Get started with TÜV SÜD
Start your unannounced audit journey with us.
What is an unannounced audit
On 25th May, 2021 Regulation EU-MDR 2017/745 was implemented. This combined the directives of 93/42/EEC (MDD) and 90/385/EEC (AIMDD). Similarly, IVDR 2017/746 replaced 98/79/EG (IVDD) on 5th April, 2017. All recommendations found in the former directives were transferred to (EU) 2017/745 (MDR) & (EU) 2017/746 (IVDR) and extended by several new requirements exclusive to MDR and IVDR.
Based on this, all EC-certified manufacturers are required to undergo unannounced audits at least once every five years.
Based on this, all EC-certified manufacturers are required to undergo unannounced audits at least once every five years.
About unannounced audits
In 2014, various European authorities such as the “Zentralstelle der Länder für Gesundheitsschutz bei Arzneimitteln und Medizinprodukten (ZLG)” of Germany and the Medicines and Healthcare products Regulatory Agency (MHRA) of UK required that Notified Bodies fully implement their unannounced audit programs.
Although the basic requirement is one unannounced audit per certification cycle once every five years, the frequency of unannounced audits can be increased for the following reasons:
- If the device under certification bears a high risk.
- If the device is frequently noncompliant.
- If there is substantial evidence to suspect a critical non-compliance.
We recommend that manufacturers estimate the likelihood of the frequency of these audits based on the factors mentioned above for each EC-certified device category in their product portfolio.
What I can expect
There are a few aspects to consider when preparing for unannounced audits.
In general, a team of two auditors will be on your site, your supplier(s) and/or subcontractor(s) for at least one full day. An unannounced audit may also last more than one day. Auditors will carefully examine key processes such as purchasing and control of incoming material and components, assembling, design control, establishment of material specifications, software validation, sterilization, batch release, packaging, and product quality control for a chosen sample device. This list is not an exhaustive list, and auditors may examine other relevant processes as well.
In addition to the production process, the unannounced audits will also focus on the product’s performance. Samples may be chosen during the unannounced audits for further inspection and testing. The Notified Body will create a specific test plan prior to the unannounced audit. Product samples will be chosen during the unannounced audits for further inspection and testing (on-site or off-site). If finished products are purchased by the legal manufacturer, the Notified Body may carry out an unannounced audit at the manufacturing supplier's facilities.
In general, a team of two auditors will be on your site, your supplier(s) and/or subcontractor(s) for at least one full day. An unannounced audit may also last more than one day. Auditors will carefully examine key processes such as purchasing and control of incoming material and components, assembling, design control, establishment of material specifications, software validation, sterilization, batch release, packaging, and product quality control for a chosen sample device. This list is not an exhaustive list, and auditors may examine other relevant processes as well.
In addition to the production process, the unannounced audits will also focus on the product’s performance. Samples may be chosen during the unannounced audits for further inspection and testing. The Notified Body will create a specific test plan prior to the unannounced audit. Product samples will be chosen during the unannounced audits for further inspection and testing (on-site or off-site). If finished products are purchased by the legal manufacturer, the Notified Body may carry out an unannounced audit at the manufacturing supplier's facilities.
What preparation I require
It is essential that you are prepared for unannounced audits at all times. Unannounced audits play an important role in the maintenance and renewal of your certification. As the audits are "unannounced", you must have policies and procedures in place for when the audit team is present at your facility.
As the unannounced audit will likely disrupt the day-to-day operational activities, you should prepare unannounced audit procedures to minimize impact to operational activities in the event of an unannounced audit. Key managers and employees that are required for the audit should be present or should be contactable or accessible in short notice.
Manufacturers should consider establishing deputies or representatives for important roles required for the audit. Communication between manufacturers and suppliers/subcontractors should be strengthened to facilitate unannounced audits.
You should take the responsibility to ensure that your suppliers and/or subcontractors are fully aware and prepared for unannounced audits because their performance will have an impact on your ability to maintain and renew your CE certification.
As the unannounced audit will likely disrupt the day-to-day operational activities, you should prepare unannounced audit procedures to minimize impact to operational activities in the event of an unannounced audit. Key managers and employees that are required for the audit should be present or should be contactable or accessible in short notice.
Manufacturers should consider establishing deputies or representatives for important roles required for the audit. Communication between manufacturers and suppliers/subcontractors should be strengthened to facilitate unannounced audits.
