Unannounced audits

Commission Recommendation of 24th September 2013 on the audits and assessments performed by notified bodies in the field of medical devices (2013/473/EU) was published on 24 September 2014 and entered into legal force on 25 September 2013 by publication in the Official Journal of the European Communities.

The EU Commission declared that the present recommendation was prompted by the fact that the provisions as defined in the Directives 90/385/EEC relating to active implantable medical devices, 93/42/EEC on medical devices and 98/79/EC on in vitro diagnostic medical devices were not interpreted and implemented in a consistent manner by notified bodies. The present legal text shall ensure that the notified bodies carry out a proper verification of the fulfilment of the legal requirements. Therefore, the EU Recommendation includes specific guidelines which notified bodies should apply when they perform product assessments and quality system assessments during their conformity assessment activities.

Furthermore, notified bodies should perform unannounced audits whereby the present recommendation also contains the modus operandi of such unannounced audits. The EU Commission set itself the goal to achieve the consistent and harmonized implementation and application of such legal provisions within the European Union. Especially as an instrument unannounced visits serve to verify the day-to-day compliance with the legal obligations .

Information regarding the application of the EU recommendation (2013/473/EU)

According to the European legislator and the economic operators, the existing legal framework for medical devices has demonstrated its merits. Medical devices are applied on and in the human body; therefore, it is understandable that the legislator imposes the utmost standards to the quality and safety of medical devices. In the light of the considerable technical developments in this product field and regarding the internal market comprising at the time 32 countries with EU member states, EFTA-countries and Turkey, the European Commission takes the view that the interpretation and application of the legal provisions was not consistent.

This led the EU Commission even during the ongoing revision of the present Directives to contribute to a uniform and harmonized interpretation and application of the existing legal provisions with specific recommendations. In order to get a clearer idea of the requirements of Annex III regarding the unannounced audits of the EU Recommendation (2013/473/EU), we answer such questions that are considered to be most significant for you:

  • 1. What are the basic framework conditions for unannounced audits?
    • Unannounced audits

      • take place in addition to initial, surveillance and or intermediate renewal audits at the manufacturer’s premises
      • are not announced in advance; not even a short time before the audit
      • must be performed at least once every three years, lasting at least one day and with at least two auditors
      • can take place at the premises of the manufacturer’s critical subcontractors or at the premises of crucial suppliers in addition to or instead of the unannounced audits at the manufacturer’s premises.

      The number of unannounced audits must should be increased if

      • the devices bear a high risk
      • the devices of the type in question are frequently non-compliant
      • specific information provides reasons to suspect nonconformities of the devices or of the manufacturer.

  • 2. How should manufacturers prepare for unannounced audits?
    • First of all, read the EU Recommendation carefully and decide how it impacts administrative-commercial and technical-regulatory procedures.

      Administrative-commercial:

      • Planning of costs and inclusion in the current budget;
      • the costs for unannounced audits are based on daily rates (at least one day with two auditors on site and around three days for preparation and follow-up). If product testing is necessary, this is also invoiced according to the actual time required for the work.
      • Substitution arrangements must be made in order to guarantee access during unannounced audits, even if certain employees are absent.
      • Employee awareness should be raised in relation to unannounced audits.
      • Identification of all critical subcontractors and crucial suppliers, so that the entire supply chain is recorded. The notified body must also be informed.
      • Contracts with these critical subcontractors and crucial suppliers must be adapted so as to allow for unannounced audits at their premises by the manufacturer’s notified body.
      • Check which crucial suppliers and / or critical subcontractors are located in countries for which a visa is required. Suitable letters of invitation should be obtained from such suppliers / subcontractors.
      • If the manufacturer maintains production sites outside the European Union in countries for which a visa is required, corresponding letters of invitation must also be provided to the notified body.
      • The notified body must be informed of periods when no production takes place (e.g. company holidays).

      Technical-regulatory:

      • Review of the product specifications and technical documentation with regard to the points described in Annex I of the Recommendation.
      • Investigation of whether the established procedures and processes of the quality management system are appropriate in order to ensure fulfilment of the legal obligations in daily operation. Here it can be useful to take the assessment as described in Annex II into consideration.
      • Provision of the technical documentation, also the documentation from subcontractors, including test protocols and reports.
      • Functioning quality control of the components, production and services supplied by third parties over the entire supply chain.
      • Performance of internal “unannounced audits”, in order to identify any omissions or mistakes and to correct or eliminate these, taking the requirements to be fulfilled into account.

