In preparation for an FDA medical device audit, the manufacturer should have a plan in place to identify the necessary documents and records, as well as train employees on how to answer the inspector’s questions. During the audit, the manufacturer should fully cooperate with the FDA inspector and provide them with all necessary information. If the inspector finds any problems, the manufacturer needs to address them promptly and effectively.

This article will offer comprehensive insights into FDA medical device audits. To delve deeper into FDA regulations, manufacturers can consult the FDA website, review guidance on preparing for audits, and refer to the guide on addressing issues identified during audits provided by GOL.

What is a medical device audit?

A medical device audit is a systematic examination or inspection carried out by regulatory authorities, such as the U.S. Food and Drug Administration (FDA), to assess whether a medical device manufacturer is complying with regulatory requirements and quality standards. These audits are designed to ensure that medical device manufacturers adhere to established guidelines and regulations throughout the entire lifecycle of their products, from design and development to manufacturing, distribution, and post-market surveillance.

During a medical device audit, inspectors review various aspects of the manufacturer’s operations, including quality management systems, manufacturing processes, documentation practices, and product performance data. The goal is to verify that the manufacturer is following Good Manufacturing Practices (GMP) or other relevant standards to ensure the safety, effectiveness, and quality of medical devices.

Medical device audits may be conducted on-site at the manufacturer’s facilities or remotely through documentation review and communication with company representatives. The frequency of audits can vary depending on factors such as the classification of the medical device, the manufacturer’s compliance history, and the level of risk associated with the product.

Overview of FDA Audit Types for Medical Device Manufacturers

In the United States and other countries, regulatory audits are carried out by government agencies, with the FDA being responsible for inspections of medical device manufacturers in the US, in accordance with the standards outlined in FDA 21 CFR Part 820. The FDA conducts four main types of inspections:

• Pre-Approval Inspections (PAIs): These inspections occur when a company submits an application to the FDA to market a new product. PAIs verify the data presented in the application and ensure that the manufacturing facility is capable of producing the product.
• Routine Inspections: Mandated by law every two years for manufacturers of class II and class III devices, routine inspections follow the Quality System Inspection Technique (QSIT). These inspections assess compliance with FDA regulations and standards. If serious public health risks are identified during a routine inspection, it may transition into a “for cause” inspection.

Read more: What is FDA 510(k)? Learn about the FDA 510(k) certification

• Compliance Follow-Up Inspections: This type of inspection evaluates the actions taken by a company in response to previous inspections that resulted in significant observations (483 observations) or the issuance of a Warning Letter by the FDA.
• “For Cause” Inspections: These inspections are initiated to investigate specific issues reported to the FDA. Reports can originate from the manufacturer, consumer complaints, or even disgruntled employees, prompting the FDA to conduct targeted inspections to address the reported concerns.

Unannounced FDA audits

Unannounced FDA audits refer to inspections conducted by the U.S. Food and Drug Administration (FDA) at medical device manufacturing facilities without prior notification to the company. These audits are designed to evaluate compliance with regulatory requirements and quality standards in real-time, without giving the manufacturer an opportunity to prepare or make adjustments specifically for the inspection. Unannounced audits help ensure that companies maintain consistent adherence to FDA regulations and standards at all times, promoting product safety and public health.

The benefits of participating in the Medical Device Single Audit Program (MDSAP)

Participating in the Medical Device Single Audit Program (MDSAP) offers several benefits for medical device manufacturers:

• Streamlined Regulatory Audits: MDSAP allows manufacturers to undergo a single audit that satisfies the regulatory requirements of multiple countries, including Australia, Brazil, Canada, Japan, and the United States. This streamlines the auditing process and reduces the burden of undergoing separate audits for each market.
• Integration with FDA Inspections: In the United States, the FDA has fully integrated its inspection process into the MDSAP. Manufacturers enrolled in the program can replace routine FDA inspections with MDSAP audits, demonstrating compliance with FDA regulations while meeting the requirements of other key markets simultaneously.
• Cost Efficiency: Participating in MDSAP can lead to cost savings for manufacturers by reducing the resources and time spent on preparing for and undergoing multiple audits. Consolidating audits into a single MDSAP audit minimizes duplication of efforts and associated expenses.
• International Market Access: MDSAP participation enhances access to international markets by demonstrating compliance with regulatory requirements through a standardized audit process. This facilitates market entry into countries participating in the program and supports global expansion strategies for manufacturers.
• Enhanced Regulatory Compliance: MDSAP audits assess compliance with ISO 13485:2016 and regulatory requirements of participating countries, helping manufacturers maintain consistent adherence to quality management system standards and regulatory expectations across multiple jurisdictions.
• Competitive Advantage: Manufacturers that participate in MDSAP demonstrate a commitment to quality and regulatory compliance, enhancing their reputation and competitiveness in the global marketplace. Certification under MDSAP can differentiate companies and products, potentially leading to increased market opportunities and customer trust.

While the UK and EU are currently not part of the MDSAP scheme, participation in the program remains beneficial for accessing other major markets and streamlining regulatory compliance efforts.

Internal audits

Internal audits are a fundamental requirement outlined in both ISO 13485 and FDA 21 CFR Part 820, aimed at ensuring the effectiveness and efficiency of a company’s quality systems. These audits serve as a proactive measure to assess whether documented procedures and systems align with regulatory standards and organizational requirements.

