Agenda

2. Agenda Regulations & Standards Compliance Medical Industry

3. Compliance – Regulatory & Standards

4. Compliance – Regulatory & Standards ISO – International Standards Organization CFR – Code of Federal Regulations SQF – Safe Quality Foods ANSI – American National Standards Institute OSHA – Occupational Safety & Health Administration FAR – Federal Acquisition Regulation FAA – Federal Aviation Administration SARA - Superfund Amendments and Reauthorization Act REACH - Registration, Evaluation, Authorisation and Restriction of Chemicals

5. Compliance – ISO Standards

6. Regulations & Standards

7. Business Solution ERP QMS CRM REPORTING Non-Conforming Materials Calibration & Maintenance Regulatory Requirements Complaints Inspections Material Returns Product Data Management Supplier Management Safety Meetings Audits FDA HACCP INVESTIGATIONS CONTROL MONITOR ISO cGMP CAPA Corrective & Preventive Actions SOX PART 11 Employee Training Change Management Document Control Quality Records Deviations

8. Business Solution ERP QMS CRM REPORTING Non-Conforming Materials Calibration & Maintenance Regulatory Requirements Complaints Inspections Material Returns Product Data Management Supplier Management Safety Meetings Audits Alerts Escalations INVESTIGATIONS Charts E-Signature Audit Trail Dashboards CAPA Corrective & Preventive Actions Security Mobile Access Employee Training Change Management Document Control Quality Records Deviations

9. Integrated Quality Solution Quality for SYSPRO’s quality management software system consists of configurable, easy-to-use, and connected applications for automating, streamlining, and effectively managing document control, change control, training control, audits, corrective/preventive action (CAPA), and other documents- and forms-based quality and business processes.

10. Document Control Document control manages the creation, approval, distribution and archiving of all controlled documents, such as manuals, procedures, work instructions, forms, job descriptions, product specifications, inspection specifications, test methods, and much more. Any document used in the application of any ISO standard must be controlled by means of a quality management system (QMS) specific to the company. A controlled document may be stored electronically, on a disk, on paper, or as a photograph. The QMS ensures each document's integrity by adhering to specific rules for document use and storage.

11. Non Conformance A non-conformance means that something went wrong – a problem has occurred and needs to be addressed. Product characteristics are not to specification. You may find a non-conformance in a service, a product, a process, from a supplier, or manufacturing process system itself. It occurs when something does not meet the specifications or requirements in some way. Those requirements might be defined by the customer, a regulatory body, or in the internal procedures of the company. A non-conformance could be identified through customer complaints, internal audits, external audits, incoming material inspection, and manufacturing or simply during normal testing and inspection activities. • The non-conformance procedure will address how you deal with the problem: • How to decide on what immediate actions will be taken to correct the problem, and who is responsible for the decision. • Assess the effects of the problem – how much, how bad (e.g. scrap/rework) • Contain the effects – (e.g. quarantine/MRB defective items • Notify affected customers • Stop further non-conformance

12. Corrective Action Corrective actions are reactive – something has gone wrong and these are the actions taken to deal with the problem. Non-conformances are resolved through corrective actions. This will include the immediate corrective actions you take to keep your customer happy, e.g. you sent the wrong part and will immediately replace it with the correct part. The problem might be identified in processes, materials, suppliers, the product, the service, the workplace, or the management system itself. • The Corrective Action procedure will include the steps taken to: • Review and document the problem • Contain or temporarily fix the problem e.g remove the defective product from production and quarantine it in a designated area for later investigation • Investigate the cause of the problem – how did it happen, why did it happen, could it happen again? • Propose an appropriate solution that will prevent the problem happening again. This will often mean a change to the process. • You need to report on what actions were actually taken • After an appropriate period of time, you will need to assess whether the actions taken were successful in preventing recurrence. Document the evidence to support your decision.

