Pharmaceutical & Medical Packaging News staff

Packaging, sterilization, and assembling are among the critical processes that could be evaluated.

By Peter Drechsler, Team Leader, Unannounced Audits, BSI Germany; Gert Bos, Head of Regulatory and Clinical Affairs, BSI Healthcare; and Paul Sim, Regulatory Affairs Manger, BSI

In February 2012, the European Health and Consumer Policy Commissioner John Dallí “called on Member States for immediate action to be taken at national level to ensure full and stringent implementation of the current legislation on medical devices. Following the discovery of the fraudulent use of non-medical grade silicone in breast implants manufactured by the Poly Implant Prothèse (PIP) Company in France, the priority now is for the Member States and the Commission to act together to tighten controls, provide a better guarantee of the safety of medical devices and to restore patient confidence in the law that protects them (1).” 

EU Health ministers were asked for immediate actions to restore public confidence in the European legislative system. The Joint Plan for Immediate Actions under the existing medical device legislation was introduced to the public in February 2012. The plan proposed to the Member States joint actions aimed at tightening controls on medical devices in the framework of the current legislation. The plan focused on four pillars: functioning of notified bodies, market surveillance, coordination of corrective actions among the Member States following vigilance and market surveillance, and communication and transparency. One key aspect of the Joint Plan for Immediate Actions was to enforce all notified bodies to make full use of the powers given to them under the current directives. In particular, these powers include unannounced audits on the premises of the legal manufactures of medical devices. A recommendation aimed at the Member States was conceived to provide advice on the arrangements needed for facilitating these audits by notified bodies (2). 

LEGAL SITUATION

The legal basis for conducting unannounced audits was laid down in the first issue of the Council Directive 93/42/EEC of 14 June 1993 concerning medical devices. Annex II 5.4 allows Notified Bodies to perform unannounced audits: “In addition, the notified body may pay unannounced visits to the manufacturer. At the time of such visits, the notified body may, where necessary, carry out or ask for tests in order to check that the quality system is working properly (…)” (3). 

The same applies for conformity assessment routes according to Annex V and VI. Similar provisions can be found in the Council Directive 90/385/EEC of 20 June 1990 on the approximation of the laws of the Member States relating to active implantable medical devices (Annex II and V) (4) and in the Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on in vitro diagnostic medical devices (Annex IV) (5). 

Although entitled to carry out unannounced audits, in most cases Notified Bodies did not use this instrument to routinely survey the manufacturers of medical devices prior to the PIP scandal (6), unless it would be a “for-cause” inspection.

The members of Team-NB, which include approximately 40% of all Notified Bodies, so representing the vast majority of EC certificates issued, committed themselves to follow the recommendation of the European Commission, as stated in the Team-NB code of conduct (7).

The recommendation is directed at the Member States of the European Community, and Member States may introduce it to its legislation. Even without legal weight, the recommendation for unannounced audits cannot be ignored by the Member States, given its great political weight. Competent Authorities need to show that they are willing to protect the health of their citizens after the recent scandals in the medical device healthcare industry. Therefore, Notified Bodies are enforced to perform unannounced audits as outlined in the recommendation and as it is reflected in the respective directives.

The purpose of the recommendation is “to facilitate the consistent application of the conformity assessment provisions contained in [the medical device directives], the notified bodies should apply the provisions of this Recommendation when they perform product assessments, quality system assessments and unannounced audits (8).”

2013/473/EU recommends that manufacturers:

• “Have to fulfill their obligations themselves regardless of any partial or total outsourcing of the production.

• Do not fulfill their obligation to have at their disposal the full technical documentation and/or of a quality system by referring to the technical documentation of a subcontractor or supplier and/or to their quality system.

• Should integrate the quality system of critical subcontractors and of crucial suppliers with their quality 
system.

• Need to control the quality of services provided and of components supplied and the quality of production thereof regardless of the length of the contractual chain between the manufacturer and the subcontractor or 
supplier (8).”

