NBCG-MED 2024-1

Application of hybrid audits to quality management system

assessments under MDR/IVDR – operational elements

June 2024

This document has been produced by NBCG-MED – Notified Bodies Coordination Group established in
accordance with Article 49 of MDR / Article 45 of IVDR, and reflects the consensus position of notified
bodies designated under:

• MDR (Medical Devices Regulation) – Regulation (EU) 2017/745

• IVDR (In-Vitro Diagnostics Regulation) – Regulation (EU) 2017/746
NBCG-MED 2024-1
Application of hybrid audits to quality management system assessments under
MDR/IVDR – operational elements

Development and adoption note

This document has been initially developed and adopted by notified bodies as Team-NB position paper
“Notified bodies’ paper on the application of hybrid audits to quality management system assessments
under MDR/IVDR” 1.

In this version, the document has been updated taking into consideration the comments of the Notified
Body Oversight subgroup of MDCG2 and adopted as NBCG-Med position. This is the first version of the
document after its adoption as NBCG-MED position. This document is available in the dedicated
section of the European Commission’s website3.

1. Background
Traditionally, quality management system (QMS) audits are performed on-site. However, during the
time of the global pandemic, notified bodies implemented procedures to apply alternative methods
utilising information and communication technologies (ICT), in alignment with the applicable
requirements and guidance such as MDCG 2020-44 and IAF MD 45.

This document has been developed following the advice from the MDCG to further elaborate on
operational elements of ‘hybrid audits’ including the identification of aspects to be audited on the
auditee’s premises, as included in MDCG 2022-176. This document represents the notified bodies’
collective position on the aspects to be considered when applying ICT-based auditing methods (‘hybrid
audits’) specifically to quality management system audits under MDR/IVDR.

1
Team-NB is the European association of notified bodies for medical devices, Team NB (team-nb.org).
2
MDCG (Medical Device Coordination Group) is an expert group established under Article 103 of MDR and as referenced in Article 98 of
IVDR.

3 European Commission / Public Health / Home / Medical Devices - Dialogue between interested parties / Overview (health.ec.europa.eu)
website, subsection Notified Body Coordination Group.
4
MDCG 2020-4 Guidance on temporary extraordinary measures related to medical device notified body audits during COVID-19 quarantine
orders and travel restrictions.
5
IAF MD 4:2023 Use of Information and Communication Technology (ICT) for Auditing/Assessment Purposes.
6
MDCG 2022-17 MDCG position paper on “hybrid audits”.

Notified Bodies Coordination Group

NBCG-MED 2024-1 Page 1 of 5
 2. Hybrid audits in the context of legislative requirements
Notified bodies are required to undertake on-site audits of manufacturer’s QMS both as part of the
initial audit and surveillance audits. In relation to the initial audit, Annex IX section 2.3 of MDR/IVDR
states:

The assessment procedure shall include an audit on the manufacturer's premises and, if appropriate,
on the premises of the manufacturer's suppliers and/or subcontractors to verify the manufacturing
and other relevant processes.

In relation to surveillance audits, Annex IX section 3.3 of MDR/IVDR states:

Notified bodies shall periodically, at least once every 12 months, carry out appropriate audits and
assessments to make sure that the manufacturer in question applies the approved quality
management system and the post-market surveillance plan. Those audits and assessments shall
include audits on the premises of the manufacturer and, if appropriate, of the manufacturer's suppliers
and/or subcontractors.

In accordance with these requirements, where quality management system audits to MDR/IVDR are
performed using alternative methods based on ICT, at least a portion of these audits must be performed
on-site to cover the manufacturing and other relevant processes, i.e. the audit must be a hybrid audit
as defined in MDCG 2022-17:

A ‘hybrid audit’ should be understood as an audit on the premises of the manufacturer or its supplier(s)
and/or subcontractor(s) with at least one auditor present on the premises and other members of the
audit team participating from elsewhere using information and communication technologies (ICT).

Such hybrid audits undertaken by appropriately qualified staff would satisfy the on-site audit
requirements of MDR/IVDR referenced above.

