Since the introduction of EU Directive 93/42/EEC, the principle of unannounced audits has already been regulated in such a way that they are carried out on an ad hoc basis, for example if there are safety concerns about a medical device.
The information about the expectation of the EU Commission that unannounced audits based on the Commission Recommendation 2013/473/EU of 24 September 2013 are now to be carried out on a regular and planned basis now presents us all with new challenges. However, it should be noted that there are companies that are familiar with this principle because their products have been approved outside the EU, as there are also regulations in place that allow other national bodies unannounced access to the company.
Triggered by the breast implant scandal, the unannounced audits, which are carried out regularly and in a planned manner, are intended to help monitor and ensure the ongoing and sustainable compliance of the company and its products with the requirements.
Even though the principle is still new, medical device manufacturers are well advised if the company is properly prepared for this situation. This is because, even at the outset, the consequences of an unannounced audit that is not carried out or not carried out properly can be severe. For example, if an audit team is turned away by the company when it appears, i.e. if the unannounced audit is not facilitated, this will have a direct impact on the certification of the company concerned.
To ensure that such and other serious consequences do not occur, you should prepare your company well by considering the following tips in your deliberations:
- Create a plan for how your employees/staff should behave in the event of an unannounced audit. Regulate responsibilities and create functioning substitution arrangements. Inform your employees about your responsibilities and your plan.
- Also inform your branch offices and production facilities about the possibility of an unannounced audit and make sure that the necessary conditions are created there as well.
- Identify your critical suppliers and prepare them for the situation as well. Create new regulations or supplement existing ones to prepare your suppliers for unannounced audits.
- Verify the effectiveness of the mechanisms created, for example through mock audits.
As with all innovations and associated opportunities, there are also risks that need to be assessed and prevented as far as possible.
We see an enormous potential for abuse of this instrument. Imagine two persons completely unknown to you appearing at your door and claiming to want to carry out an unannounced audit on behalf of your Notified Body. How can you be sure that this is true? Knowing that an unannounced audit that is not facilitated can have a direct impact on your certificate, it is a difficult decision to turn these individuals away. However, it is also a huge risk to allow these individuals into your organization and give them such deep insight into your business.
We have recognized this risk and created mechanisms that allow our certified customers to determine the authenticity of individuals. This enables you to identify potential abuse in a timely manner and respond appropriately.
Below, we explain our approach to unannounced audits and try to provide you with answers to the main questions that have been asked of us since Recommendation 2013/473/EU came into force.
What is the procedure for an unannounced audit?
DQS Medizinprodukte Gmbh (DQS MED) determines which and how many products should be part of an unannounced audit based on criteria such as product criticality, complaints, incidents and deviations from audits. Based on this, the frequency of unannounced audits is also determined. The EU recommendation requires at least one unannounced audit every three years. However, manufacturers with high-risk products may well be subject to more frequent unannounced audits. The frequency of unannounced audits continues to be based on complaints from the market and incident reports. In addition, deviations from the regular system audit can also be cause for an unannounced audit and also for an adjustment of the frequency.
The audit team usually consists of two auditors who together have the expertise applicable to the selected product. There may be cases where the required expertise is so diverse that additional subject matter experts are required in addition to the audit team.
Since the company has no possibility of influencing the audit team in the case of an unannounced audit, we take particular care in selecting the auditors in order to avoid conflicts of interest. Also, an auditor can only be rejected if it can be proven that the impartiality and independence of an auditor is compromised.
We schedule an unannounced audit with at least one calendar day. One calendar day with two auditors then corresponds to two PD. If additional subject matter experts need to be deployed, this will increase the effort accordingly.
The typical procedure for an unannounced audit is for the audit team to introduce itself to you as such and present the relevant evidence (auditor's certificates, authorization letter, assignment, and other documents if necessary) and to talk to the responsible contact person. This can be, for example, the managing director, the QMB or the production manager.
The unannounced audit begins within 30 minutes after the arrival of the audit team with an opening discussion. During this meeting, the auditing team explains which products will be audited and you jointly agree on the contact persons for the auditors. The audit team looks at both ongoing production and the technical processes surrounding the manufacturing process. This means that the flow of goods is also evaluated so that a comparison can be made between the materials used and the products manufactured. The audit team will hold brief coordination meetings with each other several times during the audit to determine the next steps.
