Introduction

An audit is a systematic evaluation of all processes and process-related documents by which quality evaluation and upholding the product quality as well as the drawbacks of products are identified 1. As per ISO 19011:2018 (section 3.1), an audit is defined as a “Systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled.” 2. The medical device manufacturing industry is gaining many benefits by introducing auditing of the quality process. This auditing is an assurance by which the stakeholders have confidence about the manufacturing process as well the standard of product as per criteria of the marketed standard. Besides this, it also generates confidence about manufacturing-related risks as well as minimizing adverse events of products. When the government offers to guarantee this protection, it becomes expensive to audit and ensure compliance with regulations. In many foreign countries, the governments appointed private auditing systems to reduce budgets as well as met the global market demands for a uniform auditing process. This means medical device manufacturing companies should undergo thorough inspections conducted by international regulatory agencies by which the product and the market are in agreement with GLPs and other regulations. This whole process of inspection is referred to as the term "medical device industry audit” 3. This descriptive, exploratory research study would help the administration and the stakeholders to take a more effective decision, increasing efficacy and enhancing knowledge of the implementation.

The key role of the study where,

• To investigate the costs and benefits of privatization in terms of efficiency and accountability,

• To assess whether third parties are utilized in conducting Food and Drug Administration (FDA) medical device inspections 4.

Objectives & Significant Benefits

In the concern of the health care system, an audit claims the assurance about the proper procedure for caring healthcare management and also handling patient treatment. This type of audit is conducted for ensuring the highest quality available in the health care system. This also helps in minimizing the risk associated with the manufacturing process of the medical device. Thus, it has a great need for establishing secure public health services. Moreover, the audit has a great impact on economic benefits which is associated with the quality of the product as poor-quality products can easily cause injuries and financial loss. Thus, the audit is a symbolic scrutiny of the purchasers about the product behavior as desired 4. An audit tends to the improvement of quality of the product by giving quality information to the buyers which impacts on purchasing decisions and buying value in the market. It is first figured out by Boylan (2000) in which the introduction of auditing and a piece of knowledge about the process which has undergone an audit, improves quality while marketed are included. It also points out the prize protectiveness of buyers because of uncertainty about their asset quality reduction. In economic theory purpose audit is an impactable factor on the market economy and market performance of products 4, 5. Auditing has a both prospective and retrospective impact. The design audit depicts the knowledge about potential failure which leads to an adverse consequence. It also produces valuable knowledge about the prevention of adverse effects, Intelligence gathering. The audit is also helpful for the investigation of invisible risks, the scope of occurrence of emerging problems, compatibility, and non-compliance as well as suggests its remedies 4. According to Sparrow (2000) "despite the potential negative or costly consequences that unfavorable findings have on businesses, audit information, when fed back into the control operation, may be significantly more valuable than the immediate disposition of the failure itself." In visualization of economic and marketing benefits the private sector provides an assurance to the market at a certain level about the quality of medical device products through an oversight audit of the manufacturing process. The ultimate user will be benefited and can demand such improvement which will help in reducing upcoming emerging problem 5. Thus, the audit can be a key factor in controlling adverse event as well as it also reduces public vulnerability about the adverse effects. Besides this, it also minimizes unethical business practices which could result in monetary loss 5, 6.

Regulation of Medical Device

The medical device has complex regulatory regulations as it engaged with third-party involvement and it has a great impact on the clinical perspective and safety of patients 7. The new device must have to be passed in conformity assessment before introducing as well as after placing in the market for checking the uniformity of quality 8, 9. The post-marketing surveillance is also needed for checking the quality standard from time to time. This should be done by the individual manufacturing company for maintaining the quality up to the mark 10. Medical devices are very much diverse in product nature. Thus, the categorization is based upon specific needs and is different from one another 11. Different regulatory authorities have different categorizations of medical devices as per their need. Mainly it is categorized based on some factors like – device failing chance, potential hazard associated with the device, degree of invasiveness etc 12. Generally, according to the level of risk, the class of medical devices is determined which is higher the risk – the higher the class of device 13. The regulatory bodies are globally recognized most are:

