MD+DI Online is part of the Informa Markets Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

How to Survive an Unannounced Audit

Shana LeonardFew companies can claim to have had as significant an impact on the medical device industry as Poly Implant Prothèse (PIP). The now-notorious PIP breast implant scandal, in which the French firm fraudulently employed industrial-grade silicone instead of medical-grade silicone in an effort to boost profits, cast a long shadow over the medical device industry and spurred demands for sweeping regulatory reform across the European Union.

Among the first changes to go into effect is the rollout of mandatory unannounced audits by Notified Bodies. While unquestionably daunting for medical device manufacturers, these surprise inspections are intended to promote quality and patient safety. In short, EU authorities want to nip quality problems in the bud and prevent another PIP fiasco.

So, how can manufacturers adequately prepare to ensure that their unannounced inspection goes smoothly and they don't encounter any additional unwelcome surprises?

What to Expect

Although unannounced audits have always loomed as a possibility for European medical device manufacturers, they were typically only carried out in response to a specific trigger or safety concern. Following the European Commission's recommendation in September, however, Notified Bodies must now perform regular unannounced audits of all manufacturers, regardless of location, that sell medical devices to the European market. 

"Notified Bodies should carry out unannounced audits at least once every third year," according to the recommendations. "Notified Bodies should increase the frequency of unannounced audits if the devices bear a high risk, if the devices of the type in question are frequently noncompliant or if specific information provides reasons to suspect nonconformities of the devices or of their manufacturer." Two auditors will typically perform an unannounced inspection in one day; companies with many products will take longer, however.

And, yes, unannounced truly means unannounced. The Notified Body Dekra's policy, for example, is to call 10 minutes in advance with the audit to officially begin within 30 minutes of arrival, Chris Sarner, project manager of medical device certification for Dekra, noted during a recent presentation at the MD&M West conference in California. Other Notified Bodies maintain that they will show up on a manufacturer's doorstep with no warning whatsoever.

"Usually audits, when done, are very effective when the manufacturer has time to prepare; all people who have knowledge of the processes are there, the manufacturer can be organized, etc.," says Peter Havel, senior vice president of medical & health services, TÜV SÜD. "But the intention of the EU Commission is to ensure continuous compliance with quality management requirements. The EU suspects that the level of compliance demonstrated during an audit might not have accurately represented realistic day-to-day compliance."

But this confirmation of day-to-day compliance introduces a new set of challenges for Notified Bodies and medical device manufacturers alike. If auditors come unexpectedly knocking at a manufacturer's door, there's the chance that the necessary employees will be unavailable, on holiday, or out sick. In addition, while manufacturers should notify their Notified Bodies of periods when certified products will not be manufactured, there will also likely be mistakes, misunderstandings, or extenuating circumstances that arise related to product and production.

The mandatory unannounced audits certainly represent uncharted territory. That's not an excuse to be completely unprepared, however. "We expect industry to have competent staff to be able to deal with all of this stuff," Sarner said. "The way we look at it is that your quality management system and your company production need to be effectively implemented whether someone's out sick or not."

To that end, it is imperative that medical device manufacturers have a clear plan in place for what to do in the event of an unannounced audit. When auditors come knocking at the door, employees need to know how to reach necessary quality management and production personnel. Staff members, according to Havel, must be aware that an unannounced audit can and may happen, so that no one turns the auditors away, thereby jeopardizing the company's certificates. He adds that small and midsize companies, in particular, need an airtight plan because they run lean teams that may not have the luxury of having staff with overlapping or redundant qualifications.

"If you look at it logically, if the system is in day-to-day compliance, the auditor should be able to walk in at any time," Havel says. "But how it is in practice is something we'll learn together with manufacturers."

Critical Subcontractors and Crucial Suppliers

As if unannounced audits weren't nerve-wracking enough, the European Commission has further complicated the process by applying them to the supply chain. "Notified Bodies may, instead of or in addition to visiting the manufacturer, visit one of the premises of the manufacturer's critical subcontractors or crucial suppliers if this is likely to ensure more efficient control," according to the recommendations. "This applies in particular if the main part of the design development, manufacturing, testing or another crucial process is located with the subcontractor or supplier."

Moving forward, manufacturers must thus identify their critical subcontractors and crucial suppliers; these companies, in turn, will be subject to unannounced audits. Here's the rub: Manufacturers need to review and, if necessary, revise contracts with their critical subcontractors and crucial suppliers to ensure they will grant access to auditors and submit to the unannounced audit. 

This step is imperative, according to Notified Body BSI Group, because if these designated suppliers or subcontractors deny access to auditors, they put the manufacturer's compliance status at risk. Ultimately, a lack of cooperation by the supply chain becomes a manufacturer's headache.

Notified Bodies have always had the power to conduct a supplier audit if deemed necessary to respond to a quality concern, but the circumstances have changed. "In the past, we would have usually accepted that a supplier is already certified by either the same Notified Body or another Notified Body and has a certificate for the parts or processes that are outsourced by the manufacturer," Havel says. "But following the logic of unannounced audits: If there is an outsourced process and this process is critical to the safety of the device or the patient, then a Notified Body has to make the decision to do an unannounced audit there, too, even if this contract manufacturer has a [quality management or ISO] certificate."

Further complicating matters is the fact that contract manufacturers and suppliers may be reluctant to acquiesce to unannounced audits. "I find that contract manufacturers have the hardest time with these things because up until today, they could hide; but, they can't hide anymore," Sarner said during her MD&M West presentation in response to an attendee's concern. "Because this is the direction it's going, [contract manufacturers] don't like it, but they know they have to be prepared for it. Eventually, they're not going to push back like they are now." 

To be fair, however, some subcontractors and suppliers have a reason to be reluctant. Those suppliers that partner with numerous medical device companies may be stuck hosting a revolving door of auditors from different Notified Bodies. In addition to the constant disruption to normal operations, a string of unannounced audits may cause conflicts and added stress if different Notified Bodies show up at the same time to perform an unannounced audit. 

Furthermore, unannounced audits raise new questions relating to intellectual property (IP), according to Havel. A contract manufacturer may not want its IP disclosed for the process or part provided to the manufacturer, for example. This is a point that may need to be addressed when revising contracts, he notes.
 

The Impact of Unannounced Visits

While device manufacturers serving the European market must now shoulder an additional burden, these measures will likely help to separate the wheat from the chaff. Companies prone to questionable quality processes or shortcuts are more likely to be discovered, and industry will be kept on its toes. 

"On one side, unannounced audits are a big burden," Havel says. "But there will be a strengthening of quality across the whole industry. Those manufacturers that are committed to quality--and that is the majority--suffer because of corner cutters. [Companies that take shortcuts] will have huge problems in the future; any time they decide to produce in a different way than was certified or approved, there could be an auditor at the door ready to [expose] them." 

 Shana Leonard is the group editorial director, medical content, at UBM Canon.

Hide comments
account-default-image

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish