When the Auditor Comes Knocking

Medical device OEMs and contract manufacturers face continual quality and safety checks for all of their products. The MedTech Group’s Mary Gilman outlines some of the critical aspects to consider when preparing for and conducting vendor and FDA audits.

A look behind the scenes shows that it is not easy to be a successful contract manufacturer of medical devices. The industry has extremely high standards and it is heavily regulated.

Having a network of effective quality systems and qualified people to implement those systems is essential. Proving the effectiveness of such a system to customers and the US FDA is made easier when you are well prepared and willing to cooperate fully with their audits.

With the onset of ISO standards, the responsibility of product quality has consistently been pushed further down the supply chain. Ultimately, the company whose name is on the finished product (the OEM) is accountable for providing the market with safe and effective goods. An on-site audit at a manufacturing facility is one of the best ways of ensuring these high-quality goods are produced.

More than ever, customer audits are an important method of winning and keeping good business. It is an opportunity for the contract manufacturer (CM) to show the OEM customer, whose name is on the product, how its systems function to provide quality products time after time. It is a vehicle the supplier can use to open communication with the device manufacturer and understand the manufacturer’s needs and expectations.

From the OEM’s perspective, it is a way to gauge a particular supplier compared with other businesses in the industry. An audit relays a company’s quality policy and objectives to a receptive audience. Consider the audit report a report card with insight – a way to stay on the cutting edge using someone else’s point of view.


When visiting a contract manufacturer’s facility, OEMs typically conduct a systemic examination of the quality system and its controls. Audit schedules are not always written into the contract, but device marketers usually exercise the right to conduct an audit at any time. Customer audits generally occur at least once a year.

Audits tend to focus specifically on how quality systems affect the products owned by the OEMs. During an audit, customers review documentation, such as lot batch records, and witness the operation and operating conditions. This on-site observation is their assurance that written procedures are in place and being followed, and that suppliers are doing what they claim to be doing.

OEMs expect to see adherence to current Good Manufacturing Practices (cGMP) during the operations and validation processes. They ask to see where raw materials are inspected and where finished products are stored until delivered. They also look at whether employees who build their products are qualified and trained and that the components being assembled come from dependable sources that consistently meet quality standards.

It makes no difference whether the CM is supplying simple components or complex assemblies, or if the medical devices are being manufactured domestically or abroad. Every product sold within the US is subject to recall.

Because contract manufacturers buy raw materials and some components from other sources, it is critical that CMs ensure that purchased items meet the statements written on certification sent with each shipment. Often, when a project is initiated, new vendors are identified. These vendors are rated based on capability and qualified in the early stages of the cGMP audit by the CM. After that, unless their rating declines due to nonconforming material issues or poor delivery, an annual audit is replaced by periodic reviews of performance and spot checks to verify material content and processes against certification.


Usually an OEM will send a highly trained individual from its regulatory or quality staff, although many audit teams also consist of personnel from engineering and purchasing. Some come equipped with an arsenal of checklists and predetermined questions.

The audit team might meet and interview operators, inspectors and supervisors at their workstations or visit office to office to follow a procedure trail. Any employee along the route may be asked to repeat his or her company’s quality policy. At other times, an audit will be conducted from a designated on-site room where audited employees are questioned about procedures and job functions. Documented evidence is retrieved and brought into the room as requested.

OEM customers usually send advance notice of an audit. Because a contract manufacturer makes many different products for a variety of customers, it is best to arrange an audit when the customer’s order is in progress. This provides a "look-see" approach that can provide clearer answers.

It also allows for certified operators to be present for an interview, and for the required documentation and equipment, including fixtures, to be at the workstation. Companies should avoid booking more than two audits in the same month, and never arrange more than one customer audit at a time; each audit requires individual time and attention.

Suppliers are often sent a written agenda of the audit plan that includes an opening meeting at the site. At The MedTech Group, executive management is present at the meeting to offer assistance in conducting the audit. An OEM should plan to be on site for one or two days and arrive well-prepared to make best use of the time available.

Firstly, the results of the previous audit are reviewed. Any corrective actions required should be completed or have ongoing progress ready for review. The audit plan may involve a facility tour, starting with an inspection of the receiving warehouse of raw materials through the sequence of processes to the final boxing and shipment of products. Often, along the way, the auditor asks to see "paperwork" or documents that verify the activities of each process or operation.

"Audit reports help measure internal progress and act as a report card for customer satisfaction."

The spotlight is on the related standard operating procedures (SOPs) and work instructions of the products supplied by that facility. The audit concludes with a closing meeting and discussions of any findings, followed by a written report within a month. The resort may mention specific issues that were performed well.

If any nonconformance is recorded, the supplier is expected to respond to the report with a corrective action plan that includes dates of completion. The supplier is not required to respond to noted observations, but should evaluate and consider any comments as a basis for future development.

A company with an established quality system should not anticipate any major changes, but in the spirit of continuous improvement and goodwill, it may decide to implement a small change to enhance the overall system. The auditor might follow up on the status of the corrective action plan and corresponding due dates. In rare cases, the auditor may need to return to the site within the same year if progress is not satisfactory.


FDA audits differ from customer audits in their scope and method. Generally, routine FDA audits occur about every two years on a predetermined schedule. There is little advance notice, and the visit may exceed five days. This type of audit is strictly between the firm being audited (the contract manufacturer) and the FDA. The agency makes no distinction between the facilities of contract manufacturers and OEMs.

The FDA focuses on any complaints received from the field since the plant’s last audit, as well as looking at the firm’s handling of corrective or preventive actions. An FDA auditor will delve through quality system documentation, searching for nonconformance with SOPs or product specifications and negligence in rectifying complaints. Most likely, the auditor will spend time on the manufacturing floor as part of the search.

An FDA audit triggered as a result of an investigation or recall will be spontaneous. Agency inspectors arrive with the intention of gathering evidence and to uncover shortcomings in quality systems that allowed a defective medical device to be manufactured and released to the public. Because the OEM is ultimately responsible for that product, the agency’s visit will start there first, with the investigation extended to the contract manufacturer for a meticulous audit.

The OEM is not required to be present during the CM audit, although it is beneficial to be in close contact and be updated at least daily on the progress and findings of the audit. Both the OEM and the CM should coordinate efforts to minimise misleading information. Because records are held for the life of the product, and those documents may reside at either company, faxed copies are freely exchanged between sites for the auditor’s ready access.

The closing meeting summarises the results or findings of the audit to management with executive responsibility. This is a chance to discuss and even challenge nonconformities and discrepancies cited by the auditor. Most likely the auditor might not have fully understood the answer to a question or was confused by it. Once the nonconformance is written into the report, the contract manufacturer is responsible for resolving all outstanding issues.

A successful FDA audit ends with no 483s or warning letters issued to the firm. There is a legal obligation for the firm to respond to and comply with the conditions specified by the FDA.

Firms often make the mistake of trying too hard to remember the correct answer to pointed questions instead of referring to the SOP. It is far better to consult the SOP for the correct answer than to appear unsure of the procedure. Auditors, too, can make the mistake of putting the audited on the defence. The process moves more easily and smoothly if both parties adopt a cooperative and professional approach.

Audits keep the honest suppliers honest and expose those that do not deserve your business. It is important to realise that each audit offers an opportunity for making improvements and brings you one step closer to complete compliance. Audit reports help measure internal progress and act as a report card for customer satisfaction. Audits should be used to determine what is considered important and necessary to succeed in this business.