When the Auditor Comes Knocking

28 February 2007 (Last Updated February 28th, 2007 18:30)

Medical device OEMs and contract manufacturers face continual quality and safety checks for all of their products. The MedTech Group’s Mary Gilman outlines some of the critical aspects to consider when preparing for and conducting vendor and FDA audits.

When the Auditor Comes Knocking

A look behind the scenes shows that it is not easy to be a successful
contract manufacturer of medical devices. The industry has extremely high
standards and it is heavily regulated.

Having a network of effective quality systems and qualified people to
implement those systems is essential. Proving the effectiveness of such a
system to customers and the US FDA is made easier when you are well prepared
and willing to cooperate fully with their audits.

With the onset of ISO standards, the responsibility of product quality has
consistently been pushed further down the supply chain. Ultimately, the company
whose name is on the finished product (the OEM) is accountable for providing
the market with safe and effective goods. An on-site audit at a manufacturing
facility is one of the best ways of ensuring these high-quality goods are
produced.

More than ever, customer audits are an important method of winning and
keeping good business. It is an opportunity for the contract manufacturer (CM)
to show the OEM customer, whose name is on the product, how its systems
function to provide quality products time after time. It is a vehicle the
supplier can use to open communication with the device manufacturer and
understand the manufacturer’s needs and expectations.

From the OEM’s perspective, it is a way to gauge a particular supplier
compared with other businesses in the industry. An audit relays a
company’s quality policy and objectives to a receptive audience. Consider
the audit report a report card with insight – a way to stay on the
cutting edge using someone else’s point of view.

AUDIT FREQUENCY

When visiting a contract manufacturer’s facility, OEMs typically
conduct a systemic examination of the quality system and its controls. Audit
schedules are not always written into the contract, but device marketers
usually exercise the right to conduct an audit at any time. Customer audits
generally occur at least once a year.

Audits tend to focus specifically on how quality systems affect the products
owned by the OEMs. During an audit, customers review documentation, such as lot
batch records, and witness the operation and operating conditions. This on-site
observation is their assurance that written procedures are in place and being
followed, and that suppliers are doing what they claim to be doing.

OEMs expect to see adherence to current Good Manufacturing Practices (cGMP)
during the operations and validation processes. They ask to see where raw
materials are inspected and where finished products are stored until delivered.
They also look at whether employees who build their products are qualified and
trained and that the components being assembled come from dependable sources
that consistently meet quality standards.

It makes no difference whether the CM is supplying simple components or
complex assemblies, or if the medical devices are being manufactured
domestically or abroad. Every product sold within the US is subject to
recall.

Because contract manufacturers buy raw materials and some components from
other sources, it is critical that CMs ensure that purchased items meet the
statements written on certification sent with each shipment. Often, when a
project is initiated, new vendors are identified. These vendors are rated based
on capability and qualified in the early stages of the cGMP audit by the CM.
After that, unless their rating declines due to nonconforming material issues
or poor delivery, an annual audit is replaced by periodic reviews of
performance and spot checks to verify material content and processes against
certification.

THE OEM TEAM

Usually an OEM will send a highly trained individual from its regulatory or
quality staff, although many audit teams also consist of personnel from
engineering and purchasing. Some come equipped with an arsenal of checklists
and predetermined questions.

The audit team might meet and interview operators, inspectors and
supervisors at their workstations or visit office to office to follow a
procedure trail. Any employee along the route may be asked to repeat his or her
company’s quality policy. At other times, an audit will be conducted from
a designated on-site room where audited employees are questioned about
procedures and job functions. Documented evidence is retrieved and brought into
the room as requested.

OEM customers usually send advance notice of an audit. Because a contract
manufacturer makes many different products for a variety of customers, it is
best to arrange an audit when the customer’s order is in progress. This
provides a "look-see" approach that can provide clearer answers.

It also allows for certified operators to be present for an interview, and
for the required documentation and equipment, including fixtures, to be at the
workstation. Companies should avoid booking more than two audits in the same
month, and never arrange more than one customer audit at a time; each audit
requires individual time and attention.

