.
• 0:58
  SPEAKER_00: Yeah, because when a leadership team views compliance
• 1:00
  SPEAKER_00: as this separate annoying hurdle rather than,
• 1:03
  SPEAKER_00: you know,
• 1:04
  SPEAKER_00: the foundation of their strategy, they literally lose control of their own product.
• 1:08
  SPEAKER_01: 100%.
• 1:09
  SPEAKER_00: I mean, the regulations we're going to unpack today aren't arbitrary rules invented
• 1:12
  SPEAKER_00: by bureaucrats.
• 1:14
  SPEAKER_00: They're codified engineering principles.
• 1:16
  SPEAKER_01: So I want to dig right into this because our source material today is an FDA warning letter.
• 1:22
  SPEAKER_01: It was issued on August 21st, 2026 to Lyon Street Medical doing business as Pensar Medical LLC.
• 1:30
  SPEAKER_00: Right.
• 1:30
  SPEAKER_00: They manufacture negative pressure wound therapy systems.
• 1:32
  SPEAKER_01: Yeah.
• 1:33
  SPEAKER_01: Devices like the Wound Pro,
• 1:34
  SPEAKER_01: the Wound Pro Plus A, and the MicroDoc, which is also referred to as the PocketDoc.
• 1:40
  SPEAKER_00: Yeah.
• 1:40
  SPEAKER_01: But before we get into the failures,
• 1:42
  SPEAKER_01: let's just establish what these devices actually do because you really need
• 1:45
  SPEAKER_01: to understand the stakes here.
• 1:47
  SPEAKER_00: Well, negative pressure wound therapy,
• 1:48
  SPEAKER_00: it's used for patients with really severe, often chronic wounds.
• 1:52
  SPEAKER_00: So think diabetic ulcers,
• 1:55
  SPEAKER_00: severe burns, or like large surgical incisions that just won't close properly.
• 2:00
  SPEAKER_01: Okay, so highly vulnerable patients.
• 2:02
  SPEAKER_00: Exactly.
• 2:02
  SPEAKER_00: And the system involves placing a specialized foam dressing directly into
• 2:05
  SPEAKER_00: the wound bed, sealing it with an airtight film and connecting it to a vacuum pump.
• 2:10
  SPEAKER_00: Right.
• 2:10
  SPEAKER_00: So the device applies continuous or intermittent negative pressure,
• 2:14
  SPEAKER_00: a vacuum effect basically,
• 2:15
  SPEAKER_00: to draw out fluid or exudate and infectious materials into a little canister.
• 2:20
  SPEAKER_01: So it physically pulls the edges of the wound together while removing the fluids
• 2:25
  SPEAKER_01: that cause infection.
• 2:27
  SPEAKER_01: And that promotes blood flow and tissue growth.
• 2:29
  SPEAKER_00: That is the goal.
• 2:30
  SPEAKER_01: Yeah.
• 2:30
  SPEAKER_00: And because it interacts directly with compromised tissue,
• 2:34
  SPEAKER_00: the mechanical precision of that pump,
• 2:36
  SPEAKER_00: the sterility of the packaging,
• 2:38
  SPEAKER_00: and the reliability of the software controlling the vacuum pressure,
• 2:41
  SPEAKER_00: it's all absolutely critical.
• 2:43
  SPEAKER_01: Because if it fails.
• 2:44
  SPEAKER_00: If the pressure drops, the wound just stops healing.
• 2:47
  SPEAKER_00: But if the pressure spikes, you can actually damage that fragile new tissue.
• 2:50
  SPEAKER_01: Which brings us to the mission for this deep dive.
• 2:53
  SPEAKER_01: We are going to explore how a failure to integrate risk management across
• 2:57
  SPEAKER_01: the entire product lifecycle led to a complete cascade of operational failures
• 3:02
  SPEAKER_01: for Pensar.
• 3:02
  SPEAKER_00: Right.
• 3:02
  SPEAKER_00: Looking at this through the lens of the QMSR,
• 3:05
  SPEAKER_00: the Quality Management System Regulation, and ISO 13485.
• 3:09
  SPEAKER_01: Yeah.
• 3:09
  SPEAKER_01: Specifically,
• 3:10
  SPEAKER_01: what happens when risk management isn't built into that initial manufacturing phase,
• 3:16
  SPEAKER_01: how software changes become incredibly dangerous without a baseline,
• 3:20
  SPEAKER_01: and why a broken KP system basically guarantees you'll repeat your mistakes.
