Recommendations of Notified Bodies on Hybrid Audits in the Medical Device Sector

In a 3.5 pages position paper, Notified Bodies have presented their views on hybrid audits of medical device and IVD manufacturers. What does it say?

Typically, audits of the quality management system of medical device manufacturers have been conducted on-site. But during the Covid pandemic, alternatives were developed using information and communication technologies (ICT). The Team NB position paper entitled "Notified bodies paper on the application of hybrid audits to quality management system assessments under MDR/IVDR" now sets out the Notified Bodies' position on the inclusion of ICT-based audits in the context of hybrid audits.

The difficulty is that both the Medical Device Regulation and the IVD Regulation provide for on-site audits. This applies to both initial audits and recurring audits of the QM system, but also to "post-market surveillance". In this respect, the quintessence of this document is that at least part of the audits must take place on site, even if ICT is used. So, they have to be hybrid audit.

The advantages of a hybrid audit compared to a full on-site audit are listed in the document. The authors see one of the advantages in the reduction of auditor burnout.

As minimum requirements for areas that are to be audited on site, the document mentions:

• Infrastructure 
• Working environment 
• Production and incoming goods, in-process controls and the final inspection
• "Servicing" 
• Design transfer to manufacturing (if internal premises are involved for verification and validation) 
• Warehouses and storage areas

Conversely, areas that can be audited using ITC are also mentioned:

• Management (e.g. quality management, regulatory affairs) 
• Improvement processes (e.g. internal audit, management review, CAPAS) 
• Personnel (e.g. qualification and training) 
• Purchasing (e.g. review of supplier qualifications)
• Design and development (unless internal premises are involved) 
• Traceability and batch documentation

The document also identifies details of the audit team qualification.

With reference to the GHTF document SG4/N30 on the audit strategy of supervisory bodies, 20-30% of the audit duration should relate to production and the "service control" subsystem. Consequently, at least 25% of the audit duration of hybrid audits should be on-site. But in any case, the on-site part should verify the existence of the company. However, there may be exceptions, e.g. if there is no on-site production (e.g. software manufacturers). And if all employees work online, an on-site part can be dispensed with.

Conclusion: The position paper provides interesting considerations on the division of on-site and online audits within the framework of hybrid audits.

For more detailed information, please also see the position paper "Notified bodies' paper on the application of hybrid audits to quality management system assessments under MDR/IVDR".