MDCG 2022-17 Rev.0
MDCG position paper on ‘hybrid audits’
Disclaimer: This document is an interactive version of the original MDCG document. We will keep it up-to-date.
This document has been endorsed by the Medical Device Coordination Group (MDCG) established by Article 103 of Regulation (EU) 2017/745. The MDCG is composed of representatives of all Member States and it is chaired by a representative of the European Commission.
This paper outlines the Medical Device Coordination Group (MDCG) position on the possible use of hybrid audits by notified bodies under Regulation (EU) 2017/745 on medical devices (MDR) and Regulation (EU) 2017/746 on in vitro diagnostic medical devices (IVDR).
It is recognised that there was a disruption to the traditional auditing method during the global COVID-19 pandemic due to travel restrictions and other health advice at that time. Since then, auditors and auditees have become accustomed with the use of information and communication technologies (ICT) during audits as described in MDCG 2020-4 (1) and MDCG 2020-17 (2). This paper aims to provide a definition for hybrid audits and clarifications with respect to how hybrid audits can be used under MDR and IVDR as advised following the publication of MDCG 2022-14 (3).
Certain conformity assessment procedures under the MDR and the IVDR require the notified body to carry out audits of the manufacturer’s quality management system (QMS). The assessment procedure must include an audit on the manufacturer’s premises both for the initial assessment (4) and for the periodic surveillance (5). The same requirement applies, as appropriate, for audits to occur on the premises of the manufacturer’s suppliers and/or subcontractors.
In addition to the terms ‘premises’ or ‘on the premises’, also ‘on-site’ and ‘off-site’ are used in the MDR and the IVDR to describe where conformity assessment activities take place.
To clarify the meaning of the term ‘hybrid audit’, the MDCG agrees on the following definition.
A ‘hybrid audit’ should be understood as an audit on the premises of the manufacturer or its supplier(s) and/or subcontractor(s) with at least one auditor present on the premises and other members of the audit team participating from elsewhere using information and communication technologies (ICT).
The presence of the auditor(s) on the auditee’s premises and of the other members of the audit team can last either from the opening meeting to the closing meeting or for a portion of that time.
A conformity assessment activity included in the audit plan can be carried out either on the auditee’s premises, from elsewhere or simultaneously from the auditee’s premises and elsewhere. The auditee should be involved in any case.
When establishing their audit plan (6), notified bodies need to make sure that they plan sufficient time to audit the relevant processes on the auditee’s premises and identify and clearly document which parts of the conformity assessment activities are carried out on the auditee’s premises or using ICT.
The MDCG may review this position and determine whether modifications are needed based on the experience gained.
The MDCG advises NBCG-Med to further elaborate on operational elements, including the identification of as aspects to be audited on the auditee’s premises.
Footnotes
(1): MDCG 2020-4 “Guidance on temporary extraordinary measures related to medical device notified body audits during COVID-19 quarantine orders and travel restrictions” (https://health.ec.europa.eu/document/download/8811a216-fdd1-45c7-bd82-381a37696f05_en?filename=md_mdcg_2020_4_nb_audits_covid-19_en.pdf).
(2): MDCG 2020-17 “Questions and Answers related to MDCG 2020-4” (https://health.ec.europa.eu/document/download/a3bbc84b-078a-46d7-a281-d68136da6d38_en?filename=md_2020-17-guidance-mdcg-qa_en.pdf).
(3): MDCG 2022-14 “Transition to the MDR and IVDR – Notified body capacity and availability of medical devices and IVDs” (https://health.ec.europa.eu/document/download/2db053bc-283c-4d2e-93f4-c3e8032e66da_en?filename=mdcg_2022-14_en.pdf).
(4): In accordance with Section 2.3 of Annex IX to MDR and IDVR and similar requirements from Annexes XI to MDR and IVDR: “The assessment procedure shall include an audit on the manufacturer’s premises and, if appropriate, on the premises of the manufacturer’s suppliers and/or subcontractors to verify the manufacturing and other relevant processes”.
(5): In accordance with Section 3.3 of Annex IX to MDR and IVDR: “Notified bodies shall periodically, at least once every 12 months, carry out appropriate audits and assessments to make sure that the manufacturer in question applies the approved quality management system and the post- market surveillance plan. Those audits and assessments shall include audits on the premises of the manufacturer and, if appropriate, of the manufacturer’s suppliers and/or subcontractors. …”.
(6): In accordance with Section 4.5.2 a) of Annex VII to MDR and IVDR: “… a notified body shall … draw up an audit programme which clearly identifies the number and sequence of activities required to demonstrate complete coverage of a manufacturer’s quality management system … clearly define, for each audit identified in the audit programme, the objectives, criteria and scope of the audit, and draw up an audit plan that adequately addresses and takes account of the specific requirements for the devices, technologies and processes involved …”.