ISO 13485 Remote Audits: Views from Both Sides of the Table

Remote audits are certainly not a new practice, but were not a routine event until COVID-19 presented the medical device industry with a particular set of challenges. Otherwise referred to as desktop audits, remote audits have been a standard practice for low-risk suppliers or in the cases where restrictions existed in entering certain parts of the world. As we adapt to the “new normal,” remote audits may become part of this new paradigm. The intent of this article is to offer a perspective from “both sides of the audit table”—from the auditor and the auditee. Both have a significant role in making these critical remote audits effective and the following should provide both parties some perspective.

From the Auditee
For medical device businesses of all types and sizes, the reality of quality management system oversight and review does not go away because of COVID-19. It is more important now than ever that your QMS performs and supports your organization in achieving the traceability and accountability the QMS implementation is based upon.

The very first aspect of responding to COVID-19 from an auditee perspective is to keep functioning to the QMS. A well-designed quality management system should be right-sized to your organization; that is, it should be functional to the operational characteristics of your business. Secondly, it should scalable and flexible to include mechanisms for when and if an organization grows or undergoes a particular stress. Likewise, it should be solution-oriented, and designed to achieve the level of quality expected from an ISO 13485 entity. Do not stop any of your regular QMS activities because of COVID-19, but utilize your existing change procedures to adapt to the fluid situation.

Similarly, continued communication with your auditing organization is key for a successful remote audit experience. Let the auditing organization know well in advance of your concerns and that you are taking additional precautions at your facility to protect your people and customers. They are doing the same right now for their teams, yet they also have the responsibility of conducting a thorough and diligent audit of your business. By being truthful and transparent in communicating your concerns, and working with your auditor, you will find a solution that satisfies both their need to be thorough auditors and your need to keep your team and location safe and healthy.

Be prepared. Ask for an audit plan at least two weeks prior to the audit. Ask questions of the auditor to understand more about what they will be looking for, and what will suffice as objective evidence. Once you have that information, be equipped with the relevant material so it is readily available when the auditor requests it. In the same vein, clearly communicate to your team your expectations for the remote audit and each team member’s responsibilities for preparation. Quality management is not a solo endeavor, and all members of your team should be contributing to readying your organization for an audit.

Test your video conferencing software and other digital tools with the auditor and the other members of your team a week or at least a few days before the scheduled date so any technical issues can be resolved well in advance of the audit. There is nothing more annoying than having to troubleshoot your conferencing platform the morning of the audit, especially if you have a large team. Plus, it does not make a good impression upon the auditor that you cannot manage a teleconference, much less a medical device quality management system. Make sure the audio can be clearly heard by all participants, and all participants can access or view the shared documents.

To that end, establish a secure cloud folder (if you do not already have one) and have your information and objective evidence laid out in various folders so it is available to show the auditor when it is requested. Grant access permissions to each of the participating team members, and ensure all documents are watermarked and password protected.

Record a tour of your facility prior to the audit. This does not have to be professional-level videography, but a clear view of how your facility is laid out and what mechanisms you have taken to ensure quality in your manufacturing process. Use this as an opportunity to highlight the strengths of your team and operation. It is important to note the audio from a video file often sounds faint during a videoconference, so be prepared to narrate the video in real-time.

As videoconferencing has become more pervasive, and working from home has become the norm, we have begun to realize it can be just as tiring as in-person meetings. Just as a traditional audit can be stressful, a remote audit with its inherent unfamiliarity can be just, if not more, stressful. So, account for this fatigue just as you would for an on-site audit and include short five- to 15-minute breaks throughout the audit plan. Use that time to stretch your legs, get more coffee, or just spend it casually with your team and the auditor. Taking this time for the collective well-being will be appreciated by all.

In the end, the remote audit process is just another adjustment we all make in the time of COVID-19. Keep in mind, even though we call this the “new normal,” there is nothing normal about this. We are not just working with novel health and safety guidelines, but all of us are trying our best to get work accomplished during a global health pandemic. Now, more than ever, people rely upon the goods and services we provide, so act with purpose; be deliberate in your preparations; and have the confidence in yourself, your team, and your QMS.

