Regulatory Open Forum

For the MDR portion, when you file an application with the NB, they will "identify links between, and allocation of responsibilities among, the various manufacturing sites, and identify relevant suppliers and/or subcontractors of the manufacturer, and consider the need to specifically audit any of those suppliers or subcontractors or both". [Annex VII, 4.5.2(a), second indent]

You believe the NB will identify your contract manufacturer and determine there is a need to specifically audit.

The NB will "clearly define, for each audit identified in the audit program, the objectives, criteria, and scope of the audit, and draw up an audit plan that adequately addresses and takes account of the specific requirements for the devices, technologies, and processes involved". [Annex VII, 4.5.2(a), third indent]

Also, note, "if not already covered by the audit program, audit the control of processes on the premises of the manufacturer's suppliers, when the conformity of finished devices is significantly influenced by the activity of suppliers and, in particular when the manufacturer cannot demonstrate sufficient control over its suppliers". [Annex VII, 4.5.2(b), first intend in the paragraph about sampling technical documentation]

As soon as the NB identifies your contract manufacturer for audit, request the audit objectives, criteria, scope, and plan. Then you will know what to expect.

In general, the NB will audit you against Article 10(9)(d) for selection and control of suppliers and sub-contractors. You will probably offer your ISO 13485:2016, 7.4 which according to CEN/TR 17223:2018 covers the requirement.

The NB will also audit you against Annex IX, Chapter 1, 2.2 paragraph 2 b) indent 3 for monitoring and control "other parties". Similarly, 4.1.5 and 7.4.1 cover the requirement.

Make sure that this information aligns with the Annex II(3)(c) information.

In Annex IX(2.3) the audit includes "an audit on the manufacturer's premises and, if appropriate, on the premises of the manufacturer's suppliers and/or subcontractors to verify the manufacturing and other relevant processes."

For the initial audit, expect the NB to audit the contract manufacturer for compliance to the controls you established and for conformity of their manufacturing process to their requirements. ISO 13485:2016 is not required unless you included it as a control. For the manufacturing audit, expect a backward tracing process audit. The auditor would select a product destined for you and follow the manufacturing process from the finished good backwards to purchasing and incoming inspection.

There are two more audit types to consider after the initial audit.

There is a surveillance audit at 12-month intervals. Under Annex IX(3.3) the NB can your contract manufacturer. It is, in my opinion, not likely with every surveillance audit. However, if the sampling plan for technical documentation includes the contract manufacturer, then an audit is likely.

There is an unannounced audit once every five years which could include a supplier audit.

For the MDD portion the same concepts apply. However, the sampling plans for technical documentation may be different and the unannounced audit frequency is three years.

For the MDR portion, when you file an application with the NB, they will "identify links between, and allocation of responsibilities among, the various manufacturing sites, and identify relevant suppliers and/or subcontractors of the manufacturer, and consider the need to specifically audit any of those suppliers or subcontractors or both". [Annex VII, 4.5.2(a), second indent]

You believe the NB will identify your contract manufacturer and determine there is a need to specifically audit.

The NB will "clearly define, for each audit identified in the audit program, the objectives, criteria, and scope of the audit, and draw up an audit plan that adequately addresses and takes account of the specific requirements for the devices, technologies, and processes involved". [Annex VII, 4.5.2(a), third indent]

Also, note, "if not already covered by the audit program, audit the control of processes on the premises of the manufacturer's suppliers, when the conformity of finished devices is significantly influenced by the activity of suppliers and, in particular when the manufacturer cannot demonstrate sufficient control over its suppliers". [Annex VII, 4.5.2(b), first intend in the paragraph about sampling technical documentation]

As soon as the NB identifies your contract manufacturer for audit, request the audit objectives, criteria, scope, and plan. Then you will know what to expect.

In general, the NB will audit you against Article 10(9)(d) for selection and control of suppliers and sub-contractors. You will probably offer your ISO 13485:2016, 7.4 which according to CEN/TR 17223:2018 covers the requirement.

The NB will also audit you against Annex IX, Chapter 1, 2.2 paragraph 2 b) indent 3 for monitoring and control "other parties". Similarly, 4.1.5 and 7.4.1 cover the requirement.

Make sure that this information aligns with the Annex II(3)(c) information.

In Annex IX(2.3) the audit includes "an audit on the manufacturer's premises and, if appropriate, on the premises of the manufacturer's suppliers and/or subcontractors to verify the manufacturing and other relevant processes."

For the initial audit, expect the NB to audit the contract manufacturer for compliance to the controls you established and for conformity of their manufacturing process to their requirements. ISO 13485:2016 is not required unless you included it as a control. For the manufacturing audit, expect a backward tracing process audit. The auditor would select a product destined for you and follow the manufacturing process from the finished good backwards to purchasing and incoming inspection.

There are two more audit types to consider after the initial audit.

There is a surveillance audit at 12-month intervals. Under Annex IX(3.3) the NB can your contract manufacturer. It is, in my opinion, not likely with every surveillance audit. However, if the sampling plan for technical documentation includes the contract manufacturer, then an audit is likely.

There is an unannounced audit once every five years which could include a supplier audit.

For the MDD portion the same concepts apply. However, the sampling plans for technical documentation may be different and the unannounced audit frequency is three years.