You should take the responsibility to ensure that your suppliers and/or subcontractors are fully aware and prepared for unannounced audits because their performance will have an impact on your ability to maintain and renew your CE certification.
Your business challenges
Additional expenses:
Due to the mandatory character of unannounced audits, manufacturers will have additional expenses at least every five years. Additional unannounced audits may occur if the device under certification bears a high risk, is frequently noncompliant, or where specific information provides reasons to suspect non-conformities of the devices or their manufacturers.
Preparation for unannounced audits:
Unlike a regular audit, there won’t be an opportunity to specifically prepare for unannounced audits. Therefore, you must be ready for an audit at any point in time. You need to draft and implement detailed policies and procedures to ensure that your staff are informed, trained and prepared for unannounced audits.
Co-ordination with your suppliers and/or subcontractors:
You should take extra measures to ensure closer communication and coordination with your critical subcontractors/suppliers.
Due to the mandatory character of unannounced audits, manufacturers will have additional expenses at least every five years. Additional unannounced audits may occur if the device under certification bears a high risk, is frequently noncompliant, or where specific information provides reasons to suspect non-conformities of the devices or their manufacturers.
Preparation for unannounced audits:
Unlike a regular audit, there won’t be an opportunity to specifically prepare for unannounced audits. Therefore, you must be ready for an audit at any point in time. You need to draft and implement detailed policies and procedures to ensure that your staff are informed, trained and prepared for unannounced audits.
Co-ordination with your suppliers and/or subcontractors:
You should take extra measures to ensure closer communication and coordination with your critical subcontractors/suppliers.
How TÜV SÜD can help you with unannounced audits
As the leading Notified Body in the medical device industry, TÜV SÜD takes a proactive approach in informing our customers about the requirements for unannounced audits:
- TÜV SÜD provides a variety of informational resources like FAQs to accompany the customer in understanding the unannounced audits.
- TÜV SÜD has expertise on unannounced audits and provides numerous resources for the clients to prepare themselves for the audits.
Frequently asked questions (FAQs)
Our unannounced audits Frequently Asked Questions (FAQs) cover extensive information about unannounced assessments for medical device manufacturers. This includes general questions as well as specific questions related to the various aspects of unannounced audits. It is intended to serve as an informational resource that manufacturers can utilise to optimally prepare for unannounced inspections.
FAQs
General
1. What exactly is meant by the word "unannounced"? Will any prior notice be provided?
There will be no prior notice for any unannounced audit conducted. TÜV SÜD will continue to keep manufacturers updated with the latest information through our unannounced audit webpage.
There will be no prior notice for any unannounced audit conducted. TÜV SÜD will continue to keep manufacturers updated with the latest information through our unannounced audit webpage.
Legal requirements
2. What are the regulations that empower Notified Bodies to conduct unannounced audits?
As per Chapter 3.4 of Annex IX of the Regulation EU-MDR 2017/745 “[t]he Notified Body shall randomly perform at least once every five years unannounced audits on the site of the manufacturer and, where appropriate, of the manufacturer’s suppliers and/or subcontractors […]”. Annex III of the EC Commission Recommendation 2013/473/EU of 24 September 2013 supports this requirement.
Also TÜV SÜD Testing, Certification, Validation and Verification Regulations (TCVVR) state in section A-1.7: “The client shall ensure that TSC and, if necessary, the personnel of authorised bodies can audit or inspect both the client’s manufacturing and operating sites and those of critical subcontractors identified by the client during ordinary business hours, even without prior notice, at the client’s expense. TSC shall also have the right to take random samples at the client’s expense to the extent necessary for the audit or inspection.”
Section B2-5.5 states: “If required by the specific certification scheme or in justified individual cases, TSC shall be authorised to conduct short-notice or unannounced audits at the client’s expense. These audits do not replace a regular surveillance audit […]”.
As per Chapter 3.4 of Annex IX of the Regulation EU-MDR 2017/745 “[t]he Notified Body shall randomly perform at least once every five years unannounced audits on the site of the manufacturer and, where appropriate, of the manufacturer’s suppliers and/or subcontractors […]”. Annex III of the EC Commission Recommendation 2013/473/EU of 24 September 2013 supports this requirement.
