A medical device company’s complaint handling system is one of the most essential elements of its quality management system. A bad process will leave the company with an increased likelihood of audit findings, and present the company with possible legal and regulatory consequences. A good ISO 13485 complaint handling process can lead to increased customer satisfaction and valuable data which can improve products.
No matter the risk level of your medical device, in order to be an ISO 13485 certified company and comply with FDA requirements, you will need to create a complaint handling procedure to understand and investigate complaints quickly. This guide will help you come to grips with the fundamental requirements of an ISO 13485 complaint handling procedure, as well as a practical understanding of how everything can be implemented and integrated into your QMS.
This article will provide an in-depth step-by-step guide on how to create a complaint handling procedure that will conform to ISO 13485:2016 standards. It will also be referencing FDA 21 CFR 820.198 a significant amount. This is because it is required for US medical device companies, and provides some helpful answers to questions raised in ISO 13485.
If you follow the guidelines established in this article you can create a procedure that meets the criteria for both documents. But, if you are outside the US you will need to look at your country’s regulations to ensure compliance.
Where possible, the topics are labeled with the applicable section in ISO 13485 and 21 CFR Part 820.198.
Table of Contents
What is a Complaint? (8.2.2b)
According to ISO 13485:2016, a complaint is:
“written, electronic or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, usability, safety or performance of a medical device that has been released from the organization’s control or related to a service that affects the performance of such medical devices.”
The FDA has a very similar definition of a complaint. From those definitions, we can see that a complaint can be from any time a medical device leaves the organization’s control, no matter where the device is in the supply chain. It can also relate to many different aspects of a complaint.
Below are some examples of medical device complaints, taken directly from the FDA product recall page:
- Heating pads causing electric shocks
- Intra-aortic pumps with unexpectedly short battery life
- BiPAP machines causing exposure to concerning chemicals
- Breathing filters disconnecting from breathing devices
- Medical lifts creating smoke or flames when low on battery
What is Feedback?
Feedback on the other hand can be either positive or negative information received from a customer. It can include concerns regarding shipping issues to the customer, as well as an appreciation for the good service received.
Cosmetic issues are also commonly considered feedback. You will need to determine what cosmetic concerns can be defined as feedback based on your product. For example, sometimes a complaint is received for the way a product looks, but the product looks that way due to underlying contamination or functional issues.
When writing your complaint handling procedure, you should state what will constitute a complaint vs feedback in your procedure. A good place to put the criteria is in the definitions section of the procedure.
Complaint Handling Unit (21 CFR 820.198a)
Before we dig into how to handle a complaint, we should first look at who is going to handle the complaint. FDA 21 CFR 820.198 includes a list of guidelines about a “formally designated unit” that a manufacturer is required to establish. In fact, the regulation is just laying out the different requirements that the formally designated unit must complete for a complaint to be correctly processed and documented.
While it may be obvious who the “formally designated unit” is going to be at your organization, it can actually be a tricky question for other organizations with multiple different departments. My advice is that there should be at least one or more people who are directly responsible for complaints being inputted, investigated, documented, and closed correctly.
Many different people may be involved with the complaint (CS, sales, engineering, etc). Regardless, one person should be responsible for documenting everything, and reaching out to their relevant coworkers when necessary.
By responsible, I mean that complaint handling needs to be a part of their job description. They should also be held accountable for the complaint being documented and closed. You may even go as far as creating metrics for complaint investigation/closure that are tied to that employee’s performance.
There is a good reason for the detail about a problem that is already solved in many companies. I have worked at organizations where complaint handling was completed in a piecemeal approach.
Someone (Customer Service (CS), sales, etc.) received a complaint and entered it into the ERP, QMS, etc. Then, the system notified someone else (usually in QA) that the complaint had been created. That person is tasked with going into the system and completing the first steps, such as determining if the complaint needs to be reported to any federal agencies. After that, someone else had to go in and complete the complaint investigation. Finally, someone else needed to go into the system and close the complaint.
Handling complaints in this way is more than likely going to lead to delays and gaps in your process.
This is why I recommend centralizing all of the activities to the designated complaint handling unit (CHU). A person in the unit (it is fine if the “unit” is only one person) should establish if the input meets the criteria for a complaint. Then, they should enter the complaint into your system, investigate the complaint (or, at least monitor the investigation and ensure it is documented correctly), attach any necessary supporting documents, and close the complaint.
When you are developing an ISO 13485 complaint handling procedure, the procedure should explain who is going to be the designated complaint handling unit. You should also state what their requirements are in terms of the complaints. Not only is this required by FDA regulations, it is also a good practice for making sure everything is completed effectively and efficiently.
Receiving and Initiating a Complaint (8.2.2a) (21 CFR 820.198 a)
Once you have established the designated unit, you need to determine all of the different ways a complaint may be received. A complaint from a customer is most likely to be sent to a customer service or sales rep. But, depending on where your company is in the supply chain, the customer may reach out directly to a quality manager or a different member of the quality team who has previously handled their complaints.
When any of these people receive the complaint, they need to know where to forward the email (or voicemail, or call, or written information taken from a call). As you probably guessed, they are going to be sending the information to the complaint handling unit. They also need to be trained in this process, since 21 CFR 820.193 specifically states “oral complaints are documented upon receipt”.
Once the complaint is received, a complaint case or file should be opened in your QMS. It’s tempting to have the person who receives the complaint create the complaint case in your system. This is also the only step that could contradict my advice of having the complaint handling unit document every piece of the complaint.
If you have a robust enough QMS, it may be fine to have whoever received the complaint enter the information into your system. This is especially true if your system will automatically notify the complaint handling unit that a case has been created.
The main pro of this approach is that it will be the most timely way for the complaint to be initiated. However, there are certainly some drawbacks that come with this approach.
First, you will need to train everyone who might receive a complaint on how to create a case file. This is harder than training them on where to send information regarding complaints.
Two, there is certain information that needs to be requested from the customer, and the complaint handling unit will have to make sure this information is obtained. The complaint handling unit is going to be the most aware of what information should be requested. They will also need the information the most for their future activities.
Third, the complaint handling unit will need to make sure all of the information is entered into the complaint case correctly. You may as well have the complaint handling unit enter all of the information instead of constantly auditing others’ work.
In conclusion, your procedure should lay out all of the ways a complaint will be received. It should also dictate where the information is going to go, and who is going to create the complaint case.
Communication with the Customer (8.2.2a)
Once you have received a complaint and created a case file, someone will likely need to reach out to the customer to obtain the required information. Down the line, they will also follow up with the customer once the complaint has been investigated.
The easiest approach is to have the CHU reach out to the customer directly, but this might not be possible depending on your organization. It’s fine if a CS or sales rep is going to be the one communicating with the customer. That said, a member of the CHU should be included in all communication.
The person reaching out to the customer should be given guidance by the CHU on what information to request from the customer. The guidance can come directly from a member of the CHU or from a controlled document listing questions to ask the customer.
Again, I cannot emphasize how much better I think it is to have a member of the CHU reach out directly to the customer. I have seen time and time again where a complaint is received and a CS or sales rep immediately responds with the documented list of questions.
The concern is that a large amount of information may already be in the initial complaint communication. The CS / Sales rep is doing what they have been taught by asking all available questions, and they do not want to be the person to create regulatory issues.
Regardless, it is super annoying to the customer to be asked for information concerning the complaint, when they already went through the trouble of providing as much information as possible in their initial communication.
You are supposed to be gathering information necessary for reporting and investigation reasons, not creating a homework assignment for your customer. The customer is already slightly perturbed with your company since they are sending in a complaint, it’s best not to annoy them any further.
Your ISO 13485 complaint handling procedure should lay out who will be communicating with the customer over the course of the complaint process.
Gathering Information from the Customer (21 CFR 820.198 d)
Once a complaint has been received and you have established who will be communicating with the customer, you will need to gather specific information for the complaint. The FDA clearly lays out what information is required, regarding your device:
(1) Whether the device failed to meet specifications;
(2) Whether the device was being used for treatment or diagnosis; and
(3) The relationship, if any, of the device to the reported incident or adverse event.
If this information has not already been provided by the customer, whoever is responsible will need to gather as much information about the complaint as possible. At a bare minimum, you will need enough information to answer the questions asked by the FDA. With that said, the more information the better, as any details may aid in the complaint investigation.
Determining Whether a Complaint Requires Reporting (8.2.2d) (21 CFR 820.198 a3)
This section of your complaint handling procedure can easily be considered the most important step from a regulatory perspective. Once a complaint has been received, you need to determine whether or not a complaint requires reporting to the relevant regulatory authorities.
A future article will provide much more in-depth insight into how to report a complaint to the FDA. For now, you just need to know whether the complaint is a reportable incident. The FDA requires you to report a complaint in the event of “deaths and serious injuries that your device has or may have caused or contributed to”. The death or serious injury can be the result of: “Failure, Malfunction, Improper or inadequate design, Manufacture, Labeling or User error.”
FDA 21 CFR 803.1 states that in the case of a reportable event the user facility must contact both the FDA and the manufacturer. So, you should learn about a complaint fairly quickly, and the user facility should already understand if the complaint requires reporting.
Your complaint handling procedure should include information on when Medical Device Reporting is required, who will be doing the reporting, and how the actions will be documented.
Is a Complaint Investigation Required? (8.2.2 c) (21 CFR 820.198c)
Once you have received information for a complaint and determined whether or not the complaint requires reporting, your next step is to figure out whether or not a complaint requires investigation.
As a note, while regulations require you to complete a complaint investigation in specific situations, you may also find it beneficial to perform an investigation when negative feedback is received. For example, while consistently short shipping your customers does not meet the definition of a complaint, this is still not beneficial to your business, and should probably be addressed.
Your procedure for investigating the feedback can be the same as your procedure for complaints investigations or can vary based on the structure of your company.
So, what situations require an investigation? Well, by definition information that is received as feedback does not require an investigation. ISO 13485 does not give any specific guidance for when to investigate a complaint since it expects you to reference your specific country’s guidance. The FDA is much clearer about when a complaint is required:
Any complaint involving the possible failure of a device, labeling, or packaging to meet any of its specifications shall be reviewed, evaluated, and investigated, unless such investigation has already been performed for a similar complaint and another investigation is not necessary.
If you receive a complaint and there are any deviations from the specifications for the Device, Labeling, or Specifications, you will need to perform an investigation unless that issue has already been investigated.
It’s important to note that while you do not need to perform an investigation if a similar investigation has already been performed, per 21 CFR 820.198b, you still need to specify why an investigation was not performed, and who made that decision (this is also a requirement in ISO 13485). I’ve provided a few examples of statements that can be added to the complaint file to satisfy this requirement below.
- “No investigation was performed, as an investigation was done for a similar complaint XXX (case number for similar complaint), and no investigation is necessary. (Name of person entering the information and date).”
- “No investigation was performed, as the information provided is considered feedback and not a complaint, and therefore no investigation is necessary (Name of person entering the information and date).”
Performing a Complaint Investigation (8.2.2c) (21 CFR 820.198 e6)
If you have determined that the complaint will require an investigation, you should have a clear procedure for how the investigation will be performed. Where your investigation is being recorded will be based entirely on your QMS and any software you are using, but certain information must be documented.
The FDA requires the following information to be recorded in the complaint records:
(1)The name of the device;
(2) The date the complaint was received;
(3) Any unique device identifier (UDI) or universal product code (UPC), and any other device identification(s) and control number(s) used;
(4) The name, address, and phone number of the complainant;
(5) The nature and details of the complaint;
(6) The dates and results of the investigation;
(7) Any corrective action taken; and
(8) Any reply to the complainant.
At this point, you should already have all of the information available up to #5, and this information should be in the complaint file. From here, you need to perform a root cause investigation for the complaint.
Your best option is to have a variety of root cause investigation tools available. You should leave your complaint handling procedure broad enough so that any of the tools can be used (as opposed to stating: “A Five Whys investigation will be conducted to determine the root cause”).
While this article will not cover all of the possible root cause tools, here is some of the information you are looking to get through your root cause analysis and complaint investigation:
- Did your device actually meet its specifications?
- Was your device actually responsible for the patient’s injury or death?
- Did the device fail as a result of a user error?
- What is the scope of the issue? Did only one device fail, or does the failure include the entire batch, product, or product line?
- Was the failure a result of poor design?
- Was the failure a result of the manufacturing procedure?
- Was the failure a result of a labeling error?
- Is the failure connected to any similar processes that may be at risk?
Once you have determined the answer to these questions and performed the root cause investigation, you will want to make sure that all of the information, tools used, and results are properly recorded in the complaint file.