• 3:25
  SPEAKER_00: Well, the best place to start is at the very beginning of a product's life cycle.
• 3:29
  SPEAKER_00: What the industry calls product realization.
• 3:31
  SPEAKER_01: Which is when it goes from a drawing to a real thing, right?
• 3:34
  SPEAKER_00: Exactly.
• 3:34
  SPEAKER_00: It's the phase where you transition a design on paper into
• 3:38
  SPEAKER_00: a physical product you can actually manufacture and sell.
• 3:42
  SPEAKER_00: And Clause 7.1 has a very clear rule here.
• 3:45
  SPEAKER_00: You must document risk management during this realization phase.
• 3:48
  SPEAKER_01: Right.
• 3:48
  SPEAKER_01: And according to the warning letter,
• 3:50
  SPEAKER_01: the FDA inspector looked at Pensar's design failure mode and effects analysis,
• 3:54
  SPEAKER_01: their DFMEA for the pocket dock device.
• 3:57
  SPEAKER_00: And what did they find?
• 3:58
  SPEAKER_01: Well, the document did identify distinct hazards,
• 4:01
  SPEAKER_01: but when it came to the actual risk control verifications,
• 4:04
  SPEAKER_01: you know, the proof that they mitigated those hazards.
• 4:06
  SPEAKER_00: Let me guess, they were missing.
• 4:08
  SPEAKER_01: Entries for software,
• 4:09
  SPEAKER_01: sterilization,
• 4:10
  SPEAKER_01: packaging, exudate management, they were all simply marked in progress.
• 4:14
  SPEAKER_00: Oh, wow.
• 4:15
  SPEAKER_00: In progress.
• 4:16
  SPEAKER_01: Yeah.
• 4:16
  SPEAKER_00: I mean, leaving a risk control marked in progress means you've identified a way
• 4:21
  SPEAKER_00: the device could potentially harm a patient,
• 4:23
  SPEAKER_00: but you just haven't bothered to prove your proposed solution actually works.
• 4:27
  SPEAKER_01: I am genuinely trying to wrap my head around this.
• 4:30
  SPEAKER_01: If I'm a CEO and I see in progress on my critical risk controls
• 4:34
  SPEAKER_01: for something like sterilization,
• 4:36
  SPEAKER_01: my first instinct is, okay, this product physically cannot leave the building.
• 4:41
  SPEAKER_00: Right.
• 4:41
  SPEAKER_00: It shouldn't.
• 4:42
  SPEAKER_01: Am I misunderstanding how FDA clearance works here?
• 4:45
  SPEAKER_01: Or did this company just totally bypass their own gatekeepers?
• 4:48
  SPEAKER_00: Well, it's actually a super common misconception about how the regulatory framework operates.
• 4:53
  SPEAKER_00: Oh, really?
• 4:54
  SPEAKER_00: Yeah.
• 4:54
  SPEAKER_00: The FDA clears the initial design of a device based on a pre-market submission,
• 4:59
  SPEAKER_00: assuming the data you provide is accurate.
• 5:01
  SPEAKER_00: But they don't, like, sit in your facility checking every piece of paper before a box ships.
• 5:05
  SPEAKER_01: Oh, so they're relying on you?
• 5:07
  SPEAKER_00: Completely.
• 5:08
  SPEAKER_00: They grant the clearance with the legal expectation
• 5:11
  SPEAKER_00: that your internal quality management system will act as the gatekeeper.
• 5:15
  SPEAKER_00: Pensar essentially dismantled their own gates.
• 5:17
  SPEAKER_01: You know what this reminds me of?
• 5:19
  SPEAKER_01: From an executive standpoint, it's almost like building a massive cargo ship.
• 5:24
  SPEAKER_00: Okay.
• 5:24
  SPEAKER_01: And you launch it into the harbor while
• 5:26
  SPEAKER_01: the hull's watertight doors are still just like a sketch on a notepad.
• 5:30
  SPEAKER_00: That is a perfect analogy.
• 5:32
  SPEAKER_01: You might float out of the harbor on a sunny day,
• 5:34
  SPEAKER_01: but the second you hit rough water, you are taking on water and going down.