NATURE OF THE AUDIT

Article 2(c) of the Commission recommendation requires that notified bodies “(…) verify the day-to-day compliance with legal obligations, notified bodies should, in addition to the initial, surveillance or renewal audits, visit the manufacturer or, if this is likely to ensure more efficient control, one of its subcontractors in charge of processes which are essential for ensuring compliance with legal requirements (‘critical subcontractor’) or a supplier of crucial components or of the entire devices (both: ‘crucial supplier’) without prior notice (‘unannounced audits’) in accordance with Annex III (8).”

Annex III of the recommendation outlines the modality of unannounced audits. Notified Bodies need to carry out these audits at least every third year. The audits frequency will be increased if the devices in question bear high risks, if the audits are related to frequent noncompliance, or if the Notified Body receives other information that leads it to suspect nonconformities of the devices or the quality management system of their 
manufacturers. 

Indicators for increase of the audit frequency could be:

• Postmarket feedback that the Notified Bodies receive, such as vigilance cases or field safety corrective actions at an unusually high frequency.

• Complaint rates observed by the Notified Body during the regular audit schedule.

• Nonconforming products in manufacturing observed during the regular audit schedule. 

• Incidents with high severity.

In general, the unannounced audits will be performed by two auditors and will last at least one day. Large and multiple-site companies should be aware that the audit will be carried out on more days or with more auditors on the sites. 

Depending on the manufacturing process, the Notified Bodies will visit the facilities of the manufacturer and/or the premises of the manufacturer’s critical subcontractors or crucial suppliers. As critical subcontractors and crucial suppliers are not defined concepts, the interpretation is largely unharmonized. BSI utilizes the following concepts:

• Critical Subcontractor: e.g., manufacturer of finished devices, key sub-assembly, or significant components. Regulatory responsibility or activities are essential for ensuring compliance with legal requirements. Includes design or software development, sterilization, sterile packaging. 

• Crucial Supplier: e.g., critical raw materials such as silicone gel component for an implant, animal tissue for use in heart valve. Includes proprietary items.  

Manufacturers shall implement and improve the quality assurance contracts with their critical subcontractors or crucial suppliers in such a way that the Notified Body in charge has the right to access the premises of critical subcontractor or crucial supplier and is able to review the respective documents and records. 

The nature of the audit is more product oriented than the regular audits, which mainly focus on the quality management system of the manufacturer. The assessment concentrates on a recently manufactured device and its conformity with its technical documentation. Part of the verification is that the raw materials and components are the same as those specified in the technical documentation of the approved device or device family, including the equipment used in the manufacturing process. Moreover, assessments review whether incoming, in-process, and final controls are the same as specified, including comparison of test result with results from design verification and validation of the medical device in question. 

Manufacturers are advised to organize their technical files and design dossiers so that they are easily accessible during the audit. Often the device might be tested to show compliance. For testing, either the Notified Body may witness the manufacturer testing the product, or the Notified Body may take the product and test it itself in its facilities. For detailed information on testing in relation with unannounced audits, please refer to Notified Body Recommendation Group DRAFT document “Testing during Unannounced Audits” (9). 

The Notified Bodies will verify the on-going manufacturing activities with respect to the associated documentation to ensure that both are in compliance with legal requirements. At least two of the following critical processes will be evaluated:

• Design control.

• Establishment of material 
specifications.

• Purchasing and control of incoming material or components.

• Assembling.

• Sterilization. 

• Batch-release. 

• Packaging. 

• Product quality control.

Section 5 of the recommendation requires that the notified bodies choose a critical process, “which has a high likelihood of non-conformity and one which is particularly safety relevant (8).“

The assessment of the processes and the conformity of the product will include the verification of the traceability of all critical components and materials and of the manufacturer’s traceability system from the entry into the premises of the manufacturer or his suppliers and subcontractors to the delivery of the final product. Risk management is essential when exchanging raw material, changing manufacturing processes, etc. 