Suppliers are often sent a written agenda of the audit plan that includes an
opening meeting at the site. At The MedTech Group, executive management is
present at the meeting to offer assistance in conducting the audit. An OEM
should plan to be on site for one or two days and arrive well-prepared to make
best use of the time available.

Firstly, the results of the previous audit are reviewed. Any corrective
actions required should be completed or have ongoing progress ready for review.
The audit plan may involve a facility tour, starting with an inspection of the
receiving warehouse of raw materials through the sequence of processes to the
final boxing and shipment of products. Often, along the way, the auditor asks
to see "paperwork" or documents that verify the activities of each process or
operation.

"Audit reports help measure internal progress and act as a report card for customer satisfaction."

The spotlight is on the related standard operating procedures (SOPs) and
work instructions of the products supplied by that facility. The audit
concludes with a closing meeting and discussions of any findings, followed by a
written report within a month. The resort may mention specific issues that were
performed well.

If any nonconformance is recorded, the supplier is expected to respond to
the report with a corrective action plan that includes dates of completion. The
supplier is not required to respond to noted observations, but should evaluate
and consider any comments as a basis for future development.

A company with an established quality system should not anticipate any major
changes, but in the spirit of continuous improvement and goodwill, it may
decide to implement a small change to enhance the overall system. The auditor
might follow up on the status of the corrective action plan and corresponding
due dates. In rare cases, the auditor may need to return to the site within the
same year if progress is not satisfactory.

THE FDA AUDIT

FDA audits differ from customer audits in their scope and method. Generally,
routine FDA audits occur about every two years on a predetermined schedule.
There is little advance notice, and the visit may exceed five days. This type
of audit is strictly between the firm being audited (the contract manufacturer)
and the FDA. The agency makes no distinction between the facilities of contract
manufacturers and OEMs.

The FDA focuses on any complaints received from the field since the
plant’s last audit, as well as looking at the firm’s handling of
corrective or preventive actions. An FDA auditor will delve through quality
system documentation, searching for nonconformance with SOPs or product
specifications and negligence in rectifying complaints. Most likely, the
auditor will spend time on the manufacturing floor as part of the search.

An FDA audit triggered as a result of an investigation or recall will be
spontaneous. Agency inspectors arrive with the intention of gathering evidence
and to uncover shortcomings in quality systems that allowed a defective medical
device to be manufactured and released to the public. Because the OEM is
ultimately responsible for that product, the agency’s visit will start
there first, with the investigation extended to the contract manufacturer for a
meticulous audit.

The OEM is not required to be present during the CM audit, although it is
beneficial to be in close contact and be updated at least daily on the progress
and findings of the audit. Both the OEM and the CM should coordinate efforts to
minimise misleading information. Because records are held for the life of the
product, and those documents may reside at either company, faxed copies are
freely exchanged between sites for the auditor’s ready access.

The closing meeting summarises the results or findings of the audit to
management with executive responsibility. This is a chance to discuss and even
challenge nonconformities and discrepancies cited by the auditor. Most likely
the auditor might not have fully understood the answer to a question or was
confused by it. Once the nonconformance is written into the report, the
contract manufacturer is responsible for resolving all outstanding issues.

A successful FDA audit ends with no 483s or warning letters issued to the
firm. There is a legal obligation for the firm to respond to and comply with
the conditions specified by the FDA.

Firms often make the mistake of trying too hard to remember the correct
answer to pointed questions instead of referring to the SOP. It is far better
to consult the SOP for the correct answer than to appear unsure of the
procedure. Auditors, too, can make the mistake of putting the audited on the
defence. The process moves more easily and smoothly if both parties adopt a
cooperative and professional approach.

Audits keep the honest suppliers honest and expose those that do not deserve
your business. It is important to realise that each audit offers an opportunity
for making improvements and brings you one step closer to complete compliance.
Audit reports help measure internal progress and act as a report card for
customer satisfaction. Audits should be used to determine what is considered
important and necessary to succeed in this business.