BSI Unannounced audit visits

BSI Unannounced audit visits

Red Overlay
Unannounced audits
Unannounced audits
Red Overlay

How BSI can support you with unannounced audits

European medical device regulations are undergoing many significant changes that will impact manufacturers, suppliers, and Notified Bodies.

One major change that has already impacted the medical device community is the EU Commission requirement for Notified Bodies to conduct unannounced audits on manufacturers of CE marked products, which was introduced in 2014.

How do unannounced audits affect my company?

BSI implemented a routine program of unannounced visits to all our CE-certified manufacturers and, if appropriate, their critical sub-contractors and crucial suppliers. Our designating Competent Authority (MHRA) requires Notified Bodies, including BSI, to conduct unannounced audits in accordance with the recommendation. This has been a requirement of Notified Bodies since the first half of 2014.

To read the full recommendation, please download the EU Commission Recommendation of 24 September 2013.

The requirement for regular unannounced audits, found within Annex III, is the most significant change introduced by the Commission Regulation. These are in addition to the current program of compliance audits conducted by Notified Bodies. This applies to manufacturers holding EC certificates under any of the three EU Medical Devices Directives i.e. MDD, AIMD, IVD, where the legal provision for unannounced visits exists. The requirement will remain under the new Medical Device and IVD Regulations due to come into force in 2017.

Read the EU Commission Recommendation >

What is the process for unannounced audits?

The Commission Recommendation states that these "unannounced audits" must be unpredictable and without prior notice, so there will be no communication with your company prior to the audit. The BSI Notified Body auditors will present themselves at your premises, and your company must provide immediate and unrestricted access.

Access to your critical sub-contractors and crucial suppliers by the Notified Body may also be required, and will be subject to identical requirements, in situations where this is likely to provide more effective control by the Notified Body. This right of access will need to be covered in your contracts with these suppliers.

How often will I receive an unannounced audit?

In November 2016, the MHRA confirmed a change to the required frequency for unannounced audits. The EU Commission Recommendation of 24 September 2013 led to Manufacturers being subject to an unannounced audit at least once every 3 years, with the frequency increased for high risk devices to every 2 years. 

From January 2017, we will apply the new frequency requirements and switch to a new schedule based on device classification, as outlined below:

Risk level  Details New audit cycle
     
Higher risk products AIMD, MDD Class III / IIb implantable devices 3 years
Lower risk products MDD Class IIb / IIa / Is / Im 5 years
IVD products Annex II List A / Annex II List B / Self-Test (under Annex IV only) 5 years