Auditing of Quality Systems of Medical Device Manufacturers Part 1: General Requirements

9. Roles and responsibilities

9.1 Auditing organisation

The auditing organisation has the regulatory authority or is designated by the regulatory authority to perform audits, the results of which are evidence of compliance or non-compliance with the regulatory requirements for quality systems. Associated with this authority are the responsibilities for management and performance of all audit activities .

The responsibilities of the auditing organisation for audit management include:

1. 
   complying with relevant regulatory requirements for audit management;
   
2. 
   complying with these Guidelines;
   
3. 
   training, selecting and supervising auditors;
   
4. 
   establishing methods to ensure consistency in the interpretation of the regulatory requirements;
   
5. 
   maintaining the means of providing prompt guidance which may be required by the audit team during the audit;
   
6. 
   safeguarding the confidentiality of all documents and information obtained in association with the audit;
   
7. 
   establishing and complying with a code of ethics;
   
8. 
   informing the appropriate authority on decisions taken when required by the regulatory requirements.
   

Audits do not result in a transfer of the responsibility to achieve quality objectives from the manufacturer to the auditing organisation.

In conjunction with the lead auditor, the responsibilities of the auditing organisation for audit performance include:

1. 
   complying with relevant regulatory requirements for auditing;
   
2. 
   agreeing on the scope of the audit, including the standards or other documents to be used, with the manufacturer as necessary to comply with and as permitted by the regulatory requirements;
   
3. 
   planning, organising, evaluating and reporting on the audit;
   
4. 
   selecting the auditors;
   
5. 
   agreeing to the language of the audit;
   
6. 
   decision making with regard to applicable regulatory requirements resulting from nonconformities discovered during the audit and subsequent verification of corrective actions.
   

9.2 Auditors

The responsibilities of auditors include:

a) complying with the applicable regulatory requirements for auditing;

b) helping the manufacturer understand the regulatory requirements;

c) planning and carrying out assigned responsibilities objectively, effectively and efficiently within the audit scope and in accordance with a code of ethics for auditors established and documented by the auditing organisation;

d) co-operating with and supporting the lead auditor;

e) collecting, analysing and, where appropriate, documenting objective evidence that is relevant and sufficient to permit the establishment of conclusions regarding compliance of the quality system with regulatory requirements and the effectiveness of its implementation in meeting quality objectives;

f) establishing the extent to which the procedures, documents and other information describing or supporting the required elements of the quality system are known, available, understood and used by the auditee’s personnel;

g) remaining alert to any indications or evidence that can influence the audit results and possibly require more extensive auditing;

h) informing the lead auditor of quality audit observations in a timely manner;

i) assisting the lead auditor in preparing the report of the audit;

j) informing the lead auditor of any major obstacles encountered in performing the audit;

k) safeguarding the confidentiality of all documents and information obtained in association with the audit:

i) when submitting such documents to the auditing organisation through the lead auditor;

ii) treating privileged information with discretion;

l) verifying that corrective actions have been taken and have been effective:

i) as a result of a previous audit;

ii) during the audit, as feasible;

iii) based on experience gained with devices on the market (e.g. post market surveillance);

iv) based on incidents of a serious nature;

m) minimising disruption to the auditee’s personnel and processes during the audit while attaining the audit's objectives.

n) complying with any health and safety or other applicable requirements of the manufacturer (see 9.3(a)).

9.2.1 Lead auditor

The lead auditor is ultimately responsible to the auditing organisation for all phases of the audit. The lead auditor shall have authority to make final decisions regarding the conduct of the audit and any quality audit observations.

The responsibilities of the lead auditor include, in addition to those of the auditors:

1. 
   identifying the requirements of each audit assigned to the lead auditor by the auditing organisation;
   
2. 
   assisting the auditing organisation with the selection of the other audit team members;
   
3. 
   previewing the manufacturer’s quality system description (where appropriate) for adequacy in meeting applicable regulatory requirements, prior to the on-site audit;
   
4. 
   preparing the audit plan and working documents and briefing the audit team;
   
5. 
   representing the audit team with the auditee’s management;
   
6. 
   communicating any nonconformities to the manufacturer as soon as possible after they are identified and indicating whether such nonconformities may affect compliance with the regulatory requirements;
   
7. 
   reporting to the manufacturer and to the auditing organisation any major obstacles encountered in performing the audit as planned;
   
8. 
   preparing and presenting the audit results clearly and conclusively to the manufacturer at the closing meeting;
   
9. 
   preparing and submitting the audit report to the auditing organisation in a timely manner.
   

9.3 Manufacturer

The responsibilities of the manufacturer include:

1. 
   defining the scope of the audit as permitted by the regulatory requirements;
   
2. 
   determining the method of compliance with the regulatory requirements;
   
3. 
   informing relevant employees about the objectives and scope of the audit;
   
4. 
   appointing responsible members of staff to accompany members of the audit team and ensuring that audit team members are aware of health, safety and other applicable requirements;
   
5. 
   providing all resources needed for the audit team in order to ensure an effective and efficient audit process;
   
6. 
   providing access to the facilities and evidential material pursuant to the regulatory requirements as requested by the auditors;
   
7. 
   co-operating with the auditors to permit the audit objectives to be achieved;
   
8. 
   receiving the quality audit observations;
   
9. 
   determining what follow-up corrective actions are to be taken to address nonconformities and other quality audit observations identified during the audit, implementing such actions in a timely and effective manner and informing the audit organisation as required;
   
10. 
    informing the auditing organisation of any significant change to the quality system as required by the regulatory requirements;
    
11. 
    informing any other auditees that may be affected by the audit, of its objectives, scope and any other relevant arrangements (see also clause 9.4).
    

9.4 Auditees

Where auditees, other than the manufacturer, are involved in the audit (i.e. subcontractors), clause 9.3, sections (c) to (g) apply. In such cases, the responsibilities for the other items remain with the manufacturer.

10. Audit team

10.1 Audit team composition

The audit team shall include a lead auditor who shall be in overall charge of the audit team. Where the audit team is comprised of one individual then this person shall be the lead auditor. The lead auditor should have the capability and experience to manage an audit.

The audit team shall include one or more persons with experience of assessing the relevant medical device technology incorporated in the manufactured products and the associated manufacturing processes. Decisions with regard to the extent of inclusion of such expertise in the audit team should be made case by case (see also clause 10.2.1).

As permitted by the regulatory system the audit team may be accompanied by:

a) audit trainees or other personnel from the auditing organisation;

b) audit trainees or other personnel from the regulatory bodies involved;

c) observers acceptable to the manufacturer, auditing organisation and auditors.

These accompanying persons are not considered to be auditors but are bound by the same obligations of confidentiality.

As permitted by the regulatory system, when the auditing organisation chooses the audit team it may take into account the manufacturer’s opinion on the suitability of the auditor(s), in particular when a conflict of interest may exist (see 5.1).

10.2 Audit team competence

10.2.1 Audit team competence criteria

The competence requirements for all auditors in the team should be based on the qualification criteria for quality system auditors (ISO 10011-2:1991, Qualification criteria for quality system auditors) as well as personal attributes (e.g. tact, diplomacy, effective communication skills).

The competence of the team as a whole should be appropriate to cover the scope of the audit. In particular:

a) The team should have competence (i.e. training and knowledge/experience) in the following:

i) assessment of the quality system for medical device manufacturers and determination of the effectiveness of its implementation;

ii) understanding the regulations and applicable standards specific to quality system requirements for medical device manufacturers;

iii) intended use of and risks associated with the devices being produced;

iv) the assessment of the design, manufacturing processes and the technologies involved.

b) The competence must be present within the audit team as a whole but not necessarily by each member of it. In assessing the quality systems of manufacturers the audit team may include additional experts in processes and technology relevant to the scope of the audit and ideally these experts should meet the requirements of clause 10.2.1 (a). The experts authorised by the auditing organisation and who are not qualified as auditors should only assess the processes related to their specialised knowledge and under the supervision of an auditor.

Alternatively, the members of the audit team may be given additional training and/or specialised knowledge related to those processes and technology (e.g. the achievement of a controlled environment and validation of the sterilisation process).

c) The lead auditor shall be competent to plan and direct the team members so that in carrying out their separate tasks, the appropriate competence is applied effectively and fairly.

10.2.2 Audit team competence records

The auditing organisation shall maintain records to demonstrate the competence of its auditors.

10.2.3 Auditor qualifications, training and experience

In addition to basic auditing skills (clause 10.2.1), the competencies specifically required for auditing medical device manufacturers may be achieved through a variety of means including a combination of qualification and one or more of the training or experience elements listed below.

a) Qualification

Auditor qualification is most likely to be in one or more of the following:

i) biology or microbiology;

ii) chemistry or biochemistry;

iii) computer and software technology;

iv) electrical, mechanical or bioengineering;

v) human physiology;

vi) medicine;

vii) pharmacy;

viii) physics or biophysics.

b) Training

Special programmes may be established for training technically qualified staff in the following:

i) understanding the regulatory requirements and related laws/ordinances/statutes etc.;

ii) auditing of medical device manufacturers’ quality systems;

iii) understanding the design and manufacturing processes and the technologies involved;

iv) safety aspects relating to the intended use of medical devices.

c) Experience

Auditor experience is most likely to be in the following:

i) working in closely related industries and the workplace such as research and development, manufacturing;

ii) working in the application of the device technology and its use in health care services and with patients;

iii) testing the devices concerned for compliance with the relevant national or international standards;

iv) conducting performance testing, evaluation studies or clinical trials of the devices.

These competencies are to be regarded as the tools to address the relevant safety and performance aspects of the quality system being audited arising from the way in which the devices:

• 
  are made, and
  
• 
  how they work, and
  
• 
  how they are used.
  

11. Audit process

The audit process applies to initial, surveillance and special audits.

11.1 Preparation

11.1.1 Notification

Where permitted by the regulatory requirements, the manufacturer should be notified in advance that an audit is to be conducted.

11.1.2 Preview of quality system description

As a basis for planning the audit, the lead auditor may carry out a preliminary review of the manufacturer's documented methods, such as the quality manual, for meeting the regulatory requirements.

This preview should be considered to be part of the execution of the audit.

If this review reveals that the system described by the manufacturer is not adequate to meet the regulatory requirements, further resources should not be expended on the audit until such concerns are resolved to the satisfaction of the auditing organisation.

11.1.3 Site visit audit plan

There shall be a site visit audit plan. If permitted by the regulatory requirements, it should be communicated to and agreed with the manufacturer, preferably in advance of the site visit.

The audit plan should be designed to be flexible in order to permit changes in emphasis based on information gathered during the audit, and to permit effective use of resources.

The audit plan shall be prepared within the audit scope and objectives based on:

1. 
   the type of audit to be conducted;
   
2. 
   information from preview of the quality system description, if available;
   

and in the case of surveillance or special audits:

3. 
   information from previous quality system audits;
   
4. 
   available post market surveillance information.
   

The audit plan should include:

1. 
   the audit scope and purpose;
   
2. 
   identification of the manufacturer's management team having significant direct responsibilities regarding the audit scope and purpose, if available;
   
3. 
   identification of reference documents (such as the applicable quality system standard and, if available, the manufacturer's quality manual);
   
4. 
   identification of audit team members;
   
5. 
   the language of the audit;
   
6. 
   the date and place where the site visit is to be conducted;
   
7. 
   the date and place where any additional documentation is to be reviewed;
   
8. 
   identification, where possible, of the manufacturer’s organisational units and, where appropriate, other auditees to be audited;
   
9. 
   the expected time and duration for each major audit activity;
   
10. 
    the schedule of meetings, including any necessary daily briefings, to be held with the manufacturer’s management;
    
11. 
    the audit report distribution and the expected date of issue.
    

Where the manufacturer has multiple premises covered by the quality system, the audit plan should adequately address this issue.

