Audit process - Medical device manufacturers

The audit process applies to initial, surveillance and special audits.
1 Preparation
1.1 Notification
Where permitted by the regulatory requirements, the manufacturer should be notified in advance that an audit is to be conducted.
1.2 Preview of quality system description
As a basis for planning the audit, the lead auditor may carry out a preliminary review of the manufacturer's documented methods, such as the quality manual, for meeting the regulatory requirements.
This preview should be considered to be part of the execution of the audit.
If this review reveals that the system described by the manufacturer is not adequate to meet the regulatory requirements, further resources should not be expended on the audit until such concerns are resolved to the satisfaction of the auditing organisation.
1.3 Site visit audit plan
There shall be a site visit audit plan. If permitted by the regulatory requirements, it should be communicated to and agreed with the manufacturer, preferably in advance of the site visit.
The audit plan should be designed to be flexible in order to permit changes in emphasis based on information gathered during the audit, and to permit effective use of resources.
The audit plan shall be prepared within the audit scope and objectives based on:
a)the type of audit to be conducted;
b)information from preview of the quality system description, if available;
and in the case of surveillance or special audits:
c)information from previous quality system audits;
d)available post market surveillance information.
The audit plan should include:
i.the audit scope and purpose;
ii.identification of the manufacturer's management team having significant direct responsibilities regarding the audit scope and purpose, if available;
iii.identification of reference documents (such as the applicable quality system standard and, if available, the manufacturer's quality manual);
iv.identification of audit team members;
v.the language of the audit;
vi.the date and place where the site visit is to be conducted;
vii.the date and place where any additional documentation is to be reviewed;
viii.identification, where possible, of the manufacturer’s organisational units and, where appropriate, other auditees to be audited;
ix.the expected time and duration for each major audit activity;
x.the schedule of meetings, including any necessary daily briefings, to be held with the manufacturer’s management;
xi.the audit report distribution and the expected date of issue.
Where the manufacturer has multiple premises covered by the quality system, the audit plan should adequately address this issue.
The manufacturer should establish and maintain documented procedures to ensure that purchased product or services from their subcontractor meet the relevant regulatory requirements. In duly substantiated cases when the manufacturer is not able to give satisfactory evidence to the audit team that purchased product or services meet the specified requirements, the auditing organisation may need, where possible, to audit the control of processes on the premises of the manufacturer's subcontractors (e.g. sterilisation subcontractors).
1.3.1.Audit plan changes
During the audit the lead auditor may make changes to the auditor’s work assignments and to the audit plan in order to ensure the optimal achievement of the audit objectives. However, the manufacturer should be aware that, based on the quality audit observations, the plan may be modified to allow flexibility in the depth of each area investigated. The manufacturer should be advised of the changes.
If the audit objectives appear to become unattainable, the lead auditor should report the fact and the reasons to the manufacturer and the auditing organisation.
1.4 Audit team assignments
Each audit team member should be assigned specific tasks, such as auditing specific quality system elements. These assignments should be made by the lead auditor in consultation with the audit team members and should be appropriate to each auditor's particular technical expertise.
1.5 Working documents
Working documents should be prepared by the lead auditor with the assistance of the other audit team members as appropriate. These documents should be designed in relation to the audit plan and are for the purpose of facilitating the collection of objective evidence and the reporting of audit results.
Working documents may include:
a) check-lists used for evaluating quality system compliance with applicable regulatory requirements;
b) forms for reporting quality audit observations;
c) forms for documenting supporting evidence for conclusions reached by the auditors.
Sample working documents should be made available to the manufacturer on request.
Working documents should be designed so that they do not restrict additional audit activities or investigations which may become necessary as a result of information gathered during the audit.
2 Audit execution
2.1 Opening meeting
The purpose of an opening meeting is to:
a) introduce the members of the audit team to the manufacturer's management;
b) review the scope and the objectives of the audit;
c) provide a short summary of the methods and procedures to be used to conduct the audit;
d) establish the official communication links between the audit team and the manufacturer;
e) confirm that the resources and facilities needed by the audit team are available;
f) confirm the time and date for the closing meeting and any interim meetings of the audit team and the manufacturer's management;
g) clarify any unclear details of the audit plan.
2.2 Examination
An on-site examination shall be performed by the audit team to:
a) determine compliance of the manufacturer's documented quality system with the regulatory requirements (further to the preview as described in clause 11.1.1 as appropriate);
b) confirm implementation of the manufacturer's procedures;
c) verify effectiveness of the manufacturer’s quality system.
2.2.1 Depth of audit
The audit team should review the elements of the quality system as contained in the audit scope with respect to the regulatory requirements, and sample documents and records at all levels in the quality system. The samples chosen should reflect the risks associated with the intended use for the device, the complexity of the manufacturing technologies, the range of devices produced and any available post market surveillance data.
The audit team should investigate all quality audit observations to establish their extent, particularly if there are concerns about product safety.
