BSI Unannounced audit visits

BSI implemented a routine program of unannounced visits to all our CE-certified manufacturers and, if appropriate, their critical sub-contractors and crucial suppliers. Our designating Competent Authority (MHRA) requires Notified Bodies, including BSI, to conduct unannounced audits in accordance with the recommendation. This has been a requirement of Notified Bodies since the first half of 2014.

To read the full recommendation, please download the EU Commission Recommendation of 24 September 2013.

The requirement for regular unannounced audits, found within Annex III, is the most significant change introduced by the Commission Regulation. These are in addition to the current program of compliance audits conducted by Notified Bodies. This applies to manufacturers holding EC certificates under any of the three EU Medical Devices Directives i.e. MDD, AIMD, IVD, where the legal provision for unannounced visits exists. The requirement will remain under the new Medical Device and IVD Regulations due to come into force in 2017.

The Commission Recommendation states that these "unannounced audits" must be unpredictable and without prior notice, so there will be no communication with your company prior to the audit. The BSI Notified Body auditors will present themselves at your premises, and your company must provide immediate and unrestricted access.

Access to your critical sub-contractors and crucial suppliers by the Notified Body may also be required, and will be subject to identical requirements, in situations where this is likely to provide more effective control by the Notified Body. This right of access will need to be covered in your contracts with these suppliers.

In November 2016, the MHRA confirmed a change to the required frequency for unannounced audits. The EU Commission Recommendation of 24 September 2013 led to Manufacturers being subject to an unannounced audit at least once every 3 years, with the frequency increased for high risk devices to every 2 years. 

From January 2017, we will apply the new frequency requirements and switch to a new schedule based on device classification, as outlined below: