Facing a medical device audit can be daunting, but with meticulous preparation and strategic responses, companies can turn this challenge into an opportunity for building a robust quality system.
Tips for Mastering Medical Device Audits
This article provides a detailed roadmap for mastering medical device audits, covering essential steps from internal audits to adeptly handling regulatory findings.
1. Demystifying Audits
Understanding the fundamental concepts behind medical device audits is crucial. ISO 19011 defines audits as systematic, documented, and independent processes for obtaining objective evidence.
This section also outlines the different types of audits, including internal and external audits conducted by regulatory bodies.
2. Navigating US and EU Audits
Medical device audits are mandatory for all device classes, but specific requirements vary depending on regulatory bodies and device classification.
In the EU and US, audits for medium to high-risk devices typically involve Notified Body audits for MDR/IVDR compliance and ISO 13485:2016 certification, FDA inspections for 21 CFR 820 compliance and manufacturing capability verification, and periodic surveillance audits.
Additionally, manufacturers are subject to unannounced and “for cause” inspections triggered by various issues.
3. Strategic Audit Preparation
Thorough preparation for an audit or inspection involves continuous auditing practices, mock audits, and self-identification of issues. Internal audits should be conducted rigorously, acting as rehearsals for external audits.
Mock audits, conducted by independent third parties, can reveal areas for improvement. Self-identifying issues and implementing corrective actions promptly demonstrates a proactive approach to compliance.
4. Selecting the Ideal Audit Host
When selecting an audit host, it’s crucial to choose someone who represents the company well, possesses in-depth knowledge of its operations and quality management system, and can handle pressure effectively.
The audit host is pivotal in ensuring a smooth and successful audit, so selecting the right individual is essential.
5. Document Readiness for Audits
To ensure a smooth audit process and avoid delays, organizations should pre-identify and readily have all necessary documents, including regulatory information, certificates, and records.
A centralized regulatory information management (RIM) system can significantly streamline the process by storing and linking to relevant documents from other systems.
6. Audit In-Action
During an audit, it is crucial to actively manage the process. The company host should introduce the organization and conduct a facility tour. While the auditor directs the audit, the host should assist and guide them throughout the process.
For unannounced inspections, a procedure should outline the reception and handling of such audits, including designating primary contacts and alternates.
Ideally, multiple company representatives should accompany the auditor, and they should not be left alone at any point. A “front room” team should transcribe every interaction and relay information to a “back room” team for support.
7. Best Information Sharing Practices
Employees should provide requested information to auditors but should consult with executives before sharing sensitive documents. Auditors should access information through photocopies or limited computer access.
Original documents can be presented but should not be kept by auditors. All information should be prepared, verified, recorded, and marked “Confidential” or “Proprietary” before being provided to auditors. An extra copy should be made for audit files.
8. Addressing Gaps in Information
Address missing or incorrect information by acknowledging the issue and discussing appropriate actions under the existing quality system. Be prepared to receive findings from any inspection and ensure that they are understood by both parties.
Address all findings diligently and respond to the regulatory body in charge of the audit with a satisfactory plan for correcting and preventing the recurrence of the identified issues.
Conclusion
In conclusion, medical device audits, though challenging, can be navigated successfully with thorough preparation and strategic responses.
Embrace the audit journey as an opportunity for continuous improvement, showcasing a commitment to compliance and the delivery of safe and effective medical devices.
Mastering medical device audits is not just a regulatory requirement – it’s a pathway to excellence in quality systems and product lifecycle management.
