Modernizing Audits: Insights from the MDSAP Remote and Hybrid Pilot Program

The medical device sector is characterized by its rapid pace and evolving landscape. In this environment, the significance of regulatory flexibility and efficiency cannot be overstated. Recognizing this critical need, the The Medical Device Single Audit Program (MDSAP) has proactively launched a Hybrid and Remote Audit Pilot Program. This initiative represents a forward-looking approach to regulatory audits, ingeniously integrating technology to enhance efficiency while steadfastly upholding audit integrity.

The Imperative of This Pilot Program

At its core, the pilot program’s objective is both straightforward and revolutionary: to streamline audit processes through the adoption of hybrid and remote models, without any compromise on quality standards. Leveraging the power of information and communication technologies (ICT) such as Zoom and Microsoft Teams, the program aims to bridge geographical distances, effectively bringing auditors and manufacturers into closer collaboration, regardless of the thousands of miles that might separate them. It’s crucial to emphasize a key point: this pilot program is not designed to replace the formal Stage 1 audits as mandated by ISO 17021-1:2015. These foundational audits retain their flexibility, with Auditing Organizations (AOs) retaining the discretion to conduct them via desktop review, remote means, or traditional on-site visits.

Defining the Scope: What’s Included and What’s Excluded

Eligibility Criteria for Device Categories:

The pilot program specifies clear eligibility for remote audits based on the nature of the device and the site’s activities. Physical product realization sites are broadly qualified for entirely remotely performed audits.

This includes, but is not limited to, SaMD (Software as a Medical Device) manufacturers and virtual producers of outsourced manufacturing. However, a crucial disclaimer is that remote auditing methods are only acceptable if the audited location does not physically do any tasks directly associated with the production of medical devices during the audit’s purview. This ensures that only appropriate sites are subject to remote scrutiny, maintaining the integrity of the audit process.

Limitations on High-Risk Products:

To safeguard patient safety and address the inherent complexities of certain medical devices, the pilot program imposes strict limitations on hybrid and remote audits for high-risk products. Specifically, these audit methodologies are explicitly prohibited for:

• Life-sustaining/supporting devices: Devices critical for maintaining life.
• Implantable devices: Devices designed to be permanently or temporarily placed inside the body.
• Devices that interact with the central nervous or cardiovascular systems: Products with direct impact on vital physiological systems.
• Devices that produce ionizing radiation: Equipment emitting radiation, requiring specialized oversight.
• Drug/biologic-combination devices: Products combining a medical device with a drug or biologic component.
• Devices that incorporate human or animal tissues or their derivatives: Products with biological components requiring stringent controls.
• Certain high-risk In Vitro Diagnostic Devices (IVDs): With the exception of pregnancy and fertility tests, this category includes IVDs used for the following purposes: detecting cancer, infectious agents, or transfusion-transmitted diseases; detecting fetal congenital disorders; ensuring immunological compatibility through tissue typing or blood grouping; and near-patient testing (point-of-care or self-testing). These exclusions highlight the program’s dedication to putting patient safety first for products that have a big impact on health.

Allowed Audit Types:

The pilot program delineates which audit types are eligible for remote and hybrid approaches, provided specific criteria are met.

The asterisks in the table denote conditions: ‘*’ indicates that eligibility is contingent on all criteria in the Device categories of the pilot procedure being met, while ‘**’ signifies a restriction, often unless a prior on-site audit under another scheme (e.g., EU MDD/MDR) has been conducted and is in good standing.

This structured approach ensures that while flexibility is introduced, it is balanced with necessary on-site oversight for initial certifications and certain special circumstances.

What Necessitates On-Site Evaluation?

Despite the advantages of remote and hybrid audits, certain critical areas continue to demand in-person assessment due to their inherent complexity, criticality, or associated risks. These areas are deemed non-negotiable for on-site evaluation:

• Sterilization procedures: Ensuring the efficacy and control of sterilization processes.
• Production traceability: Verifying the ability to track products through the entire production chain.
• Equipment calibration: Confirming the accuracy and reliability of essential equipment.
• Handling of nonconforming product: Assessing the processes for managing defective or non-compliant products.
• Activities related to design and development that incorporate risk controls: Assessing how well risk management is integrated into the design and development stages.