• 5:37
  SPEAKER_01: I mean, how does an operation even function without a basic risk map?
• 5:43
  SPEAKER_00: Yeah.
• 5:43
  SPEAKER_00: Yeah.
• 6:05
  SPEAKER_00: But what is truly staggering is that for their Wound Pro product line,
• 6:09
  SPEAKER_00: the FDA found absolutely zero FMEAs of any type.
• 6:13
  SPEAKER_01: Wait, wait, zero.
• 6:15
  SPEAKER_01: No design FMEA, no process FMEA, no user FMEA.
• 6:18
  SPEAKER_00: Nothing was found to exist.
• 6:20
  SPEAKER_01: It's just nothing.
• 6:21
  SPEAKER_01: Wow.
• 6:22
  SPEAKER_00: And their own formal QMS process risk management procedure required all three
• 6:27
  SPEAKER_00: of those for every single product.
• 6:29
  SPEAKER_01: So they wrote a rule book for themselves and then entirely ignored it.
• 6:33
  SPEAKER_01: I really want to dig into the how of this.
• 6:36
  SPEAKER_01: Like, how does a company arrive at a point where
• 6:39
  SPEAKER_01: an entire product line has zero risk documentation?
• 6:43
  SPEAKER_00: Yeah.
• 6:43
  SPEAKER_01: Is it just sheer incompetence or is there some systemic operational flaw at play here?
• 6:48
  SPEAKER_00: Well, in many organizations that struggle with this, it really comes down to a siloed culture.
• 6:53
  SPEAKER_01: Okay, how so?
• 6:54
  SPEAKER_00: So research and development might design a product,
• 6:56
  SPEAKER_00: get the regulatory clearance,
• 6:58
  SPEAKER_00: and then basically toss the design over the wall to manufacturing.
• 7:01
  SPEAKER_01: Ah, I've seen that.
• 7:02
  SPEAKER_00: Right.
• 7:03
  SPEAKER_00: If R&D never finalized the risk verification and manufacturing is,
• 7:07
  SPEAKER_00: you know,
• 7:08
  SPEAKER_00: only incentivized by production quotas, the paperwork just sits in limbo forever.
• 7:11
  SPEAKER_01: And the warning letter also noted that when the FDA pointed this out,
• 7:15
  SPEAKER_01: Pensar's short-term correction was inadequate because they lacked
• 7:18
  SPEAKER_01: an interim risk mitigation plan.
• 7:20
  SPEAKER_00: Yes.
• 7:21
  SPEAKER_01: Let's translate that for the executives listening.
• 7:23
  SPEAKER_01: What exactly is an interim risk mitigation plan?
• 7:25
  SPEAKER_00: So if you're caught manufacturing a device without verified risk controls,
• 7:30
  SPEAKER_00: you can't just promise the FDA, hey,
• 7:32
  SPEAKER_00: we'll hire a consultant to write up the FMEA over the next six months
• 7:36
  SPEAKER_00: while you just keep shipping the product as usual.
• 7:38
  SPEAKER_01: Because you're still putting unverified devices on the market.
• 7:41
  SPEAKER_00: Exactly.
• 7:42
  SPEAKER_00: During those six months, you are still exposing patients to unverified risks.
• 7:47
  SPEAKER_00: An interim plan means putting immediate temporary guardrails in place.
• 7:51
  SPEAKER_01: Like what?
• 7:52
  SPEAKER_00: Like 100% manual inspection of every single unit.
• 7:55
  SPEAKER_00: Or even halting production entirely until the foundational paperwork is actually fixed.
• 8:00
  SPEAKER_00: And Pensar just didn't do this.
• 8:02
  SPEAKER_01: So if a company doesn't know what its baseline risks are,
• 8:05
  SPEAKER_01: and they don't have a verified map of how their product functions safely,
• 8:08
  SPEAKER_01: what happens when they inevitably need to change or update that product?
• 8:11
  SPEAKER_00: Well, that's where things are really dangerous.
• 8:13
  SPEAKER_01: Right.
• 8:14
  SPEAKER_01: That dynamic brings us to the next massive failure in this morning letter.
• 8:18
  SPEAKER_01: Which is Clause 7.3.9, the control of design and development changes.
• 8:23
  SPEAKER_01: Because without a baseline, engineering changes just become blind gambles.
• 8:27
  SPEAKER_00: Totally.
