There has been much debate over 2013/473/EU (Commission Recommendation of 24 September 2013 on the audits and assessments performed by notified bodies in the field of medical devices). For starters, Annex III of 2013/473/EU states that unannounced audits should be performed at the rate of at least one every three years. However, if the manufacturer is entering a device into commerce that can be deemed as high-risk, the frequency of these surprise audits can be increased. Remember, these audits are not free. In fact, as a minimum, two auditors will be performing these unannounced audits for a period of at least one-day and potentially longer, depending on the number of finished medical devices. Guess who pays for these visits? If you answered the device manufacturer (legal manufacturer) then you would be correct. There is clearly a “numismatic” (look-it-up) value associated with these additional audits. The price of playing poker increases significantly if you hand your notified body a long list of “critical subcontractors” or “crucial suppliers” so use these categories wisely. Enjoy.

2013/473/EU

Unless you have been living in a cave, everyone in industry should have been notified, by their notified body, of the unannounced audit requirement released in the fall of 2013. In reality, this is nothing new. Your notified body has always retained the authority to show-up on your doorsteps unannounced for a cup of coffee, free lunch, a free dinner, and an audit. 2013/473/EU does nothing more than quantify the practice by identifying specific requirements needed for compliance. As with any regulation or standard, there is always room for some interpretive issues; however, the requirement for auditing critical subcontractors and crucial suppliers has now been clearly delineated within the framework of 2013/473/EU.

Although many of you may be in disagreement with Dr. D’s interpretation of this requirement, the old doctor has spoken with several of the well-known notified bodies. Generally speaking, these unannounced visits will be product/manufacturing specific (including the potential collection of product samples for testing) and not Quality Management System (QMS) centric. Simply stated, these audits will not be substitutes for your surveillance and recertification audits, these are additional audits. Hey if you do not want to believe Dr. D, the doc strongly suggests that you contact your notified body.

Additionally, your notified body has by now given you a new/revised contract and a document that requires you to list your critical subcontractors and crucial suppliers. Dr. D cautions you to be very careful when giving this information to your notified body. Why? Because your organizations will be on the hook to pay for these additional audits if the critical subcontractors or crucial suppliers identified do not have an existing relationship with your notified body. Thank you Poly Implant Prothese (PIP), and your now imprisoned founder Jean-Claude Mas (enjoy your four years in the joint).

Furthermore, refusal by a manufacturer, critical subcontractor, or crucial supplier to grant access can result in the suspension of a manufacturer’s certificate(s). This equates to no revenue stream coming from Europe. Remember, it is imperative that you inform your critical subcontractors and crucial suppliers of their status. After all, nobody likes surprises.

Finally, Annex I of the Recommendation delineates the product assessment requirements associated with these unannounced audits. Specifically, your notified body will:

• Verify that a manufacturer’s devices have been correctly qualified as a medical device;
• Verify the correct device classification has been selected;
• Verify compliance with relevant harmonized standards;
• Verify the essential requirements associated with a device’s design including: (a) design; (b) manufacturing; (c) packaging; (d) labeling; (e) identification of hazards; (f) identification of risks; (g) identification of safety requirements; and (h) application of state-of-the-art.
• Review of pre-clinical data; and
• Verify the correctness of technical documentation.

From a QMS assessment perspective, Annex II delineates basic requirements, associated with the product manufacturing that may be assessed during the unannounced visit. Remember, there will be two auditors on-site. For example, you can expect the auditors to verify the effectiveness of maintaining traceability and effective controls over a manufacturer’s supplier-base, including a trip to your stockroom(s).

Requirements Extracted From 2013/473/EU

Dr. D has taken the liberty of extracting a few of the more salient requirements from the Recommendation. Obviously, it is always considered a best practice to download and read the entire Recommendation. If you have interpretation concerns, contact your notified body. After all, you are paying your notified body a small fortune, so get your money’s worth people.

Purpose

“To verify the day-to-day compliance with legal obligations, notified bodies should, in addition to the initial, surveillance or renewal audits, visit the manufacturer or, if this is likely to ensure more efficient control, one of its subcontractors in charge of processes which are essential for ensuring compliance with legal requirements (‘critical subcontractor’) or a supplier of crucial components or of the entire devices (both: ‘crucial supplier’) without prior notice (‘unannounced audits’) in accordance with Annex III.”

Annex II – Quality System Assessment

“2. The quality system assessment should include audits on the premises of the manufacturer and, if this is also necessary to ensure efficient control, on those of its critical subcontractors or of its crucial suppliers. Notified bodies should establish a risk-based approach to identify such subcontractors and suppliers and should clearly document this decision process.”

General advice in case of outsourcing of the production via subcontractors or suppliers

Critical subcontractors or crucial suppliers may be suppliers of suppliers or even suppliers further down the supply chain. Notified bodies should refrain from signing arrangements with manufacturers unless they receive access to all critical subcontractors and crucial suppliers and thus to all sites where the devices or its crucial components are produced, regardless of the length of the contractual chain between the manufacturer and the subcontractor or supplier.”

Annex III – Unannounced Audits

“1. Notified bodies should carry out unannounced audits at least once every third year. Notified bodies should increase the frequency of unannounced audits if the devices bear a high risk, if the devices of the type in question are frequently non-compliant or if specific information provides reasons to suspect non-conformities of the devices or of their manufacturer. The timing of the unannounced audits should be unpredictable. As a general principle an unannounced audit should not take less than one day and should be executed by at least two auditors.

2. Notified bodies may, instead of or in addition to visiting the manufacturer, visit one of the premises of the manufacturer’s critical subcontractors or crucial suppliers if this is likely to ensure more efficient control. This applies in particular if the main part of the design development, manufacturing, testing or another crucial process is located with the subcontractor or supplier.”

Takeaways

Unannounced notified body audits are nothing new. Unfortunately, because of one really bad apple in the industry and a perception of the regulatory environment in the EU lacking teeth, the Commission with the prodding of several notified bodies (you know who you are) has come up with an unrealistic and expensive solution for industry. That being said, the only takeaway Dr. D will leave the readers this week is to be very careful with the identification of critical subcontractors and crucial suppliers. At the end of the day, incorrectly tagging subcontractors and suppliers with critical and crucial tags will cost your organizations dearly. Someone is going to have to pay for these audits and it will not be your suppliers.

In closing, thank you again for joining Dr. D and I hope you find value in the guidance provided. Until the next installment of DG – cheers from Dr. D. and best wishes for continued professional success.

References:

1. 2013/473/EU. (2013, September). Commission recommendation of 24 September 2013 on the audits and assessments performed by notified bodies in the field of medical devices. Official Journal of the European Union. Retrieved July 25, 2014, from http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2013:253:0027:0035:EN:PDF.