1

Management Controls

Slide 1 

Hello, my name is Tonya Wilbon. I am the Acting Deputy Director for the Division 

of Industry and Consumer Education in the Office of Communication and 

Education at CDRH. This presentation will provide you with comprehensive, 

fundamental information with regards to the Management Controls required by 

the Quality System Regulation. Management Controls are important to help 

ensure that you provide adequate resources and that you implement and monitor 

an effective quality system. Quality system is also referred to as Quality 

Management System, and I'll use both terms interchangeably throughout this 

presentation. 

Slide 2

These are the learning objectives for this presentation. First, we'll provide some 

background information about management Controls. Next, we'll explain the 

purpose of the management Controls subsystem. And finally, we'll review the 

Quality System Regulation requirements for management Controls. 

Slide 3

Let's begin with some background information about Management Controls.

Slide 4

This diagram depicts the 7 subsystems of a quality system. I'd like to point out 

that the management subsystem is placed directly in the middle of the diagram. 

It's placed there to demonstrate that management is at the core or the center of 

the firm's quality system. It's also placed strategically in the middle so you can 

physically see how management is interrelated and actually linked to all of the 

other subsystems that make up a firm's quality system. Management Controlss 

are critical to the effectiveness and sustainability of a firm's quality system. 

Slide 5

Of the 7 subsystems I showed on the previous slide, 4 of them are considered 

major, and management Controls is one of them. It is a key quality indicator of 

your quality system. Management Controls make up the basic foundation of your 

quality system and without having such Controls in place, a manufacturer will not 

have an effective quality management system in place. 

Slide 6

FDA considers management to be ultimately responsible for the entire quality 

system. 
2

Slide 7 

FDA has defined quality system in 21 Code of Federal Regulation, or CFR, 

820.3(v) as the organizational structure, responsibilities, procedures, processes, 

as well as resources for implementing quality management. 

Slide 8

With that said, manufacturers are required to implement a management Controls 

subsystem. Let's now review the purpose of this subsystem.

Slide 9

The Management Controls subsystem accomplishes several things. First, it 

provides adequate resources for operations within your quality management 

system. Examples of adequate resources are qualified individuals to perform 

their designated activities; equipment and supplies, both that make up the device 

as well as those used to manufacture the device; and finally, adequate facilities 

that ensure appropriate space for manufacturing. 

Slide 10

The second purpose of the Management Controls Subsystem is to ensure that an 

adequate and effective quality system has been established. For example, 

manufacturers have to make sure that there are controlled manufacturing 

processes and controlled documentation per 21 CFR 820.40. Manufacturers have 

to control these processes to ensure the process will consistently produce the 

desired result. In addition, manufacturers have to make sure the equipment 

being used has been calibrated, inspected, and tested. 

Slide 11

The last purpose of the Management Controls Subsystem is to monitor the 

quality system and make any necessary adjustments. The management 

representative ensures that the quality system is being monitored and that any 

necessary adjustments are made based on information obtained from periodic 

management reviews. 

Slide 12

Now that we've reviewed the background information and purpose of the 

Management Controls System, let's take a closer look at its requirements found in 

the Quality System Regulation.

Slide 13

Specific sections of the Quality System Regulation within the Code of Federal 

Regulations, or CFR, address the requirements we consider to be the essential 

elements of the Management Controls Subsystem. These are, Management 

responsibility, found in 820.20; Quality Audit, found in 820.22; and Personnel, 

found in 820.25. Let's take a closer look at each of these sections.
3

Slide 14

First is Management Responsibility, which has several sections. The 

manufacturer must establish a quality policy and objectives. By establish, we 

mean define, document and implement. This quality policy is established by 

management with executive responsibility. The regulation requires that the 

quality policy actually addresses quality and that the overall intention with 

respect to quality ensures that the safest and most effective products are placed 

on the market. The manufacturer is also required to ensure that the quality policy 

is understood and implemented by all employees. 

Slide 15

FDA considers management with executive responsibility to be a senior 

employee and has the authority to establish and change the quality policy and 

quality system. FDA's definition or description of management with executive 

responsibility is consistent with the definition in the International Organization for 

Standardization document, ISO 9001. The agency tries to harmonize with 

terminology and expectations with the rest of the world and other foreign 

regulators. 

