"U" is for unannounced audits – what's up with those?
I visited the RAPS Regulatory Convergence conference in Seattle, which provides for a very nice opportunity to catch up with the European medical devices crowd that had gathered in numbers to explain the current changes in EU medical devices law to the US audience and to each other. Apart from the ever charming and authoritative Ms Minor of the European Commission who provided an excellent overview of the current state of the EU medical devices revision, there was a very interesting session on unannounced audits by notified bodies.
What you should know is that the unannounced audits are not something for the mid term future when the revision proposals enter into force somewhere in 2014 or 2015. No, there is a little perfect storm brewing that will make this a reality in 2013 with the following ingredients:
- current EU medical devices legislation that already allows unannounced audits by notified bodies;
- a new Code of Conduct for Notified Bodies (v 3.0), dated 10 October 2012 that contains a section on unannounced audits “will become applicable directly after official publication and coming into force of relevant regulations, directives or guidance documents from the European Commission or Member States, that require Notified Bodies to conduct unannounced audits”, one of the interesting points here being how a guidance document can “require” unannounced audits – this looks rather like a one-two set-up between the Commission and the notified bodies for the moment, until the regulation proposals for medical devices (proposal here) and in vitro diagnostics (proposal here) enter into force. Indeed, what a coincidence: a guidance document in the form of a Commission recommendation (see below) is in the works and will be published end of this year, to enter into force in 2013. In addition you could wonder about whether this system includes the proper checks and balances (more about that below);
- an ongoing process in the Member States pursuant to former Commissioner Dalli’s Action Plan to beef up market surveillance by, among other things, requiring notified bodies to use the instrument of unannounced audits (“Member States to require their designated Notified Bodies to perform unannounced audits of the manufacturers to which they have September 2012 delivered certificates. The frequency of these unannounced audits should be defined by the Commission in a Commission Recommendation, based on the risk of the devices, after consultation with the Member States”);
- a draft Commission recommendation on audits and assessments, which, Ms Minor informed us, will be ready by end of 2012, and will be implemented 2013. I have not seen any public drafts of that document, but will be watching out for them. It won’t be very exciting, I predict, as the Commission will make sure that the recommendation will be in sync with the Notified Bodies Code provisions on unannounced audits.
Nice to know all of this of course, but what should you already be doing now as manufacturer?
First, you should start to update your quality system to include a procedure for unannounced audits (as is already a reality for US). If you are planning to copy your FDA procedure for this, think again: “unannounced” in the EU will be really unannounced as in giving you no notice whatsoever and not the short notice the FDA gives you, as was explained in the session at the RAPS conference. The EU is going for the complete surprise effect because this is believed to be the magic bullet for preventing the type of criminal fraud behind the PIP breast implants case. The surprise audits will focus on manufacturing: “The audit shall be based on verifying conformity of a recently produced adequate sample (product, batch, lot) of an approved device type”, as the new notified bodies code puts it.
Secondly, not only you have to be able to account for unannounced audits, but also other parties on which you depend for different steps in the manufacturing process may be visited by surprise. The new notified bodies code provides in this respect: “In case the manufacturer has subcontracted one or more critical parts of manufacture either to own manufacturing locations or to suppliers and they are regarded significant for the safety and performance of the device under review, then the Notified Body needs to determine whether those sites need to be visited as part of the unannounced visit.” That means that if you outsource your manufacturing (which could even include steps as sterilisation in my view) – as a lot companies do – you have make provision for your contractors to be audited at any time. Most of the contract manufacturing agreements and quality agreements in the market will not be equipped to deal with this, so you will need to
- update the agreement to oblige the contractor to accomodate this (“Manufacturers must have appropriate contracts with their subcontractors that allow an unannounced visit by their Notified Body”, the code says) and perhaps even agree a mechanism of bonus / malus with the contractor as his compliance will influence the frequency of further unannounced audits (see below in more detail);
- draft a procedure for the contract manufacturer to follow and include that in the agreement to avoid surprises; and
- train the contract manufacturer in the procedure, also to avoid surprises.
The notified bodies present in Seattle at the RAPS conference said they will not accept any excuses for not being ready to accommodate a surprise audit. “If you are able to manufacture that day you should be able to receive an audit”, I picked up from the representative of SGS. In the vein of the intention to prevent PIP-like scandals anyone switching on the production line must be ready for a surprise audit.
Thirdly, plan for this to happen at least once per 3 years and plan for the following audit burden:
“• For a legal manufacturer that has subcontracted all critical manufacturing and final inspections steps, and where only documentation is kept and management tasks take place, the minimum duration of the unannounced visit shall be 0.5 day (+ additional time for the subcontractor visit ).• In all other cases where there at least final inspection takes place at the legal manufacturer, the minimum duration of the unannounced visitshall be 1 day.
• The Notified Body shall define the suitable appropriate duration for the visits to additional sites (manufacturing locations and/or critical subcontractors), and shall document the rationale for determining the appropriate duration.”
The audit happens at least once per 3 years, because depending on your risk profile you may be audited more often based on these criteria:
Who pays for the unannounced audits? Take a guess… yes, it’s the manufacturer. And anyone else he can pass these costs on to. That brings me to the point of checks and balances, because what can you do if a notified body places you under higher frequent surprise inspections (which will cost you) and you don’t agree? Well, basically nothing because you have an agreement with the notified body and that agreement will not give you access to an independent legal review of their decision (except maybe if the notified bodies will change the model, which I am not of aware of them doing for the moment), even though the notified bodies are in fact exercising delegated state authority. The only thing you can do if you can’t agree with the notified body is complain to the authorities that the notified body is not performing its task well and that they should be told off. But hang on, under the current climate authorities will be hesitant to tell off notified bodies for increasing inspection frequency, because this is precisely what they would like them to do given the scandals that put pressure on the system. In conclusion, recourse against this type of notified body decision will be problematic to say the very least.
If you need help with your agreements and procedures: my firm has already been thinking about how to deal with this, so feel free to contact me (or try our Question Time feature).