• 8:28
  SPEAKER_00: The standard requires any medical device manufacturer to adequately review,
• 8:33
  SPEAKER_00: verify, validate, and approve design changes before they're implemented.
• 8:38
  SPEAKER_00: You have to prove the change doesn't introduce a totally new hazard.
• 8:41
  SPEAKER_01: But because Pensar didn't have their baseline risk controls locked in,
• 8:45
  SPEAKER_01: their change management process was basically chaos.
• 8:48
  SPEAKER_00: Absolute chaos.
• 8:49
  SPEAKER_01: Let's look at the software side of this.
• 8:50
  SPEAKER_01: The FDGA found they implemented multiple software changes to the MicroDoc
• 8:55
  SPEAKER_01: and WoonPro Plus devices without any batch records confirming
• 8:59
  SPEAKER_01: the updates actually took place on the manufacturing line.
• 9:01
  SPEAKER_00: It's just wild.
• 9:02
  SPEAKER_01: For instance,
• 9:03
  SPEAKER_01: they had an engineering change order,
• 9:05
  SPEAKER_01: ECO 25039, for a WoonPro Plus firmware update, but zero proof it was installed.
• 9:11
  SPEAKER_00: And during the inspection,
• 9:12
  SPEAKER_00: the company's president actually confirmed
• 9:14
  SPEAKER_00: that no such batch record had been documented.
• 9:16
  SPEAKER_01: Unbelievable.
• 9:17
  SPEAKER_00: But the most glaring example of this chaos was ECO 25008.
• 9:21
  SPEAKER_00: The stated purpose of this engineering change order was to, and I quote, clean up all code.
• 9:27
  SPEAKER_01: Okay, I have to push back on this for a second.
• 9:29
  SPEAKER_01: Because in the broader tech world, right,
• 9:31
  SPEAKER_01: software engineers push massive code cleanups,
• 9:34
  SPEAKER_01: refactoring agile updates all the time.
• 9:37
  SPEAKER_01: It's standard practice to improve user experience.
• 9:40
  SPEAKER_00: Sure, in consumer tech.
• 9:41
  SPEAKER_01: Yeah.
• 9:42
  SPEAKER_01: So why is a general code cleanup such a cardinal sin in medical devices?
• 9:47
  SPEAKER_00: Well, the difference really lies in the consequences of a failure.
• 9:50
  SPEAKER_00: And just the interconnected nature of the software.
• 9:53
  SPEAKER_00: I mean, in consumer tech,
• 9:55
  SPEAKER_00: if a code cleanup introduces a bug,
• 9:56
  SPEAKER_00: an app crashes and you have to restart your phone.
• 9:59
  SPEAKER_01: Right.
• 9:59
  SPEAKER_01: Minor inconvenience.
• 10:00
  SPEAKER_00: But in a negative pressure wound therapy device,
• 10:03
  SPEAKER_00: if a code cleanup inadvertently changes, say, the timing of the vacuum sensor.
• 10:08
  SPEAKER_01: Oh, man.
• 10:09
  SPEAKER_00: Yeah.
• 10:09
  SPEAKER_00: The device might apply continuous high pressure to a fragile surgical wound.
• 10:14
  SPEAKER_00: That can cause severe hemorrhaging.
• 10:15
  SPEAKER_01: And the warning letter states that neither the CEO nor
• 10:18
  SPEAKER_01: the president could even explain what code changes were actually incorporated under
• 10:22
  SPEAKER_01: that cleanup all code order.
• 10:24
  SPEAKER_00: No verification record existed at all.
• 10:26
  SPEAKER_01: Hearing an engineering order to clean up all code with zero paper trail
• 10:31
  SPEAKER_01: that is terrifying for leadership, that is not a controlled change.
• 10:35
  SPEAKER_01: That is introducing a black box into your product line.
• 10:38
  SPEAKER_00: Exactly.
• 10:39
  SPEAKER_00: Which reveals a fundamental misunderstanding of regression testing
• 10:43
  SPEAKER_00: within their software validation procedure.
• 10:45
  SPEAKER_01: Walk us through regression testing.
• 10:47
  SPEAKER_00: So regression testing is the process of confirming that unchanged portions of
• 10:51
  SPEAKER_00: the software weren't inadvertently disrupted by a change you just made.