The manufacturer should establish and maintain documented procedures to ensure that purchased product or services from their subcontractor meet the relevant regulatory requirements. In duly substantiated cases when the manufacturer is not able to give satisfactory evidence to the audit team that purchased product or services meet the specified requirements, the auditing organisation may need, where possible, to audit the control of processes on the premises of the manufacturer's subcontractors (e.g. sterilisation subcontractors).

11.1.3.1 Audit plan changes

During the audit the lead auditor may make changes to the auditor’s work assignments and to the audit plan in order to ensure the optimal achievement of the audit objectives. However, the manufacturer should be aware that, based on the quality audit observations, the plan may be modified to allow flexibility in the depth of each area investigated. The manufacturer should be advised of the changes.

If the audit objectives appear to become unattainable, the lead auditor should report the fact and the reasons to the manufacturer and the auditing organisation.

11.1.4 Audit team assignments

Each audit team member should be assigned specific tasks, such as auditing specific quality system elements. These assignments should be made by the lead auditor in consultation with the audit team members and should be appropriate to each auditor's particular technical expertise.

11.1.5 Working documents

Working documents should be prepared by the lead auditor with the assistance of the other audit team members as appropriate. These documents should be designed in relation to the audit plan and are for the purpose of facilitating the collection of objective evidence and the reporting of audit results.

Working documents may include:

1. 
   check-lists used for evaluating quality system compliance with applicable regulatory requirements;
   
2. 
   forms for reporting quality audit observations;
   
3. 
   forms for documenting supporting evidence for conclusions reached by the auditors.
   

Sample working documents should be made available to the manufacturer on request.

Working documents should be designed so that they do not restrict additional audit activities or investigations which may become necessary as a result of information gathered during the audit.

11.2 Audit execution

11.2.1 Opening meeting

The purpose of an opening meeting is to:

1. 
   introduce the members of the audit team to the manufacturer's management;
   
2. 
   review the scope and the objectives of the audit;
   
3. 
   provide a short summary of the methods and procedures to be used to conduct the audit;
   
4. 
   establish the official communication links between the audit team and the manufacturer;
   

1. 
   confirm that the resources and facilities needed by the audit team are available;
   

5. 
   confirm the time and date for the closing meeting and any interim meetings of the audit team and the manufacturer's management;
   
6. 
   clarify any unclear details of the audit plan.
   

11.2.2 Examination

An on-site examination shall be performed by the audit team to:

1. 
   determine compliance of the manufacturer's documented quality system with the regulatory requirements (further to the preview as described in clause 11.1.1 as appropriate);
   
2. 
   confirm implementation of the manufacturer's procedures;
   
3. 
   verify effectiveness of the manufacturer’s quality system.
   

11.2.2.1 Depth of audit

The audit team should review the elements of the quality system as contained in the audit scope with respect to the regulatory requirements, and sample documents and records at all levels in the quality system. The samples chosen should reflect the risks associated with the intended use for the device, the complexity of the manufacturing technologies, the range of devices produced and any available post market surveillance data.

The audit team should investigate all quality audit observations to establish their extent, particularly if there are concerns about product safety.

11.2.2.2 Collecting objective evidence

Objective evidence should be collected through interviews, examination of documents and visual observation of activities and conditions in the areas of concern and should be verified. Information gathered through interviews may be tested by acquiring additional information from other independent sources, such as visual observation, measurements and records. Based on this objective evidence, quality audit observations should be noted where there are indications of nonconformities.

Objective evidence may be further documented by collecting copies of documents or, on occasion, taking photographs. Collection of evidence in this manner should be accurately recorded and acknowledged by the auditor and the auditee.

The audit includes collecting evidence of procedures and their implementation to determine compliance with regulatory requirements for post production surveillance (such as complaint handling) and, where appropriate, the design process including risk analysis and clinical evaluation.

Documents or copies collected by the auditors during the audit should be noted and acknowledged.

11.2.3 Quality audit observations

All quality audit observations should be recorded. Nonconformities, and quality audit observations which may become nonconformities, should be reviewed with the manufacturer as soon as possible after they are noted.