Slide 16

Second, the manufacturer is required to establish and maintain an organizational 

structure. Remember, the definition of quality system included organizational 

structure. This organizational structure must be adequate regarding time and 

employees allocated for all functions identified. Manufacturers cannot have 13 

different functions within the facility and only have individuals assigned to two of 

those functions. They must control all functions affecting device quality, 

including technical functions, administrative functions, or have activities that 

address human factors to reduce/prevent non-conformances. 

Slide 17

This organizational structure must consider the type of device that is 

manufactured, as well as the organizational goals and customer needs. For 

example, the organizational structure of Class I and Class III medical device 

manufacturers may be different from each other. Small and large manufacturers 

may have different organizational structures. The regulation doesn't tell you 

exactly how the organizational structure should look, but it should reflect the 

types of device manufactured and organization size.

Slide 18

While not required in the regulation, a common and best practice to document the 

organizational structure is to have an organization chart. Here's an example of 

one with multiple levels of employees. This chart looks relatively involved. This 

example is an indication that the organizational chart can be quite complex. It has 

a President at the top level, then a Vice President at the 2nd level. 

The 3rd level has specific designated section and the 4th level depicts staffing for 

those sections. 
4

Slide 19

Manufacturers must establish appropriate responsibility and authority. This must 

be independent to every function affecting quality. Manufacturers must ensure 

that an individual assigned to a specific responsibility is appropriate for 

performing that activity based on level of expertise, education, training, etc. A 

manager cannot assign someone to address sterility if that individual does not 

have the necessary education and training to perform activities related to sterility. 

The expertise needed for a particular deliverable or task within manufacturing 

doesn't need to be limited to a single specialty or a stand-alone group. For 

example, a microbiological device would likely include microbiologists on the 

design and manufacturing teams, but may also include other specialists such as 

a statistician, a pediatrician, or an engineer.

Slide 20

820.20 requires that manufacturers provide adequate resources. As I previously 

mentioned, providing adequate resources is one of the purposes of the 

Management Controls subsystem. Manufacturers must develop procedures to 

address those resources to make sure the quality objectives may be achieved. 

Ensuring that personnel are trained for the particular job, role and responsibilities 

is an important step in providing adequate resources. 

Slide 21

There are a few signs that FDA has used to help determine whether a 

manufacturers has adequate resources. If during an inspection, FDA observes 

that the manufacturer was not meeting deliverables and timelines, this may be an 

indication of inadequate resources. Missed timelines may be due to lack of staff, 

equipment, or available materials. Having a high volume of non-conforming 

product awaiting disposition, lengthy time to resolving investigations, and 

lengthy time to implementing corrective actions are all indications of inadequate 

personnel, which is another important resource. 

Slide 22

Manufactures are required to appoint a management representative. This must be 

one person who is a member of management, and the appointment must be 

documented. The specific name of the individual does not have to be 

documented, but a specific role or job description does have to be documented. 

The FDA investigator will request documentation that this individual has been 

documented. That Management Representative is responsible for ensuring that 

the quality system is established and maintained as well as for reporting on the 

performance of the quality system to management with executive responsibility. 

Slide 23

The third major management responsibility is that manufacturers conduct 

management reviews. Management reviews must be conducted by management 

with executive responsibility. 
5

They must be done with sufficient frequency, as defined by the manufacturer, and 

should ensure that management is informed of problems in a timely manner. The 

manufacturer should consider the outcome of internal audits to evaluate potential 

updates to the quality system.

Slide 24

Management reviews must be documented. Manufacturers are required to have 

management review instructions and procedures that define the frequency of the 

reviews, ensure reviews are systematic, and ensure that all parts of the quality 

system are audited. The regulation does not require manufacturers to have inperson management reviews, but the procedures must document how those 

reviews will be done. Note that FDA will not routinely review these documents.

Slide 25

The fourth major requirement is that manufacturers must establish a quality plan. 

In this quality plan, the manufacturer is required to define quality practices, 

resources, as well as activities. Manufacturers are required to have a quality 

policy as well as a plan to document all of these activities. It can be an 

independent document and it can reference the Device Master Record, the Quality 

System Record, and other quality system records already in place. There is no 

specific format, as FDA does not tell manufacturers how to establish this quality 

plan.