Manufacturers of medical devices shall prepare themselves for unannounced audits, at least through:

• Implementation of an appropriate process for receipt of unannounced audits.

• Generate awareness for unannounced audits throughout the 
organization.

• Preparation of all subsidiaries for potential unannounced audits.

• Internal auditing of the processes, products, and technical files in order to detect weaknesses and critical spots.

• Determination of critical subcontractors or crucial suppliers.

• Reviewing and revising of all quality assurance contracts of critical subcontractors or crucial suppliers.

• Budgeting of the costs related to unannounced audits.

A manufacturer and its critical subcontractors or crucial suppliers can deny or terminate an unannounced audit at any time. However, they will still be liable for the costs, and by doing so manufacturers put their EC-Certificates at risk with the consequence of suspension or cancellation of those certificates.  

SUMMARY

Regular unannounced audits have placed additional obligations on both the Legal Manufacturer and the European Notified Bodies; this article explains some of the detail contained within the EU Recommendation 2013/473/EU. Following discussions with the UK Designating Authority (MHRA), German Designating Authority (ZLG), and a number of other Notified Bodies, BSI agreed an implementation date of the April 1, 2014.  Since that date we have been conducting unannounced audits of our manufacturers holding EC Certificates in different countries. Predominantly the legal manufacturer has been the subject of the audit; we have, however, conducted a small number of unannounced audits at critical subcontractors or crucial suppliers. As the program develops in the future, it is likely that more critical subcontractors or crucial suppliers will be visited.

To help organizations certified by BSI understand the recommendation and to encourage audit preparations, we sent a number of communications and delivered publicly available webinars (http://medicaldevices.bsigroup.com/en-GB/our-services/Unannounced-audits...). Subsequently, our QMS Assessors and Technical Experts were trained in the requirements of the Recommendation and the requisite processes and procedures in order to allow them to conduct the audits.

Our experience to date has been very positive—we have found that manufacturers are aware of the recommendation and the requirements and have or are implementing procedures for managing the audit. Unlike routine surveillance audits, no prior notification is given; the first point at which the auditee is aware of the audit is when our team presents itself on site. Some practical issues are emerging, including, for example, how to access restricted or secure sites; how to handle arrival on site undergoing another audit in process, such as by U.S. FDA; the importance of clients notifying us when not manufacturing; and how to manage the issue around “multiple” audits, etc. These and other issues require further harmonization between Notified Bodies and other stakeholders to find suitable and pragmatic approaches.

It is fair to recognize one criticism particularly from the smaller or medium-sized organizations: that of the costs associated with unannounced audits, not only the Notified Body fee, but also the need, ability, and resources to be able to support the on-site audit along with the issue of a potentially disproportionate audit duration to the size of company where a limited range of devices are produced. For example, a two-person company manufacturing one device still is subject to a minimum audit of one day by two people. Therefore, as we go forward, some of these subjects will undoubtedly be reviewed and discussed with our UK and German Designating Authorities in conjunction with other Notified Bodies, as well as with Team NB to further detail their Code of Conduct on the issues relating to the unannounced visits (7).

REFERENCES

1. EC - Press Release. Medical devices: European Commission calls for immediate actions - tighten controls, increase surveillance, restore confidence. [Online] 2012. [Cited: 11 01 2015.] http://europa.eu/rapid/press-release_IP-12-119_en.htm?locale=en.

2. EC. COMMISSION STAFF WORKING DOCUMENT: Implementation of the Joint Plan for Immediate Actions under the existing Medical Devices legislation. [Online] 2014. [Cited: 11 01 2015.] http://ec.europa.eu/health/medical-devices/files/swd_pip_14_en.pdf.

3. COUNCIL DIRECTIVE 93/42/EEC of 14 June 1993 concerning medical devices. OJ. 1993, Vol. L 169, p. 1.

4. COUNCIL DIRECTIVE 90/385/EEC of 20 June 1990 on the approximation of the laws of the Member States relating to active implantable medical devices . OJ. 1990. Vol. L 189, p. 17.

5. Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on in vitro diagnostic medical devices. OJ. 1998. Vol. L 331, p. 1.

6. EC. SWD(2014) 195 final: COMMISSION STAFF WORKING DOCUMENT -- Implementation of the Joint Plan for Immediate Actions under the existing Medical Devices legislation. [Online] 2014. [Cited: 05 01 2015.]http://ec.europa.eu/health/medical-devices/files/swd_pip_14_en.pdf.

7. Code of Conduct for Notified Bodies under Directives 90/385/EEC, 93/42/EEC and 98/79/EC (V3.3). www.team-nb.org. [Online] 2015. [Cited: 30 01 2015.] http://www.team-nb.org/documents/2015/CodeofConductMedicalNotifiedbodies....

8. COMMISSION RECOMMENDATION of 24 September 2013 on the audits and assessments performed by notified bodies in the field of medical devices. OJ. 2013, Vol. L 253, p. 27.

9. Notified Bodies Recommendation Group. “Testing during unannounced Audits” V2.3. [Online] 2014. [Cited: 15 01 2015.] http://www.team-nb.org/documents/2014/NBRG%20WG%20Testing_UA_Interim_NBM...

BIOGRAPHIES

Dr. Peter Drechsler has earned his Ph.D. at the University of Augsburg in Metal Physics on non-equilibrium phase transitions in precipitation hardened alloys. Subsequently he held a position for three years as a researcher at the Dental Clinic of the University of Würzburg. For the following seven years the acted as the head of test laboratory for non-active medical devices at TÜV SÜD in Munich, Germany. Apart from this position he was accredited as a Lead Auditor for Medical Devices. Next, he joined the Global Supplier Quality Group at Gambro in Hechingen, Germany, as a Senior Supplier Quality Engineer. After joining BSI Germany (NB0535) in July 2014, he has served as the team leader for the unannounced audit group as well as a technical expert for orthopedic and dental devices.

Dr. Gert W. Bos has 22 years of experience in lifesciences (devices and pharma), in university, industry as well as in four Notified Bodies. Dr. Bos holds a position as Head of Regulatory and Clinical Affairs at BSI Healthcare (NB0086 / NB0535) and is Head of Notified Body at BSI-Germany (NB0535). He is president of the Notified Body association TEAM-NB, vice-chair of the Medical Notified Body forum NB-Med in Brussels, and participates in the Notified Body Recommendation group (NBRG),  the Clinical Investigation and Evaluation Group (CIE), Medical Device Expert Group (MDEG) and a number of MDEG workgroups. He is one of the Regulators representing Europe in the IMDRF Workgroup on regulated Product Submissions. He is a founding member of the Dutch RAPS Group.

Paul Sim has worked in the healthcare industry for 34 years and is currently Project Managing BSI’s implementation of EU Commission Recommendation 2013/473/EU dealing with Unannounced Audits. Joining BSI in August 2010 leading the BSI effort working with the Saudi Food & Drug Authority on the implementation of the SFDA Medical Device Interim Regulations. Previously he held senior RAQA leadership positions at Spacelabs Healthcare, Teleflex Medical, Smiths Medical, Ohmeda (formerly The BOC Group healthcare business).  Paul is a member of the Association of British Healthcare Industries (ABHI) Technical Policy Group and is Convenor of the ABHI ISO TC 210 Mirror Group. Convenor of the BSI Committee, which monitors all of the work undertaken by ISO TC 210, and Convenor of the BSI Sub-committee dealing with Quality Systems. As UK Delegation Leader to ISO TC 210, Paul is also actively involved in the work of national, European and international standards' committees, dealing with revisions to the ISO 9000 series, ISO 13485, ISO 14971, ISO 15223 and others. He is Deputy Chairman and Council Member of Barema (British Anaesthetic & Respiratory Manufacturers Association), also a Member of the Association of Anaesthetists of Great Britain and Ireland (AAGBI) Safety Committee.