At the end of the audit, a final discussion will take place and the results will be communicated. Any deviations will be documented in deviation reports as usual and made available to the company for elimination. The audit team prepares a short report about the visit, which also has to be countersigned by the audited company. This report is made available to DQS MED for internal review.
When and how are product tests performed?
The decision whether a product test will be performed is up to DQS MED. The on-site auditors therefore make a recommendation to DQS MED to perform a product test. The recommendation is given by naming the product type as well as the corresponding batch or serial number or any other information that allows the exact identification of the product. The criteria and characteristics to be taken into account during the test are also specified.
The auditing team will immediately inform you of this information so that you do not put this designated product into circulation until further notice. DQS MED will then contact you promptly and - if the decision for product testing is made - explain to you the further procedure for testing the notified product. Depending on the tests to be performed, it is quite possible that several products of the same type/model will be requested.
We perform product testing with laboratories we trust, which are accredited for the respective testing and recognized by Germany's Central Authority of the Länder for Health Protection with regard to Medicinal Products and Medical Devices (ZLG).
The Commission's recommendation is very clear regarding the involvement of suppliers in unannounced audits. So it is no secret at all that your critical suppliers will be part of or even the main actor in an unannounced audit. This applies to suppliers both inside and outside the European Union.
Since laws, regulations and recommendations of the EU Commission are only valid within the EU, third countries are a particularly sensitive issue. The legal situation - as different as it already is within the EU itself - becomes even more interesting when you leave the EU. Even if you agree with your suppliers that DQS MED is to be granted access for such cases, this does not mean that it will work. The first hurdle may be to get a visa at all. Apart from the fact that in some countries the unannounced audit will no longer be unannounced, there is still the question of whether the audit team will actually make it to the site.
There are countries in which we have the option of conducting unannounced audits. We will also use this option there. For those countries where we expect obstacles, other mechanisms will be required. These mechanisms can be - just to give an example - that you keep reserve samples from each delivered batch, which are then made available for possible testing. Again, this should be considered in your company's preparation.
What preparatory measures should you take for your company?
The tricky thing about an unannounced audit is that it is always inconvenient. Whether important employees are on vacation or sick, whether it is the peak production season, or whether preparations for a trade fair are underway. There is never a standstill in a company.
It is all the more challenging when an audit is to take place unannounced and you have to demonstrate that you meet all requirements.
Remember, illness or absence for any other reason is no excuse for not allowing an unannounced audit.
Create mechanisms for these and similar situations so that you are always able to facilitate an unannounced audit. For example, a procedure could be implemented that governs what the chain of information is if an audit team shows up at your door unannounced and demands entry. Establish a contact person who will deal with the audit team. And remember: this employee also goes on vacation sometimes. So you should also arrange for a substitute. Inform your employees about this innovation, e.g. set up an information chain in your company.
If your company has company vacations or a company outing, create suitable rules here as well. We will be happy to include information on this in our system so that it can be taken into account appropriately when planning unannounced audits.
Inform your key suppliers and structure contracts with them accordingly. Your key suppliers, i.e. those who have a significant influence on the quality and performance of your products, can also become part of or the object of an unannounced audit. Do you have OEM-PLM business? Again, keep contracts in mind.
How should you behave during an unannounced audit?
The situation in an unannounced audit is certainly a bit more tense than during a regular system audit. At least until the principle is established. This applies both to the company concerned and to the auditors. It is particularly important to build trust. For this reason, the auditors will identify themselves with the appropriate evidence of authenticity and correctness. If you still have doubts about the authenticity, your known contact at DQS MED will help you.
As soon as you are completely convinced of the authenticity - and only then - you meet the audit team with the same openness as in a regular audit. The goal of the audit is always to prove together with you that your company complies with the relevant requirements at all times. Therefore, the audit team will also - and especially in view of the extraordinary situation - give you sufficient opportunity and time to provide the requested evidence.
What options do I have to assure myself of the authenticity of the audit and the individuals?
The unannounced audit model is a tool that can have more than just benefits. It can also be significantly abused. How easy it would be to gain entry to a company by referring to the applicable Notified Body, for example, in order to obtain otherwise inaccessible information from competitors. We see it as the core of confidence building that we implement all possible mechanisms to prevent unauthorized access under the pretext of an unannounced audit allegedly commissioned by DQS MED.
