EU Commission establishes basis for unannounced audits
On September 24, 2013, the European Commission published a recommendation on audits and assessments performed in the field of Medical Devices. This recommendation also includes unannounced audits at manufacturers and their suppliers. The implementation of these recommendations is binding. Effective immediately, Medical Device manufacturers must expect unannounced control audits by their Notified Bodies at any time.
The recommendations now published form part of the immediate actions taken to improve patient safety. Although, they do not include any new requirements compared to present requirements, they specify how to interpret and implement the existing requirements. The Commission's intention is to establish clear and consistent requirements for all Notified Bodies and for the assessment of Medical Devices before the introduction of the new Medical Device Regulation. The Commission’s recommendation establishes a clear basis for the three significant parts of the verification of manufacturer compliance, i.e. examination of design dossiers and the performance of regular announced and unannounced audits.
Notified Bodies already have to review the technical documentation of class IIa and IIb Medical Devices according to a defined sampling plan. The recommendations now require an examination of at least one sample of every device category over the certification period of five years. This new requirement will particularly affect manufacturers with several device categories of class IIb devices.
Where any doubt, no matter how small, arises concerning the conformity of a manufacturer or a device, Notified Bodies must carry out additional tests at any time during a regular audit. Additionally, they must check the consistency between the quantity of purchased raw materials and components and the number of finished products.
These audits can take place not only on the premises of manufacturers but also throughout the supply chain including at the premises of their suppliers and subcontractors. They are intended to include – if necessary – critical subcontractors and crucial suppliers along the entire supply chain of a Medical Device. However, responsibility for the Medical Devices always, and without exception, lies with the manufacturer. This means that in an audit, manufacturers cannot refer auditors to their suppliers' documentation and quality management systems. Instead, they must have the complete device documentation at hand at all times.
The European Commission also recommends that manufacturers integrate their own quality management systems with those of their suppliers and subcontractors. Manufacturers are responsible for the ongoing monitoring of the quality of all purchased products and services, irrespective of the length of the contractual chain and of the mutual trust and history between the manufacturer and the subcontractor or supplier.
Unannounced audits are to be carried out at random at every Medical Device manufacturer at least once in every three years. In individual cases – for example, if devices bear a high risk or are frequently noncompliant or where specific information provides reasons to suspect nonconformities of the devices or their manufacturers – the frequency of unannounced audits may be increased.
According to the Commission’s recommendation, unannounced audits should take not less than one day and should be carried out by two auditors. If crucial processes are not carried out by the manufacturer but by a subcontractor or supplier, the audits will be carried out at their premises. Manufacturers have to ensure that Notified Bodies can also access their partners' premises at any time and carry out audits there. In the future, the Notified Bodies will also take samples from ongoing production during these unannounced audits.
Preparation for unannounced audits
In the future, unannounced audits can be decisive for manufacturers to maintain their certification. Accordingly, being prepared for an unannounced visit by the Notified Body at all times is crucial. The process will differ very much from the announced and well-planned assessments that have been carried out so far. Manufacturers will have no time for thorough preparation. Given this, they need to have action plans in place for these surprise audits and should prepare all employees accordingly.
Manufacturers should have a contingency plan and know in advance how to request support and how to alert the responsible persons if an auditor arrives for an unannounced visit at the reception desk. What action is taken if crucial employees are absent on the day of the audit and other employees need to drop the normal work and activities they have scheduled for this day?
Manufacturers also have to ensure that auditors can access production and storage areas at any time and will be introduced to the activities without delay. Copies of the design documentation and test records must be readily available, testing facilities and equipment must be cleared if necessary and ongoing tests interrupted if this is required by the auditors' test plans.
The above provisions also apply to visits to subcontractors and suppliers, for which responsibility also rests with the legal manufacturer of the Medical Device. The costs of an unannounced audit depend on the size of the business and may range between EUR 7,500 and the costs of a regular surveillance audit. TÜV SÜD Product Service will soon contact all clients and inform them further about the process of unannounced audits and the relevant contractual arrangements.