Global Regulatory Pulse

Unannounced Notified Body Audit

In Consulting, European Market, Regulatory by Stephan Buttron

On 24th September 2013, the European Commission published a Recommendation (2013/473/EU) regarding assessments and audits to be performed by Notified Bodies in the field of medical devices. The goal of unannounced audits is to maintain the continuous day-to-day regulatory compliance of manufacturer’s certified medical product and quality management system requirements.

The European Commission expects all Notified Bodies to perform unannounced audits as a post-market surveillance measure to ensure CE-marked medical devices meet approved safety and performance requirements and specifications from raw materials to finished goods at all times. This mandatory post-market inspection requirement is now fully implemented, and applies to all legal manufacturers certified under one of the European medical device directives (AIMDD, MDD, IVDD). Unannounced audits are performed at least once every three (3) years.

There is a big gap between scheduled Notified Body audits and mandatory unannounced audits. Unannounced audits may be conducted without any specific cause, and may be in addition to or instead of a regular audit.

The regulated medical device industry provided education and training to all concerned stakeholders and is prepared to successfully manage unannounced audits. However, when notified body auditors are knocking on the door to conduct an unannounced audit, what precautions should be made to ensure processes, documents, and medical devices are in place to avoid unexpected results?

A key focus of unannounced audits is the legal manufacturers’ supply chain. This includes contract manufacturers and Original Equipment Manufacturers (OEMs) for components, sub-assemblies, and packaging and labeling. The purpose is to verify adherence to quality and regulatory requirements of outsourced processes. Contractors and OEMs must ensure and provide traceable documentation for raw materials, components, and sub-assemblies, including manufacturing processes with specified safety and performance requirements.

The current MDD 93/42/EC (M5) as amended only requires an on-site inspection on the premises of the manufacturer’s suppliers and/or subcontractors in duly substantiated cases (i.e. with the need of a duly justified reason). To minimize business risks, it is mandatory to review and, if needed, revise contractual agreements with suppliers and subcontractors to meet this new obligation. Related supply and/or manufacturing agreements must clearly define its quality and regulatory obligations and responsibilities. Incorporating your critical supply chain into an audit schedule to verify and validate the delivery status of aforementioned commitments is strongly advised to avoid surprises. It is also always good advice to have a closer look into the scope and effectiveness of the implemented Quality Management System processes and results of past audit reports and other issues (e.g., systemic non-conformances), and apply these to improve suitability and effectiveness.

Notified Bodies hold the certificate holder responsible to ensure unannounced audits of the manufacturing and business premises listed on the holder’s certificate—relevant warehouses of representatives, importers and branches—can be performed at any time during standard business hours and without prior notice.


Stephan Buttron currently serves as NAMSA’s Senior Product Development Strategist. Mr. Buttron has over 20 years’ experience in achieving EU, U.S. FDA and other international regulatory medical device approvals and registrations. He has provided global consulting services on regulatory strategy development to medical device manufacturers regarding least burdensome pathways for 510(k)/PMA and MMD-CE mark applications. He has successfully managed FDA pre-submission meetings for Investigational Device Exemption (IDE) pathways with multiple FDA specialty branches. Stephan is considered a key industry thought leader on risk management, and has provided multiple training sessions to medical device manufacturers on structured risk management process per EN ISO 14971 & EU MDD 93/42 as amended with directive 2007/ 47. Mr. Buttron has also provided countless educational opportunities to international organizations regarding medical device design and development issues related to ISO 13485 & EU MDD 2007/47 compliance.