13. Education & Training Employee Training module helps to manage the identification, responsibilities, authorities, and training and certification requirements for each employee in an easy-to-use environment. This provides a simple way to schedule and record training. • Manage the following: • Streamline training communication • Written job descriptions and their competencies • Create course profiles • Identify course prerequisites • Define pass/fail criteria • Define expiration date and receive notifications • Handles internal and external training • Identify qualified trainers based on course • Paper or electronic copies of licenses, certificates, training records, etc. • Gap analysis • Training Schedule with plan • Controls the training records once employee training is completed • Linked to Document Control

14. Inspections Build a database of Inspection Specifications, detailing all product characteristics, inspection rates, and then record the results with the inspection record is being performed. Manage First Article, In-process, Final and Receiving Inspection results, and other user-definable inspection activity. • Manage the following: • Automate the inspection process • Generate inspection documentation • Setup control level warnings • Identify Tooling/Equipment required • Track inspection time/cost • Associate unlimited attachments • Generate Non-conformance

15. Auditing An audit is simply another form of inspection and testing – except that in this case the product being inspected is the management system itself. There are two basic audits, internal and external. Internal is auditing the companies own processes, while External audits manage and control your Suppliers. Audits are performed to ensure that suppliers (or prospective suppliers) systems, practices, and procedures are defined, documented, controlled and periodically assessed for effectiveness and compliance. Audits are also conducted as pre-award survey to assess supplier capabilities and qualifications needed to meet specific client contractual obligations. Audits help uncover areas that are in need of attention. Quality, safety and environmental management standards all require audits to monitor and report on the effectiveness of the management system.

16. Supplier Management You should evaluate and select suppliers based on their ability to meet your requirements. You have to define the requirements that are important to your organization, and select suppliers on those criteria. The list of approved suppliers is part of your quality management system. Evaluation Criteria Obviously cost is an important criterion for selecting a supplier, but it shouldn’t be the only factor – or even the most important one. A reliable and consistent supplier is worth paying extra for, since the less variation coming into your process; the easier it is to keep consistent results. It’s not just the product you need to think about – consistent lead times, good customer support, delivery, and business stability are important too. Evaluation Methods Some companies use a questionnaire form with new suppliers, while others deem best to perform a physical audit of the suppliers facility. For existing suppliers, you will need to periodically re-assess whether your suppliers are still meeting your needs. To evaluate suppliers based on their past performance, you’ll need to keep records (e.g. an Incoming product inspection log, records of supplier non-conformance).

17. Tooling & Equipment Schedule and record the results of all your calibration activities and costs for each piece of equipment. Maintenance or Repair tickets can be scheduled independently and easy-to-read reports and automatic notifications indicate when equipment is due for calibration/maintenance. R&R studies can also be done quickly and uniformly. Maintenance is an intuitive, easy and effective way of recording and tracking equipment that requires preventive and reactive maintenance. Complete with work orders, this module is easy and powerful, minimizing operator input during normal and repair operations.

18. Industry Information MEDICAL • Definition • Classification Controls • Classification Breakdown • 21CFR part 11 • 21CFR part 820(GMP) • ISO 13485/9001 • Recall management • Validation Key Provisions

19. Definition • A Medical Device is "an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is: • Intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or • Intended to affect the structure or any function of the body of man or other animals, and which does not achieve any of it's primary intended purposes through chemical action within or on the body of man or other animals.

20. Definition • One end of spectrum - highly invasive and technologically complex products • Electrically active implantable products • Pacemakers • Artificial cochlear devices • Implantable neurotransmitters • Non-active implantable devices: • Coronary stents • Spine screws • Knee or hip replacement devices

21. Definition • Other end of spectrum – simple consumer items • Bandages • Dressings and drapes • Disposable surgical instruments / syringes • Barrier contraceptives – such as condoms • Diagnostic & surgical equipment also regulated • MRI imaging machines • Electro-cautery devices • ECG monitors

22. Classification • Stringency of regulation depends on “Class” of the device being produced • Three Classes: • Class I – General Controls • Class II – General Controls with Special Controls • Class III – Pre-Market Approval

