FAQs: Unannounced Audits

What exactly is meant by the word “unannounced”? Will any prior notice be provided?

There will be no prior notice for any unannounced audits conducted. However, TÜV SÜD has sent a general notification regarding the start of its unannounced audit program to its clients. Click here [ PDF 2417 kB ] to view the notification letter. TÜV SÜD will continue to keep manufacturers updated with the latest information through our unannounced audit webpage.

Why don’t the unannounced audits and their respective man-days count toward surveillance audits?

This was once under consideration by the European Commission. However, the scope of unannounced audits is considerably different from routine surveillance and recertification audits. Unannounced audits are much shorter and are focused on products while surveillance audits are focused on quality management systems. Therefore, the European Commission decided that unannounced audits should be conducted in addition to the regular auditing program.

Will other Notified Bodies that offer European Certification also conduct unannounced audits?

Unannounced audits have to be performed by all Notified Bodies for manufacturers of devices under the MDD, AIMDD, or IVDD.

Will the export of products to the EU be prohibited depending on the result of an unannounced audit?

The unannounced audit will play an important role in maintaining certification of a manufacturer regarding the European Medical Device Directive. Therefore, it is possible that certification can be suspended based on the result of an unannounced audit. Placing products on the European market would have to cease until the certification is valid again. The nonconformities handling procedure is the same as current practice.

What can I do to keep informed with updates regarding unannounced audits?

For the latest updates regarding TÜV SÜD’s unannounced audit program please visit our unannounced audits webpage.

For general updates regarding unannounced audits and other regulatory developments, please subscribe to our email newsletter here.

Why are unannounced audits mandatory now?

The European Commission Recommendation (2013/473/EU) outlines the importance of verifying the continuous day-to-day compliance with legal obligations. Therefore, the European Commission expects Notified Bodies to perform unannounced audits in addition to product assessments and quality system assessments. The Recommendation has been accepted by all Member States.

What are the regulations that empower Notified Bodies to conduct unannounced audits?

The Medical Device Directives (for example Directive 93/42/EEC Annex II, No. 5.3) empowers Notified Bodies to facilitate unannounced audits where necessary.

The new European Commission Recommendation 2013/473/EU also provides detailed requirements for unannounced audits.

Please refer to the TÜV SÜD Testing and Certification Regulations, section B1-2.7.2:

"The certificate holder shall ensure that the Certification Body can inspect the manufacturing and business premises listed on the certificate and the relevant warehouses of their representatives, importers and branches at any time during standard business hours and without prior notice."

Please also refer to section C1-11 to B2-3.4 which states "Unannounced audits may be conducted without any specific cause…They may be conducted in addition or instead of a regular audit."

How does the European Commission define "products" in relation to the recommendations for sampling?

The European Commission Recommendation refers to "device types" to be sampled. TÜV SÜD regards "device types" to be defined by the maximum configuration, a list of components/sub-assemblies plus a description of how the models are constructed from the maximum configuration and list. All models which are included in the device type typically have a common design, construction, parts, or assemblies essential to ensure conformity with applicable requirements.

For the same device, there may be differences in defined device types that are dependent upon the same nature or type of the compliance criteria applied (e.g. area of application [intra-cardiac catheter], application range [bone screws], safety, EMC, performance, effectiveness, etc.). In the context of a specific standard, if the product standard defines a device type, this definition takes over.

Where can I read or download the European Commission’s Recommendation (2013/473/EU)?

You can find the link to the European Commission Recommendation (2013/473/EU) here.

Does the European Commission Recommendation only apply to legal manufacturers located in Europe?

No, unannounced audits apply for all EC Certificate holders (legal manufacturer), regardless of whether the manufacturer resides in Europe or outside the European Economic Area (EEA).

Which manufacturers are subjected to unannounced audits?

Unannounced audits apply for all EC Certificate holders (legal manufacturers), regardless of whether the devices are covered under the MDD, AIMDD, or IVDD.

If a manufacturer holds EC Certificates under MDD and IVDD, does the manufacturer need to have different unannounced audits for each directive?

The unannounced audits will focus on a particular product, regardless of whether the device is regulated under the MDD, AIMDD, or IVDD. TÜV SÜD will not plan unannounced audits for each EU directive separately.

My company manufactures In Vitro Diagnostic (IVD) related products. Will we be subjected to unannounced audits?

Unannounced audits apply for all EC Certificate holders (legal manufacturer), regardless of whether the devices are covered under the MDD, AIMDD, or IVDD.

Our company has several product lines and/or several manufacturing sites. What products and what sites will be subjected to an unannounced audit?