• EC Medical Device Directive 93/42/EEC

• US Food and Drug Administration regulations

• AAMI HE74:2001: Human Factors Design Process for Medical Devices

• IEC 60601-1-8:2003 (Medical electrical equipment – Part 1-8: General requirements for safety - Collateral standard: General requirements, tests and guidance for alarm systems in medical electrical equipment and medical electrical systems)

• ISO 14971:2000, Medical devices – Application of risk management to medical devices(2003)

• BS 7000-6:2005 Design management systems, Managing inclusive design 14, 15, 16.

Steps of Conducting of a Medical Device Audit

The manufacturing company performs an official audit program through its internal audit service for identifying the areas where potential risk can occur. This audit service performs a brief risk assessment program in all the departments including operation units, maintenance units, storage facilities, as well as all the managing departments. Based on this audit report and audit approval committee will deliver a full-proof audit plan to face external auditing bodies. This audit plan indicates the high-risk factor associated with manufacturing as well the maintenance. Besides this, it also addresses the time limit for fulfilling these types of gaps. Special projects on the respective domain will be generated by this plan to conceal the gaps. During the invested years the analyzing data about risk assessment will be updated from time to time by continuous interviews of executives and detailed data analysis by which the audit plan can be modified if there is a need 17. The generic way of systematic audit implementation having the following steps. This are-

• Initiation,

• Scope,

• Frequency,

• Preparation,

• Review of documentation,

• The programmer,

• Working documents,

• Execution,

• Opening meeting,

• Examination and evaluation,

• Collecting evidence,

• Observations,

• Close the meeting with the auditee,

• Report,

• Preparation,

• Content,

• Distribution,

• Completion,

• Report,

• Submission,

• Retention of the audit report 18.

There are seven general steps for conducting an audit process going to be discussed though there can be a slight variation for respective companies.

Planning

The audit must be well planned by which every person can take part with firm confidence and preparation. Both the respective management and the auditor should meet up at a certain level of agreement on the objective, planning, and engagement of the process of auditing after a successful compilation of negotiation and appointment. It can be coined as an Internal audit process though the auditor can be external or the employee of that company itself. This is done as a trial of preparation for an external audit. The auditor must have complete access to all accounts for a detailed analysis and paperwork and he must be done this complete audit process in a given time frame. This is briefly scheduled by which every stakeholder and employee can assume the time frame and be ready with proper documentation 19.

Requesting financial documents

A primary list of documents which will be a first step of scrutiny of documentation. The auditor can further draw up more document lists as per requirement. It can be asked for previous auditing documents such as ledger, receipts, banking documents, relevant charts of board meetings, etc. The detailed audit plan will be drafted after complete scrutiny of provided documents.

Open meeting

An open meeting between senior management, the administrative department, and the auditor may be conducted by which the details of the audit plan scope, objectives, and the problem zone may be discussed. In this open meeting, the time of the audit and the information about the types of questions and interviews going to be faced by the employees are informed in front of the authority 20, 21.

On-site work

The business-related transactions and all kinds of business records would be examined by the auditor on any random date to find anomalies. If the auditor is primarily satisfied with the data, then a deep analysis of all the records will be conducted for obtaining more accurate details. If any kinds of doubt or miss-match are observed, a brief interview session will be taken place with the involved people for a satisfactory answer.

The accounts as well as the transactions are verified and thoroughly examined for accurate maintenance control of accounts. Besides this, it is also readily checked the presence of the internal control system and it’s working 22.

Draft report

Based upon the thorough inspection the auditor will put a draft report before management, indicating financial mismanagement, fraud category, and false accounting policies if present. The report also contains proper suggestions and corrections provided by the auditor for improving the efficacy and productiveness of a company.

Additional requirements

If the auditor feels more additional information, then a request for more materials is generated from the auditor. If this information is well enough, a change draft report can be made. Noted that after the compilation of changed draft steps, the auditor report will be in final form and it cannot be corrected further 22.

Publishing report

This is the final step in which the finalized report of the auditor is published to state the outcome of the audit. It is presented to the management authority and completely reviewed by them before making it public 23, 24 [Figure 1].

Types of Medical Device Audit

There are several regulatory bodies are present that are responsible for regulating the law related to medical device manufacturing. The main global bodies are such as:

• Audits by EU Notified Bodies

• FDA audits

• Unannounced audits

• Internal audits

EU Notified Body

In the European Union division medical device manufacturing companies are being categorized. By the given categories they must have gone through the audit. The regulatory bodies will recognize the respective company against the regulations MDR 2017/745 or IVDR 2017/746 for marketing. This also addresses the company's QMS against the requirement of ISO 13485:2016. If it is obtained by a company then it's indicated that the QMS of the respective company is well established and the company is eligible for marketing in the EU legally 25.

Unannounced Audit

An unannounced audit having the main concern with a specific product of a company in most cases. Besides this, an unannounced audit by regulatory bodies will increase the frequency of classification of medical devices manufacturer. It is organized at least once every three years to evaluate the risk associated with the products. It is done without prior notice to the company. The auditor from the regulatory body will introduce themselves on the company premises and has full authority of access to visit the restricted area and all documentation. If any kind of non-conformities related to the design, manufacturing process, or storing, are identified by the regulatory auditing authorities, immediate action will be taken as per instructions provided by the auditor to correct the problem. This will also implement in changing the SOPs manual depending on the depth of the problem 26.

FDA Audit

In the USA the government agency named USFDA (United States Food and Drug Administration) is responsible for inspecting medical device manufacturers. The standard speciation of inspection is as per FDA 21 CFR PART 820. The FDA inspection has four different categories for the conduction of audit of the medical device manufacturers. These are such -

Pre-Approval Inspections (PAIs) – This type of audit is done against the application of launching a new drug product by a company. This will inspect the database, manufacturing capability, and facility of a manufacturing company.

Routine Inspections- It is required for Class – II, and III device manufacturing companies in every 2 years. This method is coined as the ‘Quality System Inspection Technique (QSIT)’. Compliance Follow-Up Inspections- This kind of inspection is done for reviewing the progress against the previous inspection or issuing a warning letter. “For Cause” Inspections- This kind of inspection is done for investigating a specific problem reported to FDA by consumers or manufacturers 25, 26.

Internal Audit

The internal audit is a valuable parameter for the continuous improvement of productivity as well as for ensuring documentation. So internal audit is upholding efficacy and maintaining quality. It is done as per ISO 13485 and FDA 21 CFR Part 820. According to ISO, an internal audit is needed for correct documental arrangement and well-planned document gathering and storing. Not only is this the internal audit needed to verify the regulatory requirements and standard implementation and maintenance 26, 27.

Audit Execution Process

The conduction of an audit in any medical device manufacturing company can be done in one of three ways as following-

• On-site audits

• Remote audits

• Self-audits

On-Site Audits

This kind of audit is done after stage- I of the certification audit. In this stage, the respective company’s managing employees to all involved staff are interviewed. All documentation must be in ready condition for verification by the regulatory authority. It is actually a physical verification of the company according to their claim for fulfilling regulatory requirements.

Remote Audits

The remote audit is quite similar to the on-site audit. In this kind of audit, the auditor is connected through different technology for reviewing documents, conducting interviews with the staff, and attending presentations.

Self-Audits

This kind of audit is a type of internal audit as a part of maintaining quality standards as per regulatory standards by each of medical device manufacturing company. This ensures organized documentation and a valid effective QMS. This kind of audit is executed by employees who are not directly involved in the respective manufacturing process matter 28 [Figure 2].