23. Classification Controls Class I General Controls • Present minimal potential for harm to the user • Subject to the least regulatory controls • Controls cover: • Register manufacturing and distribution locations • List device to be marketed with FDA • Manufacture in accordance with good manufacturing practices • Label in accordance with labeling regulations • 21 CFR 801 • 21 CFR 809 • Report adverse events • Typical Class I products: • Tongue depressors • Arm slings • Stethoscopes • Elastic bandages • Examination gloves • Hand-held surgical instruments • Other similar types of common equipment

24. Classification Controls Class II General Controls with Special Controls • Typical Class II products: • X-ray machines • PACS • Powered wheelchairs • Infusion pumps • Surgical drapes • Suture materials • Acupuncture needles • Class II devices are held to a higher level of assurance than Class I • The must perform as indicated • Pose mild potential risk • Additional special controls include: • Special labeling requirements • Mandatory performance standards • Post market surveillance

25. Classification Controls Class III Pre-market Approval • Class III is most stringent regulatory category • Devices in this category usually: • Require pre-market approval • Support or sustain human life • Full description on intended use including the manufacturing, processing, packing and installation • Performance standards to ensure device meets each standard • Require additional regulation to assure safety and effectiveness • Typical Class III products: • Heart valves • Pacemakers • Silicone gel-filled breast implants • Joint replacements • Implanted cerebella stimulators

26. Classification Breakdown • FDA established classifications for 1700 different generic types of devices and grouped into 16 medical specialties • Referred to as panels • Assigned to one of three regulatory classes based on level of control • Class device assigned to determines the type premarketing submission/application required for clearance • Class II a 510(k) will be required for marketing • Class III requires a premarket approval application (PMA) 868 Anesthesiology870 Cardiovascular862 Clinical Chemistry and Clinical Toxicology872 Dental874 Ear, Nose, and Throat876 Gastroenterology and Urology878 General and Plastic Surgery880 General Hospital and Personal Use864 Hematology and Pathology866 Immunology and Microbiology882 Neurology884 Obstetrical and Gynecological886 Ophthalmic888 Orthopedic890 Physical Medicine892 Radiology

27. Classification Breakdown

28. 21 CFR Part 11 Electronic Records; Electronic signatures Subpart A – General Provisions Subpart B – Electronic Records Subpart C – Electronic Signatures

29. 21 CFR Part 11 • Subpart A – General Provisions • Subpart B – Electronic Records • Subpart C – Electronic Signatures 11.1 Scope 11.2 Implementation 11.3 Definitions 11.100 General requirements 11.200 Electronic signature components and controls 11.300 Controls for identification codes/passwords 11.10 Controls for closed system 11.30 Controls for open system 11.50 Signature manifestations 11.70 Signature/record linking

30. Requirements for Compliance Technical controls • Data validation • Audit trails • Time stamps • Security • Record maintenance • Electronic signatures Administrative controls • Notifications • Training • Standard Operating Procedures

31. What makes SYSPRO Compliant Audit Trails • Job logging • Amendment journals • Record archiving Security • Role based access • Password control & configuration • Program access • System audit log Electronic Signatures • Signatures audit SYSPRO Workflow Services • Sequencing of steps SYSPRO Reporting Services • Archiving utilities

32. 21 CFR Part 11 Electronic Records; Electronic signatures Subpart B – Electronic Records 11.10 Controls for Closed system 11.30 Signature Manifestations 11.50 Signature/record linking

33. 11.10 b Controls for a Closed System (b) The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency. Persons should contact the agency if there are any questions regarding the ability of the agency to perform such review and copying of the electronic records. • SYSPRO Reporting Services • Forms & Reports • Form Designers • Report Output • XML Viewing

34. 11.10 c Controls for a Closed System (b) Protection of records to enable their accurate and ready retrieval throughout the records retention period. • Archive and Retrieve Documents • SYSPRO Reporting Services • Archive • Output to .pdf • Encryption

35. 11.10 d Controls for a Closed System (d) Limiting system access to authorized individuals. • SYSPRO Security • Definition • Alternate passwords & configuration • Login attempts & lockout controls