A general device description, including any information on any planned variants
Design drawings, details on the planned method of manufacture, diagram of components, sub-assemblies, circuits etc
Descriptions and explanations are required to understand the abovementioned drawings and diagrams and the operations of the product
Results of risk analysis and a list of standards that are applied in full or part (Standards are referred to in Article 5 MDD)
Description of the solutions adopted to meet the essential requirements of the Directive if standards have not been applied fully. (Standards are referred to in Article 5 MDD)
Sterility information, description, and methods of use of sterile products
Results of design calculations and inspections carried out
If the device is to be connected to other device(s) to operate as intended, then there must be proof provided to indicate that it conforms to the essential requirements when connected to any such device(s) having characteristics specified by the manufacturer
Test Reports
Clinical Reports wherever applicable and Clinical data as per Annex X of MDD
Label and Instructions for use
MDR
All Technical documentation requirements of MDD must be presented for the MDR alongside the below additional list:
Device Description and Specifications
Basic UDI-DI
the intended patient population and medical conditions to be diagnosed
contra-indications and warnings
principles of operation of the device and its mode of action
the rationale for the qualification of the product as a device
the risk class of the device and the justification for the classification rule(s) applied
an explanation of any novel features
A description of the accessories for a device, other devices and other products that are not devices intended to be used in combination with it.
a description or complete list of the various configurations/variants of the device
a general description of the key functional elements, e.g., its parts/components
a description of the raw materials incorporated into key functional elements and those making either direct contact with the human body or indirect contact with the body
Technical specifications
Reference to previous and similar generations of the device
Information to be supplied by the manufacturer
A complete set of labels or labels on the device and on its packaging
The instructions for use in the languages accepted in the country of sale
Design and Manufacturing Information
information to allow the design stages applied to the device to be understood
complete information and specifications, including the manufacturing processes and their validation, their adjuvants, the continuous monitoring and the final product testing
identification of all sites, including suppliers, sub-contractors and manufacturing sites.
General Safety and Performance Requirements
The general safety and performance requirements that apply to the device and an explanation as to why others do not apply
The method or methods used to demonstrate conformity with each applicable general safety and performance requirement
the harmonised standards, CS or other solutions applied
the precise identity of the controlled documents offering evidence of conformity with each harmonised standard, CS or other method applied to demonstrate conformity
Benefit-Risk Analysis and Risk Management
The benefit-risk analysis, the solutions adopted, and the results of the risk management
Product Verification and Validation
The documentation shall contain the results and critical analyses of all verifications and validation tests and/or studies undertaken to demonstrate the conformity of the device with the requirements of this Regulation.
Pre-Clinical and Clinical data
Results of tests
If applicable: biocompatibility report, physical, chemical and microbiological characterisation, electrical safety and electromagnetic compatibility, software verification and validation,
stability, including shelf life,
performance and safety
Where applicable, conformity with the provisions of Directive 2004/10/EC of the European Parliament and of the Council (1) shall be demonstrated
Where no new testing has been undertaken, the documentation shall incorporate a rationale for that decision
the clinical evaluation report and its updates and the clinical evaluation plan
the PMCF plan and PMCF evaluation report, and if not applicable, justification of why a PMCF is not applicable
Additional information required in specific cases
Data of the tests conducted to assess safety, quality and usefulness on:
Medicinal product used
Medicinal products derived from human blood or human plasma
Tissues or cells of human or animal origin or their derivatives
Substances or combinations of substances that are intended to be introduced into the human body and that are absorbed by or locally dispersed in the human body
CMR (carcinogenic, mutagenic, or toxic for reproduction) substances
Endocrine-disrupting substances
A description of:
Sterility or defined microbiological condition to be maintained
Methods used in devices with measuring functions to ensure the accuracy as given in the specifications.
Combination/configuration of devices connected to other devices (s) to operate as intended, including proof that it conforms to the general safety and performance requirements when connected to any such device(s) having regard to the characteristics specified by the manufacturer
Post Market Surveillance
Post-market surveillance plan drawn up in accordance with Article 84
Post Market surveillance plan shall address:
Information concerning serious incidents, including information from PSURs, and field safety corrective actions
Records referring to non-serious incidents and data on any undesirable side-effects
Information from trend reporting
Relevant specialist or technical literature, databases and/or registers
Information, including feedback and complaints, provided by users, distributors and importers
Publicly available information about similar medical devices
The post-market surveillance plan shall cover at least:
A proactive and systematic process to collect any information
Effective and appropriate methods and processes to assess the collected data
Suitable indicators and threshold values shall be used in the continuous reassessment of the benefit-risk analysis and the risk management
Effective and appropriate methods and tools to investigate complaints and analyse market-related experience collected in the field
Methods and protocols to manage the events subject to the trend report
Methods and protocols to communicate effectively with competent authorities, notified bodies, economic operators, and users
Reference to procedures to fulfil the manufacturer’s obligations
Systematic procedures to identify and initiate appropriate measures, including corrective actions
Effective tools to trace and identify devices for which corrective actions might be necessary
A PMCF plan, or a justification as to why a PMCF is not applicable
The PSUR referred to in Article 86 and the post-market surveillance report referred to in Article 85
Disclaimer: Regulations/legislations are subjected to changes from time to time and the author claims no responsibility for the accuracy of information.
