Unannounced Audits – the Future of ISO?
The European medical device regulations are currently being redeveloped. Major changes are being considered for all if not most aspects of it. They are taking a pragmatic look at anything that has been criticized as ineffective. This will mean big changes to anyone selling medical devices into Europe. One topic that has been brought up is unannounced audits of ISO 13485 management systems. While specific plans are unclear at the moment, it is expected that organizations that sell medical devices are subject to normal, planned ISO audits but also periodic unannounced audits on a specific schedule. This may mean that in addition to your planned surveillance audit you also receive an unannounced audit. It might mean that in the second year you don’t get a scheduled audit but instead receive an unannounced audit. Perhaps more likely is that you will receive an unannounced audit at least once during the validity of your medical device certificate (currently 5 years but expected to change to 3). It does mean more auditing and it does mean audits that might yield more telling results.
The problems with this don’t only lie with the manufacturers. The certification bodies will have to plan and schedule (with a new secret system) and if the audits are in addition to existing planned audits there will be a resource problem – finding appropriate auditors. To make it worse, it is currently thought that it will be required that two auditors attend the unannounced audits – a management system auditor (13485) and a technical specialist (device auditor). This will add to the complications experienced by the certification body.
All of this is very nice and assuring to consumers – but who pays. As at the moment, the device manufacturer pays. Technically this keeps the cost at the source but it is still additional cost. Unannounced audits for vendors and suppliers are also being discussed. The costs are likely to be a debate between the device manufacturer and their suppliers. But one way or another the manufacturer pays….as does the consumer eventually.
There is no attempt here to discuss whether in fact unannounced audits are in fact effective. What if the auditors show up and the quality manager is on vacation? What if the company is on shutdown?
And so what does this mean for ISO? If unannounced audits prove to be successful we may see the approach adopted by Aerospace and Automotive. That would be all the leaders of the QMS (9001) market. That would put pressure on the accreditation agencies to push for it generally. It could happen. However, even if the stars align for this, the accreditation agencies have enough trouble getting certification bodies to do a good job of planned audits. This is an interesting development to watch but nothing to worry about for ISO 9001 organizations. If you are ISO 13485 certified and/or supply medical device manufacturers – keep a keen eye out. This is coming.