ISO 13485 mandates internal audits to:

1. a) Verify compliance with planned and documented arrangements, the requirements of the standard, internal quality management system requirements, and relevant regulatory standards.
2. b) Evaluate the effective implementation and maintenance of the quality management system.

Organizations are required to establish procedures outlining responsibilities for audit planning, execution, and reporting. Furthermore, they must maintain records documenting audit activities, including the processes audited, areas assessed, and conclusions drawn.

Similarly, FDA 21 CFR Part 820 also mandates organizations to conduct regular internal audits and demonstrate their commitment to this process. These audits can be conducted by either third-party consultants or internal personnel, provided there is no conflict of interest.

Overall, internal audits serve as a vital tool for organizations to identify areas for improvement, ensure compliance with regulatory requirements, and uphold the integrity of their quality management systems.

International partners participating in the MDSAP

International partners participating in the MDSAP include:

MDSAP Members:

• Therapeutic Goods Administration of Australia
• Brazil’s Agência Nacional de Vigilância Sanitária
• Health Canada
• Japan’s Ministry of Health, Labour and Welfare, and the Japanese Pharmaceuticals and Medical Devices Agency
• U.S. Food and Drug Administration

MDSAP Official Observers:

• European Union (EU)
• United Kingdom’s Medicines and Healthcare products Regulatory Agency (MHRA)
• The World Health Organization (WHO) Prequalification of In Vitro Diagnostics (IVDs) Programme

MDSAP Affiliate Members:

• Argentina’s National Administration of Drugs, Foods and Medical Devices (ANMAT)
• Ministry of Health of Israel
• Kenya’s Pharmacy and Poisons Board (NEW)
• Republic of Korea’s Ministry of Food and Drug Safety
• Federal Commission for Protection from Sanitary Risks (COFEPRIS) of Mexico
• Singapore’s Health Sciences Authority (HSA)
• TFDA – Taiwan Food and Drug Administration

From January 1, 2014, to December 31, 2016, the FDA, along with its international partners, participated in a Medical Device Single Audit Program Pilot. On June 29, 2017, a report was issued summarizing the outcomes of the prospective “proof-of-concept” criteria established to confirm the viability of the Medical Device Single Audit Program. The Final MDSAP Pilot Report documented outcomes based on data generated during the three-year pilot.

Following an evaluation of the MDSAP Final Pilot Report, the MDSAP Regulatory Authority Council (the international governing body of MDSAP) concluded that the MDSAP Pilot successfully demonstrated the viability of the program.

The FDA will continue to accept MDSAP audit reports as substitutes for routine Agency inspections. However, firms engaged in activities related to the Electronic Product Radiation Control (EPRC) provisions of the Act will remain subject to FDA inspections for EPRC activities.

Types of FDA inspections for Medical Device QMS

Types of FDA inspections for Medical Device Quality Management Systems (QMS) include:

• Pre-approval inspections: These inspections occur before the FDA approves a new medical device. They ensure that the manufacturer has established and implemented a QMS that complies with the Quality System Regulation.
• Routine inspections: Conducted every two years for class I and II medical devices, these inspections ensure that the manufacturer maintains a QMS in compliance with the Quality System Regulation.
• Compliance follow-up inspections: These inspections verify that the manufacturer has addressed any deficiencies identified during previous inspections.
• For-cause inspections: Conducted when the FDA suspects non-compliance with the Quality System Regulation.

During each inspection, the FDA reviews the company’s QMS documentation and records. Interviews with employees are conducted to assess their understanding of the QMS and their roles in maintaining it. If deviations from regulations are found, the FDA issues a Form 483. The company must respond within 15 business days with a corrective action plan.

FAQs about FDA medical device audit

How often are FDA medical device audits conducted?

Manufacturers of Class II and III medical devices undergo FDA inspections every two years. These inspections can occur with little notice as the FDA prioritizes inspections based on risk, giving higher priority to devices with greater risk levels. Manufacturers of implantable, life supporting, or life sustaining devices are more likely to be inspected by the FDA.

What are the objectives of FDA medical device audits?

The primary objectives of FDA audits are to assess compliance with regulatory requirements, including Current Good Manufacturing Practices (CGMP), and ensure the safety, efficacy, and quality of medical devices available in the market.

Is it necessary to establish a quality management system for a Class I device?

The necessity to implement a quality management system for a Class I device depends on the specific requirements outlined in the FDA classification regulation or product code assigned to the device.

Is ISO 13485 sufficient for FDA compliance?

No, ISO 13485 alone is not sufficient for FDA compliance. The FDA does not recognize ISO 13485 as being in compliance with FDA Quality System Regulation (QSR) outlined in 21 CFR part 820. Additionally, certification to ISO 13485 does not equate to compliance with FDA QSR requirements.

Understanding the frequency of FDA medical device audits is crucial for manufacturers to ensure compliance and prepare effectively. Navigating the complexities of FDA regulations can be challenging, but you don’t have to do it alone. GOL offers expert FDA registration services to guide you through every step of the compliance process, ensuring your medical devices meet all necessary standards and regulations. Ready to simplify your FDA medical services registration journey? Contact GOL today and take the first step towards seamless compliance and market entry.