A notified body is an independent organisation designated by an EU country to assess the conformity of products before being placed on the market. Under EU MDR 2017/745, the notified body is also called a conformity assessment body.
A conformity assessment body (CAB) or a notified body is responsible for carrying out the conformity assessment procedure mentioned in the applicable Regulation.
What does a notified body do?
A notified body assesses whether the product conforms to the requirements set out in the legislation using a conformity assessment procedure. Some essential activities under the procedure include testing, certification, and inspection.
A notified body is a third-party organisation that works for the benefit of manufacturers. The list of Notified bodies is updated on the NANDO website (New Approach Notified and Designated Organisations).
A notified body also has a list of requirements that need to be fulfilled to carry out conformity procedures.
What is a conformity assessment?
Any legal manufacturer of a product can place their products if the product meets all the requirements. Before a product may be sold, it must undergo a conformity evaluation.
The primary goal of the European Commission is to help ensure that dangerous or otherwise non-compliant items do not enter the EU market.
A conformity assessment is done
Before a product is released on the market, its conformance is evaluated.
To demonstrate compliance with all regulatory standards, which include testing, inspection, and certification.
For each product, the applicable product regulation specifies the method of conformance.
In turn, a conformity assessment guarantees the following:
The product about to be placed on the market meets all legal standards.
The procedure ensures the confidence of consumers, public authorities, and manufacturers regarding the conformity of products.
How is the conformity procedure done?
Product legislation describes the conformity assessment method for each individual product. In the case of medical devices, EU MDR 2017/745 is the latest applicable legislation.
Manufacturers may choose between different conformity assessment procedures, if applicable. The manufacturer may carry out the assessment. If the appropriate legislation requires it, a conformity assessment body is involved in the conformity assessment process.
At the end of the conformity assessment, a CE certificate is issued, which implies that the medical devices conform to the requirements set out in the applicable Regulation.
This ensures that the manufacturer can freely market the device in the EU. The CE certificate and the device bear the CE marking adjacent to which the number of the notified body that issued the same is present.
CE marking with the number of the Notified body
Requirements to be met by Notified Bodies
Annex VII of EU MDR 2017/745 mentions the requirements for Notified bodies. Some general requirements like organisational structure, impartiality and confidentiality are mentioned. More specific requirements include the following:
Maintenance of an appropriate QMS
The Quality Management System must be established such that management structure, documentation, policies and objectives are clear. The QMS must ensure that good documentation practices are followed. This includes control of documents and records, continuous reviews and frequent audits.
Resource requirements
Notified bodies must be capable of carrying out all tasks assigned to them under the Regulation with the utmost professional integrity and competence in the specific field, whether done by notified bodies themselves or on their behalf and under their supervision. The personnel responsible for the tasks carried out by notified body must have suitable qualifications and adequate expertise.
Process requirements
The notified body must have documented processes and sufficiently detailed procedures in place for the conduct of each conformity assessment procedure for which it is designated, including the individual steps from pre-application activities to decision-making and surveillance and considering, as necessary, the respective device specification.
FAQs
Do all EU countries have a notified body?
No. Some countries do not have a notified body. The complete list of notified bodies under EU MDR is provided here. Some examples of notified bodies include TUV, SGS and BSI. These notified bodies do not have a presence in each European country, but the certification they provide is accepted elsewhere.
How do I choose the best-notified body for my devices?
While there is no one best-notified body, a couple of things should be considered when choosing one. Cost of the conformity assessment procedure, response, and geographic location of the notified body. Furthermore, choosing a notified body that also allows the MDSAP certification is considerable if the device is marketed to countries like the US, Canada, and so on.
