The transition to EU MDR and EU IVDR has come with a steep learning curve for all in the industry, including both manufacturers and notified bodies. With hundreds of MDR and IVDR technical files under our belts, we have learned a lot about the most common findings — and how to avoid them. Through our mock audit service, manufacturers get the benefits of former notified body reviewer experience and deep regulatory and clinical expertise with medical devices and IVDs.
What Is a Mock Audit?
A mock audit mimics the process that would be followed by reviewers in a live audit. The intent is to inform you about important issues so you can prepare for actual audits that a regulatory body or certifying authority would perform. A mock audit is essentially a chance to identify opportunities for improvement and pinpoint any remaining issues before submission. Ideally, a mock audit is preceded by a gap assessment to provide the best chance for success.
RQM+ performs mock audits for MDR, IVDR, FDA, MDSAP and ISO 13485. The approach is customized and depends on the client, types of products, classifications of products and the intended scope of certification.
Benefits of Doing a Mock Audit
When you complete a mock audit and implement the resulting recommendations, it increases the likelihood of passing real audits. You’re basically doing a dry run that allows you to become familiar with the expected audit process and the specific requirements, providing visibility into gaps.
Taking the time to go through a mock audit also reduces the risk of significant findings, which can lead to major delays and unexpected costs. If there are findings, they are less critical and remediation is more efficient. Getting your submissions right the first time and not trying to do just the bare minimum ultimately reduces your resource burden in the long term.
Common Audit Findings
The more you can learn from the findings in real and mock audits, the better able you will be to prepare your own documentation.
IVDR is much more expansive and prescriptive than the previous In Vitro Medical Device Directive (IVDD), and the jump from the directive to the In Vitro Device Regulation (IVDR) has meant significant changes for most manufacturers. The largest issues are with older products that were self-certified because many manufacturers don’t have compliant technical documentation in place. The challenge is that you must now demonstrate that you’re up to date on the most recent standards and guidance documents as well as the regulation.
The requirements for demonstrating clinical performance are a common hurdle for manufacturers. Unlike clinical testing for medical devices, where you can do patient testing, IVDs test patient samples. Therefore, the demonstration of clinical performance must be in line with the IVDR.
Common findings for IVDR mock audits include:
- Incorrect classifications - Manufacturers are not providing sufficient justification for the risk classification, often because the intended purpose statement is not clearly defined.
- Not meeting testing requirements - Requirements for testing are much more rigorous. In many cases, test protocols and data for legacy devices are not compliant with the new regulation.
- Not providing sufficient validation data - Validation data may not be up to current standards.
- Not meeting standards or common specifications - Noncompliance with standards and common specifications demonstrates a lack of knowledge of all requirements and failure to incorporate these documents into the quality management system (QMS).
- Not meeting clinical performance requirements - Clinical performance studies are not compliant with the IVDR requirements.
- Processes not in place for unique device identification (UDI) assignment - MDR and IVDR require a unique UDI to be assigned to every medical device and IVD.
- Processes not in place for EUDAMED registrations - Although the modules are still rolling out, manufacturers must have processes in place for registering products in the EUDAMED database.
The transition from the Medical Device Directive (MDD) to the Medical Device Regulation (MDR) was also expansive, and findings for medical device audits are similar to those we have seen for IVDR.
Common EU MDR mock audit findings include:
- All requirements not being met - The number of requirements expanded almost tenfold, so covering all those things is typically the biggest challenge.
- Not having a clearly defined intended purpose statement - The intended purpose statement affects classification and, therefore, cascades through all documentation. Manufacturers must go beyond a general description of what the device is used for and describe the specific indications.
- Insufficient clinical data to address all indications and device variants - Clinical data must be provided to support all indications for use.
- Incorrect labeling - Clients are finding that they need to update labeling and make sure testing is accurate to support label claims.
- Processes not in place for UDI assignment or EUDAMED registrations
How Does an RQM+ Audit Work?
When you do a mock audit with RQM+, we create a plan that includes the agenda and regulatory scope for the audit. The appropriate team is determined when the scope is defined, and selections are made based on the experience and competency of the auditor(s). The process typically takes a week to conduct, and RQM+ offers flexibility for performing audits on-site or remotely.
Notified bodies expect that any consultants you hire demonstrate the proper competency with the scope. This is why it’s important to hire someone such as RQM+ with deep expertise and expansive regulatory knowledge.
Audits vs. Gap Assessments
Before considering a mock audit, medical device and IVD manufacturers should first complete a gap assessment. As a first step, a gap assessment will identify necessary areas for improvement and outline the best path for closing those gaps. Once the gaps have been filled, a mock audit is a precursor to a notified body audit and is intended to identify administrative inconsistencies and other potential issues with technical files. By the time you do a mock audit, the technical file should be complete and ready to submit. The objective is to determine readiness for notified body review.
Periodic internal QMS audits are also recommended, especially for products with a higher risk classification. The intent is to ensure that your QMS is always in compliance and ready for an external audit.
How RQM+ is Different
RQM+ is not unique in offering a mock audit. However, we have team members with extensive auditing and industry expertise, including former notified body experience. We also offer the benefit of providing improvements or regulatory strategy that would help you do better in the future. We don’t just give you recommendations — we provide solutions.
As we continue to refine our mock audit processes, we’re implementing tools that incorporate automation for greater consistency, efficiency and a streamlined process. Team sizing is also an advantage because we can provide as many experts as necessary for an efficient and effective process.
If you develop software devices, check out our on-demand webinar, “Common FDA and Notified Body Software Deficiencies and How to Avoid Them,” to learn more about challenges specific to these types of devices.