All You Need To Know About The Unannounced Audit Visit From A Notified Body

The unannounced audit visit is a mandatory requirement set by the European Commission, which shall be performed in addition to the regular auditing. Its purpose is to verify that the quality management system is implemented effectively. This type of audit is usually conducted by a notified body at least once every three years and leads to additional expenditures for manufacturers. The unannounced audit visits happen without notice, and the auditor must be allowed to enter the facility. If permission is denied, the auditor has the right to recommend the immediate suspension of the certification in question.

The unannounced audit visits concern all medical device manufacturers in Europe, whose products are certified under any of the CE directives, and all EC certificate holders. In this regard, EC certificate holders can be:

• Companies that are OEM (original equipment manufacturers) for other companies;
• Firms that import products, produced outside of Europe, in the EU/EEA;
• Companies, exporting products to markets outside of the EU/EEA.

Typical for the unannounced visits is their considerably different scope from the routine surveillance and recertification audits. The time an unannounced inspection can last for is concise because it aims in assessing a randomly selected product. The product is examined at the facility where it’s manufactured. If the company has multiple product lines and/or production sites, then products from the different lines and locations will be subject to an assessment.

During the audit, the notified body has to ensure the presence of day-to-day product compliance. For that to happen, key processes such as design control, product quality control, assembling, batch release, packaging, and others, are inspected with great caution. After the audit, a confidential audit report and a list of all findings, concerning non-compliances of the product, are given to the manufacturer. Then, the manufacturer has 60 days to present a root cause analysis, along with correction and corrective action plan.

Given all the above, it's clear that the unannounced audit visit from a notified body is an essential part of the post-certification surveillance process, and it can bring some very unpleasant surprises with severe consequences. 

To safeguard themselves, manufacturers must keep in mind the following:

1. Verify and authenticate the notified body performing the audit visit. There are three main steps that the manufacturer should go through:

• Request to see an authentication letter. The audit team should provide one.
• Use the contact information in the letter to call the audit organisation and ask for verification.
• Request a copy of the authentication letter. It is usually received via email or fax.

 2. During the unannounced audit visit, the auditor requires to see the following:

• The selected product’s compliance with the technical file and all legal requirements applicable;
• Traceability system and its conformity with the provisions of the legislative instrument;
• Traceability documentation of critical components and materials used;
• Ongoing manufacturing activity during the audit visit;
• Relevant manufacturing documentation.

3. Present a product portfolio of all CE marked models categorised into device types, which contains the following information:

• A complete range of product models and the criteria for including the specific range into a device category;
• A detailed description of the models’ construction;
• A full list of all components and subassemblies;
• In the event of having some processes outsources, information of each one should be included;
• Information on all critical suppliers.

The unannounced audit can quickly turn into an obstacle if the auditor raises doubts about the conformity of the product’s type. In such cases, a product specimen is required for additional inspection and testing. Moreover, if there are any critical parts, purchased from a supplier, and outsourced processes, the audit team has the right to conduct an unannounced audit visit at the OEM’s facilities. The product sample can be tested in any of the following ways:

• On-site by the manufacturer’s personnel and with the auditor as a witness;
• In the laboratory of the notified body;
• By qualified staff on the manufacturer’ or the OEM’s premises
• In a qualified external laboratory.

In case the product sampling at the manufacturer’s facility is not feasible, the notified body can request samples from any of the following sources:

• Products already put on sale;
• Products installed at a customer location;
• Materials and components included in the final product;
• Unfinished products.

Lastly, to avoid any issues related with the testing of the product sample and ensure the delivery of reliable results, the manufacturer has to be able to present documentation, such as complete product specifications, test protocols from the verification and validation of the product design, test descriptions, and instructions, etc.