TÜV SÜD uses a dynamic calculation method to determine the frequency of audits that a particular manufacturer will receive. This method is designed to ensure that larger manufacturers with multiple products and sites receive a fair share of unannounced audits. However, careful consideration is given such that manufacturers are not overly burdened by unannounced audits.

Our company holds an EC Certificate. However, we are an Original Equipment Manufacturer (OEM) producer for another company. Do unannounced audits apply to us?

Yes, unannounced audits apply for all EC Certificate holders (legal manufacturers), regardless of whether the devices are sold under the manufacturer’s own brand name or as an OEM product.

We hold an EC Certificate to export our products to countries outside of the EU. We do not export to Europe. Will we receive unannounced audits as well?

Yes, unannounced audits apply for all EC Certificate holders (legal manufacturers), regardless whether the devices are placed on the European market or outside the European Economic Area (EEA).

When will you start performing unannounced audits?

TÜV SÜD started its unannounced audit program in April 2014. Manufacturers with EC Certificates from TÜV SÜD should be prepared for an unannounced audit as early as Q2 2014.

What is the maximum amount of time between unannounced audits?

The European Commission Recommendation states that "Notified Bodies should carry out unannounced audits at least once every third year". Therefore, unannounced audits have to be performed once in 3 years at a minimum.

How should we verify and authenticate the auditors when they show up on our premises for an unannounced audit?

Verification and authentication of the auditor is a very important step that manufacturers must take in order to safeguard themselves. Please ensure that you verify and authenticate everyone who is present on your site to conduct an unannounced audit.

TÜV SÜD has a very clear process for verifying and authenticating the auditors:

• Upon arrival of the audit team on the manufacturer’s site, an authentication letter is handed to the manufacturer by the audit team.
• The manufacturer can contact their local TÜV SÜD contact person/office and ask for a verification of the unannounced audit, based on the information provided in the authentication letter.
• Upon request, a copy of the authentication letter can be faxed or e-mailed to the client.

Please ensure that the auditor is a genuine TÜV SÜD auditor prior to starting the audit. The responsibility lies with the manufacturer to ensure that the auditors are genuine by following the steps outlined above.

What happens during an unannounced audit?

There are a few aspects to consider when preparing for unannounced audits. A team of at least two auditors will be on site for at least one full day. An unannounced audit may last multiple days.

Mandatory elements to be audited in all unannounced audits include:

• Conformity of selected device with the technical documentation and with legal requirements
• Traceability of all critical components and materials
• Traceability system
• Conformity of the following with legal requirements:
• Manufacturing activity ongoing at the time of the unannounced audit
• Manufacturer’s documentation relevant for the manufacturing activity

In addition to mandatory processes, the unannounced audits will focus on a particular product. A product sample will be chosen during the unannounced audits for further inspection and testing. Product testing will not be mandatory for quality management related certificates (Please refer to Q25 for more information).

Key processes such as design control, establishment of material specifications, purchasing and control of incoming material and components, assembling, sterilisation, batch release, packaging, and product quality control will be selected and carefully examined. This list is not an exhaustive list and other relevant processes may be examined as well.

A specific test plan can be set up by the Notified Body prior to the unannounced audit:

• The Notified Body may take product samples with them for further testing.
• In the event where critical processes are subcontracted or if critical parts are purchased from a supplier, the Notified Body may also conduct an unannounced audit on the facilities of critical subcontractors and critical suppliers.

Will the auditors for unannounced audits be the same as our normal auditors?

The auditor may or may not be your usual auditor(s). Unannounced audits are different from surveillance audits and therefore different auditors may be involved in conducting the unannounced audit.

What happens if major noncompliances are detected during an unannounced audit?

The manufacturer will receive an Audit Finding List and will be given at maximum 60 days to respond to the nonconformities and present the root cause analysis, correction and corrective action plan or implementation. This procedure is in line with current practice.

What happens if I do not allow the auditor to enter the company?

The audit team will document this in the audit report and recommend that the certification board suspend the certification in question.

Will we receive a statement that the unannounced audit was performed? What confirmation will we receive from TÜV SÜD after completing the unannounced audit?

The manufacturer will receive a Confidential Audit Report and, if applicable, an Audit Finding List.

Is testing mandatory for unannounced audits?

For quality management related certificates, testing is not mandatory. However, testing may occur if the unannounced audit team has reasonable doubts about the conformity of the device type(s). The performed test(s) may include additional testing in line with Section 4 of Annex III of the European Commission Recommendation 2013/473/EU.

For product related certificates where the manufacturer has applied for a design dossier examination or for a type examination (product assessment), Notified Bodies should perform testing in line with Section 4 of Annex III of the European Commission Recommendation 2013/473/EU.

