ISO 13485 · Expert · 14 min lesson
Notified body audit conduct: unannounced audits, sampling and nonconformity handling
EU MDR 2017/745 Annex IX sections 2 and 3 (including 3.4), Annex VII section 4, Article 56; Commission Recommendation 2013/473/EU; ISO 19011 audit principles
What you will learn
- Explain how a notified body samples processes, products and suppliers and how it grades what it finds.
- Prepare the organisation for an unannounced audit, from the front desk to the records room.
- Respond to notified body nonconformities with containment, root cause and corrective action inside the deadline.
Key takeaways
- A notified body samples processes, devices and critical suppliers, and treats the sample as typical of the whole process (Annex IX, Annex VII section 4).
- Annex IX section 3.4 requires unannounced audits at random, at least once every five years, with no prior notice.
- Readiness means a named duty manager, a records index and a rule that no record is hidden or rewritten.
- Grades are set by the notified body procedure; they rest on evidence, extent and risk, and are changed by evidence.
- A response has containment, extent, root cause, corrective action and an effectiveness check, with evidence attached before the deadline.
Free practice question
Two auditors from the notified body arrive at Marlow at 08:30 with a letter of authorisation and no appointment. The reception clerk says the quality manager is abroad and asks them to come back next week.
What is the correct view of the clerk response?
Acceptable, because audits need an appointment.
Not quite. Annex IX section 3.4 provides for audits without notice, so an appointment cannot be demanded.
Not acceptable: unannounced audits are provided for by Annex IX section 3.4 and the company should verify the letter and call the duty manager.
Correct. Section 3.4 provides for audits with no prior notice, and QP-27 style arrangements make the response orderly.
Acceptable, if the auditors are offered a tour instead.
Not quite. A tour is not the audit access that the contract and Annex IX section 3.4 require.
Not acceptable, because the auditors must be sent away at once.
Not quite. Sending auditors away is the opposite of the required cooperation under Annex IX section 3.4.
Key terms
- unannounced audit: An audit performed by the notified body without prior notice, at random and at least once every five years (Annex IX section 3.4).
- surveillance audit: A planned audit after certification to check that the quality system continues to meet Annex IX.
- sampling: Choosing a part of a process, record set or product range to draw a conclusion about the whole.
- major nonconformity: A grade used by many notified bodies for a requirement not met with possible effect on conformity or safety; defined by the body procedure, not by the Regulation.
- root cause: The underlying reason the system allowed a nonconformity, identified so that corrective action removes it (ISO 13485 clause 8.5.2).
- effectiveness check: Verification, with evidence, that a corrective action removed the cause and did not create a new problem (ISO 13485 clause 8.5.2).
Official sources
- Regulation (EU) 2017/745 on medical devices, Annexes VII and IX (EUR-Lex)
- Commission Recommendation 2013/473/EU on audits and assessments performed by notified bodies in the field of medical devices (EUR-Lex)
- TUV SUD: unannounced audits under the MDR (notified body explainer)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.