When should you call the NB/CB/AO relative to initial/changed product/system maturity state?

When should you call the conformity assessment body?

We often receive this question in some similar form, such as:

• When is the best time to order an audit relative to a Quality Management System (QMS) or product change? 
• What is the earliest time we should apply for a conformity assessment (so that we can reserve our spot in the queue as early as possible)? 
• How much should our QMS/product documentation be ready (vs having placeholders, TBD items) by the time of certain milestones (application, stage 1 audit, stage 2 audit, Technical Documentation (TD) review, issuance of our certificates) in the initial certification process? 
• What are the risks of applying too early for conformity assessment/QMS audit? 

Note: in this article, the term CAB (conformity assessment body) will be used (which can mean an ISO 13485 accredited certification body, MDSAP recognized auditing organization, EU notified body or UK approved body).

Principles

Based on the ISO/IEC 17021-1:2015 standard, clause 4.4.2: “The certification body has the responsibility to assess sufficient objective evidence upon which to base a certification decision”. In practice this means that the CAB can only certify activities and product groups that it can audit.

It is important to understand that QMS audits are typically challenging the certified organization’s ability to perform the certified activities (for example, based on their control of one or more technologies, competency of their personnel, suitability of the infrastructure, consistency and robustness of their QMS processes, establishment of up- and downstream supply chain, including regulatory representation in their target countries). As such, CABs are typically not interested in whether the manufacturer actually has any orders in one or more countries so long as they can fulfill orders (in an ideal case from the day following the last day of the audit) with devices that are regulatory compliant to the given market.

Q: Does this mean that the CAB cannot use any flexibility to resolve catch-22 situations (i.e. an organization or their site cannot have orders from prospective clients before they get certified – and thus can’t be qualified as suppliers to their clients – and they cannot get certified before they have any client orders to demonstrate their capability to fulfil those orders)?

A: No. The CAB has reasonable flexibility to deal with these types of situations, such as:

• Auditing a process that is representative (but may be not fully identical or fully released) to the final certified process.
• • auditing based on not real (“dummy” or “test”) orders. Auditing such internally generated (but otherwise representative) orders can resolve the catch-22 situation.

How similar should a process be at the time of the audit to the final setup?

The process should be similar in the following aspects: Process installation (including the site, machinery and utilities), Operational and Performance parameters (e.g. sequence of steps, device settings, materials and semi-finished goods, DMR and DHR documents, product monitoring and measurement sampling and test conditions, personnel training) should be identical, or at least within the established tolerance of the process.

Differences should be minimal and mostly administrative (e.g. a print or a DHR template to be final draft instead of the released version, subassemblies to be a form-fit-function compatible prototype instead of a released part, some trained personnel working under supervision, raw materials may be engineering samples instead of the final commercial bulk packaging, some non-quality related elements like final floor markings for quarantine or RMA area not permanently marked just provisionally marked, pre-approved nonconforming material disposition – especially rework – methods not finalized, etc.).

As for product preparedness, for example in the EU, the MDR Annex IX, section 2.1 requires that the application for conformity assessment shall include the draft declaration of conformity (DoC) covering all products in the conformity assessment. It is understood that the DoC needs to be in draft as the final approved version includes the MDR QMS certificate number, but otherwise it should be final. In particular, this DoC final draft already includes a statement that the manufacturer declares that the covered products, at the time of the application, already fulfill the applicable requirements of the EU MDR. This is the assumption of the notified body for all products in the conformity assessment process (i.e. not only the models sampled to be subject to TD reviews in the initial year). Again, it is understood that in an ideal world, the NB completes the conformity assessment (audit and TD reviews) immediately (within a few days) and issues the certificate on the last day of the last part of the assessment and the manufacturer can start putting their products on the European market.

If the manufacturer knowingly applies for a certification/conformity assessment before this complete level of preparedness (typically to reserve their spot in the application queue), they run the risk of having nonconformities during the process. Even TDs not sampled for review in the initial year can be sampled during the initial QMS audit (as early as the Stage 1) for the CAB to assess if the product realization processes are consistent with the medical device file. Some CABs (including the notified body of SGS) have additional provisions in the client agreements allowing the individual audit or technical documentation review completely closed with a negative result if it is clear that the documentation is not ready for the assessment; in this case the manufacturer has to restart the failed part of the process negating all benefits of a premature application. The above listed remaining tasks typically can be finished by the manufacturer while they are waiting for their scheduled audit dates or after the audit for the CAB to finish the post-audit administration and issue the requested certificates).

In conclusion, it is usually not a good idea to apply before:

• The QMS is in a steady state (ideally operating for at least six months in its final representative state). Validated processes should have passed the performance qualification (PQ) phase with at least two batches showing consistent and compliant results (and the manufacturer can reasonably perform the last batch and finalize the process validation reports while waiting for its audit).
• The QMS is in a steady state (ideally operating for at least 6 months in its final representative state), validated processes should have passed the performance qualification (PQ) phase with at least two batches showing consistent and compliant results (and the manufacturer can reasonably perform the last batch and finalize the process validation reports while they are waiting for their audit).

The above strategy equally applies to new and changed QMSs and products (i.e. the changes to the system or products have to be in a similar level of representative maturity as for an initial audit). In particular, in accordance with the ISO 13485:2016 requirements, the quality plan controlling the change/transition has to ensure that the QMS (or affected products) are in a compliant state at all times during the transition period (the CAB will not accept that the future state of the QMS or product is expected to again be compliant – the manufacturer can easily find themselves in jeopardy of even getting their certificates suspended or scope limited if the change dismantles the previous processes and QMS controls before the successor systems are put in place). It is recommended to only discontinue the previous processes (including the update of MDD certified product TDs) once the new/updated certificate is issued (or if such update is not required, the agreed CAB deliverables – e.g., audit report, TD review report, amendment letter, etc. – are delivered to the manufacturer).

Note: While the manufacturer is waiting for the CAB to issue their deliverables, the manufacturer can continue to operate the updated processes, but the resulting products should not be released (i.e., should be put in quarantine). This can mitigate the impact of the wait.

By: Balazs Bozsik, Technical Director, Medical Device