36. 11.10 d Controls for a Closed System (d) Limiting system access to authorized individuals. • SYSPRO Security • Role, operator, group, company • eSignatures • Program Access • Activities and fields • Access Control

37. 11.10 e Controls for a Closed System (e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for as long as it is required for the subject electronic records and shall be available for agency review and copying. • System audit logs • Job logging • Time stamps • Amendment journals

38. 11.10 e Controls for a Closed System (e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for as long as it is required for the subject electronic records and shall be available for agency review and copying. • Amendment journals

39. 11.10 f Controls for a Closed System (f) Use of operational system checks to enforce permitted sequencing of steps and events, as appropriate. • SYSPRO Workflow Services • Process sequencing • Approvals and Rejections

40. 11.10 g Controls for a Closed System (g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand. • Password Controls • 128 byte encryption • Password aging • Password recycling • Login controls • Login attempts • Lockout accounts • Idle accounts • Automatic sign-out

41. 11.10 i Controls for a Closed System (i) Determination that persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks • On-line education system - SLC • New employees training • Existing employee review • New module how-to • Training & Certification - uniPoint • New employees training records • Existing employee review

42. 11.50 a Signatures/Record Linking (a) Signed electronic records shall contain information associated with the signing that clearly indicates all of the following: • (1) The printed name of the signer; • (2) The date and time when the signature was executed; and • (3) The meaning (such as review, approval, responsibility, or authorship) associated with the signature. • Electronic Signatures

43. 11.70 a Signatures/Record Linking Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means. • Password Setup • Electronic Signatures

44. 11.200 Electronic Signatures Components 11.200 Electronic signature components and controls. Electronic signatures that are not based upon biometrics shall: Employ at least two distinct identification components such as an identification code and password. • Password Setup/Alternate Password

45. 21 CFR Part 11

46. 21 CFR Part 820 Quality System Regulation Current Good Manufacturing Practices SYSPRO and uniPoint Part 820 Breakdown

47. 21 CFR Part 820 • Subpart A General Provisions • §820.1 Scope • §820.3 Definitions • §820.5 Quality system • Subpart B Quality System Requirements • §820.20 Management responsibility • §820.22 Quality audit • §820.25 Personnel • Subpart C Design Controls • §820.30 Design controls • Subpart D Document Controls • §820.40 Document controls • Subpart E Purchasing Controls • §820.50 Purchasing controls • Subpart F Identification and Traceability • §820.60 Identification • §820.65Traceability • Subpart G Production and Process Controls • §820.70Production & process • §820.72Inspection, measuring & test equipment • §820.75Process validation • Subpart H Acceptance Activities • §820.80 Scope • §820.86 Receiving, in-process and finished device acceptance • Subpart I Non-Conforming Product • §820.90 Non-conforming product

48. 21 CFR Part 820 • Subpart J Corrective & Preventive Actions • §820.100 Corrective & preventive actions • Subpart K Labeling & Packaging Control • §820.120 Device labeling • §820.130 Device packaging • Subpart L Handling, Storage, Distribution & Installation • §820.140 Handling • §820.150 Storage • §820.160 Distribution • §820.170 Installation • Subpart M Records • §820.180 General requirements • §820.181 Device master record • §820.184 Device history record • §820.186 Quality system record • §820.198 Complaint files • Subpart N Servicing • §820.200 Servicing • Subpart O Statistical Techniques • §820.250 Statistical techniques

49. SYSPRO Tools • Purchasing • Inventory • Receiving inspection • Approved vendor • Return to vendor • Supplier performance • Design Controls • CAD integration • Bill of material • Engineering change • Identification & Traceability • Lot/serial control • Component to parent • Up & down query • Production and Process Controls • Work in progress • WIP inspection • Servicing • Returned merchandise • CRM – Field Service • Transaction posting – Depot • Electronic records • Factory documentation • Record archiving

50. Integrated Quality Solution • Document Control • Education & Training • Non-conformance • Corrective Action • Tooling & Equipment • Inspections • Audits • Supplier Management • Surveys