• 10:55
  SPEAKER_00: Software is deeply interdependent, right?
• 10:57
  SPEAKER_00: Right.
• 10:57
  SPEAKER_00: So a change in a module that controls,
• 11:00
  SPEAKER_00: let's say, the display screen could unexpectedly draw more power.
• 11:04
  SPEAKER_00: And that causes the module that controls the pump motor to starve and shut down.
• 11:08
  SPEAKER_01: Oh, wow.
• 11:09
  SPEAKER_00: If you aren't performing regression testing against a baseline risk map,
• 11:12
  SPEAKER_00: you are literally just crossing your fingers.
• 11:14
  SPEAKER_01: How does a team confidently drive product iteration and speed to market
• 11:18
  SPEAKER_01: if they cannot prove what code is in the device they just shipped?
• 11:21
  SPEAKER_00: They can't.
• 11:22
  SPEAKER_00: They also made a hardware or firmware change that they characterized as
• 11:27
  SPEAKER_00: a cosmetic noise change without documenting a risk assessment tied to
• 11:32
  SPEAKER_00: the original DFMEA.
• 11:34
  SPEAKER_01: They just said it was cosmetic.
• 11:35
  SPEAKER_00: They just declared it was unrelated to safety or effectiveness.
• 11:39
  SPEAKER_01: Let's break down the mechanics of why
• 11:40
  SPEAKER_01: a quote-unquote cosmetic noise change is never just cosmetic in a vacuum pump.
• 11:45
  SPEAKER_00: Okay, so to make a mechanical pump quieter,
• 11:47
  SPEAKER_00: you usually have to change the physical housing,
• 11:51
  SPEAKER_00: perhaps adding dampening materials,
• 11:53
  SPEAKER_00: or you change the voltage to lower the motor's RPMs.
• 11:56
  SPEAKER_01: And if you add dampening foam to the housing,
• 11:58
  SPEAKER_01: you might trap heat, which could cause the motor to overheat and fail.
• 12:02
  SPEAKER_00: Precisely.
• 12:03
  SPEAKER_00: Or if you lower the motor RPMs,
• 12:05
  SPEAKER_00: you might change the flow rate of the exudate being pulled from the wound.
• 12:09
  SPEAKER_00: You cannot simply declare a change safe without proving it against your risk map.
• 12:13
  SPEAKER_01: Every alteration has to be evaluated.
• 12:15
  SPEAKER_00: Every single one.
• 12:16
  SPEAKER_00: You have to ensure it doesn't introduce a new hazard.
• 12:19
  SPEAKER_00: Proper change governance isn't a roadblock designed to slow engineering down.
• 12:23
  SPEAKER_00: It's the very mechanism that allows you to innovate safely and quickly.
• 12:27
  SPEAKER_01: And this engineering chaos, it inevitably bleeds into regulatory trouble.
• 12:32
  SPEAKER_01: Specifically with corrections and removals,
• 12:36
  SPEAKER_01: What happened with the MicroDoc software update out in the field?
• 12:40
  SPEAKER_00: So Pensar realized they had a virgin issue with the MicroDoc software from multiple customers.
• 12:44
  SPEAKER_00: So they just conducted software reworks out in the field to get these customers on
• 12:48
  SPEAKER_00: the correct revision.
• 12:49
  SPEAKER_01: Okay.
• 12:50
  SPEAKER_00: Now, under 21 CFR Part 806,
• 12:53
  SPEAKER_00: fixing a software flaw in the field to reduce a risk to health is considered
• 12:56
  SPEAKER_00: a medical device correction.
• 12:58
  SPEAKER_00: And you are legally required to submit a report to the FDA within 10 working days.
• 13:03
  SPEAKER_01: Let me guess, they updated the software out in the wild without telling the agency.
• 13:06
  SPEAKER_00: They missed the 10-day window entirely.
• 13:08
  SPEAKER_00: As of the date of the warning letter, they still hadn't submitted it.
• 13:11
  SPEAKER_01: Man!
• 13:12
  SPEAKER_01: So we have unverified original designs combined
• 13:14
  SPEAKER_01: with unverified undocumented code changes and unreported field corrections.
• 13:18
  SPEAKER_01: It's a disaster.
• 13:19
  SPEAKER_01: The baseline is completely broken and the iteration process is blind.