Technical documentation should contain details of the medical device in a clear, organized, readily searchable and unambiguous manner.
It should be provided with all medical devices irrespective of the device class and to be kept updated throughout the product life cycle. Technical documentation is to be prepared according to the requirements given in Annex II of EU MDR 2017/745.
Requirements of Technical Documentation as per Annex II
Device description and specification, including variants and accessories
Information to be supplied by the manufacturer
Design and Manufacturing information
General safety and performance requirements
Benefit-risk analysis and risk management
Product verification and validation
Device Description and Specification, including variants and accessories
This section mentions that technical documentation must include all basic device details such as trade name, general description, basic UDI-DI, principles of operations, classification details, accessories description, key functional elements, technical specification etc. There must also be a proper reference to previous or similar medical devices.
Information to be supplied by the Manufacturer
This section mentions that manufacturer must include a complete set of labelling for the device and its packaging. The manufacturer must also ensure the language requirements of the same according to the each member states’ language requirements.
Design and Manufacturing Information
This section mentions that the technical documentation shall include complete information on processes carried out by the manufacturer during the design stage, manufacturing, validation, monitoring and final product testing of the device.
Identification details of all sites and people involved in the manufacturing process must also be made available.
General Safety and Performance Requirements
This section mentions that the technical documentation must demonstrate conformity to general safety and performance requirements set out in Annex I of the MDR.
This shall include details such as an explanation for safety and performance requirements that the device satisfies and an explanation for requirements that it does not meet, methods used to demonstrate conformity, harmonized standards, Common specifications, and the identity information of the control documents.
Benefit-Risk Analysis and Risk Management
This section mentions that the technical documentation shall include the benefit-risk analysis, solutions adopted, and risk management results as per Annex I of the MDR.
Some significant points from the Risk management section of Annex I are
The risk management plan must be available for each device
Should be able to identify foreseeable hazards associated with each device
should be able to estimate and evaluate the risks
should have plans to eliminate/control the risks
should be able to assess the impact of risk at various stages of the device’s lifecycle and thereby estimating overall risk, benefit-risk ratio, and risk acceptability
Section 1 to 8 of Annex I gives detailed information on general safety measures and other risk management requirements.
Product Verification and Validation
This section mentions that the technical documentation shall contain results and critical analyses of all verification and validation tests/studies.
Some significant Tests/studies discussed in the section are
Biocompatibility
Electrical Safety
Electromagnetic compatibility
Software verification and validation
Stability
Performance and Safety
Physical, chemical, and microbiological characteristics
sterility
A clinical evaluation report and a PMCF (Post-market clinical follow-up) plan and evaluation report must be available. Else, a justification for why PMCF is not applicable must be made available.
Additional information required in specific cases is given in detail in Section 6.2 of Annex II of the EU MDR.
Post-Market Surveillance
Annex III of the MDR majorly mentions that the post-market surveillance plan must address the method of collection and utilization of available data (Such as information on serious incidents and their corrective actions, data on any undesirable side- effects and so on) and includes a list of details a post-market surveillance plan must include in the plan.
There is also a reference to PSUR (Periodic safety update report) and post-market surveillance report mentioned in articles 86 & 85, respectively.
Significant Changes to be noted during the transition from MDD to MDR
Device description to include UDI, UDI-DI or any such number for traceability reasons
Reference requirements to previous or similar medical devices
Under labelling requirements in the MDR, it is explicitly talks about the labelling of devices and their packaging
Language requirements for labelling
As per the MDD, only Class III devices required an explanation for design stages and procedures. The same is now updated to all classes of medical devices in MDR
Identification requirements of all manufacturing sites, design including suppliers and contractors are required now
General safety and performance requirements are updated versions of Essential requirements from the MDD
The benefit-risk analysis is explicitly mentioned as part of risk management requirements in the MDR
Product verification and validation requirements
A detailed explanation of pre-clinical and evaluation and Clinical Evaluation requirements are provided in the MDR
The requirements of the Clinical Evaluation plan and report, Post-market clinical follow-up plan and report are specially mentioned in the MDR
Additional information for special case devices (e.g., combination device, sterile device, device with measuring function etc.) is mentioned in detail in the MDR
FAQs:
What are Common specifications?
