Have you ever wondered what a medical device audit is like?
And above all, what does it look like from the auditor's point of view?
In this article, we take you on a typical medical device audit and show you what it looks like from the auditor's perspective.
Let's go!
It's Wednesday, a mild summer evening. I'm sitting in a restaurant near my hotel, chewing on my pizza with relish, when suddenly, someone taps me on the shoulder from behind. It's my old friend Leo. I'm happy to see him, but at the same time, wondering why he is around.
Leo is an auditor in the medical device industry. He tells me he has been auditing for a notified body for the last 3 days. I'm curious, so I invite him to have dinner to tell me more about it.
His client manufactures non-active medical devices and is not new to the notified body. However, he was new to Leo, and he didn't know the acting persons before the audit. His project handler told him they were "okay," and the quality system seemed "quite compliant."
I'd like to know how such an audit works, so Leo starts talking about the audit from his perspective and reviews the last three days in detail. This is his story:
Getting Started – How I Prepare for Medical Device Audits
Although there are another 14 hours until the audit starts, my work starts now.
The client organized a 3-star hotel with simple facilities and a friendly atmosphere. I am sitting on my bed, preparing the audit trail. The audit trail is my records, and they will become the final audit report after the end of the audit. It all starts with copy-pasting the contents of the audit plan into the trail, ensuring that I don't forget anything.
It has become more complex over the last few years.
I must write at least one objective piece of evidence for each topic. Especially under MDSAP, I will need to record way more audit evidence.
Sometimes I wonder if the authorities want us to audit (which originates from listening) or want us to write a shiny booklet about the client's quality management system.
The First Finding – Before the Official Medical Device Audit Has Even Started
It's late, around 10 pm, I have not even entered the company, but I have documented the first finding. Why already now?
As a medical device auditor, I must verify the client's website for incorrect advertisements and claims.
Unfortunately, the intended use published on the website does not fit the intended use in the instructions-for-use, which was recently verified in the TD assessment.
Anyhow, I'll explain it to the client during the opening meeting; maybe a justification is available. Let's call it a day now.
Medical Device Audit: Opening Meeting and Facility Tour
Having had an excellent breakfast in the hotel, I am starting at half eight for the opening meeting. Good to see that the top management is participating. This is always a good sign, as it indicates sufficient QMS and quality staff support.
The opening meeting includes the usual topics. I must explain the audit plan, criteria, scope, and logistics.
Management complains about high certification costs and insufficient adherence to promised timelines during the TD assessment. For sure, all this is true, and I commit to communicating his concerns to my project handler.
The short facility tour after the opening was helpful for a better understanding of the company, its processes, and its limitations.
The Typical Medical Device Audit Procedure – A Loop of Questions, Evidence, and Discussions
Some hours later, I find myself in deep discussions with the client.
The current topic is last year's audit findings. Any auditor must review the previous findings to ensure the corrections and corrective actions were implemented effectively. For example, the client promised to revise his management review templates to capture new regulatory requirements better. However, the latest review still did not discuss this topic adequately. No MDCG guidance was assessed, and the latest revision of the MDSAP audit approach is not documented.
Should I write it down as a (major) non-conformance? Or may I acknowledge that the procedure was revised and templates were updated?
The rest of the day continues accordingly, and the wrap-up concludes with several potential minor non-conformities. I was okay with the management review as the regulatory person was well able to explain the contents and non-applicability of the new MDCG guidance, and he also provided a pleasant last-minute gap assessment of the new MDSAP audit approach.
Medical Device Audits = Long Days, Short Nights
Back in the hotel, I spent some time in front of the TV to recover. However, my audit trail needs some dedication to document today's records. As open topics arise, it's a daily necessity, and I can follow up tomorrow. My work ends today around midnight… oh, my dear.
Medical Device Audit Déjà-vu and Closing Meeting
Day 2 and 3 can be described as Déjà-vu of the previous medical device audit day: questions, shreds of evidence, and discussions all over the place.
The atmosphere during the audit is good. There is enough coffee and food in the room to keep us going, and they even start to understand my black humor.
The client is strong in some areas, especially the R&D folks know exactly what they are doing. But as seen so often before, they did not always document their rationales and thought processes. There was a considerable discussion about a design change leading to a change in sterilization parameters. Unfortunately, the client did not submit a change notification to the notified body. They should have known that any change to sterilization would require a change notification. This will trigger a significant non-conformity now.
Finally, the closing meeting is approaching. The client drops in his last documents to get rid of some findings. By the way, he could not justify the differences in intended use, leading to another significant non-conformity.
As usual, I'll consider all I can get, but finally, the time is over!
For me, the maximum pressure is building up now – finalizing the finding list. This is the most critical document, as it needs to be signed by the client. I'll need to write the non-conformities precisely and consistently against a requirement. We must add the regulatory requirements, like MDD, MDR, and the relevant MDSAP tasks. The client's signature will state that he understood the findings. This leaves him the possibility to appeal the audit result later on.
The management team was in the closing meeting and challenged me on the findings.
For sure, I was happy to discuss all open topics and concerns. "It was a tough audit and harder than the ones before," the general manager admitted, and he added, "but it was reasonable, and we learned a lot, thanks." For me, this sounds like positive feedback, and maybe, I was able to improve the quality and safety of their devices a little bit.
After the Medical Device Audit
It's Wednesday, 2 pm, and the audit is done – for the client. For me, it is not over yet. The work is only done if I complete the paperwork:
Different medical device audit reports for MDR/MDD and MDSAP
Scanning the Opening/Closing and Finding List
Some auditors are doing this some weeks later, but I am used to accomplishing those activities on the same or next day.
The following client is to be served – tomorrow already!
-----------------------------------------------------------------------------------------------------------
Your next medical device audit is approaching and your Quality Management System is anything but audit-proof? Let us take the burden off your shoulders.
SIFo Medical supports you on your way to compliant processes & documentation. Together we'll bring your QMS to peak performance.
Contact us at office@sifo-medical.com for further information.