Unannounced audits are no surprise when you are truly ready

Of all the requirements and audits that medical device manufacturers know, there is one that makes many of them a little uncomfortable, and that is the unannounced audit. This is not another audit planned well in advance with weeks of preparation. It is an audit that happens without any warning, sometimes on the least convenient day.

That is exactly why it is important to understand that unannounced audits are not just another tool of the notified body. They are a formal regulatory requirement, and they come to check the real thing, the way it runs day to day.

Wait, what is an unannounced audit?

An unannounced audit is an audit that the notified body performs without any advance coordination with the manufacturer or the supplier. The auditors simply arrive at the site, whether it is the main manufacturing plant or a subcontractor, to check that the product is actually manufactured in line with the technical documentation and the regulatory requirements, under normal working conditions and without advance preparation.

The focus of this kind of audit is the product itself and its manufacturing process. Unlike regular certification audits, which look at processes and system-level documents, here the auditors want to see that the product coming off the production line right now matches what was approved.

The regulatory requirements are not a recommendation

The need for unannounced audits did not start with the MDR. As early as 2013, the European Commission published a recommendation encouraging notified bodies to perform unannounced audits. When the MDR and the IVDR came into force, this requirement became a clear obligation:

• Every manufacturer that holds a quality management system certificate under the EU MDR or IVDR must undergo at least one unannounced audit every five years.

• The audit can also take place at subcontractors or suppliers involved in manufacturing.

• The purpose of the audit is to check actual conformity with the technical documentation, including sampling and testing of real products.

In addition, the notified body may perform an unannounced audit in response to an event that came up in vigilance reports or in other post-market information.

What does an unannounced audit look like from the notified body's side?

Even though the audit is not coordinated with you, the notified body has a very orderly process that starts long before anyone arrives on site:

The preparation stage (which happens behind the scenes):

1. Selecting the products to be checked from all the products covered by the quality certificate.

2. Defining a test protocol based on information from previous audits, the technical documentation or the risk analysis.

3. Selecting the site, which can be the main site, a subcontractor or a supplier, depending on where the critical part of manufacturing takes place.

The audit itself

• Two auditors arrive at the site without warning.

• A short opening meeting is held.

• Samples are taken from actual production, from finished products or even from the market.

• A full traceability check is performed, from the components through to the records.

• The tests can be performed on site or sent to a recognized external laboratory.

• At the end of the audit there is a closing meeting, and a preliminary report is handed over.

After the audit

• Test results (if the tests were done externally) are sent later.

• Any nonconformity that is found, even if it was found at a supplier, is the full responsibility of the manufacturer.

How can you prepare for something that is meant to be a surprise?

The answer is simple. You do not need to prepare even one day ahead; you need to maintain ongoing readiness.

Here are practical steps every manufacturer and supplier can take:

1. Inform the notified body in advance about times when the site is closed, such as holidays, vacations and maintenance shutdowns.

2. Explain to employees what an unannounced audit is. When they understand that it is part of the routine, they respond with cooperation rather than stress.

3. Prepare your critical suppliers and service providers, especially those involved in assembly, processing or quality control.

4. Keep your documentation up to date and accessible, especially the technical documentation, procedures, production records and traceability records.

5. Consider an internal exercise. A mock audit done once a year can expose weak spots before the notified body does.

In summary

Unannounced audits are not "just another regulatory requirement". They are a reality check: does the company really work the way it commits to in its technical documentation, and does quality hold up even when nobody is watching?

A successful unannounced audit is proof that the quality management system really works and does not only exist on paper. A company that stays ready as a matter of routine has nothing to fear. Quite the opposite.