This is the moment that all Medical Device manufacturers are afraid of. The moment when some strangers are coming to your company to review if you have done a good job. This is the moment where you will try to hide a lot of information from them and where they will ask you a lot of questions. Yes, this is the Notified Body Audit.
But don’t worry, within this article I will explain to you what will happen and how to get prepared for it. An audit is never a good moment but if you prepare it correctly, this can be. Anticipation is the key.
Recently, we have had a Podcast episode with Martin Witte from TÜV SÜD and I tried to ask him as much question as possible so this helps you get prepared for your audit. You can see the video below.
Subscribe to my Youtube Channel to get notified of my next videos
And below I tried to extract all the information that can help you to get prepared. Don’t hesitate to contact me if you have any questions.
If you want to know more about the different types of audits and how to get prepared for it, here is an article I wrote a few months ago to help you.
Table of content
- What is a Notified Body audit?
- When should you please your Notified Body Audit?
- When will you receive some non-conformances?
- What is the difference if you are new to the market?
- Product review: Before of After on-site audit?
- Which class of product to go first?
- Notified Bodies vs. Harmonized standards
- Key elements: Internal audit and Management Review
- Conclusion
What is a Notified Body audit?
An audit is an official inspection of an organization, typically by an independent body.
A notified body audit is where an organization designated by an EU country to assess the conformity of certain products before being placed on the market. You can find these Notified Body audits within the NANDO Database. Once the organization has cleared the audit, a certificate will be provided.
For example, Martin Witte is coming from TÜV SÜD which is a well-known Notified Body.
So, let’s see how medical device manufacturers should be prepared for audit to be compliant with the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR).
But before that, if you are interested to become a Notified Body auditor, you can look at this interview I have done with Bassil Akra.
Subscribe to my Youtube Channel to get notified of my next videos
When should you please your Notified Body Audit?
It is important to know when and how to approach the notified body. As the proverb goes “The Earlier the Better” applies here as well. So, the earlier you approach the notified body the better you can plan and execute the audit.
Do not wait until you complete all your documentation works, as it may be delayed and leave you with a short time. Once the product manufacturing has been completed and documents partially completed, you can start your application to the notified body.
Once the notified body has received the application, they will start their review internally and plan the audit along with the manufacture, based on the number of products, classification, conformity assessment routes, etc.
Generally, the notified body takes 3 to 6 months to internally review and plan the audit schedule.
The medical device classification as per EU MDR is class III, class IIb, class IIa, class I depending on their risk levels. The graph indicates how the notified body interactions vary with device classification. So, the higher the classification the more interactions and audit plan is required.
But there is an exception with class I (reusable/reprocessing) device. If the product is a reusable surgical instrument class I in MDD there is no need for an interaction with a Notified Body, but this changes with the MDR. Class Ir (for the reusable surgical instrument) is a new class and it is required to be audited by a Notified Body.
In that case, there can be some challenges as the manufacture faces the NB for the first time and there will be a greater number of manufactures approaching the Notified Body, whereas the Notified Body number is really low. Therefore, for the class I (reprocessing/reusable) product manufactures should not wait. there will be a lot of learning to undergo.
If you want to know more about Class Ir or the other sub-classes, I invite you to check this video where I have interviewed Elem Ayne from ACR medical.
When will you receive some non-conformances?
In this section, we will see how some non-compliance can occur. What is important to understand is that even if this is not visible you should still talk about it. Here we’ll take 2 real examples to illustrate this point.
For example, EUDAMED is not active currently and will be fully available from May 2022. So, when you are trying to be prepared for the audit make sure all information and processes to be done when EUDAMED is active should be documented. If some documents need to be uploaded in EUDAMED per EU MDR requirement, you need to document on your procedure all the other processes till the last step of uploading the document. When EUDAMED will be active and you understand how it is working, then you can create additional work instruction to help you perform the internal EUDAMED process. An auditor will understand that you cannot describe something that you don’t know. And don’t worry, if this is not Live, the auditor will also not know how this is working because it’s not existing.
Similarly, for the Single Registration Number (SRN) which will be obtained from EUDAMED (an only from EUDAMED), make sure a blank space is given for SRN in procedures, process and labels documents. You can mention Not Available for the moment (A blank space is not a Good Document Practice). Once EUDAMED is active and you obtain the SRN number, then you can enter it in all documents.
If there is no information about EUDAMED in the documents it will be considered as NC.
Share this article
What is the difference if you are new to the market?
If your product is new to the market, there are few points to be noted to be audit-ready. Some of the manufacturers are saying, “We don’t have complaints because our product is not on the market yet”, but then how can you know if your Process for Complaint handling is correct.
The solution is to test it by performing some simulation. You simulate that you have received some complaints and that you are going through them. Keep this simulation on your files to prove that you have tested it and if the auditor is asking, you can show them that this was done. The objective is to prove to an auditor that your system is working correctly.
It is the same for your Post-market surveillance. You should test it by simulating that you have collected some market data and that you have created your PMS Report or PSUR.
The auditor is here to verify that all is working correctly, so show him that you have not just waited to receive some market information to verify that your Quality Management System is working well.