2.2.2 Collecting objective evidence
Objective evidence should be collected through interviews, examination of documents and visual observation of activities and conditions in the areas of concern and should be verified. Information gathered through interviews may be tested by acquiring additional information from other independent sources, such as visual observation, measurements and records. Based on this objective evidence, quality audit observations should be noted where there are indications of nonconformities.
Objective evidence may be further documented by collecting copies of documents or, on occasion, taking photographs. Collection of evidence in this manner should be accurately recorded and acknowledged by the auditor and the auditee.
The audit includes collecting evidence of procedures and their implementation to determine compliance with regulatory requirements for post production surveillance (such as complaint handling) and, where appropriate, the design process including risk analysis and clinical evaluation.
Documents or copies collected by the auditors during the audit should be noted and acknowledged.
2.3 Quality audit observations
All quality audit observations should be recorded. Nonconformities, and quality audit observations which may become nonconformities, should be reviewed with the manufacturer as soon as possible after they are noted.
Documentation of nonconformities should:
a) be expressed in a clear, concise manner;
b) be supported by objective evidence;
c) identify the specific requirements which have not been met.
2.4 Non-compliance with the regulatory requirements
One or more major nonconformities will indicate that the manufacturer is not in compliance with the regulatory requirements. Examples of quality audit observations that may be classified as such nonconformities are as follows:
a) failure to address an applicable element of the regulatory requirements for quality systems (e.g. failure to have a complaint handling or training system);
b) failure to implement an applicable element of the regulatory requirements for quality systems;
c) an excessive number of minor nonconformities against an element of the regulatory requirements for quality systems;
d) failure to implement appropriate corrective and preventative action when an investigation of post market data indicates a pattern of product defects;
e) products which are put onto the market which cause undue risk to patient and/or users when the device is used according to the manufacturer's instructions;
f) the existence of products which clearly do not comply with the manufacturer’s specifications and/or the regulatory requirements due to defective elements in the quality system;
g) repeated nonconformities from previous audits.
2.5 Closing meeting
At the end of the audit, the audit team should hold a meeting with the manufacturer's management and those responsible for the functions concerned. The main purpose of this meeting is to present quality audit observations to the management in such a manner as to ensure that the results of the audit are understood.
The lead auditor should present the quality audit observations and identify which ones are, in the opinion of the audit team, nonconformities with an explanation including an indication of their relative severity with respect to the regulatory requirements.
The lead auditor should present the audit team’s conclusions regarding the effectiveness of the quality system in meeting quality objectives.
A written list of quality audit observations, which in the opinion of the audit team are nonconformities, should be presented to the manufacturer's management.
The receipt of the above list of nonconformities should be acknowledged by the manufacturer's management.
A date should be agreed for submission to the audit organisation of corrective action plans necessary to address identified nonconformities.
3 Audit report
3.1 Report preparation
The audit report should be written to provide the auditing organisation with a permanent record of the audit conducted and the manufacturer with information on which to base corrective action and improve its quality system. It should be prepared under the direction of the lead auditor, who is responsible for its accuracy and completeness.
3.2 Report content
The audit report should accurately reflect the content of the audit. It should be dated and signed by the lead auditor. It should either reference previously issued information or as applicable the following items:
a) the scope and objectives of the audit, including the processes and product groups involved;
b) details of the audit plan, the identification of audit team members and manufacturer's representative(s), audit dates, and identification of the specific organisation audited;
c) identification of the audit criteria against which the audit was conducted (regulatory requirements for quality systems, manufacturer's quality manual. etc.);
d) identification of nonconformities, including:
i) details of each nonconformity;
ii) the audit criterion or the specific regulatory requirement to which it applies;
iii) the relative severity with respect to regulatory requirements; and
iv) the date for submission of any necessary corrective action plans.
e) the effectiveness of the manufacturer's quality system in meeting quality objectives;
f) details of any corrective action(s) taken during the audit;
g) recommendation to the auditing organisation for follow up action including time schedule.
Confirmation of the nonconformities and recommendations given by the audit team as referred to under d), e) and g) should be provided to the manufacturer by the auditing organisation as soon as possible but not longer than 6 weeks after conclusion of the audit. Exceptionally, the time scale may be extended when a quality audit observation is to be investigated after the audit to verify whether or not it is a nonconformity and to determine its significance with respect to the regulatory requirements. In this case the manufacturer should be informed as soon as possible of the cause for the delay and a revised issue date.
3.3 Report distribution
The audit report should be transmitted or made available to the manufacturer by the auditing organisation.
The audit report should be issued as soon as possible within a defined time period. If it cannot be issued within the defined time period, the reasons for the delay should be given to the manufacturer and a revised issue date should be established when permitted by the regulatory policies of the auditing organisation.
4 Retention of audit records
The auditing organisation shall retain auditing documents for a period of time prescribed by the applicable regulatory requirements.
5 Audit completion
The audit is completed upon submission of the audit report to the manufacturer