In September 2013, the European Commission published the recommendation On the Audits and Assessments Performed by Notified Bodies in the Field of Medical Devices. The full recommendation can be found here. The list of recommendations in its entirety is actually quite a short document to read in comparison to other regulatory documents. There have been many other individuals and entities that have posted their thoughts, comments, and anticipations for the full implementation of this recommendation.

The Notified Bodies have also been carefully publicizing how they are going to be initiating and performing these unannounced audits. At the time of writing, we are aware of a few Notified Bodies conducting anywhere between 30 to 60 unannounced audits. This article is going to speak primarily about how this is going to impact medical device manufacturer’s suppliers, sub-contractors, and contract manufacturers.

Outsourced operations not off the hook

Medical device manufacturers that outsource any significant portion of their finished device work activities are likely going to experience challenges meeting the intent of this recommendation. What we are aware of is the following from the recommendation:

Directive 90/385/EEC, Directive 93/42/EEC, and Directive 98/79/EC do not provide any exceptions for outsourced production compared to in-house production. Accordingly, it is necessary to include in duly substantiated cases the most important subcontractors and suppliers in the conformity assessment procedures.

Thus, the European Commission does not consider the work activities performed by outsourced production activities to be any different from in-house activities. We have already seen instances where Notified Bodies visited contract manufacturers because the legal manufacturer may not have had proper controls over their suppliers and subcontractors. Thus, as part of the quality system certification process, Notified Bodies insisted on performing audits of the suppliers and subcontractors that they believe significantly impact the quality of the finished device. The rest of the article will discuss ways that medical device manufacturers can properly plan for and anticipate these unannounced audits so that their certifications will not be put in jeopardy.

Supplier qualification and monitoring

Supplier qualification has been an expected quality system process for many years, though it is much more important now that this is properly defined. The manufacturer must develop a method for classifying the suppliers that they use and the level of control that is exercised for their suppliers.

Level of control must be clearly defined, as one difficulty we have seen is that a supplier perceived as non-critical by the manufacturer may in fact be deemed critical by the Notified Body. Manufacturers must have a defined method and rationale for how they classify suppliers and subcontractors as crucial to the operations or activities performed:

• Any contract manufacturer(s) should automatically be categorized as crucial or “key” suppliers that must have much more control than an “off-the-shelf” component supplier.
• Develop a procedure for supplier control and monitoring that defines the level of control required for the suppliers including questionnaires, on-site audits, non-conformities observed, and continued monitoring.
• Routine supplier monitoring must support that at least annually (preferably quarterly) supplier monitoring is performed to assure the crucial suppliers are maintaining the level of control expected.

Quality agreements or contracts

This is probably the most important aspect to examine when considering the publication of the recommendation for unannounced Notified Body audits. If you do not have a Quality Agreement or Contract in place with your critical/significant suppliers and/or subcontractors, you may face difficulties.

When your Notified Body arrives for an unannounced audit and decides that they will visit your contract manufacturer, what are you going to do? Especially when your contract manufacturer does not agree to an audit by your Notified Body, or who may have conflicts with your Notified Body because they have their own, or they may not even be certified to an internationally recognized management system standard. What does the manufacturer do?

What if the supplier will not agree to an agreement or contract?

Having a quality agreement or contract in place between the manufacturer and the supplier is crucial to allow the Notified Body to perform audits as necessary. If the supplier or subcontractor does not agree to this requirement, this may require the selection of a different supplier or subcontractor that will agree to these terms.

Unfortunately we see this as a significant challenge for some manufacturers whose suppliers do not agree to these conditions, which will necessitate negotiations. This may also result in compensation to the supplier for these unannounced audits being performed at their facility. The medical device manufacturer does not want to be stuck with a Major Nonconformity because their critical/key supplier does not agree to an on-site audit by a Notified Body.

Performing audits of significant suppliers

One approach that the medical device manufacturer can take to help reduce the chances of their Notified Body auditing their supplier is to conduct their own on-site audit. The difficulty in this approach is that supplier audits take time, typically require travel, and incur increased costs. In addition, many supplier or contract manufacturers are not keen on customer audits because they take a day or two away from their own work schedules. The question to be asked is: does the manufacturer want the Notified Body auditing their supplier or doing the audit themselves?

As commented in the recommendation document for unannounced audits: The quality system assessment should include audits on the premises of the manufacturer, and if this is also necessary to ensure efficient control, on those of its critical subcontractors or of its crucial suppliers. Notified Bodies should establish a risk-based approach to identify such subcontractors and suppliers and should clearly document this decision process.

The medical device manufacturer can remove this “risk” by providing evidence that they have performed the quality system assessment of their supplier. The manufacturers should invest the time and cost into conducting audits of their suppliers or subcontractors. This will assure the Notified Body that the manufacturer has implemented the most efficient and proper controls of their suppliers, which will hopefully prevent a Notified Body from deciding to perform their own unannounced audit of your supplier.

Conclusion

Medical device manufacturers need to view their suppliers and subcontractors as extensions of their own quality systems. Most manufacturers separate that line as just a purchasing function; however, when it comes to critical/key suppliers, this is an incorrect approach to take. In order to prevent or minimize the risk that Notified Bodies would perform unannounced audits of their suppliers, manufacturers need to understand the impact: Notified Bodies should verify whether the manufacturer’s business organization is appropriate for ensuring the conformity of the quality system and of the medical devices. And, Notified Bodies may, instead of or in addition to visiting the manufacturer, visit on of the premises of the manufacturer’s critical subcontractors or crucial suppliers if this is likely to ensure more efficient control. This point applies, in particular, if the main part of the design development, manufacturing, testing or another crucial process is located with the subcontractor or supplier.

Crucial suppliers need to be partners in the development, manufacturing, testing, and/or distribution of medical devices. Medical device manufacturers need to apply the appropriate controls, qualification, on-site auditing and supplier monitoring for ensuring that these controls are met. Ensure that a quality agreement or contract has been established with your supplier or subcontractor that can allow audits of their facility at any time … by any party (particularly your designated Notified Body).