The on-site requirement for these areas reflects their profound impact on product quality, safety, and regulatory compliance.

Strategic Planning for Hybrid and Remote Audits

Planning a hybrid or remote audit is far from a simplistic “plug-and-play” exercise; instead, it demands a strategic and meticulous approach. Key planning considerations include:

• Clear Component Definition: Precisely defining which audit components will be conducted remotely versus those requiring on-site presence.
• Mutual Consent: Obtaining explicit mutual consent from both the auditing organization and the manufacturer regarding the audit methodology.
• Competent Audit Team: Ensuring the audit team possesses the necessary competencies as outlined by IMDRF MDSAP WG/N4.
• Hybrid Audit On-Site Time: For hybrid audits, mandating that on-site audit time constitutes at least 50% of the total audit duration, unless exceptional circumstances warrant otherwise.

Beyond these core elements, other crucial planning activities encompass:

• ICT Tool Testing: Rigorously testing information and communication technology tools (e.g., Zoom, Teams) to ensure seamless communication and functionality.
• Contingency Planning: Developing robust contingency plans to address potential technical disruptions or unforeseen challenges.
• Digital Document Exchange Preparation: Establishing protocols and preparing for efficient digital exchange of audit-related documents.
• IT Support Involvement: Ensuring the active involvement of IT support staff from both the auditor and the auditee to facilitate technical aspects.

Reporting and Certification Guidelines

Audits conducted under this pilot program necessitate unambiguous and detailed documentation.This includes:

• Clearly stating if the audit is “remote” or “hybrid.”
• Outlining the digital platforms used and the audit dates.
• Documenting any technical issues or limitations encountered that could potentially impact the reliability of the audit findings.

A critical provision regarding certification is that fully remotely audited sites can only be listed on the Medical Device Single Audit Program (MDSAP) certificate if they have also undergone at least one on-site or hybrid audit within the current audit cycle. This stipulation reinforces the necessity of periodic physical presence to validate remote assessments and maintain comprehensive oversight.

Measuring Success: A Phased Evaluation

The success of the pilot program will be meticulously assessed by the Regulatory Authority Council and Subject Matter Experts (SMEs) following its conclusion.The evaluation will encompass several key performance indicators:

• Procedure Compliance: Following the established protocols for the pilot program.
• Quality of Audit Reports: The comprehensiveness, accuracy, and clarity of audit reports.
• Timeliness of Submissions: The promptness of report submissions and related documentation.
• Stakeholder Feedback: Gathering input and perspectives from all involved stakeholders.
• Trends and Findings in Nonconformities: Analyzing patterns and observations related to nonconformities identified during audits.

The aggregate outcome of this comprehensive assessment will be instrumental in determining whether this innovative approach becomes a permanent fixture within the broader Medical Device Single Audit Program (MDSAP) framework.

The Road Ahead: What’s Next?

As the March 31, 2025 deadline approaches, industry stakeholders are keenly observing the pilot program’s trajectory. The question on everyone’s mind is whether this pilot will seamlessly transition into a lasting feature of the The Medical Device Single Audit Program (MDSAP) process. It is very likely that hybrid and remote auditing will become a permanent part of medical device regulatory supervision if the program continuously shows that it can increase efficiency, maintain quality standards, and improve adaptability within the regulatory landscape.

Conclusion

The Medical Device Single Audit Program (MDSAP) remote and hybrid audit pilot program transcends being merely a pragmatic response to post-pandemic circumstances. It represents a visionary leap into the future of regulatory compliance within the medical device sector. This adaptable, ICT-facilitated methodology offers substantial advantages to both auditors and manufacturers, paving the way for a more intelligent, responsive, and ultimately more efficient regulatory landscape.

Technology has the ability to completely transform how medical device manufacturers adhere to international norms, encouraging greater collaboration and operational flexibility while ensuring the highest levels of quality and safety, provided it is properly integrated into the audit process.

Reference

MDSAP AUDIT APPROACH (MDSAP AU P0002.009)

Author: Sandeep Shivkant Kulthe