• 13:24
  SPEAKER_01: In a healthy operational system,
• 13:25
  SPEAKER_01: when things break in the field,
• 13:28
  SPEAKER_01: internal feedback loops catch the issues before they spiral, right?
• 13:31
  SPEAKER_00: Usually, yes.
• 13:32
  SPEAKER_01: But this brings us to Clause 8.5.2 and MDRs.
• 13:37
  SPEAKER_01: Basically, corrective and preventive actions.
• 13:40
  SPEAKER_01: The final piece of this failure cascade.
• 13:42
  SPEAKER_01: Because at Pensar, the feedback loops were completely broken, cutting off the final safety net.
• 13:47
  SPEAKER_00: Your CAPIA system is supposed to be the engine of continuous improvement for your business.
• 13:52
  SPEAKER_00: When a failure occurs,
• 13:53
  SPEAKER_00: you investigate it,
• 13:55
  SPEAKER_00: you document the root cause,
• 13:56
  SPEAKER_00: implement a fix, and then you actually verify that the fix worked.
• 14:00
  SPEAKER_01: It's basic problem solving.
• 14:01
  SPEAKER_01: Yeah.
• 14:02
  SPEAKER_00: And the regulations explicitly require you to document these steps.
• 14:06
  SPEAKER_00: But the FDA reviewed five of Pensar's Cappier records and found this severe pattern
• 14:11
  SPEAKER_00: of blank fields.
• 14:12
  SPEAKER_01: I often think of CAPA as an enterprise's immune system.
• 14:15
  SPEAKER_01: You know,
• 14:15
  SPEAKER_01: when a pathogen,
• 14:16
  SPEAKER_01: like a defect or a field failure,
• 14:18
  SPEAKER_01: enters the body,
• 14:19
  SPEAKER_01: the white blood cells attack it,
• 14:20
  SPEAKER_01: learn from it, and create antibodies so it never harms the organization again.
• 14:23
  SPEAKER_00: I love that.
• 14:24
  SPEAKER_00: But Pinsir's immune system was completely offline.
• 14:27
  SPEAKER_00: CAPA 037, which was opened in January 2024, was entirely incomplete.
• 14:32
  SPEAKER_01: How incomplete?
• 14:33
  SPEAKER_00: The root cause section,
• 14:34
  SPEAKER_00: the corrective action sections,
• 14:35
  SPEAKER_00: and the effectiveness verification sections were all left completely blank.
• 14:39
  SPEAKER_01: How does that actually happen in a corporate environment?
• 14:42
  SPEAKER_01: Is it software fatigue like quality engineers just opening tickets in
• 14:47
  SPEAKER_01: a digital system to hit a geeky eye and then forgetting about them?
• 14:50
  SPEAKER_00: It's often a mix of template fatigue and honestly a culture of fear.
• 14:54
  SPEAKER_01: Oh, interesting.
• 14:55
  SPEAKER_00: Yeah.
• 14:56
  SPEAKER_00: When compliance is viewed as just a paperwork exercise,
• 14:59
  SPEAKER_00: an engineer might open a KPI just so they can tell management,
• 15:02
  SPEAKER_00: hey, I opened a ticket.
• 15:03
  SPEAKER_01: Right.
• 15:04
  SPEAKER_00: Box check.
• 15:05
  SPEAKER_00: Exactly.
• 15:06
  SPEAKER_00: Another issue is that documenting a root cause feels like admitting liability to some people.
• 15:12
  SPEAKER_00: If an organization doesn't have a culture of psychological safety,
• 15:15
  SPEAKER_00: employees will literally leave fields blank rather than put in writing that
• 15:20
  SPEAKER_00: the engineering team messed up.
• 15:21
  SPEAKER_01: Wow.
• 15:22
  SPEAKER_00: We saw this with KPAR Series 9,
• 15:24
  SPEAKER_00: which contained only unfilled placeholder language that carried over from
• 15:28
  SPEAKER_00: a template.
• 15:28
  SPEAKER_01: So they just opened a digital template, saved it, and never did the work.
• 15:31
  SPEAKER_01: Seeing a completely blank KPAR is like your white blood cells clocking out for lunch
• 15:36
  SPEAKER_01: during a severe infection.
• 15:38
  SPEAKER_01: No, and that is where the entire QMS fractures.
• 15:40
  SPEAKER_01: KPA 036 noted that a corrective action was taken.