When testing a product sample, would it be sufficient that testing is done on-site with the TÜV SÜD auditor as a witness?

Yes, on-site testing with the TÜV SÜD auditor as a witness might be sufficient if tests can be performed on-site.

Other options include the testing of samples by our laboratory or by qualified personnel under one of the following:

• Under TÜV SÜD observation on TÜV SÜD premises
• On the manufacturer’s premises
• On the premises of the manufacturer’s critical supplier
• In qualified external laboratories

If an auditor decides to take an expensive product for off-site testing, will the product be returned in its original condition? Will we be reimbursed for the product?

If it is possible to perform tests on raw materials, intermediates, components or unfinished products, these tests will take place instead of destructive tests on final devices. The device acquisition and its testing will be financed by the manufacturer.

Please refer to the TÜV SÜD Testing and Certification Regulations, Module B1 Special Regulations for product testing and certification.

What criteria do Notified Bodies have for selecting the products that will be sampled?

Notified Bodies may select products which have a high likelihood of nonconformity. Other reasons may include:

• Media reports and news about malfunctions
• High risk devices
• Noncompliant products
• Information from the market based on malfunctions of similar products
• Information or inquiries from the authorities
• High rate of device noncompliance

How will sampled products be tested?

Testing of device conformity will be done in accordance to ANNEX III Section 4 of the European Commission’s Recommendation 2013/473/EU, with the main focus on the safety and performance of the device. Possible tests include:

• Microbiological safety testing
• Mechanical safety testing
• Packaging testing
• Performance testing
• Electrical safety testing
• Functional safety testing
• EMC testing

How will the manufacturer be involved in the unannounced audit during the testing of components?

When testing components on the manufacturer’s premises, the manufacturer will use its own personnel and laboratory test equipment while the personnel from TÜV SÜD will supervise the tests.

Can the manufacturer’s products, subassemblies or components be sampled at their supplier’s premises?

The European Commission Recommendation requires performing tests at the premises of critical subcontractors or crucial suppliers. Testing could even be performed on devices installed at a customer location. But samples may only be taken at the site of the supplier with the manufacturer’s consent.

What will determine whether a product will be tested on-site or off-site?

If products cannot be tested on-site during audit or if the product cannot be tested on-site for technical reasons, the following options are available:

• If samples are available and can easily be shipped to our laboratories and tested in our laboratories, the device will be sampled during an audit for later testing.
• If samples are available but difficult to be shipped out or if they are difficult to be tested in our laboratories, the tests will be performed on the selected device at the manufacturer’s, operator’s (such as a hospital), or critical supplier’s premises as arranged by the manufacturer.
• If there is no certified device type manufactured at the time of the unannounced audit. Test samples will be bought on the market and shipped to our laboratories.

How will testing be conducted on products that do not have a finalised sample?

If sampling at the manufacturer’s premises is not possible, Notified Bodies should take samples from the market, if necessary with support by the competent authorities, or should perform testing on a device installed at a customer location.

If it is possible to perform tests on raw materials, intermediates, components or unfinished products, these tests will take place instead of destructive tests on final devices.

What happens if the on-site test results are different from the results provided by the manufacturers?

If the test results play an important role in the safety and performance of the device, a recommendation of suspension of its certification will follow if the results deviate negatively when compared to the manufacturer’s data.

What is the definition for a critical subcontractor and crucial supplier?

TÜV SÜD regards the terms to be a synonym for "critical supplier" as defined by various regulations. Please refer to NBOG BPG 2010-1 and GHTF SG3/N17/2008, EK-MED 3.9 B 16 for more information.

Which critical suppliers and crucial subcontractors will be likely candidates for unannounced audits?

Examples of candidates for unannounced audits may include:

• Original Equipment Manufacturers (OEM)
• Suppliers or subcontractors involved in the design and development of medical devices or software development
• Suppliers or subcontractors providing processes which require a validation as sterilisation, sterile packaging, virus inactivation
• Suppliers or subcontractors providing critical raw materials that are not fully verified by receiving inspection and testing, e.g. component or raw material for an implant, animal tissue materials

What happens to the manufacturer’s certificate if a critical supplier or a crucial subcontractor refuses the unannounced audit?

In this event, it must be assumed that the device may be noncompliant and suspension of certification for the concerned devices is a possible consequence.

Could a supplier audit be a substitute for an unannounced audit at the manufacturer’s site?

The unannounced audits are always performed for the legal manufacturer regardless of which site or critical supplier will be included in the unannounced audit. There are no unannounced audits performed at suppliers that are not part of an unannounced audit for a legal manufacturer.