Common Specifications are a set of technical and/or clinical requirements, other than a standard, that provides a means of complying with the legal obligations applicable to a device, process or system.
What is the UDI?
The UDI is a series of numeric or alphanumeric characters that is created through a globally accepted device identification and coding standard. It allows the unambiguous identification of a specific medical device on the market. The UDI is comprised of the UDI-DI and UDI-PI. The unique identifier may include information on the lot or serial number and be able to be applied anywhere in the world.
What is the Basic UDI-DI?
Basic UDI-DI is intended to identify and connect devices with the same intended purpose, risk class and essential design and manufacturing characteristics. It is independent/separate from the packaging/labelling of the device and it does not appear on any trade item
Is Post-market surveillance (PMS) applicable for only higher risk classes?
PMS is required for all device classes. A PMS plan and report to be maintained and kept updated by the manufacturer throughout the device life cycle.
Disclaimer: Regulations/legislations are subjected to changes from time to time and the author claims no responsibility for the accuracy of information.
EU MDR – Article 117 – The French Poly Implant Prostheses (PIP) breast implant controversy prompted medical rules to be revised and formed new Medical Devices and In-Vitro Devices Regulations to safeguard public health.
As per the European Medicines Agency (EMA) definition, a medicinal device is a substance or combination of substances intended to treat, prevent or diagnose a disease, or restore, correct or modify physiological functions by exerting a pharmacological immunological or metabolic action.
Medical devices, or device parts, are increasingly being produced for use with medicinal items, which might range from a basic prefilled syringe to more complex autoinjectors to medical devices incorporated as sensors in tablets.
Regulatory bodies have created specialised capabilities and requirements over the last decade due to the increased integration of medicines and devices seen in the latest generation of combination products.
To achieve fast and proper market access for new combination products, manufacturers must adequately understand the unique requirements in each country, and the development of combination products entails a specific pattern of engagement between manufacturers and regulatory bodies.
Based on their primary mode of action, products that combine a medicinal product (or substance) and a medical device are governed by Regulation (EU) 2017/745 or Directive 2001/83/EC.
How is a product categorised as a medicinal product or a medical device based on its mode of action?
As per the EU MDR 2017/745, the product is controlled as a:
medical device when the action of the medicinal substance is auxiliary to the action of the medical device,
medicinal product when the action of the medicinal substance is prominent and not supplementary to the action of the medical device.
For example, an insulin injector pen’s principal action is insulin administration. As a result, the injector pen will be classified as a medicinal product.
The necessity of a declaration of conformity and an EU certificate issued by a notified authority for the evaluation of compliance of the device part and the Drug-Device Combination marketing authorisation dossier is the most significant change brought about by Article 117 of EU MDR.
Suppose these conformity assessment documents are excluded from the dossier. In that case, the applicant will be asked to give an opinion from a notified body on the device part’s compliance with the relevant requirements of EU MDR Annex I.
A notified body is a conformity assessment service provider appointed by the National Competent Authority to assess the conformity of medical devices before being placed on the Union market.
When the device is integrated with a medicinal substance where the action of that substance is principal, or when the medical device administers a medicinal product forming a single integral product, such devices are considered an integral product (combination of medical device and medicinal product).
They shall be governed by Directive 2001/83/EC or Regulation (EC) No 726/2004 and the relevant general safety and performance requirements set out in Annex I of Regulation (EU) 2017/745.
The devices must meet the following criteria before they may be placed on the market:
The device and the medicinal product should be combined into a single integral product
The single integral product should not be reused
The single integrated product is only meant to be used in combination
Marketing Authorisation Applications (MAA)
An application by the Marketing Authorisation Holder (MAH)/applicant to a European regulatory body seeking authorisation to commercialise a pharmaceutical inside the European Union is known as a Marketing Authorisation Application (MAA).
Once obtained, the centralised marketing authorisation is valid in all EU Member States and EEA-EFTA countries (Iceland, Norway, and Liechtenstein).
