The annual surveillance audit by the notified body is very different from the initial certification audit. It is not intended to validate the initial conformity of the QMS and the technical documentation - that has already been done. It is intended to verify that conformity is being maintained over time, that processes genuinely function outside of audit-preparation periods, and that changes to the device and its regulatory context have been properly taken into account.
What surveillance auditors look at differently
The continuity of processes since the last audit. The surveillance auditor compares the state of the QMS today with the state documented at the last audit. Are indicators monitored continuously or only as the audit approaches? Are CAPAs handled within deadlines or allowed to pile up? Did the management review take place using real data, or was it reconstructed after the fact?
The update of the technical documentation and the CER. For a Class IIa or IIb device, the CER must be updated regularly. A CER that has not changed since the initial certification despite two years of post-market data is a strong signal to the auditor.
The integration of post-market data. Complaints, vigilance data, new clinical publications: are they analysed and their conclusions integrated into risk management and clinical evaluation? A PMS system that collects data without analysing it or drawing conclusions from it is not compliant.
Change management. Any change made to the device since the last audit must be documented and assessed in accordance with the MDCG 2020-3 guidance. A change that was not reported to the notified body when it was significant is a serious non-conformity.
The golden rule for preparing for surveillance audits
Do nothing specifically for the surveillance audit. If the QMS functions properly on an ongoing basis - indicators monitored, CAPAs handled, documentation kept up to date - the surveillance audit does not require any particular preparation in the sense of a last-minute “sprint”.
What you can do in the weeks preceding the audit: an internal verification audit to identify any residual gaps to correct before the notified body audit, a review of the status of ongoing CAPAs, and a check that the PSUR and CER have been updated.