Unannounced Audits
What is all the fuss about?
Picture the scene…
It’s been a busy week, but thankfully today is Friday. You are looking forward to the weekend, and you have arrived at work a little early, looking forward to working through your planned tasks, and perhaps catching up on a backlog of emails. You’ve been waiting for this opportunity for a while. You may even get to leave the office early too…..
But wait,… it’s barely 8.30am, and there is a knock at the door? “Can I help you?… The Notified Body you say?…hmmmm” “You are here to conduct an Unannounced Audit you say? – right…., ummm, well, you see, our production unit is closed today, and I really am very busy….”
“We need to be in your production area within 15 minutes” comes the reply from the auditors, as they enter…
Your perfect day has been cancelled. And it may even get worse than that…
Unannounced Audits (UAs) are quite literally unannounced. The first you will know that you (or your critical supplier/subcontractor) have one is the presence of the NB/AB at the door, with a letter from their Head Office, and their identification. It’s in your contract with your NB/AB that you signed, so it should be no surprise, however many manufacturers (especially those who are not making the product directly (let’s call them Virtual Manufacturers)) are usually very surprised.
UAs are not new.
They came about as a result of an EU Commission Recommendation back in 2013 (2013/473/EU) and have been used for routine and ‘with cause’ audits for getting on for 10 years now. I believe the first UA was conducted in March/April 2014.
NBs/ABs have refined their processes during that time and as a result of conducting so many UAs, and if you have yet to experience an Unannounced Audit, they can feel very different from the surveillance audits you are used to as the objective intent is very different.
Whether you are experienced with UAs or not, the following points should serve to be of interest to you as there may be new information…
- Unannounced Audits can be conducted, by some Notified Bodies, using a hybrid approach. Not just due to Covid, but for all UAs. This is where one auditor (normally the QMS auditor) is on-site and is joined remotely/virtually by the Product Assessor (Technical Reviewer). There is a recently published MDCG position paper (2022-17) on hybrid audits.
- To clarify, no prior notice at all will be given by the NB/AB that they will conduct the UA. In your contract with them, you have already accepted they will perform UAs.
- Unannounced Audits can take place at the same as your routine/planned NB audits. I have known this to happen, and neither audit team knows the other is there.
- Unannounced Audits can happen the day immediately after your routine/planned NB audits. I have known this to happen too. It may even be the same auditor. (Of course, they cannot tell you they are coming back!). They can of course occur immediately before your planned audits which can be interesting!
- If you have certification under UK MDR, MDD (or IVD), or EU MDR (or EU IVDR), you can expect to have 2 Unannounced Audits.
- If you are certified under UKCA, MDD or IVDD, you can expect your Notified Body to conduct a UA at least once every 3, and at least once every 5 years for MDR 2017/745 and IVDR 2017/746.
- UAs must last for at least one whole day and should be carried out by a team of at least 2 auditors.
- If you have critical sub-contractors and suppliers, they are more likely to receive the Unannounced Audit than a ‘virtual’ manufacturer. Any findings raised at those locations are for you to deal with, not the supplier, so if you have not considered this, other than a clause in your contract with them, now is the time to do that and make sure your supplier is not a cause of compliance issues.
Access to Product Specialists (Technical Reviewers) for supporting the UA was always a key challenge for the NBs. Auditors travel for their job, Product Specialists do not, however with the advent of hybrid audits this has removed that obstacle, so I would suggest UAs will be carried out more frequently in the coming months and years. (Some NBs have already stated that they will use hybrid audits for all or most UAs moving forward…)r
Tips for being prepared for the UA:
- If you have never had a UA, start reading. Understand the scope, purpose, and requirements of Unannounced Audits, and read as much as possible about these. I suggest you start with the commission recommendation itself
- Make a plan and document every thought about the UA process from what you have read
- Turn that plan into actions and get it done. A procedure covering most of the points is better than no procedure for UAs.
- Be audit ready all of the time. Always. This is most important. How you ensure this depends very much on the size and maturity of your business. The product selected for the UA activities is the choice of the Auditor, not yours, so don’t plan on showing a ‘golden product’!
- Expect the unexpected, and have plans for all possible scenarios.
- Conduct your own Unannounced Audits (or contract a third party for greater impartiality)
- Understand your NB’s/AB’s UA processes and align your management processes accordingly. E.g. if they need to be in production within 15 minutes of arrival, update your procedures and train all staff as needed.
- Establish processes to assist the management of the UA. This includes the verification of the UA teams credentials upon arrival but can also extend to processes covered by the scope of the UA, for example product testing.
- Have a delegate Management Representative documented in your QMS.
- Make sure that you have a robust process for notifying relevant people (both internal and external as needed).
- Train all relevant personnel/employees in the purpose of the UA, the expectations for them, and how to stay calm and cooperative. Depending on the size of your business and the business model you operate, this can be simple or complex. If you have a physical location with reception area, be sure that the first contacts know what to do (and what not to do). This audit cannot be responsibility of the Quality Department alone!
- Check that your contracts with critical suppliers/subcontractors has a requirement for them to allow UAs from your NB/AB. Ensure they know they cannot refuse the auditor entry!
- Check your own NB/AB website/contract for their specific requirements for UAs. They may have webinars to watch, or guidance/FAQs published on their websites.
Final thoughts
UAs can be daunting. They have a habit of occurring at the most inconvenient of times, yet they demand immediate and sustained support from several departments of your organization for the duration of the audit.
Whatever you do, no matter what the reason, do not deny the auditors entry. Most Notified Bodies will simply document that ‘audit result’ in the report, and recommend to their certification board that the related certification is suspended.
Next Steps for you
Add this topic to your next Management Meeting agenda and
talk about how you will handle a UA after reading the above. Make sure top
management know about these audits and the criticality of their success to you
organization.
If after this you have any questions about, or need support in relation to, Unannounced Audits,
do not hesitate to contact Advena to discuss.
We can talk about offering a UA readiness audit, or a mock UA, or just have a
conversation to put your mind at ease!