According to Annex I of Regulation (EU) 2017/745, the MAA shall provide the following for a combination device starting on 26 May 2021:
Declaration of Conformity, and the CE certificate issued by a notified body for the device part having a CE mark
An opinion from a notified body on the conformity of the device part, if it does not hold a CE mark, Declaration of Conformity, and the CE certificate irrespective of the class of the device
Additional information of the benefit/risk assessment of the medicinal product when requested
Where a CE mark has not been issued to the device component on its own, the manufacturer must reach out to a NB and obtain their opinion on the device conformity and provide the NBO report in the MAA
In case the documents mentioned above are issued following the Medical Device Directives 93/42/EEC or 90/385/EEC, then they are still valid and can be used to support the requirements throughout the transition period, which lasts until 26 May 2024.
According to the European Medicines Agency (EMA) or the National Competent Authority (NCA), these documents must be provided in the initial MAA for the medicinal product, and if not, they must be produced before an opinion on the medicinal product application may be granted.
Failure to submit the appropriate documentation may cause the evaluation period to be delayed.
If any changes to the design, intended purpose of the device part, or a new version are launched after the Marketing Authorization has been granted to the manufacturer, the necessary declaration of conformity, CE certificate, and notified body opinion should be submitted to the EMA/NCA.
If the revisions influence the device’s quality, safety, or efficacy, the applicant/Marketing Authorisation Holders (MAH) must file a variation application, consulting the Medicines Competent Authority that gave the marketing authorisation (if the change is unclear).
As part of regulatory compliance, the relevant member states require the Mutual Recognition Procedure (MRP)/Repeat Use Procedure (RUP) application after submitting the variation application.
The dossiers for this application include the General Safety and Performance Requirements (GSPR) of the MDR and Annex I of Directive 2001/83/EC, Section 3.2’s point 12 of Directive 2001/83/EC as amended by Article 117 of the MDR, and supporting documents like the declaration of conformity, certificate of conformity or notified body opinion.
The European Public Assessment Report (EPAR) contains information on the submission and evaluation of materials, procedures, findings, and conclusions of the marketing authorisation application (MAA) to the EMA/NCA.
Co-Packaged Medical Devices (EU MDR – Article 117)
If a medical device is provided as part of the secondary packaging of a marketed medicinal product (co-packaged) and does not form an integral part of the medicinal product, the Marketing Authorisation Holder/applicant must ensure that their co-packaged medical device is CE marked, meets the MDR’s general safety and performance requirements, and is entirely compliant with the MDR before it can be placed on the market. Spoons, measuring cups, inhalers, and spacers are co-packaged medical devices. MDR 2017/745 must be followed by self-CE marked Class I devices.
Article 117 of the Regulation requires Notified Body involvement for European market authorisation of a medicinal product that incorporates an integral medical device or drug-device combination product. The EMA has released an FAQ to help the combination products’ manufacturers understand Article 117 requirements better. Manufacturers must keep in mind that the summary report of NBO will be issued by the notified body only after they verify if all the GSPR requirements are met adequately. Based on their opinion report, the medicines agency decides on the products’ MAA.
FAQs
Is the NBO report mandatory to be submitted to the MAA?
There are 2 ways to do this: 1. If the device is CE marked already, the manufacturer must submit a DoC and a copy of the CE certificate for the device. 2. If the device is not CE marked, obtain the NBO report (assessment of GSPR) and submit it to the authority along with your MAA application
What is a Single Integrated Drug-Device product?
If a medical device used to administer a medicinal product is placed on the market in such a way that the device and medicinal product form a single integral product which is intended exclusively for use in the given combination and which is not reusable, that single integral product shall be governed by Directive 2001/83/EC or Regulation (EC) No 726/2004, as applicable.
What are a few examples of Drug-Device Combination products?
Pre-filled syringes, inhalers, pre-filled pens, an antibody combined with a therapeutic drug, transdermal patches, and insulin pump. Co-packaging examples are a Drug or vaccine vial packed with a syringe and a dose-dispenser medication.
Disclaimer: Regulations/legislations are subjected to changes from time to time and the author claims no responsibility for the accuracy of information.