Depending on the individual case, the unannounced audit may be performed only at the premises of the critical supplier.

Who will incur the expenses if audits occur at the critical subcontractors’ and crucial suppliers’ premises?

There is no separate quotation for unannounced audits for critical subcontractors and crucial suppliers. The expenses for these audits are borne by the manufacturer.

Has sharing a single audit for a common supplier been considered by Notified Bodies? Has there been any effort to establish a communication plan between Notified Bodies regarding planned unannounced audits to avoid overlap or multiple audits?

This is an approach that is being considered by Team NB, but the subject has not been finalised yet. To be considered is the fact that the unannounced audit has to be product related and therefore it is not ensured that results gained during other audits are transferable.

Additionally, there might be different approaches taken by different Notified Bodies and the audits may not be transferable.

Does the manufacturer need to inform TÜV SÜD of supplier shutdowns?

No. To date, there has been no official requirement established for the manufacturer to provide this information.

During routine audits, auditors would routinely assess which of the manufacturer’s suppliers might be good options for unannounced audits and may ask for the shutdown information for those particular suppliers.

Many suppliers have proprietary processes and systems. Without a direct relationship (including a Confidentiality Agreement) established between a Notified Body and a firm’s supplier, how do Notified Bodies plan on conducting unannounced audits of proprietary processes?

The unannounced auditing of critical suppliers has to be ensured by the legal manufacturer in respective contracts with their supplier. If a particular supplier asks for a Confidentiality Agreement with TÜV SÜD, such an agreement can be provided by TÜV SÜD. Only the template provided by TÜV SÜD for such a Confidentiality Agreement can be used for this purpose and not any template of the supplier or manufacturer.

Our company occasionally experiences temporary periods of closure. This may be due to holidays, company trips and other reasons. What happens in the event when we receive an unannounced audit during a period of closure? Will additional expenses be incurred as a result? What can be done to avoid such a scenario?

Manufacturers are required to notify TÜV SÜD regarding any closures to any of their sites. If the notification is done in a timely manner and in advance, there will be no additional expenses such as cancellation fees for transportation and accommodation.

What happens when our manager on duty or other relevant staff is not present during an unannounced audit?

Manufacturers are responsible for implementing policies and procedures to ensure that all relevant staff required for an unannounced audit are available within a short notice. In the event that relevant staff is on leave, covering persons should be assigned as substitutes.

What would happen if my company is already engaged in an audit with another authority or Notified Body on the day that TÜV SÜD visits for an unannounced audit?

The TÜV SÜD unannounced audit will not be scheduled in conflict with other audit activities by TÜV SÜD. If the TÜV SÜD unannounced audit coincidently takes place at the same time as another audit or inspection, the TÜV SÜD audit team will perform the unannounced audit and consider the lack of on-site resources and availabilities.

What happens if I do not allow the auditor to see all the processes that are used for manufacturing the product certified by TÜV SÜD?

The audit team will document this in the audit report and recommend to the certification board the suspension of the certification.

How will the quoting for unannounced audits work?

Individual unannounced audits will not be quoted in advance. You may contact your regular audit coordinator at TÜV SÜD and ask for a generic cost estimate of an unannounced audit at your site.

Who will incur the expenses related to unannounced audits?

The incurred expenses will be charged to the manufacturer´s account.

What party will incur the travel expenses of the auditor? If the client incurs the cost, will the client know in advance the cost of the expense?

The manufacturer incurs the travel costs and expenses. The travel costs are usually in the same range as regular audits.

What party will incur the expenses involved in transporting test samples?

Test samples, if taken at the premises of the manufacturer, will be shipped by the manufacturer at their expense.

Who will incur the cost of sampling and testing?

The manufacturer will incur the costs of sampling and testing.

What language will the unannounced audits be conducted in?

The audit language usually follows the local language of the auditee. TÜV SÜD documentation, however, is either in English or German. This is needed for our internal certification process and for our accreditation needs. In addition, the documentation for our clients may be in the local language as well.

If the unannounced audit is conducted in English, will TÜV SÜD provide a translator?

Whenever possible, an auditor capable of performing the audit in the local language will be chosen. Otherwise, English is the audit language. In rare cases where the company has no translator available, TÜV SÜD will engage a translator, with the costs being charged to the client.

My facility is in a country where a visa is needed. How will TÜV SÜD handle this situation?

First, TÜV SÜD will utilise local auditors, whenever possible, who do not require a visa. If the audit team requires a visa and we need an invitation letter for the visa application, we will request a "non-dated" Invitation Letter in advance.