  • 3. What is the procedure of an unannounced audit?
    • The auditors provide proof of identity when they arrive. Various factors, such as the number of devices produced and the number of factories, the number of components produced in-house etc., can prolong the time required for the audit and can also lead to the use of more than two auditors.

      During an unannounced audit, the auditors verify in particular if the devices are manufactured in compliance with the specifications of the technical documentation. In order to establish this, either a recently-produced adequate sample or a product sample taken directly from the ongoing manufacturing process must be examined.

      The following items, in particular, are included in the scope of the audit:

      • Traceability of all critical components and materials
      • The system of traceability
      • The documents.

      Product test can be performed in this connection. The test takes place at the manufacturer’s premises or at the premises of critical subcontractors and/or crucial suppliers, with the auditors of the notified body as observers.

      If a design dossier or type examination is to take place, the number of product samples to be taken rises dependent on the number of device types produced. The notified body always takes sample devices at the end of the production chain belonging to at least three sample device types, and where the manufacturer produces more than 99 device types, devices belonging to at least every hundredth type are also taken.

      Within the framework of assessment of the quality assurance system, it should also be verified if the production activity that was ongoing during the unannounced audit is in line with the manufacturer’s documentation relevant to the manufacturing activity and that the production activity and the documentation are in conformity with legal requirements. Finally, at least two critical processes should be checked in more detail.

      The critical processes include:

      • design control
      • establishment of material specifications
      • purchasing and control of incoming materials or components
      • assembling
      • sterilisation
      • batch-release
      • packaging
      • product quality control.

      Any nonconformities that are identified are communicated to the manufacturer or to his critical contractor or crucial supplier at the end of the unannounced audit, followed by a subsequent audit report. Any nonconformities that are identified have to be rectified within a set period.

  • Display all

FAQ - Frequently Asked Questions regarding use of the EU Recommendation (2013/473/EU)

  • What happens if access is denied to the auditors?
    • Denial of access, which must be documented by the auditors, can lead to suspension of the certificate and, according to the EU Recommendation, to termination of the contract.

  • How is authentication of the auditors carried out?
    • The auditors identify themselves with a suitable letter when they arrive at the premises to be audited. Authentication of the auditors can be confirmed by the organisation to be audited by calling the contact telephone number stated in the letter. The manufacturer cannot assume that auditors already known to him will perform the unannounced audit.

  • Must manufacturers of IVDs also reckon with unannounced audits?
    • Performance of unannounced audits applies to all medical devices which fall within the scope of the directives on medical devices, active implantable medical devices and in-vitro diagnostics, regardless of their manufacturing location.

  • Must all notified bodies perform unannounced audits?
    • According to the EU Recommendation which applies to medical devices, active implantable medical devices and in-vitro diagnostics, the application of this Recommendation, and in particular performance of unannounced audits, must be evaluated by the Member States. At the same time as this Recommendation, the EU Commission issued the Commission Implementing Regulation (EU) No. 920/2013 on the Designation and Supervision of Medical Device and AIMD Notified Bodies. These legislative texts clarify on the one hand the binding use and performance of unannounced audits by the notified bodies, and on the other hand the control mechanisms used by the European legislature in collaboration with the Member States.

  • Are there any exceptions with regard to unannounced audits?
    • All medical device manufacturers who fall within the scope of the directives on medical devices, active implantable devices and in-vitro diagnostics must undergo an unannounced audit.

  • What are critical subcontractors and crucial suppliers?
    • Please refer to the relevant documents: ZLG 3.9 B 16 (Central Authority of the Länder for Health Protection with regard to Medicinal Products and Medical Devices, Responses on Conformity Assessment), NBOG-BPG 2010-1; GHTF/SG3/N17:2008.

  • Are product tests always required during the unannounced audit?
    • If a notified body is responsible for the product assessment, samples must always be taken in accordance with the types of device that are manufactured. The examinations and/or tests of the product samples can take place either at the operating premises of the manufacturer, of his critical subcontractors or crucial suppliers, or in external laboratories with the notified bodies observing. However, the notified bodies may also perform the product tests themselves. If the notified body is not responsible for the product assessment, but for the assessment of the quality assurance system, product tests are only performed if this is necessary in order to establish conformity.

  • What happens if a product sample if not available?
    • In such cases the EU Recommendation specifies that the notified bodies should take product samples from the market, if necessary with support by the competent authorities. As an alternative, notified bodies can perform testing on a device installed at a customer location.

  • Display all