Also TÜV SÜD Testing, Certification, Validation and Verification Regulations (TCVVR) state in section A-1.7: “The client shall ensure that TSC and, if necessary, the personnel of authorised bodies can audit or inspect both the client’s manufacturing and operating sites and those of critical subcontractors identified by the client during ordinary business hours, even without prior notice, at the client’s expense. TSC shall also have the right to take random samples at the client’s expense to the extent necessary for the audit or inspection.”
Section B2-5.5 states: “If required by the specific certification scheme or in justified individual cases, TSC shall be authorised to conduct short-notice or unannounced audits at the client’s expense. These audits do not replace a regular surveillance audit […]”.
Scope and application
3. Which manufacturers are subjected to unannounced audits?
Unannounced audits apply for all EU and EC Certificate holders (Legal Manufacturer), regardless of whether devices are covered under MDR (incl. Art. 120) and IVDR (incl. Art. 110).
4. Are unannounced audits still performed for manufacturers who have received a confirmation letter?
If a confirmation letter was issued (covering the EC certificate until MDR/IVDR certification) , the issuing Notified Body is still responsible for regular as well as unannounced surveillance activities via MDR Art. 120 / IVDR Art. 110.
Unannounced audits apply for all EU and EC Certificate holders (Legal Manufacturer), regardless of whether devices are covered under MDR (incl. Art. 120) and IVDR (incl. Art. 110).
4. Are unannounced audits still performed for manufacturers who have received a confirmation letter?
If a confirmation letter was issued (covering the EC certificate until MDR/IVDR certification) , the issuing Notified Body is still responsible for regular as well as unannounced surveillance activities via MDR Art. 120 / IVDR Art. 110.
Unannounced audit procedure
5. How should we verify and authenticate the auditors when they show up on our premises for an unannounced audit?
Verification and authentication of the auditor is a very important step that manufacturers must take to safeguard themselves. Please ensure that you verify and authenticate everyone who is present on your site to conduct an unannounced audit.
TÜV SÜD has a very clear process for verifying and authenticating the auditors:
Upon arrival of the audit team on the manufacturer's site, an authentication letter is handed to the manufacturer by the audit team.
The manufacturer can contact their local TÜV SÜD contact person/office and ask for a verification of the unannounced audit, based on the information provided in the authentication letter.
Upon request, a copy of the authentication letter can be emailed to the client.
Please ensure that the auditor is a genuine TÜV SÜD auditor prior to starting the audit. The responsibility lies with the manufacturer to ensure that the auditors are genuine by following the steps outlined above.
Verification and authentication of the auditor is a very important step that manufacturers must take to safeguard themselves. Please ensure that you verify and authenticate everyone who is present on your site to conduct an unannounced audit.
TÜV SÜD has a very clear process for verifying and authenticating the auditors:
Upon arrival of the audit team on the manufacturer's site, an authentication letter is handed to the manufacturer by the audit team.
The manufacturer can contact their local TÜV SÜD contact person/office and ask for a verification of the unannounced audit, based on the information provided in the authentication letter.
Upon request, a copy of the authentication letter can be emailed to the client.
Please ensure that the auditor is a genuine TÜV SÜD auditor prior to starting the audit. The responsibility lies with the manufacturer to ensure that the auditors are genuine by following the steps outlined above.
Testing and assessment
6. Is testing mandatory for unannounced audits?
Chapter 3.4 of Annex IX of the Regulation EU-MDR 2017/745 states that “[…] the Notified Body shall test an adequate sample of the devices produced or an adequate sample from the manufacturing process to verify that the manufactured device is in conformity with the technical documentation […]“.
Equally, the EU Commission Recommendation 2013/473/EU highlights in Annex III section 4 that ”[...] These samples should be tested by the notified bodies or by qualified personnel under their observation on their own premises, or on the manufacturer’s premises, or on the premises of the manufacturer’s critical subcontractor or critical supplier or in external laboratories.”.