Documentation of nonconformities should:

1. 
   be expressed in a clear, concise manner;
   
2. 
   be supported by objective evidence;
   
3. 
   identify the specific requirements which have not been met.
   

11.2.4 Non-compliance with the regulatory requirements

One or more major nonconformities will indicate that the manufacturer is not in compliance with the regulatory requirements. Examples of quality audit observations that may be classified as such nonconformities are as follows:

1. 
   failure to address an applicable element of the regulatory requirements for quality systems (e.g. failure to have a complaint handling or training system);
   
2. 
   failure to implement an applicable element of the regulatory requirements for quality systems;
   
3. 
   an excessive number of minor nonconformities against an element of the regulatory requirements for quality systems;
   
4. 
   failure to implement appropriate corrective and preventative action when an investigation of post market data indicates a pattern of product defects;
   
5. 
   products which are put onto the market which cause undue risk to patient and/or users when the device is used according to the manufacturer's instructions;
   
6. 
   the existence of products which clearly do not comply with the manufacturer’s specifications and/or the regulatory requirements due to defective elements in the quality system;
   
7. 
   repeated nonconformities from previous audits.
   

11.2.5 Closing meeting

At the end of the audit, the audit team should hold a meeting with the manufacturer's management and those responsible for the functions concerned. The main purpose of this meeting is to present quality audit observations to the management in such a manner as to ensure that the results of the audit are understood.

The lead auditor should present the quality audit observations and identify which ones are, in the opinion of the audit team, nonconformities with an explanation including an indication of their relative severity with respect to the regulatory requirements.

The lead auditor should present the audit team’s conclusions regarding the effectiveness of the quality system in meeting quality objectives.

A written list of quality audit observations, which in the opinion of the audit team are nonconformities, should be presented to the manufacturer's management.

The receipt of the above list of nonconformities should be acknowledged by the manufacturer's management.

A date should be agreed for submission to the audit organisation of corrective action plans necessary to address identified nonconformities.

11.3 Audit report

11.3.1 Report preparation

The audit report should be written to provide the auditing organisation with a permanent record of the audit conducted and the manufacturer with information on which to base corrective action and improve its quality system. It should be prepared under the direction of the lead auditor, who is responsible for its accuracy and completeness.

11.3.2 Report content

The audit report should accurately reflect the content of the audit. It should be dated and signed by the lead auditor. It should either reference previously issued information or as applicable the following items:

a) the scope and objectives of the audit, including the processes and product groups involved;

b) details of the audit plan, the identification of audit team members and manufacturer's representative(s), audit dates, and identification of the specific organisation audited;

c) identification of the audit criteria against which the audit was conducted (regulatory requirements for quality systems, manufacturer's quality manual. etc.);

d) identification of nonconformities, including:

i) details of each nonconformity;

ii) the audit criterion or the specific regulatory requirement to which it applies;

iii) the relative severity with respect to regulatory requirements; and

iv) the date for submission of any necessary corrective action plans.

e) the effectiveness of the manufacturer's quality system in meeting quality objectives;

f) details of any corrective action(s) taken during the audit;

g) recommendation to the auditing organisation for follow up action including time schedule.

Confirmation of the nonconformities and recommendations given by the audit team as referred to under d), e) and g) should be provided to the manufacturer by the auditing organisation as soon as possible but not longer than 6 weeks after conclusion of the audit. Exceptionally, the time scale may be extended when a quality audit observation is to be investigated after the audit to verify whether or not it is a nonconformity and to determine its significance with respect to the regulatory requirements. In this case the manufacturer should be informed as soon as possible of the cause for the delay and a revised issue date.

11.3.3 Report distribution

The audit report should be transmitted or made available to the manufacturer by the auditing organisation.

The audit report should be issued as soon as possible within a defined time period. If it cannot be issued within the defined time period, the reasons for the delay should be given to the manufacturer and a revised issue date should be established when permitted by the regulatory policies of the auditing organisation.

11.4 Retention of audit records

The auditing organisation shall retain auditing documents for a period of time prescribed by the applicable regulatory requirements.

11.5 Audit completion

The audit is completed upon submission of the audit report to the manufacturer.