Then, you will need to decide how the complaint-related product will be handled, as well as what corrections and corrective actions, if any, will be needed.
Handling Complaint Related Product (8.2.2e) (21 CFR 820.198 e7)
Based on the result of your complaint investigation, you need to elect how you are going to handle the product related to the complaint.
If you have determined that there was indeed a failure of the device, labeling, or packaging and that this failure is systematic, applying to either the entire lot or product, you will likely need to take certain actions.
These actions may be a device recall or can be simpler such as issuing guidance for all purchasers of the device. If the failure was the result of a user error, you may need to provide a new IFU to your customers.
If you still have some of the related product within the company’s possession, you will have to decide whether you are going to rework the product, packaging, or labeling, scrap out the product, or perform other necessary actions. Note that a risk assessment may be required for the rework or other activities.
Initiating Corrective Actions (8.2.2f) (21 CFR 820.198 e7)
After identifying the root cause of the complaint, and performing any immediate correction actions, your procedure should then define how corrective actions (CAPA) will occur to fix the underlying cause of the issue.
One tip for determining which complaints need to escalate to a CAPA is to define the circumstances that require corrective actions in your CAPA procedure. That way you are not constantly assessing each complaint individually, and determining if a CAPA should be generated.
For example, a component manufacturing company may determine that they do not need to initiate a CAPA if the complaint is the result of certain dimensional concerns found during the customer’s incoming inspection. However, they will need to create a corrective action if they determine that the dimensional concern has a high likelihood of causing the device to fail in the field.
The process for creating a CAPA should already be defined in your CAPA procedure. Your complaint handling procedure just needs to point to your CAPA procedure, saying something along the lines of “Corrective actions will be handled per CAPA QP (name of CAPA procedure)”.
You can close a complaint while the CAPA is still in process. Still, you will need to make sure that all of the CAPA actions are properly executed and documented.
Alternatively, if you decide not to initiate a CAPA, you should state the justification for not performing the CAPA in the complaint case (the justification can reference the CAPA triggers in your CAPA process).
Final Response to the Customer (21 CFR 820.198 (e8)
After determining if an investigation and CAPA are necessary, and completing any required actions, you will most likely need to reach out to the customer with the final response. Your procedure should state who is going to be responding to the customer, and what information needs to be required.
If the complaint was initiated by a customer who is the end user of the medical device, you may just need to send the customer a replacement device. On the other hand, the complaint may have come from another medical device company. In that case, they may want a more detailed response including the corrective actions taken, especially if the customer sent a Supplier Corrective Action Request (SCAR).
If the customer did send a SCAR, you will also need to figure out if you can respond using your complaint template, or if you must use the customer’s SCAR template. It is beneficial to have a customer-facing complaint template created that can easily be integrated into the rest of your QMS.
In most situations, you should be able to use this template. But, depending on the Quality Agreement you have in place with the customer (or the amount of pull the customer has), you may need to fill out the information on their SCAR form.
Whatever situation is applicable, someone will likely need to reach out to the customer that made the complaint. Make sure that this response is documented and included in the complaint file.
Closing the Complaint
Finally, your ISO 13485 complaint handling procedure should also dictate when a complaint case can be closed. This is something that can be overlooked when writing out the procedure, but it is highly beneficial to add as much information as possible about complaint closure. Otherwise, you can end up in a situation where all activities are complete, but the complaint case remains open.
Most of the time, you can close a complaint once the investigation is complete and the final response has been sent to the customer. As previously stated, you can close a complaint without a connected CAPA being closed as long as the investigation is complete.
There are circumstances where you will want to wait for a response from the customer before closing the complaint. If so, this should be written into your complaint handling procedure. You may also want to keep a complaint open for various reasons, such as waiting for a high-risk CAPA to be closed, or to keep actions open for MDR.
It is also a good idea to include guidelines for when you can close a complaint without the final response to the customer. For example, a customer may never respond to initial follow-up inquiries related to a complaint.
Wrapping Up
By following this guide, you are well on your way to constructing an awesome ISO 13485 complaint handling procedure. A good procedure is important both to meet regulatory requirements, but also to increase the quality of your QMS.
If you have any questions or opinions, please write them in the comment section below, or reach out from our contact page.