This article provides an update on the status of unannounced audits by Notified Bodies for CE Marking of medical devices.
The EU Commission provided recommendations to Notified Bodies last Fall on how they should conduct three different kinds of audits: 1) product assessments, 2) quality system assessments, and 3) unannounced audits (http://bit.ly/Audit-Recommendations). The recommendations do not propose any changes to existing practices for product assessments (i.e., review of CE Marking applications) that are being conducted in accordance with the European Directives, or quality system assessments that are being conducted in accordance with ISO 17021. The recommendation does, however, propose new auditing practices specific to conducting unannounced audits (http://bit.ly/Unannounced-Audits).
The recommendation is addressed to the Member States, rather than Notified Bodies because the intent is for Competent Authorities in each member state to enforce these recommendations when they are reevaluating existing Notified Bodies for renewal. The intent is that the EU Commission and the Member States will use compliance with the “recommendation” for unannounced audits as one of the criteria for deciding which Notified Bodies would retain their status when the new European Medical Device Regulations were approved in 2015. Therefore, all of the Notified Bodies are scrambling to complete a number of unannounced audits before the end of 2014.
Who will be audited in 2014?
In 2014, the primary targets for unannounced audits will be manufacturers of high-risk, Class III devices. The prime targets for unannounced audits are unlikely to contract manufacturers, because Notified Bodies may not have access to all the technical documentation while they are auditing a contract manufacturer. I expect each of the Notified Bodies to plan at least one unannounced audit of a contract manufacturer for a Class III device that is outsourced. Still, I don’t expect this to be the focus of unannounced auditing activities in 2014.
It is already July, and only a handful of unannounced audits have been performed as “pilots.” Most of the Notified Bodies trained auditors on how to conduct unannounced audits in May or June during their annual auditor training. Therefore, we can expect a dramatic increase in the number of unannounced audits during the remaining months of 2014. If your firm has recently had CE Marking compliance issues with a Class III device, you should expect an auditor soon.
4 Ways unannounced audits are different
Unannounced audits differ from traditional quality system audits in four ways.
1. Unannounced audits are truly unannounced–with no warning at all. Even the US FDA inspectors have the courtesy to call on Friday to inform manufacturers of their intent to visit the following Monday or Tuesday. To ensure that auditors can conduct unannounced audits as planned, Notified Bodies are asking manufacturers to provide information about when production activities will be shut-down.
2. Unannounced audits will always be conducted by an auditing team with at least one person that is qualified to review the technical documentation (i.e., Technical File or Design Dossier) and compare it to the actual production activities. This is similar in some ways to how FDA inspectors review a Device Master Record (DMR) and then compare the DMR to production and process controls they observe in manufacturing. However, the technical experts from Notified Bodies typically have a minimum of five years experience similar designing devices, and a two-person team can spread your resources dangerously thin if you are a smaller company that is used to providing a guide for only one auditor or inspector.
3. Unannounced audits will involve more time spent by auditors in production areas, instead of reading documents in conference rooms. You can expect brief opening meetings because auditors need to review critical processes as quickly as possible. Specifically, the auditors are required to use a risk-based approach to select two of the following processes:
- design controls
- establishment of material specifications
- purchasing control and incoming inspection
- assembling
- sterilization
- batch-release
- packaging
- product quality control
If a company conducts sterilization on-site, I would expect this to be a likely prospect for sampling. However, the two areas I hope to be sampled most frequently are: 1) purchasing control & incoming inspection, and 2) batch-release. These two processes are expected to be sampled frequently because these processes facilitate ad hoc sampling and demonstration of testing. This is important because Notified Bodies are expected to observe product testing.
4. Unannounced audits will be conducted at suppliers when critical processes are outsourced. Therefore, if Class III device manufacturers outsource final inspection, packaging, and sterilization–the suppliers providing these services may be unannounced audit targets for multiple Notified Bodies. ISO 13485 certified suppliers have enjoyed a decade of little direct involvement by regulators, but unannounced audits are about to change this.
How will unannounced audits change in the future?
In 2015 and beyond, unannounced audits will be conducted at contract manufacturers and manufacturers. Unannounced audits will also be conducted for all risk classifications of devices–unless the device does not have Notified Body involvement (i.e., Class I, non-sterile, and non-measuring devices). The number of unannounced audits will also increase, because Notified Bodies are required to conduct an unannounced audit for each client at least once during three years–and more frequently for high-risk, Class III devices.
What should be done to prepare?
Preparation for unannounced audits should be very similar to your preparation for FDA inspections (http://bit.ly/FDA-Inspection-Webinar). Still, you will now need to evaluate your suppliers more rigorously to ensure they are also prepared for unannounced audits. The FDA rarely visits suppliers, and they are not allowed to review supplier auditing records. Notified Bodies will not have these restrictions. You will need to demonstrate a good balance between incoming inspection activities and other types of supplier controls. If your incoming inspection activities consist primarily of reviewing paperwork, then you need to balance this with supplier auditing (http://bit.ly/Supplier-Audits) and monitoring of in-process and final inspection nonconformities caused by supplier quality problems.
If you are interested in learning more about unannounced audits by Notified Bodies, please click on this link to pre-register for our webinar recording on the topic: http://bit.ly/unannounced-audits-webinar. Pre-registration pricing is $79, compared to our normal webinar price of $129. The pre-registration period ends on July 18.
As a CRO and identified as a “critical supplier” by one of our clients to their Notified Body, as we manage their device clinical trial, I read with interest your blog this month as the reality so far seems to be unannounced inspections from the NB to manufacturers or their subcontract manufacturers. From my read of the definition of a “Critical Supplier”, it is “…as Supplier delivering materials, components, OR SERVICES that may influence the safety and performance of the device”. As a service provider managing the clinical trial, but not involved in any aspect of the manufacturing of the device, apparently we are classified as a “Critical Supplier”. Has there been any experience to date with the reality of CROs receiving unannounced NB inspections as a result of Sponsor classification of their CRO as a “Critical Supplier” to their NB? The definition for “Critical Supplier” seems extremely broad and yet the focus of these unannounced inspections seems to be more focused on the manufacturing process/controls.
Great question. I have not seen anywhere that a CRO was specifically identified as a “critical supplier” and I have never seen one identified on the CE certificate as a significant subcontractor. It is true that the definition can be interpreted this way, but I think the Notified Bodies and European regulators are defining “services that may influence the safety and performance” being only service providers that are involved in the post-design activities–not the design verification and validation activities. The design verification and validation is sampled by Notified Bodies and pre-approved for high risk devices. Notified Bodies and Competent Authorities also are involved in the oversight of clinical studies. There could be a situation where an unannounced audit of a clinical site might be warranted, but not under the “unannounced audit” initiative. I have heard of no unannounced audits of CROs, but I do know one auditor that actually conducted an unannounced audit of a contract manufacturer.
Pingback: Unannounced Audits: When will your Notified Body’s next audit be? - Medical Device Academy Medical Device Academy