Slide 26

The final requirement of Management Responsibility is that manufacturers are 

required to establish quality system procedures. These quality system 

procedures are typically general procedures that may be used throughout the 

quality system for specific devices. Here again, the manufacturer may want to 

outline the structure of the documentation and how the results will be presented, 

if that is required or if it's necessary. 

Slide 27

Next, we'll review the requirements for Quality Audits, which is found in 21 CFR 

820.22.

Slide 28

The regulation requires manufacturers to conduct a quality audit of the entire

quality system, and not just certain subsystems within the manufacturer's quality 

system. FDA does not recommend manufacturers to use the Quality System 

Inspection Technique (QSIT) as the method for conducting internal audits. This 

QSIT guide can be used to help guide the manufacturer; however, it is not 

sufficient as the method for conducting internal audits. 

The QSIT guide addresses four major subsystems, whereas manufacturers are 

required to audit the entire quality system.
6

Quality audits ensure that the quality system is in compliance and are used to 

determine the effectiveness of the quality system.

Audits are required to be conducted by an individual who does not have direct 

responsibility for the area being audited and must be conducted with a sufficient 

frequency.

Slide 29

Manufacturers must take corrective action when non-conformances have been 

identified during the audit. The results must be reported to the management with 

executive responsibility and should be reviewed during the management reviews. 

Manufacturers are required to document the date and the results of the audits 

and whether or not re-audits will be conducted and when.

Slide 30

Quality Audit procedures may include a number of things, such as the 

responsibilities for each part of the audit process; who will audit what area; the 

schedule of audits and auditor qualifications; when to re-audit; the scope and 

purpose of the audit; a checklist; and the format for presenting the results to 

management for review. 

Slide 31

The final section of the Quality System Regulation that addresses the 

Management Controls Subsystem is Personnel, which is found in 21 CFR 820.25.

Slide 32

This section of the regulation requires manufacturers to have sufficient personnel 

with necessary education, background, training, and experience. This will ensure 

that all quality system activities are performed by individuals who are qualified to 

do so. Manufacturers are required to determine personnel training needs and 

then ensure that personnel, including temporary employees, are trained. 

Slide 33

There are several ways management may determine the personnel qualifications. 

Management may review the employee's resume, interview the employee, or 

contact references about the employee's ability to perform the expected tasks.

Slide 34

Finally, the regulation requires manufacturers to ensure that personnel have the 

necessary education, training, and background as well as that when personnel 

are trained, they are made aware of device defects that can occur if they do not 

perform their job correctly as intended. 

Properly trained personnel are able to identify device defects, which in turn will 

help prevent non-conforming product to be released on the market. 
7

Slide 35

All training should be documented. The regulation specifically requires that 

manufacturers ensure that individuals who perform verification and validation 

activities be made aware of device defects during their training.

Slide 36

After watching this presentation, I hope you have a better understanding of the 

regulatory requirements for Management Controls. In summary, Management 

Controls is one of the basic foundations of the quality management system and is 

considered a key quality indicator. Its purpose is to provide adequate resources, 

monitor, and make adjustments to the quality system. Management Controls 

involves the performing of audits of the entire quality system. 

Slide 37

The specific requirements for the Management Controls Subsystem are codified 

under 21 CFR 820.20, 820.22, and 820.25. And finally, FDA considers 

management to be ultimately responsible for the entire quality system.

Slide 38

Management, make sure that you determine if the quality system you have in 

place is the one you should have. Consider whether you need to make changes 

to ensure that you can produce finished medical devices that are safe and 

effective. Make sure that you review and evaluate the quality system frequently 

to ensure it is effective. And for those staff who are not managers, make sure 

you inform management regularly about the state of the quality system.

Slide 39

CDRH provides multiple opportunities for industry education. This presentation 

and other helpful resources are available through the Division of Industry and 

Consumer Education (D-I-C-E). Resources include: CDRH Learn and Device 

Advice. In addition, the Division of Industry and Consumer Education (D-I-C-E) 

answers questions by phone and email from industry and consumers related to 

medical devices. For additional information on these or any other medical device 

regulatory topics, feel free to contact D-I-C-E. Thank you for your attention.

**********