- Always ask to see the DQS MED auditor ID card . In addition to the name of the auditor, this also contains a photograph (and must be signed by the auditor).
- Always ask to see the assignment of the audit team. Pay attention to the scheduled time frame for the unannounced audit. If the current date is not within this time frame, the audit is no longer authorized by DQS MED. In this case you do not have to allow the audit team to enter. There will be no negative consequences for you or your certification process.
- Have your contact person at DQS MED confirm the authenticity before the start of the unannounced audit. When doing so, dial only the telephone number known to you of the account manager or internal contact person assigned to you. Do not accept any deviating telephone numbers from the (alleged) auditor team!
- If the audit reveals that strangers or persons not authorized by DQS MED want to gain access to your company with reference to an unannounced audit, do not grant these persons access under any circumstances.
Who can I call at DQS MED if I have questions about this topic?
Each of our certified customers is assigned a contact person in our company whose telephone number is known in your company. Please feel free to call your contact person. If they are unable to help you directly, you will be directed to an employee who can answer your questions with confidence.
Note that you should critically consider telephone numbers given to you by auditors against the number known to you - at least if you have not yet convinced yourself of the authenticity of the auditors and the unannounced audit.
Who bears the costs of an unannounced audit?
With the unannounced audits, there is inevitably expense. The development of the new procedures, additional personnel resources and infrastructure for processing, as well as the expenses associated with the assessment and accreditation must be taken into account.
Therefore, the calculation is based on the effective effort with the usual daily rate for procedures according to Directive 93/42/EEC according to the current price list.
As you may have noticed, you have received our updated General Terms and Conditions in the past weeks and months. In these, the necessary passages have been changed to create the contractual basis for the implementation of the planned regular unannounced audits.
With this change, the unannounced audits will now become relevant and mandatory for the issuance and maintenance of certificates in accordance with Directive 93/42/EEC.
Our aim is to use this instrument of unannounced audits together with you in order to demonstrate without any doubt that your company complies at any time with the regulations imposed on you and to further demonstrate that your products comply with the Essential Requirements of Directive 93/42/EEC.
That this succeeds depends, of course, to a large extent on you. Because without you and your willingness to let us evaluate this also in the context of an unannounced audit, the lasting conformity of your products cannot be examined by us and thus also not be confirmed. We would then no longer be in a position to confirm the fulfillment of the requirements and the conformity of your products and would therefore also not be able to maintain your certificate according to RL 93/42/EEC.
Furthermore, it must be taken into account that, in accordance with the recommendation of the EU Commission, we initially plan an unannounced audit with at least 2 person days by 2 auditors, so that this is effectively carried out on one calendar day. However, the duration on site is ultimately decided by the course of the audit. If, at the end of the day, the audit team is of the opinion that not all audit objectives have been achieved, it is up to the audit team to decide to continue the unannounced audit on the next day within reasonable limits. However, it must be evident that the audit objectives can be achieved on that day. If this is not apparent, the audit must be terminated. An incomplete audit will result in the products for which the audit objectives have not been achieved being removed from the certificate until further notice. The further course of action is then to be discussed with DQS MED on a case-by-case basis.
In the event of a negative decision, you will of course have the opportunity to appeal the decision. Before a possible negative decision becomes effective, you can explain your point of view to us in a written statement within 7 calendar days. Incidentally, the audit team will already point this out to you during the audit. In addition, after a negative decision has been made, you will also receive a written explanation from DQS MED of your options regarding appeals and comments.
Please note that these unannounced audits are important for you as a manufacturer to maintain your certification. The preparation of the company alone cannot take place as in the case of the regularly scheduled audits and therefore places a special demand on you. It may be that important employees are not present, so that, for example, more extensive training or substitution arrangements are required in your company to make the unannounced audit possible. Your employees can be helped by regulations on how to inform top management when a team of auditors shows up at your door unannounced. Ensure that access to production and the warehouse is guaranteed at all times and that escorts are also assigned to the auditing team. Also remember to brief your key suppliers and subcontractors of critical importance accordingly and, if necessary, add any necessary contractual provisions to enable an unannounced audit there as well.
Be prepared that an unannounced audit can take place at any time!