From the Auditor
For remote audits, the basics for performing the audit have not changed. Use the risk-based approach to determine the companies that would best fit the remote audit strategy (e.g., low- to medium-risk product, good quality and delivery performance, no or minor audit findings during the last audit). There may be a hybrid solution of remote and on-site auditing that could be helpful to reduce travel expenses.

Plan for a successful start by putting together the audit agenda ahead of time and working with the auditee organization before the actual audit date. As soon as possible, work with the auditee to set up a trial run of the video system you plan to use or they have. There are usually technical difficulties with cameras and audio, so it’s best to work them out before the audit to avoid delays. The ability to share screens to review information is helpful when there are proprietary processes or intellectual property.

It is important to have a good microphone so the auditee can hear you clearly. One important item is to show people how to mute themselves when they’re not talking. There have been times when the conversation wasn’t meant for the auditor to hear.

As part of the audit plan, the auditor should provide a list of documents they want to review prior to the audit. The use of a secure file-sharing system works very well (e.g., Dropbox, Google Docs, OneDrive). This can be used to provide documents during the audit as well. The flow of information is easier to manage than using emails.

As part of the audit, you will expect to see objective evidence of records. The challenge is not every company is paperless and may not have all the records scanned/electronically available. During the initial conversation, ask the auditee what type of system they have and what records are available electronically. If they are hard copies, you may request a copy of a log and identify specific records to be available for the audit date. The more you help the auditee to be prepared, the smoother the audit will go.

Remote audits require you to be in an area without interruptions so you can be fully engaged in listening and observing the auditees. “Active listening” is important to detect underlining issues that may not be as noticeable when you’re not on-site. When on-site, you can observe many things such as lunch trash in the barrel of the assembly department, or a strong odor of unusual or out-of-place chemicals. Remote audits will require you to observe the people, the body language, and the presentation of information. These may be signs of issues that may require further investigation.

When feasible, have the auditee provide a virtual tour of the facility. The best situation is when it can be accomplished live through smartphones (e.g., FaceTime). This will permit questions to be asked directly by the auditor.

If you are running multiple sites or have multiple auditors as part of the audit, it’s best to have your own “backroom” communication tool. Usually, the lead auditor would meet with the audit team to discuss the progress, but in a case of remote auditing, the team will still need to communicate. The best practices are to use communication tools such as Slack or WhatsApp. This allows confidential or sensitive information to be communicated among the audit team.

Conclusion
Resisting the change is not the best path to take. We are all going through challenges adapting to the constraints imposed by COVID-19; the sooner we adjust and embrace the potential the situation allows, the easier we will be able move on to bigger and better things. Achieving effective audits that ensure compliance and quality still can be accomplished through remote auditing. Preparation and communication are key. 

---

James Shore is the chief quality officer at Quality Lean Solutions (www.qualityleansolutions.com), which provides “Simple Sustainable Solutions” for medical device and high-tech manufacturers. He has over 30 years of quality and supplier management experience working in the medical devices, semiconductor, aerospace, and defense industries. Shore’s professional certifications include ASQ Certified Six Sigma Black Belt, ASQ Certified Quality Manager/Operations Excellence, Certified Quality Auditor, and Certified Mechanical Inspector, as well as ASQ Senior Member (joined in 1988). He is a Certified Welding Inspector and Test Supervisor for the American Welding Society as well.

Neel Patel is vice president at Florida Anodize System & Technologies (www.anodizefast.com), a provider of tight-tolerance aluminum anodic coatings for the medical and surgical device industry. He is the product line leader for FAST ColourLock, an innovative anodic surface treatment designed to withstand surgical cleaners, and industry-leading EtO and VHP sterilization systems. Patel earned an MBA in Global Management from the Thunderbird School of Global Management.