Auditing of Quality Systems of Medical Device Manufacturers Part 1: General Requirements

GHTF.SG4.(99)28

FINAL DOCUMENT

Title: Guidelines for Regulatory Auditing of Quality Systems

of Medical Device Manufacturers –

Part 1: General Requirements
Authoring Group: SG4
Endorsed by: The Global Harmonization Task Force
Date: June 29, 1999

The document herein was produced by the Global Harmonization Task Force, a voluntary group of representatives from medical device regulatory agencies and the regulated industry. The document is intended to provide non-binding guidance to regulatory authorities for use in the regulation of medical devices, and has been subject to consultation throughout its development.

There are no restrictions on the reproduction, distribution or use of this document; however, incorporation of this document, in part or in whole, into any other document, or its translation into languages other than English, does not convey or represent an endorsement of any kind by the Global Harmonization Task Force.

Contents

Foreword 1. Introduction 2. Scope 3. Reference documents 4. Definitions 5. General principles for auditing organisations 6. Audit objectives 7. Audit scope 8. Types of audit 9. Roles and responsibilities 10. Audit team 11. Audit process 12 Corrective action follow-up Annex	2 3 4 4 4 6 8 9 9 11 14 17 23
A: List of organisations represented on Study Group 4: Auditing	24
B: List of references to the relevant regulations applicable to manufacturers of medical devices and which include compliance with quality system requirements	25
C: Relevant auditing organisations responsible for enforcement of the regulations listed in Annex B	26
D: Definitions of 'manufacturer' applicable to the regulations listed in Annex B	27
E: References	29
List of supplements	30

Foreword
“Guidelines for regulatory auditing of quality systems of medical device manufacturers: part 1; general requirements” has been endorsed by the Global Harmonisation Task Force as a Final Document. It has been prepared by Study Group 4, auditing and is a consensus.

In February 1998, the GHTF Proposed Document version (SG4(98)24) was made available to other agencies through the participating regulatory bodies and trade associations in order to solicit comments. At the same time, it was also made available, in the public domain, through the UK Medical Devices Agency home page on the Internet. Study Group 4 reviewed the comments received and as a result amendments were incorporated into this document.

Comments or suggestions for changes to this Final Document should be sent to the Convenor of Study Group 4 (for address details, see below).

Global Harmonisation Task Force documents
All documents produced through the Global Harmonisation Task Force (GHTF) for medical devices represent the informal advice of participating manufacturers, other participants, and government officials as to useful practices concerning the subject matter.
Final Documents are available for publication by any national or regional authority as appropriate. Various approaches will be followed for implementation, depending upon the responsibilities of the participating national authority, the applicable regulatory process and the contents of the document.
As with international standards, GHTF documents do not, by themselves, have official status but are intended to offer sound advice. The expectation is, however, that governments, through applicable procedures, may wish to give GHTF documents official status.
GHTF documents are freely available to interested parties at all stages of their development (Working Drafts, Proposed Documents and Final Documents) and are considered to be in the public domain.

Robert Allen Convenor, Study Group 4: auditing Medical Devices Agency Hannibal House Elephant and Castle London. SE1 6TQ ENGLAND

Tel: [phone] Fax: [phone] e-mail: [e-mail]

1. Introduction

This document has been prepared by Study Group 4: Auditing which was convened by the Global Harmonisation Task Force. The members of this group were auditing experts from, or acting on behalf of, regulatory bodies and representatives of the medical device manufacturing industries from Australia, Canada, Europe, Japan and the USA. A list of the organisations represented on the Study Group can be found in Annex A.

The incorporation of quality system requirements, based on ISO 9001/9002/9003, into regulations applicable to manufacturers of medical devices, provides the opportunity for developing mechanisms that would lead to global harmonisation.

In preparing this document, the group's objective was to contribute to the process of global harmonisation of regulatory quality system auditing of manufacturers of medical devices. Other regulatory bodies are invited to take advantage of the experience embodied in these guidelines when considering introducing regulatory systems for medical devices in which compliance with quality system requirements is to be an element of the regulations.

This document has been written for auditing organisations. However, it may also assist the medical device manufacturer to prepare for, facilitate and respond to the applicable regulatory audits.