Product review: Before of After on-site audit?
The Notified body assess the product first before starting the audit, because without knowing the product they cannot know what to audit. So, for example, for a class III device without seeing the technical documentation/dossier the NB cannot identify the criticality of the product. The technical documentation is a collection of all outputs from QMS. The outputs have to be reviewed to understand the severity/complexity of the product.
If the manufacturer has developed a new technology, the notified body should read and understand the process. He identifies all the risk which may occur with the product. By doing this for high risk products the Notified Body is trying to anticipate any elements that he should verify. The auditor or assessor that will review your files may be different from the auditor that will visit your facility, so the assessor will communicate all this information in advance to the auditor so he can prepare the questions he should ask. Therefore, this is why the product assessment and review are done prior to the audit.
Technical Documentation Templates
- Template compliant to requirements of MDR 2017/745 Annex II and III.
- Formatted with the chapters already defined.
- Guidance provided to help you identify the content to include
- General Safety and Performance Requirements compliant to Annex I.
- Include guidance to prove evidence to the requirements.
Which class of product to go first?
The manufacture may have a portfolio of product codes under a different classification. All the codes cannot be audited at once. It is always better to go to audit the complex product first in that way it will be easier for all other products that are coming after.
class III and class IIb device classification follow different review and conformity assessment routes. For one conformity assessment route, only one certificate can be issued. If there are many conformity assessment routes, many audit and CE certificates will be required.
The manufacture should plan the audit with the Notified Body accordingly in which it will cover many process or conformity assessment routes and as well the maximum number of product codes. For sure this will be beneficial.
Notified Bodies vs. Harmonized standards
The manufacture should follow the requirements to increase the protection of humans, the environment, users/patients, to comply with the state of art. The manufactures should when possible comply with the harmonized standards published by the EU commission. But this is not an obligation. This is more of a recommendation.
Why?
The Notified body keeps updated on the latest standards; technical specifications, published by the EU commission, and expects the manufactures also be updated on the latest version of standards and technical specifications.
If the manufacture is not aware of the latest version of harmonized standards or non-harmonized standards and used the superseded/older version of standards, Notified Bodies can consider it as Non-compliant. If an old standard (even harmonized) is not capturing some information that is critical for the product, then the Notified Body will not blindly say that your product is compliant just because it follows the Harmonized Standards.
For example, a pacemaker device that can be allowed in an MRI scan had been developed using the latest technology by the manufacture, which might not have a harmonized standard published for it. In this case, the notified body checks for the technical specifications published and expects the manufacture to comply with the technical specifications for the device.
For now, the only harmonized standards published are with EU MDD and IVDD. The EU Commission has issued a mandate to CEN and CENELEC to create the new harmonized standards for EU MDR and IVDR but this was rejected. A new mandate should be issued in January 2021.
Telenovela
Check the TELENOVELA that I have created to illustrate this situation. https://youtu.be/IrdZAGBSV8I?t=521
Key elements: Internal audit and Management Review
Before facing the audit, it is mandatory to conduct an internal audit and a management review. Internal audit checks the quality of the QMS and this is done by “Yourself” or by a “Consultant”. You can train your team to the ISO 19011 so they know the process to conduct an audit.
Internal audit reports will be checked in the first phase of the audit by a Notified Body, just to make sure the issues are addressed systematically.
For example, during an internal audit, the organization finds out that there is no team available to handle complaints and then reports a Non-conformance. The NC’s reported during the internal audit will be taken to the Management Review and the management should then invest money and resources to plan a team to handle complaints. Even though NC’s was identified, the internal audit is not closed, the management should show some evidence that they have analyzed the issue and that they are working on it. Only then, they can avoid NC’s from the notified body. It would not be good to have an NC coming from the Internal Audit and then receive another NC on the same topic from the Notified Body. So you should not only find the issue but provide some evidence that you are working on it so it is resolved.
Check this video on how to execute an internal audit. I hope this will help you to upgrade your team.
So, if your QMS is shifted from MDD to MDR (or from IVDD to IVDR), and the internal audit and management review is missing, you’re missing the quality check.
These are the few points to be noted down by the manufactures when facing an audit. So why wait, contact your notified body today and plan the audit. Wishing you a lot of success…!!
Conclusion
A Notified Body like any other audit is a question of preparation. If you are asking yourself the right questions and you are finding all the answers, then an auditor will not be able to surprise you.
To help you prepare for an audit, I can also perform with you a Mock Inspection. I act like a real auditor, asking you all possible questions and reviewing your documentation. Then we can establish a plan to make you audit-ready. Don’t hesitate to contact me.
And if you want to see the result of a successful audit. Here is the story of Shokoufeh Kodabandeh from the Straumann Institute. This is always great to see some companies with a happy end.
Medical Device expert. Monir founded Easy Medical Device to help Medical Device companies to place compliant products on the market. He proposes his consulting services so don’t hesitate to contact him at info@easymedicaldevice.com or +41799036836
My objective is to share my knowledge and experience with the community of people working in the Medical Device field.