Preparation of Medical Device Audit

To face off an audit a lot of preparations are needed for a medical device manufacturer. It started with sorting documentation to the interview phase preparation and interrogation. Generally, it’s based upon four major pillars. These are:

• Reviewing All Documents

• Prepare an Audit Plan

• Train the Team and Delegate Responsibilities

• Get Ready for Both On-Site and Remote Auditing

Reviewing All Documents

The company must go through the previous audit reports and suggestions and also review the effectiveness of the running system and verify the documents. It is not only needed to verify all main documents like the design of the machine, drive master file, batch records, standard operating process, controls and change controls, and device record history but also needed to prepare all the supporting documents. The supporting documents should be easily accessible during the audit process 29.

Prepare an Audit Plan

An audit plan is one of the most effective parts of audit processing by which the type of audit and the level of successful audit conduction are determined. The management should prepare an effective outline of the audit plan including the types, stages, and levels of certification factors.

Train the Team and Delegate Responsibilities

The employees should have proper training by which they can deliver a potential answer to the auditor. So, the training session is an essential part of the audit proceeding. The authority should provide relevant tasks by which the employee can accumulate practical experience and they should know about the audit plan 30, 31.

Get Ready for both On-Site and Remote Auditing

The company should be ready to face off both on-site and remote auditing. So, the preparation of physical documentation as well as soft copies of relevant documents must be in ready mode to submit anytime during the audit process as per requirement. In a pandemic situation or distance factor, the online mode is taken place in most cases. Both in online or remote auditing, the auditor’s responsibility as well as the company’s approach should not be casual. For remote auditing, the respective company should have a relevant digital platform for conducting the audit process 32.

Process-Based Auditing of Medical Devices

The QMS is an important effective tool that acted as a control mechanism that is responsible for preventing any kinds of deviations related to the use of medical devices. It is also important for isolating the root cause and prevention and takes the proper implementation of CAPA. The auditor should evaluate the QMS effectively, self-regulation, and the structure of QMS 33.

Plan: The planning depends upon the level of establishment of QMS for obtaining a standard report fulfilling the regulatory requirement.

Do: The auditor must check if the manufacturer follows the QMS or not.

Check: The auditor must check if the manufacturer evaluates its present QMS and regulatory requirements. As the medical device is a sensitive product the continuous evaluation process is a must need for manufacturing. So auditor must evaluate the effectively and management review of QMS from previous internal audits.

Act: The auditor must need to verify the CAPA for maintain the quality of medical devices conforming the laws and regulations 34, 35 [Figure 3, Figure 4].

Problems solving pathway via audit process – Ishikawa diagram

The Fishbone diagram (also called the Ishikawa diagram) is a tool for identifying the root causes of quality problems. It was named after Kaoru Ishikawa, a Japanese quality control statistician, the man who pioneered the use of this chart in the 1960's. The Fishbone diagram is an analysis tool that provides a systematic way of looking at effects and the causes that create or contribute to those effects. Because of the function of the Fishbone diagram, it may be referred to as a cause-and-effect diagram. In the medical devices audit the fishbone diagram is used to identify the problems associated with medical devices arisen during treatment procedure. This is also helpful to neutralize the problem by providing indication about the solution 36.

Importance of the Audit of Medical Device

• The final audit report is a complete validation of each and every system involved in manufacturing medical devices. Besides this, it also provides necessary support to obtain financial benefits for the company and the stakeholders. It also helps to make records up to date and well preservation of database 37.

• The audit report informed about the management inside the company as well as it states the relationship with the employees and provides a brief idea about the mental state of their workers before the authority 38.

• Regular audit in the medical device manufacturing sector lowers the risk of below-quality production, storage problem, and overproduction.

• It also helps to identify errors and can have a brief idea about emerging sectors of futuristic problems 39, 40.

• The audit thus can be a system checker of the whole manufacturing process, management, quality issues, and marketed risk 41 [Figure 5].

CONCLUSION

Being in the medical devices industry, it should understand that the products touch the lives of multitudes of people across the globe. Hence, the company must abide by the highest industry standards. This is ensured by being certified by international regulatory agencies and standards such as the US FDA 21 CFR Part 820 and ISO 13485:2016.

Funding Support

The authors declare that they have no funding support for this study.

Conflict of Interest

The authors declare that they have no conflict of interest for this study.