The beneficiaries of the regulatory audit and the deliverables are as follows:

1. 
   for the patient/user,
   

• 
  a high degree of assurance that only safe and effective medical devices will be available;
  

2. 
   for the regulatory body,
   

• 
  a high degree of assurance (along with technical evaluation, where required in addition) of safe and effective devices;
  
• 
  reliable, objective evaluation of compliance with regulatory requirements of the manufacturer's quality system;
  

3. 
   for the manufacturer,
   

• 
  independent evaluation of quality system effectiveness and compliance with regulatory requirements;
  
• 
  if satisfactory, results are evidence (or part thereof) of compliance with regulatory requirements necessary to market devices.
  

Note 1. Terms written in italics in the main body of the document text are defined in section 4. Definitions.

Note 2. The auditing of a medical device manufacturer's quality system may represent only one part of the conformity assessment procedure required by the applicable regulations.

2. Scope

This document provides guidelines for auditing organisations responsible for establishing, planning, carrying out and documenting audits of quality systems to address regulatory requirements for manufacturers of medical devices. In addition, it describes the competence criteria that the audit team should meet.

The document also covers related requirements on the audit report and follow-up on corrective actions.

Non-regulatory quality management issues, as may be part of total quality management activities, are excluded.

3. Reference documents

This document is based on the principles in all three parts of ISO 10011:1990 and the auditing principles in ISO 14000 series (see Annex E).

Note 3. References to relevant regulations applicable to manufacturers of medical devices which include compliance with quality system requirements are listed in Annex B.

4. Definitions

Reference should be made to the definitions given in:

- the relevant regulatory requirements,

- ISO 8402:1994 and ISO 10011-1:1990, together with those below.

All the definitions below are for the purpose of these guidelines.

Note 4. Some terms in ISO 8402:1994 are repeated here and the source is indicated in square brackets [ ].

4.1 Audit

A systematic and independent examination to determine whether quality activities and related results comply with planned arrangements and whether these arrangements are implemented effectively and are suitable to achieve objectives [ISO 8402].

For the purpose of these guidelines, "audit" means audit of the auditee’s (see 4.2) quality system to determine compliance with the relevant regulatory requirements.

Note 5. When addressing the regulatory requirements the term 'inspection' has been used to indicate the same meaning as the term 'audit'.

4.2 Auditee

Any organisation whose quality systems are to be audited for compliance with the relevant medical device regulatory requirements.

Note 6. This can be the manufacturer and/or their subcontractor(s).

4.3 Auditing organisation

A body designated, on the basis of specific regulations, to carry out audits according to assigned tasks.

Note 7. Relevant auditing organisations responsible for enforcement of the regulations listed in Annex B are given in Annex C.

4.4 Auditor

A person with relevant qualifications and competence to perform audits or specified parts of such audits and who belongs to, or is authorised by, the auditing organisation.

4.5 Lead auditor

An auditor designated to manage an audit (also known as an audit team leader).

4.6 Manufacturer

The legal entity subject by regulation to quality system requirements.

Note 8. In several international standards the term 'supplier' is substituted for the term 'manufacturer'.

Note 9. Definitions of 'manufacturer' applicable to the regulations listed in Annex B are given in Annex D.

Note 10: In some internationally recognised Standards and Guidelines on auditing, specific responsibilities are assigned to the client (i.e. a person or the organisation requesting or commissioning the audit). These responsibilities are assigned on the basis that the client, as the financial supporter and primary customer of the audit, has the ultimate authority regarding the audit.

The ultimate authority for the audit of medical device manufacturers is the auditing organisation and the term “client” is not used therefore in these guidelines. .

4.7 Nonconformity

The non fulfilment of specified requirements within the planned arrangements.

Other terms may be used to mean the same as nonconformity (e.g. 'non compliance', 'deficiency').

4.8 Objective evidence

Verifiable information or records pertaining to the quality of an item or service or to the existence and implementation of a quality system element, which is based on visual observation, measurement or test.

4.9 Quality audit observation

Statement of fact made during a quality audit and substantiated by objective evidence.

