As Unannounced Audit Requirements for Medical Devices Are Implemented, Learn From a Notified Body’s Perspective & Experience

Of the recent changes to the European medical device regulation framework, the requirement to conduct unannounced audits of manufacturers of certain CE-marked medical devices has been garnering much attention and raising many questions from manufacturers, suppliers, and subcontractors alike.  Commission Recommendation of 24 September 2013 on the Audits and Assessments Performed by Notified Bodies in the Field of Medical Devices(2013/473/EU) (Recommendation) requires Notified Bodies (NBs) to conduct unannounced audits systematically for each CE-certified legal manufacturer, critical subcontractor, and crucial supplier of a Class I sterile or measuring, Class II, Class IIb, or Class III medical device during the device’s certification cycle.  The Recommendation provides that the unannounced audits should be performed at least once every three years, last at least one day, and be conducted by a team of at least two auditors.  The unannounced audit comes in addition to the initial surveillance and renewal audits of the three-year certification cycle described in the three European Directives on Medical Devices (90/385/EEC, 93/42/EEC, 98/79/EC). 

Many NBs, such as the British Standards Institution (BSI – a UK National Standards Body), recently have started implementing the unannounced audit requirements.  Given their limited implementation history, the medical device industry has a number of questions regarding the details and mechanism of the unannounced audit process.  To address some of these questions, BSI hosted a webinar on August 5, 2014 to share its experience to date.  We outline here some of the issues addressed by BSI’s webinar, as well as tips for ensuring your organization is prepared for an unannounced audit.

Who Can Expect To Be Audited?

Although the legal manufacturer (i.e., the holder of the medical device certification) is the primary focus of these audits, the Recommendation states, “[u]nannounced audits in premises of the manufacturer or itscritical subcontractors or crucial suppliers should be foreseen in the contractual arrangements between the notified bodies and the manufacturers.”  Thus, the unannounced audits may take place on manufacturers’ premises or those of critical subcontractors or crucial suppliers who participate in “the main part of the design development, manufacturing, testing or another crucial process.”  A determination of criticality may be based on the impact of the subcontractor’s or supplier’s contribution to the design, analysis, and testing in-process controls, as well the subcontractor’s or supplier’s impact on the safety and efficacy of the finished product. 

Why Is There Different Nomenclature for “Crucial” Suppliers & “Critical” Subcontractors?

There is no hierarchical-based reasoning for the difference in nomenclature.  The decision to audit each is determined by the same standard – whether the supplier or subcontractor takes part in any substantial manufacturing or design activities with a potential to substantially impact the medical device’s safety and functionality.

What Happens During an Unannounced Audit?

The first notice a firm will receive regarding the audit is the arrival of two NB auditors at its door.  Generally, auditors conducting unannounced audits will be different from those who initially inspected a firm to support its CE certificate and from those who perform routine, planned audits.  The auditors will present identification to company officials and request to speak to the most senior official on site.  The key is having a process to receive the auditors and ensuring that they are allowed immediate, unrestricted access.  Unlike a routine audit, there will generally be no fixed assessment agenda.  Instead, the auditors will conduct a briefing meeting, during which they will cover a high-level timeline of planned activities.  Following the morning meeting, the auditors will make their best effort to proceed to the manufacturing area as quickly as possible.

During the audit, the auditors will verify that ongoing manufacturing is consistent with the technical file and design dossier supporting a medical device’s marketing approval.  This may be accomplished by sampling a medical device from the manufacturing line (or, if a particular medical device is not currently being manufactured, the auditors may choose to sample a finished medical device from a storage or warehouse location, or sample a similar medical device that is being manufactured).  The auditors will also inspect testing and other critical processes.

Afternoon auditing activities may involve a review of documentation needed to support the morning’s auditing activities.  The audit typically ends with a wrap-up meeting, during which the auditors can be expected to provide feedback on any nonconformances.  After the audit, the corresponding NB will prepare and submit a complete auditing report to the manufacturer, generally within two to three weeks.

Of note, the legal manufacturer has responsibility for informing its NB during an unannounced audit of any out-of-the-ordinary manufacturing schedules for itself and its critical subcontractors and crucial suppliers, including any extended periods of non-manufacture or reduced manufacturing, holidays, inventory shutdowns, and off-shift schedules.

How Are Unannounced Audits Different From Routine NB Audits?

When referring to the general nature of unannounced audits, NBs such as BSI often emphasize the word “inspection” and stress that industry should view the process as more akin to an inspection than a full regulatory audit.  After all, given their unplanned nature, one of the main objectives of the unannounced audit is to witness ongoing, routine manufacturing operations; that is, the auditor’s aim is to “inspect” current production and the day-to-day operation of the firm, while attempting to minimize any potential disruption to operations.

Below are some of the differences between a routine audit and an unannounced audit:

  • In contrast with a routine audit, the assessment team will typically work together during an unannounced audit.
  • Also in contrast with a routine audit, unannounced auditors typically will not have a detailed, set agenda but will instead provide a more flexible breakdown of audit timelines.
  • The unannounced audit focuses on the medical device itself, whereas in a routine audit, quality systems and controls may be equally and independently emphasized.  BSI experts have stated that they will not necessarily begin an unannounced audit by examining quality systems unless they have a reason, such as a reported nonconformance.
  • Because the audit is unplanned, NBs recognize that a particular medical device may not be in an active manufacturing state on the day of the audit.

What Can Industry Do to Prepare?

To prepare for unannounced audits, firms should consider enacting the following measures:

  • Communicate the requirements of Commission Recommendation 2013/473/EU to all employees.
  • Implement a procedure for managing unannounced audits by regulatory bodies, and ensure that employees are properly trained on the procedure.
  • To ensure optimal performance during an unannounced audit, hold regular mock audits.
  • Factor the additional costs associated with unannounced audits into company budgets.

Many NBs have sent requests to manufacturers seeking information on manufacturing facilities, facilities of critical subcontractors and crucial suppliers, status of CE certificates, and periods of non-manufacture or reduced manufacturing, among other factors.  During the webinar, BSI encouraged manufacturers to complete and return the form as soon as possible.  Failure to do so may actually increase the chance of an audit, because the NB may not have enough information to conclude it does not need to audit a particular firm. 

What Are NBs Saying About Their Implementation Experiences to Date?

According to NBs such as BSI, although some manufacturers have expressed surprise to be audited “so soon,” most manufacturers generally have been prepared, and there was awareness throughout the firm of the process of unannounced audits.  Also, BSI reported that personnel have been cooperative and followed firm processes to receive unannounced audits.  The overall feedback that BSI received is that the unannounced audit was a “more positive experience than expected.” 

Thus, despite some questions regarding the details of this relatively new requirement, one thing is certain: A manufacturer of a Class I sterile or measuring, Class II, Class IIb, or Class III CE-marked medical device can expect to be audited by an NB soon.  While the idea of hosting an unannounced audit may seem daunting, there are many steps firms can take now to prepare.  Given the unplanned nature of these audits, some level of flexibility will be expected – and indeed necessary – on the part of both the NB and the firm for the unannounced audit to be successful.