7. What criteria do Notified Bodies have for selecting the products that will be sampled?
Notified Bodies may select products which have a high likelihood of nonconformity. Other reasons may include:
-Media reports and news about malfunctions
-High risk devices
-Noncompliant products
-Information from the market based on malfunctions of similar products
-Information or inquiries from the authorities
-High rate of device noncompliance
8. How will the manufacturer be involved in the unannounced audit during the testing of components?
When testing is performed on the manufacturer`s premises, the manufacturer will use its own personnel and laboratory test equipment while the personnel from TÜV SÜD will supervise the tests. For an off-site test of a physical device, a product sample (or sample of either semi-finished or raw material) will be taken during the unannounced audit. The sampled product(s) will be tested at a test laboratory of TÜV SÜD Product Service GmbH or qualified external laboratories of TÜV SÜD Danmark ApS. For an off-site test of a (stand-alone) software/firmware access to the app, server, web app etc. of the relevant product is required. The penetration test will take place at TÜV SÜD Product Service GmbH.
9. Which critical suppliers and crucial subcontractors will be likely candidates for unannounced audits?
Critical supplier processes are eligible for unannounced audits if they are responsible for processes that may affect the safety of the medical device in such a way that failure to comply with the specified process requirements may cause an unacceptable risk to the patient, user or third party, or that the performance characteristics of the medical device may be significantly adversely affected as a result.
Chapter 3.4 of Annex IX of the Regulation EU-MDR 2017/745 states that “[…] the Notified Body shall test an adequate sample of the devices produced or an adequate sample from the manufacturing process to verify that the manufactured device is in conformity with the technical documentation […]“.
Equally, the EU Commission Recommendation 2013/473/EU highlights in Annex III section 4 that ”[...] These samples should be tested by the notified bodies or by qualified personnel under their observation on their own premises, or on the manufacturer’s premises, or on the premises of the manufacturer’s critical subcontractor or critical supplier or in external laboratories.”.
7. What criteria do Notified Bodies have for selecting the products that will be sampled?
Notified Bodies may select products which have a high likelihood of nonconformity. Other reasons may include:
-Media reports and news about malfunctions
-High risk devices
-Noncompliant products
-Information from the market based on malfunctions of similar products
-Information or inquiries from the authorities
-High rate of device noncompliance
8. How will the manufacturer be involved in the unannounced audit during the testing of components?
When testing is performed on the manufacturer`s premises, the manufacturer will use its own personnel and laboratory test equipment while the personnel from TÜV SÜD will supervise the tests. For an off-site test of a physical device, a product sample (or sample of either semi-finished or raw material) will be taken during the unannounced audit. The sampled product(s) will be tested at a test laboratory of TÜV SÜD Product Service GmbH or qualified external laboratories of TÜV SÜD Danmark ApS. For an off-site test of a (stand-alone) software/firmware access to the app, server, web app etc. of the relevant product is required. The penetration test will take place at TÜV SÜD Product Service GmbH.
9. Which critical suppliers and crucial subcontractors will be likely candidates for unannounced audits?
Critical supplier processes are eligible for unannounced audits if they are responsible for processes that may affect the safety of the medical device in such a way that failure to comply with the specified process requirements may cause an unacceptable risk to the patient, user or third party, or that the performance characteristics of the medical device may be significantly adversely affected as a result.
Contingencies
10. How to handle unannounced audits during company closure and avoid additional expenses?
Our company occasionally experiences temporary periods of closure. This may be due to holidays, company trips and other reasons. What happens in the event when we receive an unannounced audit during a period of closure? Will additional expenses be incurred as a result? What can be done to avoid such a scenario?
Manufacturers are required to notify TÜV SÜD regarding any closures to any of their sites. If the notification is done in a timely manner and in advance, there will be no additional expenses such as cancellation fees for transportation and accommodation.
11. What happens when our manager on duty or other relevant staff is not present during an unannounced audit?
Manufacturers are responsible for implementing policies and procedures to ensure that all relevant staff required for an unannounced audit are available within a short notice. If relevant staff is on leave, covering persons should be assigned as substitutes.
Our company occasionally experiences temporary periods of closure. This may be due to holidays, company trips and other reasons. What happens in the event when we receive an unannounced audit during a period of closure? Will additional expenses be incurred as a result? What can be done to avoid such a scenario?
Manufacturers are required to notify TÜV SÜD regarding any closures to any of their sites. If the notification is done in a timely manner and in advance, there will be no additional expenses such as cancellation fees for transportation and accommodation.
11. What happens when our manager on duty or other relevant staff is not present during an unannounced audit?
Manufacturers are responsible for implementing policies and procedures to ensure that all relevant staff required for an unannounced audit are available within a short notice. If relevant staff is on leave, covering persons should be assigned as substitutes.