4.10 Quality system

The organisational structure, responsibilities, procedures, processes and resources for implementing quality management [ISO 8402].

For the purpose of these guidelines 'implementing quality management' is taken to include both the establishment and maintenance of the system.

4.11 Regulatory requirements

For the purpose of these Guidelines any part of a law, ordinance, decree or other regulation which applies to quality systems of medical device manufacturers.

Note 11. Guidelines, notes, draft documents, or the like should not be used as regulatory documents and are not to be construed as such unless formally promulgated.

4.12 Subcontractor

An entity, separate from the manufacturer, that provides to the manufacturer either a material, product or sub-assembly (or a component) to a proprietary specification which is incorporated into or used in the manufacture of the finished medical device or a service (e.g. testing, sterilisation) to enable the medical device to meet defined requirements. If the separate entity is owned by the manufacturer, it may or may not be considered a subcontractor, depending upon the control exercised by the manufacturer.

5. General principles for auditing organisations

5.1 Independence

The auditing organisations and their auditors shall be impartial and free from engagements and influences which could affect their objectivity, and in particular shall not be:

a) involved in the design, construction, marketing, installation, servicing or supply of the device categories within the scope of the audit;

b) involved in the design, construction, implementation or maintenance of the quality system being audited;

c) an authorised representative of the manufacturer.

Examples where independence could be compromised would include the following:

i) the auditor having a financial interest in the company being audited (e.g. holding stock in the company);

ii) the auditor being employed currently by a manufacturer producing medical devices.

iii) the auditor being a member of staff from a research or medical institute or a consultant having a commercial contract or equivalent interest with the manufacturer or the manufacturers of similar devices.

All persons and organisations involved with an audit should respect and support the independence and integrity of the auditors.

The impartiality of the auditing organisation and auditors shall be established and documented.

5.2 Audit objectives and scope

Audit objectives and scope should be clearly defined and documented by the auditing organisation and the audit team and, as permitted by the regulatory requirements, agreed to by the manufacturer in the initial planning stages of the audit. However, based on the quality audit observations, the audit scope and objectives may be modified.

5.3 Roles, responsibilities and authorities

All the organisations involved in the audit process should be identified and their respective roles, responsibilities and authorities should be clearly defined and documented to:

1. 
   ensure a clear understanding of mutual expectations throughout the audit process;
   
2. 
   provide a means of accountability with respect to relevant regulatory requirements.
   

5.4 Resources

Adequate resources in terms of competent staff, financial support, time to conduct effective audits and, where necessary, access to technical information and expertise from external sources should be committed to the conduct and implementation of audits and all supporting audit activities in order to ensure that audit results and conclusions are of the highest possible reliability within the limitations of the sampling aspects of auditing.

5.5 Competence of the audit team

Audits of medical device manufacturers should only be performed by audit teams possessing as a whole the education, skills and experience with respect to the relevant regulatory requirements and to the device technologies and related processes, as well as those required for auditing.

5.6 Consistency of procedures

The conduct of audits should be in accordance with defined and documented methodologies and techniques designed to provide consistency of approach and depth among audits of the same type and scope. The management of audit activities should be in accordance with documented, systematic procedures designed to provide the necessary technical and administrative support for the audits. Such procedures should be designed to comply with the applicable regulatory requirements and align with these Guidelines. See also clause 11.1.2

5.7 Adequacy of audit documentation

Documentation associated with each audit shall be maintained in accordance with applicable regulatory requirements and be sufficient to:

1. 
   provide adequate information to the appropriate regulatory authorities to be used, if necessary, in pre-market approval or post market surveillance activities; and
   
2. 
   ensure traceability and continuity between the successive audits of the same system; and
   
3. 
   provide a basis for corrective action and opportunities for quality improvement to the manufacturer.
   

5.8 Confidentiality, due professional care and code of ethics

The confidentiality of all documents and information obtained in association with an audit should be safeguarded. There should be no disclosure of such documents and information to a third party without the express approval of the auditee, unless it is a regulatory requirement.

Due professional care, diligence and good judgement should be practised at all times in the conduct of an audit and in the management of supporting activities in accordance with an established and documented code of ethics.

