case studies
How a Malaysia-Based Box Build Partner Helped a Medical Device OEM Catch a Change-Control Gap Before It Became an Audit Finding
/)
Flexi Versa Group
How a Malaysia-Based Box Build Partner Helped a Medical Device OEM Catch a Change-Control Gap Before It Became an Audit Finding
A mid-volume medical device OEM was preparing to transfer a Class II home-use device — a compact electromechanical unit with a multi-conductor cable harness and a sealed enclosure — from its NPI line into full production with a contract manufacturer in Malaysia. The device had already cleared design verification and regulatory submission. What remained was the part every program manager underestimates: making sure the production line built the device exactly as it was validated, batch after batch, with documentation that would hold up if an auditor asked for it eighteen months later. Three weeks into the design transfer process, a routine fixture qualification check surfaced a discrepancy that could easily have gone unnoticed until it was much more expensive to fix.
The Challenge
During pilot builds, the OEM's quality team noticed that a cable harness routing on several sample units didn't quite match the drawing on file. The variance was subtle enough that it hadn't affected functional test results, which is exactly what made it dangerous — nothing on the line had failed, so nothing had triggered a review. Left unaddressed, this was the kind of quiet substitution that surfaces during a regulatory inspection, not during production.
The stakes were specific to this program:
The device was scheduled for a regulatory audit within the following year, and any undocumented deviation from the Device Master Record would be a direct finding
The OEM had no internal visibility into whether the change was isolated to a handful of pilot units or had already propagated into planned volume tooling
Traceability records needed to tie the exact harness configuration back to specific lot codes and operators, and it wasn't yet clear whether that data existed for the affected units
A design transfer delay at this stage risked pushing the production release date past the OEM's committed launch window
If the root cause turned out to be a supplier-side sourcing substitution, it would call into question whether other components on the build were subject to the same risk
For a device already carrying regulatory sign-off, an unflagged mechanical deviation wasn't a minor line note — it was a direct threat to the audit trail the entire submission depended on.
The Solution
The contract manufacturer's quality engineering team treated the discrepancy as a design transfer control issue first, not a production shortcut to route around. Their response followed a defined sequence:
Immediate hold and lot isolation. Production on the affected build stage was paused, and every unit built since the pilot run was isolated by lot code pending investigation — before the OEM even formally requested it.
Root cause investigation. Engineers traced the routing variance back to a work instruction that had been updated informally by a line supervisor to reduce assembly time, without being run back through the change control process.
Device History Record reconciliation. The quality team pulled DHR data for every affected unit — operator ID, lot code, test results — and confirmed the variance was contained to the pilot batch rather than having propagated into approved volume tooling.
Formal change request submission. Rather than simply reverting the work instruction, the team documented the proposed routing change, including its rationale and test data, and submitted it to the OEM for a proper engineering and change-control review.
Fixture and work instruction requalification. Once the OEM approved a resolution, the corrected work instruction was validated on the actual production fixtures before the line was released to resume.
Technical Support & Collaboration
What stood out to the OEM's program team wasn't just that the issue got fixed — it was how it was communicated. The contract manufacturer's quality engineer reached out directly within hours of the internal investigation starting, rather than waiting for a formal deviation report to work its way through a ticketing system. The OEM had a standing line to the same engineer throughout the investigation, not a rotating cast of account managers relaying updates secondhand.
Daily updates continued until the isolation and root cause work was complete, even on days when there was little new to report — the OEM's team knew where things stood without having to ask. When the change request was submitted, it came with the underlying test data already attached, so the OEM's own engineering review didn't have to chase down supporting documentation before it could sign off. That transparency shortened what could have been a multi-week back-and-forth into a resolution the OEM could actually defend to its own regulatory team.
The Outcome
The isolated pilot units were dispositioned and excluded from the production release. Volume tooling was confirmed to reflect the approved configuration, and the corrected work instruction was validated before production resumed. The design transfer proceeded on its original schedule, and the OEM entered its regulatory audit window the following year with a complete, defensible change history for the affected component — including the deviation, the investigation, and the documented resolution.
Beyond the immediate fix, the OEM avoided the outcome that matters most in cases like this: a scramble to reconstruct records under audit pressure, or a finding that calls the rest of the DHR into question. The program stayed on schedule, and the OEM came away with confidence that undocumented changes at the box build level wouldn't be the thing that eventually surfaced during a customer complaint or field issue instead.
Why It Worked
Change control was contractually explicit, not assumed. The requirement that any process deviation route through a documented change request had been built into the supplier agreement, not just implied by ISO 13485 certification.
DHR discipline was real, not just filed. Because lot-level traceability was already being maintained consistently, the investigation took days rather than weeks to reconstruct.
Direct engineering access removed the usual lag. The OEM wasn't waiting on a support queue — it was talking to the person who actually understood the fixture and the deviation.
The fixture qualification step existed at all. Design transfer was treated as a controlled, validated handoff rather than an informal one, which is what surfaced the issue before it reached volume production.
This is what dependable medical device box build actually looks like in practice — not the absence of problems, but a quality system built to catch them before they reach an auditor, a complaint file, or a patient. For technical buyers evaluating a contract manufacturer, the equipment list rarely tells that story. The response to a deviation does.
Contact us at: contact@flexiversa.com