• 15:41
  SPEAKER_01: But that action was never incorporated back into the firm's risk analysis,
• 15:44
  SPEAKER_01: and the effectiveness fields were left blank.
• 16:01
  SPEAKER_01: This is a critical point.
• 16:02
  SPEAKER_01: If we want to build resilient organizations,
• 16:05
  SPEAKER_01: how do you practically integrate risk analysis back into a KPA system
• 16:08
  SPEAKER_01: so it actually works?
• 16:10
  SPEAKER_00: Well, it has to be a continuous closed loop system.
• 16:13
  SPEAKER_00: When a failure occurs, your investigation must ask one vital question.
• 16:17
  SPEAKER_00: Did we predict this failure in our original FMEA?
• 16:20
  SPEAKER_01: Okay.
• 16:21
  SPEAKER_00: If the answer is yes, then you have to ask why your predicted risk control failed.
• 16:25
  SPEAKER_00: But if the answer is no,
• 16:26
  SPEAKER_00: then your FMEA is incomplete and you have to update it
• 16:29
  SPEAKER_00: with this newly discovered hazard.
• 16:30
  SPEAKER_01: But you can only trigger a KPAY if your internal definitions for recognizing
• 16:35
  SPEAKER_01: a problem are actually clear in the first place.
• 16:38
  SPEAKER_01: Which brings us to their medical device reporting, or MDR, failures.
• 16:42
  SPEAKER_01: Right.
• 16:43
  SPEAKER_01: Because an MDR is often the trigger for a major KPAY.
• 16:47
  SPEAKER_00: The regulation dictates that you have to report an event to the FDA
• 16:50
  SPEAKER_00: if information reasonably suggests your device caused or contributed to a death
• 16:55
  SPEAKER_00: or serious injury.
• 16:57
  SPEAKER_00: But Pensar's internal procedure for MDRs didn't even include an adequate definition
• 17:03
  SPEAKER_00: of what reasonably suggests means.
• 17:05
  SPEAKER_01: Let's look at the psychology of that, because reasonably suggests wasn't clearly defined.
• 17:09
  SPEAKER_01: Imagine a quality engineer sitting in a cubicle gets a complaint about a wound infection.
• 17:14
  SPEAKER_01: Without a strict definition, human nature takes over, right?
• 17:17
  SPEAKER_01: They downplay it.
• 17:18
  SPEAKER_01: They think infections happen all the time.
• 17:19
  SPEAKER_01: The patient was already sick.
• 17:21
  SPEAKER_01: It's just a device malfunction.
• 17:22
  SPEAKER_00: Yeah, that happens a lot.
• 17:23
  SPEAKER_01: They don't realize the regulatory standard requires them to assume
• 17:26
  SPEAKER_01: the device contributed to the injury until they can definitively prove otherwise.
• 17:31
  SPEAKER_00: And that lack of definition led directly to the mishandling of complaint C-029.
• 17:37
  SPEAKER_00: A patient using Pensar's negative pressure system sustained an infection at
• 17:41
  SPEAKER_00: the wound site, specifically purulent drainage.
• 17:44
  SPEAKER_01: Which means it was actively weeping infectious fluid.
• 17:47
  SPEAKER_00: Exactly.
• 17:48
  SPEAKER_00: The situation escalated to the point where the patient required medical
• 17:51
  SPEAKER_00: and surgical intervention to remove retained foam from the wound
• 17:55
  SPEAKER_00: to preclude permanent impairment.
• 17:56
  SPEAKER_01: Just so you listening understand the medical mechanics here,
• 18:00
  SPEAKER_01: the foam dressing from the device was left inside the patient's wound.
• 18:03
  SPEAKER_01: And when that happens,
• 18:04
  SPEAKER_01: the body's natural granulation tissue actually starts growing into
• 18:08
  SPEAKER_01: the porous structure of the foam.
• 18:10
  SPEAKER_00: It's awful.
• 18:10
  SPEAKER_01: You can't just pull it out like a Band-Aid.
• 18:12
  SPEAKER_01: A surgeon has to go in with a scalpel and physically excise the foam and the new tissue.
• 18:16
  SPEAKER_00: It is a severe event.
• 18:18
  SPEAKER_00: That is the very definition of a serious injury under the regulations.
• 18:22
  SPEAKER_00: Now, Pensar became aware of this event on May 1st, 2024.
• 18:26
  SPEAKER_00: They failed to submit the required MDR within the 30 calendar day window.
• 18:30
  SPEAKER_01: Typical.
• 18:31
  SPEAKER_00: And when they finally did submit it,
• 18:32
  SPEAKER_00: they incorrectly categorized it as a malfunction report instead of
• 18:35
  SPEAKER_00: a serious injury report.
• 18:37
  SPEAKER_01: How does a quality engineer downgrade a surgical excision to a mere malfunction?
• 18:42
  SPEAKER_00: Well, because the procedure didn't define reasonably suggests,
• 18:46
  SPEAKER_00: they likely convinced themselves that the infection caused the surgery,
• 18:50
  SPEAKER_00: not the retained foam,
• 18:52
  SPEAKER_00: completely missing the fact that the device was inextricably linked to the event.
• 18:56
  SPEAKER_01: Which completely misrepresents the severity of the issue to the regulatory agencies
• 19:01
  SPEAKER_01: and, frankly, to their own internal management teams looking at the data.
• 19:04
  SPEAKER_00: Right.
• 19:05
  SPEAKER_01: If the executive team sees a dashboard with malfunctions, they don't allocate resources.
• 19:10
  SPEAKER_01: Right.
• 19:11
  SPEAKER_01: If they see serious injuries requiring surgery, they stop the assembly line.
• 19:15
  SPEAKER_00: When you connect all these dots, you really see the breathtaking cascade of systemic failure.
• 19:20
  SPEAKER_00: A serious injury occurs.
• 19:22
  SPEAKER_00: It is miscategorized and delayed in reporting because the procedures lack basic definitions.
• 19:27
  SPEAKER_00: Because the reporting is flawed, the severity isn't recognized by leadership.
• 19:31
  SPEAKER_00: Therefore,
• 19:32
  SPEAKER_00: the resulting KPAs are opened but left as blank templates or closed
• 19:37
  SPEAKER_00: without effectiveness checks.
• 19:39
  SPEAKER_00: It all stems from viewing risk management as an isolated theoretical exercise rather
• 19:42
  SPEAKER_00: than the living, breathing operational system it is supposed to be.
• 19:44
  SPEAKER_00: 100%.
• 19:59
  SPEAKER_01: Leaving KPAs blank or disconnected from risk analysis basically guarantees
• 20:03
  SPEAKER_01: that you will repeat your failures.
• 20:05
  SPEAKER_01: You will keep shipping devices with unverified software changes,
• 20:09
  SPEAKER_01: and you will keep having retained foam incidents because you never closed the loop.
• 20:12
  SPEAKER_00: None of these FDA citations are about government overreach or nitpicking typos.
• 20:17
  SPEAKER_00: They're about a company that lost total control of its engineering and quality feedback loops.
• 20:23
  SPEAKER_00: A solid, interconnected quality management system is a strategic asset.
• 20:28
  SPEAKER_00: When your risk controls are verified before launch,
• 20:30
  SPEAKER_00: when your software changes are regression tested against the baseline,
• 20:34
  SPEAKER_00: and when your corrective actions actually update your corporate knowledge.
• 20:37
  SPEAKER_01: Things just work.
• 20:38
  SPEAKER_00: Yes.
• 20:39
  SPEAKER_00: Your business runs with incredible efficiency.
• 20:42
  SPEAKER_00: You can innovate faster because you know exactly where the guardrails are.
• 20:46
  SPEAKER_01: That is the mindset shift that separates industry leaders from companies drowning
• 20:50
  SPEAKER_01: in compliance issues.
• 20:52
  SPEAKER_01: It is about maintaining absolute,
• 20:54
  SPEAKER_01: verifiable control over your product's lifecycle to drive enterprise value.
• 21:00
  SPEAKER_00: And Pensar serves as a stark reminder of what happens when
• 21:04
  SPEAKER_00: that operational control is entirely abandoned.
• 21:08
  SPEAKER_01: Oh, wow.
• 21:08
  SPEAKER_01: Yeah.
• 21:33
  SPEAKER_01: If
• 21:33
  SPEAKER_01: an organization's quality management system cannot even govern static human written
• 21:38
  SPEAKER_01: code today, how in the world will it handle the autonomous engineering of tomorrow?