5.9 Audit results and conclusions

The results and conclusions of audits should be consistent and accurate regardless of the auditors or the auditing organisation involved, to provide the beneficiaries of the audit with the necessary level of confidence in the output. Such conclusions are subject to the normal limitations of an audit as the objective evidence collected during the audit is a sample not normally based on a statistical rationale.

5.10 Quality system

Auditing organisations should implement and maintain a quality system to ensure that the audits conducted are of the highest quality in accordance with these general principles and to facilitate continuous improvement.

6. Audit objectives

Audits are designed to:

1. 
   determine conformance of a manufacturer's quality system with regulatory requirements;
   
2. 
   determine the effectiveness of the implemented quality system for the purposes of meeting specified quality objectives which include all of the appropriate medical device regulatory requirements;
   
3. 
   audit the quality system as the manufacturer has defined it (c.f.,note 12 below);
   
4. 
   in the case of audits subsequent to the initial audit, ensure that corrective actions agreed as a result of the previous audit have been completed effectively.
   

Note 12. A manufacturer may have a quality system that is more extensive than that defined in the regulations.

7. Audit scope

The audit scope describes the extent and the boundaries of the audit in terms of:

1. 
   the subject medical devices controlled by the quality system to be audited;
   
2. 
   the quality system requirements against which the quality system is to be audited;
   
3. 
   the type of audit required (initial, surveillance or special);
   
4. 
   physical location of activities and documentation to be audited.
   

Audits for regulatory purposes should not impose an increase in the scope of quality system requirements over and above those necessary to meet regulatory requirements.

8. Types of audit

8.1 Initial audit

An initial audit, when applicable for confirmation of conformance with regulatory requirements, will generally be an audit of all elements of the quality system (see  6.c).

8.2 Surveillance audit

A surveillance audit for a previously audited facility can either constitute a full audit or partial audit of the quality system.

The time interval between surveillance audits will depend upon:

1. 
   the risk associated with the intended use of the medical devices;
   
2. 
   the number of the quality system elements to be examined;
   
3. 
   the nature of the quality system elements to be examined;
   
4. 
   the scope and results of the previous audits;
   
5. 
   the post market surveillance data available on the subject devices indicating a possible deficiency in the quality system;
   

The time interval between surveillance audits should not be greater than 3 years but in the case of high risk devices not greater than 2 years.

If partial audits are used for surveillance, within a maximum period of 5 years all elements of the quality system should be audited.

Note 13. Auditing organisations may specify certain aspects of the quality system which are always included in a partial audit (e.g. corrective action or follow-up of quality audit observations from the last audit).

8.3 Special audit

These audits may be required when:

a) external factors apply such as:

i) available post-market surveillance data on the subject devices indicate a possible significant deficiency in the quality system;

ii) significant safety related information becoming known to the auditing organisation.

b) significant changes occur to a manufacturer, which have been submitted as required by the regulations or become known to the auditing organisation, and which could affect the decision on the manufacturer's state of compliance with the regulatory requirements.

The following are examples of such changes which could be significant and relevant to the auditing organisation when considering that a special audit is required, although none of these changes should automatically trigger a special audit :

i) Modifications to the manufacturer's quality system policies caused by:

• 
  new ownership of the manufacturer;
  
• 
  relocation of the manufacturer's activities or controls to a new site;
  

ii) Modifications to the defined authority of the management representative that impact:

• 
  quality system effectiveness or regulatory compliance;
  
• 
  the capability and authority to assure that only safe and effective medical devices are released;
  

iii) Addition of a new device category to the manufacturing scope within the quality system (e.g. addition of sterile single use dialysis sets to an existing scope limited to haemodialysis equipment, or the addition of magnetic resonance imaging to an existing scope limited to ultrasound equipment);

iv) Modification of the site operation involved in the manufacturing activity (e.g. relocation of the manufacturing operation to a new site or centralising the design and/or development functions for several manufacturing sites);

v) Significant modifications to special processes (e.g. change in production from sterilisation through a subcontractor to an on site facility or a change in the method of sterilisation).

8.4 Unannounced audits

An unannounced audit may be necessary if the auditing organisation has justifiable concerns about implementation of corrective actions or compliance with regulatory requirements.