Mind The Gaps

In our COVID-19 alternate reality, most businesses are running at some level. As a certifying body, we at PQA have a unique insight on how thing are going –in our new “normal.” The good news is, in most cases, products and services are being produced, and customers are getting served – many of us have been surprised by how much we CAN do remotely (including ISO audits!), and what MUST continue to happen onsite at the facility. That said, we want to draw attention to some gaps we’ve seen that have potential for significant risks.

Record retention on remote devices - While we all have systems in place to back up our networks, how are backups occurring for all the laptops since many are keeping records (incl. sales or service records, design edits, etc.) on laptops instead of logging in to seemingly slower networks. Consider requiring daily or weekly uploads to the network as a standard job responsibility.
IT support/recovery - Like backups, does your IT support cover the needs of your presently home-based employees. My laptop recently got a Microsoft BitLocker shutdown which turned out to be a MS hard drive encryption software ‘upgrade.’ Even one or two hours, let alone days, with a non-functional laptop can negatively impact decisions made without data necessary for customer satisfaction.
Process documents – most of us have had to adjust our processes, but does everyone know, and are they all following the new procedure? In the medical device world, a Temporary Authorization (TA) is used to document what has changed to adapt. For temporary changes, consider using a TA to record how the process has been amended for now. Remember, documenting your processes ensures that all involved follow the same steps to achieve the same outcome.
Calibration – if staff who manage critical time-based activities like calibration are furloughed, who picks up the task? We have seen several instances of outdated calibration, outdated calibration logs, and lost, out-of-calibration items that were still being used to measure products.
Training – while this is one process that can continue online, don’t forget to record attendees, evaluation methods and results. Also, ensure that revised training data is housed centrally to avoid loss.
New software – have you implemented new software? ISO 13485 requires that software is validated. Have you validated that records transferred from one system to the other are complete and present? How are any glitches being reported and prioritized for resolution?