MDCG 2020-17 Rev.10
Questions and Answers related to MDCG 2020-4
Disclaimer: This document is an interactive version of the original MDCG document. We will keep it up-to-date.
This document has been endorsed by the Medical Device Coordination Group (MDCG) established by Article 103 of Regulation (EU) 2017/745. The MDCG is composed of representatives of all Member States and it is chaired by a representative of the European Commission.
1. Introduction
This document presents questions and answers on temporary extraordinary measures related to medical device notified body audits during COVID-19 quarantine orders and travel restrictions.
The issues covered by this document have been identified in the context of the implementation of the principles outlined in the guidance document “MDCG 2020-4 Guidance on temporary extraordinary measures related to medical device notified body audits during COVID-19 quarantine orders and travel restrictions” (1). The questions and answers presented below provide further details on the operational and practical implementation of the principles outlined in the guidance document MDCG 2020-4 and should be read in conjunction with such document.
The situation caused by the COVID-19 quarantine orders and travel restrictions is closely monitored and considered by the Commission and Member States, therefore, the questions and answers may be updated from time to time as new issues are identified.
2. Scope
2.1 Under which regimes may initial audits be conducted remotely?
In order to ensure medical care and to prevent the shortages of products on the market, initial certification audits under the Directives may be performed using the principles and guidance outlined in MDCG 2020-4. This also requires the notified body to perform a case-by-case assessment, justified and documented as outlined in section 5 of the guidance. (2)
2.2 Is it possible to conduct remote audits in order to extend the scope of certification?
In order to ensure medical care and to prevent the shortages of products on the market, audits to extend the scope of certification under the Directives may be performed using the principles and guidance outlined in MDCG 2020-4. This also requires the notified body to perform a case-by-case assessment, justified and documented as outlined in section 5 of the guidance. (2)
2.3 What devices are considered “clinically necessary during the period of COVID-19 restrictions”?
A list of essential medical equipment related to the COVID-19 pandemic has been developed by the Commission jointly with the Member States and agreed by the MDCG. The list is published at Commission’s website (3) and may be subject to future updates, if needed. Devices listed can be considered “clinically necessary during the period of Covid-19 restrictions”.
2.4 Is applicability of MDCG 2020-4 limited to devices “clinically necessary during the period of COVID-19 restrictions”?
MDCG 2020-4 has a wider scope and was endorsed by the MDCG in order to allow notified bodies to perform alternative extraordinary measures and arrangements to on-site audits, including remote audits, in the context of the COVID-19 pandemic. In line with the postponement of the MDR date of application by one year, the scope of the aforementioned guidance covers certificates issued under the Directives. MDCG 2020-4 is intended to address all devices requiring the involvement of a notified body, thus not limited to COVID-19 essential medical equipment.
2.5 Is it possible to audit existing and new critical subcontractors/suppliers remotely?
Remote audits of existing and new critical subcontractors/suppliers under the Directives may be conducted using the principles and guidance outlined in MDCG 2020-4 and requiring the notified body to perform a case-by-case assessment.
2.6 Can unannounced audits be conducted remotely?
The postponement of the MDR date of application by one year was adopted by the EU co-legislators in order to alleviate pressure to all actors involved, including notified bodies, deferring the date of repeal of the Directives. In addition, MDCG 2020-4 was endorsed by the MDCG in order to allow notified bodies to perform alternative extraordinary measures and arrangements to on-site audits, including remote audits, in the context of COVID-19 pandemic in order to support the continued supply of medical devices on the market. Although the conduct of unannounced audits is outside the scope of MDCG 2020-4, from a risk-based approach, it is recognised that these audits may be postponed and that the recommendations in Article 2(c) and Annex III of Commission Recommendation 2013/473 may not be followed during the period of the pandemic.
3. Proposed temporary alternative extraordinary measures and arrangements to on-site audits
3.1 What are the “most advanced” information and communication technologies (ICT)? What software is to be used? What communication technologies are to be used? What is the necessary hardware?
ICT has the potential to simulate on-site audits if used appropriately and with the adequate conditions in place. It must be highlighted that it is not up to the MDCG guidance to identify or recommend specific technologies for use during these audits. Nevertheless, it is important to underline that ICT used for the purposes of remote audits should at a minimum ensure effective communication with the necessary levels of security, integrity, confidentiality and data protection. It is of foremost importance that the technology chosen can ensure these principles aare upheld. Both parties in question (the manufacturer to be audited and the notified body auditing) should agree in advance of the audit on the use of a specific technology in which use they are both proficient.
Similar to on-site audits, preparation plays a large part in facilitating a seamless remote audit. It is recommended that a test is performed ahead of the foreseen audit date in order to test the technology and internet connection, avoiding any unforeseen complications during the audit.
Internet connection quality and stability is essential, therefore, the test should also focus on ensuring that connection is ensured in all areas/rooms expected to be part of the remote audit. It is also recommended that IT persons responsible for monitoring the connection should be available to both parties in case any complications arise during the audit.
It may be necessary to formalise agreements between the two parties as to the consent to use personal data, individual images and recordings. Records of these agreements should be maintained. Where necessary, a data protection officer may be consulted by both parties.
4. Eligibility criteria and procedural aspects
4.1 Is any special preparation on the notified body or manufacturer’s side necessary in advance of conducting a remote audit?
Once the remote audit has been announced, the notified body should agree with the company to be audited the electronic system that will be used to conduct the remote audit and the staff members needed to be during the audit.
Moreover, the notified body may request the company to provide access to, or, send in advance all of the the documents related to the audit, in order to be assessed by the notified body in advance.
Both the notified body and the manufacturer should verify the ICT agreed upon to ensure that the remote audit can be carried out properly, see question 3.1 of this document. In addition they may have a videocamera system to allow the notified body to watch their facilities if necessary. The use of videocameras would require a risk assessment on a case-by-case basis.
The manufacturer should ensure the availability of relevant documents and records during the remote audit and that their system gives the possibility to share the documents with the notified body.
4.2 How the audit program established by the notified body should be taken into account in case of remote audits and what happens if a remote audit cannot be performed in accordance with such audit program?
During the extraordinary situation facing the COVID-19 pandemic there could be a situation when the manufacturer or the notified body is not able to perform an on-site audit. If this is the case, a remote audit can be an option to use.
The remote audit should be intended to replace on-site audits scheduled by the notified body and detailed in their audit program. The notified body’s procedures and relevant MEDDEV/MDCG/NBOG BPG guidelines (4) should be followed. An on-site audit should be performed as soon as it is possible after a remote audit.
There should be a discussion between the manufacturer and the notified body to decide what part of the audit programme / individual audit can be conducted remotely and what part(s) must be conducted on-site later. This time plan should also include an estimate for when an on-site audit can be conducted. Any deviation from the audit program has to be justified and documented by the notified body.
The timing of the remote audit should be planned according to the audit programme or as soon as possible. In the case that the manufacturer needs to postpone a remote audit they should provide a rationale with enough evidence for such a need.
If it is not possible to follow the audit plan and there is a justification from the manufacturer, the notified body has to perform a risk-based assessment if it is neccesarry to impose specific restrictions on the certificate(s) or when to suspend the certificate(s) concerned.
If it is still not possible to perform a remote audit, the notified body has to decide about the status of the certification, e.g. suspension. During a suspension the manufacturer cannot place any devices on the market.
If the notified body cannot perform an audit or it concludes that the results of the remote audit were deemed unacceptable, the notified body has to withdraw the certificate according to its own procedures.
4.3 How does performing an audit by alternative measures affect the calculation of audit duration?
The determination of the audit duration for on-site audits varies dependant upon a number of factors such as the size and activities of the manufacturer/audited site, the number of personnel on-site, the manufacturering capability and the technologies used, the scope and complexity of medical devices, the number of subcontractors as well as on the nature, functionality and complexity of the management system to be audited.
For a remote audit, the notified body should make clear that the calculation of audit duration does not include travel time. Furthermore, during this calculation the notified body must also take into account that delays may be caused by network connections. For example, if the internet connectivity is unreliable then online streaming activities may be interrupted and it may take some time to reconnect and solve all the network problems.
The duration of a remote audit may be longer or shorter than if the audit was performed on-site. The difference in duration may be dependant upon the content and complexity of the audit as well as the technology used to conduct the audit. As for all audits, the duration should be justified by the notified body.
As in an on-site audit, a remote audit should cover all relevant activities including documentation review, interview of employees and tour of the manufacturers’ facilities.
4.4 Does the notified body have to retain all documentation submitted by the manufacturer for later review, or can it be properly disposed of and notified to the manufacturer?
With regard to remote audits conducted in line with MDCG 2020-4, it is the expectation that the notified body ensures that documentation records are sufficient to provide a discernible audit trail for quality management system audits and that such records should be available to relevant authorities. As with any audit, evidence gathered during the audit should be appropriately recorded and where considered necessary, copies of relevant documentation should be retained.
Documentation should be treated in confidence as per legislative requirements.
Footnotes
(2): Especially “In the exceptional circumstance of the issuance of an initial or extended scope certificate under these alternative extraordinary measures, the notified body should consider the clinical risk / benefit of their decision and should clearly document their rationale for these decisions. At the request of the designating authority the notified body should inform the national authority of any such decisions and provide any supporting documentation.”