Notified Body Audit Preparation: MDR Checklist

For medical devices in class IIa and above, there is no way around the notified body. It assesses the quality management system and the technical documentation and ultimately decides on the certificate, without which CE marking is not possible. Audits are not a one-off event; they accompany a device throughout its life cycle. This article explains which audits manufacturers face and what good preparation looks like.

Which audits the MDR requires

The conformity assessment procedure under Annex IX of the Medical Device Regulation (MDR) involves three types of audit:

Audit	Timing	Purpose
Initial audit	before the certificate is issued	Demonstrate that the QMS and documentation meet MDR requirements
Surveillance audit	at least every 12 months	Confirm that the system continues to be applied effectively
Unannounced audit	at least once every five years	Review day-to-day operations, often with product checks and possibly at critical suppliers

Certificates under the MDR are valid for a maximum of five years, after which a reassessment follows. In addition, the notified body reviews the technical documentation, either on a sampling basis or for every device depending on the class (see our article on MDR classification).

What auditors look at most closely

An MDR audit goes further than a pure ISO 13485 audit. Alongside the QMS, the obligations from the regulation itself are in focus. In our experience, these topics receive particular scrutiny:

• General safety and performance requirements (Annex I): is there traceable evidence for how each requirement is met?
• Risk management: is the risk management file according to ISO 14971 up to date and linked to design, production and market surveillance?
• Clinical evaluation (Article 61, Annex XIV): are the clinical data sufficient, and is the evaluation updated regularly?
• Post-market surveillance (Article 83 onwards): is there a PMS plan, and do findings feed back into risk management and clinical evaluation?
• Vigilance and complaints: are incidents assessed and reported on time?
• Person responsible for regulatory compliance (PRRC, Article 15): is the person appointed, qualified and aware of their duties?
• UDI and EUDAMED: have device identification and registration been implemented?
• Supplier control: are critical suppliers evaluated, contractually bound and monitored?
• Change management: are substantial changes notified to the notified body in advance?

Preparation checklist

Eight to twelve weeks before

• Request the audit plan from the notified body and check it against your scope
• Review the results of the last audit: are all nonconformities closed and the effectiveness of actions demonstrated?
• Carry out an internal audit focused on MDR priorities, ideally by someone who is not responsible for the area
• Keep the management review up to date, including metrics on complaints, CAPA, suppliers and audits

Four to six weeks before

• Check the technical documentation for completeness and currency (Annexes II and III)
• Align the clinical evaluation, PMS report or PSUR and risk management file; contradictions between these documents are a frequent finding
• Prioritise open CAPAs and set realistic deadlines
• Review supplier files for critical suppliers, including quality agreements

In the week before the audit

• Assign a contact person for each process and arrange deputies
• Set up a "back room": a small team that provides requested documents quickly and completely
• Hold a short briefing for everyone involved: schedule, roles, how to handle questions
• Prepare rooms, access and digital permissions for the auditors

Audit day: practical tips

From audits on both sides of the table, as auditor and as auditee, the same success factors come up again and again:

• Answer honestly and precisely. Answer the question asked, no more and no less. If you don't know something, say so and bring in the responsible person.
• Work with evidence. Statements like "we always do it this way" don't convince. Records, minutes and approvals do.
• Find documents quickly. Long search times suggest the system is not under control. A clear filing structure or an eQMS pays off here.
• Understand findings rather than argue. If something is unclear, ask exactly what a finding refers to. Raise technical objections factually and with evidence.
• Take notes. One person records questions, comments and requested documents. This makes follow-up much easier.
• Use the closing meeting. Have all findings and their grading confirmed before the auditors leave.

After the audit: handling nonconformities properly

Findings are usually graded as major or minor nonconformities. The notified body sets the deadline for submitting an action plan and evidence. A robust response covers:

1. Correction: what was done immediately to fix the specific problem?
2. Root cause analysis: why did it happen? Methods such as 5 Whys or Ishikawa help to look beyond the symptom.
3. Corrective action: what prevents it from happening again, including elsewhere?
4. Effectiveness check: how and when will you demonstrate that the action works?

Responses that only address the symptom ("the document has been updated") are frequently rejected and cost extra time.

Unannounced audits: always be audit-ready

Unannounced audits show how a QMS works day to day. Short-term preparation is not possible, so manufacturers should make sure that

• a responsible contact person is reachable at all times,
• contracts with critical suppliers grant the notified body access,
• records are maintained continuously, not just before planned audits.

Conclusion

A notified body audit can be planned well if the QMS works in everyday practice and the documentation is consistent. Knowing the MDR priorities, taking internal audits seriously and organising audit day in a structured way reduces nonconformities and protects your timeline and market access. The foundation is an effective QMS, usually according to ISO 13485.

We support the preparation and facilitation of internal and external audits, drawing on many years of experience as both auditor and auditee. Learn more about our MedTech consulting or get in touch.