Remote Medical Audits During COVID-19

The healthcare sector is at the epicenter of the current global pandemic challenge. With significant interventions taken by the government officials in the context of the current COVID-19 global outbreak, businesses are rapidly adjusting to the changing needs of their people, their customers and suppliers, while navigating the financial and operational challenges. The travel and quarantine restrictions have significantly affected the ability of notified bodies to conduct mandatory on-site audits under the medical devices legislation.

This blog identifies how to use remote medical audits effectively and aims to help manufacturers turn massive challenges into meaningful change during these trying times. Against this backdrop, remote inspections are a new concept for most of us, and manufacturers are unsure of its objectivity, trustworthiness, credibility and effectiveness.  However, we presume it to be an effective way to keep your certification program moving along, as was originally planned before the Coronavirus/ COVID-19 pandemic.

The following is the ninth in the series of blogs. In this blog, we intend to provide practical guidance on how to prepare for remote audits with your notified body during these unprecedented times.

To learn more about the EU MDR changes you can view some of the previous posts in the series:

• Medical Device Equivalence vs Demonstration of Equivalence
• Post-market Clinical Follow-up Requirements for EU MDR
• The New European Union MDR: Impact on Technical Files
• Low-risk Device Challenges
• Selecting and Working with your Notified Body
• Medical Devices with Ancillary Medicinal Substances
• Regulatory Challenges Writing EU MDR Compliant Clinical Evaluation Reports (CER)
• International Medical Device Regulators Forum (IMDRF) & Summary of Recent Changes to Clinical Evaluation Guidance

What is a remote audit? When are remote audits allowed? How does a notified body decide whether a remote audit is permitted or not?  What documents are reviewed at a remote audit?  How do manufacturers prepare for a remote audit?  What tools should be used?  When is an on-site follow-up audit required?  This blog anticipates to address all these queries, to help you prepare.  It is always worthwhile to check with your notified body on their modus operandi.

Firstly, what is a remote audit?  A remote audit is the same as an on-site audit, but the auditor engages with you via technology. It is important to keep in mind that the remote audit is not to be viewed as an inferior method for performing on-site audits. Even more so than in the case of an on-site audit, it still covers documentation and record review, tours of your premises, interviews with workers and presentation of findings by using a range of technology platforms including:

• Live web streaming technology such as Webex, Skype, MS Teams, GotoWebinar
• Live streaming paired with mobile technology such as a smartphone or tablet with video capabilities (e.g. WhatsApp, Skype or Facetime)
• Live streaming paired with technology and video headsets

If remote audits can be undertaken, it limits certification constraints as the audit program is enabled per the initial audit schedule.  Remote inspections may even be cost-effective, as there are no additional expenses, such as travelling, accommodation expenses to be added.  Although, be mindful, that it may be expensive in the long run if a follow-up audit is required, but this may be necessary to maintain current certification.

Audits that qualify for remote inspections are;

• Most surveillance audits
• Portions of recertification audits
• NB Transfer Audits
• Review of Covid-19–related devices

The following may not be suitable for remote audits; initial Stage II audits (unless it’s COVID-19–related), scope expansions, adding new sites, new processes and unannounced inspections etc.

Typically, your notified body will work with you on a risk-based approach. Whereby, usually a pre-audit questionnaire will be issued to the manufacturer, this will be completed and then sent back to the notified body. The Scheme Manager will review the completed documentation while taking into consideration the audit history, being mindful of the significant changes that were intended to be considered at the next audit.

Some substantial questions that needs to be addressed include;

1. Will the Quality Management System (QMS) be fully functional?
2. Will the client operate some kind of smartphone/camera application (WhatsApp, Facetime, Skype), allowing live audio/visual access to the manufacturing areas?

After assessing all of the above pointers, the Scheme Manager should contact the manufacturer and discuss the recommendation. If agreed upon by the manufacturer, the remote audit may progress.

Notified bodies may offer different approaches based on the factors above;

• Full remote audit
• Full remote audit with an on-site follow-up verification
• Partial remote audit plus an on-site follow-up
• Rescheduled on-site audit
• Certification suspension

You need to check with your NB to see which of these approaches they do offer.

As with any audit, you will receive your audit plan from the assigned reviewer.  They will most probably provide you with a list of documents as part of this plan, that may encompass the quality manual, an index of all QMS procedures, complaint records, corrective and preventive actions (CAPA’s) etc.  The notified body should work with you on this, taking into consideration specific requirements and your technology infrastructure, to ensure a successful audit.

Post confirmation, the date will be scheduled, the audit team leader will start the audit planning process. This includes identifying and settling on the technology approach to be used during the audit.

Typically, manufacturers should have a video conferencing tool; this would be something like Cisco Webex, Microsoft Teams, Skype.  Whichever you choose, just ensure that the security settings are adequate to meet your needs.  A successful remote audit relies on proper connectivity (i.e. voice and video) to ensure stable communication between the auditor and the auditee.

Once your connection is up and running, audit evidence will be collected via interview, review of documentation and records (via screen sharing) and observation of processes and activities (via video-sharing, if possible). It is recommended that you have a collaboration area, such as a google drive, one drive, dropbox whereby you can share documents with the auditor as required.  Evidence collected will be documented, reviewed and reported to support the audit findings and conclusions – the only difference is it will be done using remote techniques.  It is recommended that you have adequately tried these methods, before the audit date, ensuring that connectivity, logging on, etc., all work as anticipated.

A follow-up audit is scheduled for recertification which mandates follow-up verification activities.  It may be for a scope expansion,e.g., the addition of new sites, a new process or new devices (excluding COVID-19–specific devices).

In addition to a standard on-site audit report, remote audit reports will also include details about the remote auditing methods applied.  There should not be any significant differences in the way that you receive your audit report.

While we navigate the uncertainty imposed by the pandemic with new ways of living, inclusive of aspects like working from home, social distancing, and severe travel restrictions being imposed, we have to adapt the best we can. But speed is of the essence while organizations globally are experiencing workforce disruption at an unprecedented scale and speed. We are optimistic that with the key insights provided in this blog setting up, hosting and being part of a remote audit is one thing less that you and your business have to worry about. Remote audits may become a permanent fixture of our future, but for now, they are here, and we have to embrace them and work closely with our notified body to try to keep disruption to a minimum.