From experience gained during pandemic, hybrid audits, when appropriately planned, are effective and
have the following advantages compared to fully on-site audits:

• According to notified bodies’ estimation, hybrid audits may save up to 25% of auditor capacities
compared to on-site audits, allowing to redirect the capacity saved towards undertaking additional
MDR/IVDR audits to aid in the overall MDR/IVDR transition from Directives thus enabling more
efficient use of auditor capacities
• Less time and effort need spent on travelling and accommodation hence reducing travel
constraints
• Reducing the risk of travel to high-risk areas (e.g., political unrest, pandemic, natural disaster)
• Reducing the risk of burnout for auditors
• Hybrid audits are more sustainable and reduce the environmental impact of auditing
• Hybrid audits promote inclusivity

Notified Bodies Coordination Group

NBCG-MED 2024-1 Page 2 of 5
 3. Audit requirements
While some aspects of the manufacturer’s QMS can be effectively audited using ICT, certain aspects
should be addressed in the on-site part of a hybrid audit.

Examples of areas that can be effectively audited by using ICT and areas to be audited in the on-site
part of the audit include (but are not limited to) those listed in the following table.

The table has been established considering the audit subsystems listed in Annex VII Section 4.5.2 b)
and the requirements of Article 10 (9) of MDR/IVDR, as well as Section 6.2 of GHTF/SG4/N307, and has
been partially adjusted to be compatible with the audit processes of the MDSAP Audit Approach8, which
are included in the following table for information.

Audit subsystem Areas that can be effectively audited Areas to be included in the on-site
by using ICT: part of the audit:

Management, including pre- • Verification that QMS covers all • Verification of the existence of
market requirements and parts and elements of a facility
product documentation manufacturer’s organisation
NOTE: The overall on-site part of the
dealing with the quality of
audit must, as relevant, verify
processes, procedures and
evidence of product compliance,
MDSAP Audit Processes: devices
such as purchasing documents,
• Responsibility of the
• Management production and inspection records
• Device Marketing Authorization
management
(see section 5, last sentence)
and Facility Registration • Strategy for regulatory
compliance
• Identification of the applicable
general safety and performance
requirements and exploration of
options to address them
• Risk management
• Clinical evaluation
• Resource management,
qualification and training of
human resources
• Handling communications with
authorities, notified bodies, other
operators, customers and or
other stakeholders

7
GHTF/SG4/N30:2010 Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers. Part 2:
Regulatory Auditing Strategy (historical).
8
MDSAP AU P0002.008 Audit Approach (revision of 1 April 2023).

Notified Bodies Coordination Group

NBCG-MED 2024-1 Page 3 of 5
 Audit subsystem Areas that can be effectively audited Areas to be included in the on-site
by using ICT: part of the audit:

Corrective and preventive • Post market clinical follow-up

actions, including for post- • Implementation and
market surveillance and PMCF maintenance of a post-market
surveillance system
• Processes for monitoring and
MDSAP Audit Processes:
measurement of output, data
• Measurement, Analysis and analysis and product
Improvement improvement
• Medical Device Adverse Events • Processes for reporting serious
and Advisory Notices
incidents and field safety
Notification
corrective actions
• Management of corrective and
preventive actions

Design and development • Design and development • Design transfer to production/

activities not involving on-site manufacture, if on-site testing
MDSAP Audit Process:
facilities (design transfer should facilities are involved in
• Design and development be audited on-site if on-site verification and validation
testing facilities are involved)

Production and process • Traceability and batch records • Planning, product realisation,
controls • Process for the UDI assignment infrastructure, implementation
of device modifications, work
environment, warehouse/
MDSAP Audit Process: storage facilities, equipment
calibration, servicing
• Production and Service
Controls • In-process and final inspection

Purchasing controls including • Purchasing activities not involving • Incoming inspection/ verification
verification of purchased on-site facilities, such as review of purchased products
devices of supplier files

MDSAP Audit Process:

• Purchasing

Notified Bodies Coordination Group

NBCG-MED 2024-1 Page 4 of 5
 4. Audit team qualification
In the context of MDR/IVDR hybrid audits, the audit team must meet the qualification criteria specified
in Annex VII section 3.2.6 of MDR/IVDR related to site auditors.

The site auditor(s) performing the on-site part of a hybrid audit should be qualified for
the MDT/IVT codes appropriate to the processes in the scope of the audit which physically occur at the
audited facility and have sufficient knowledge as site auditor on the device and the device related
technologies as appropriate to the audited activities. In circumstances where it is not possible that the
auditor(s) physically present at the audited facility cover all the required qualifications, additional audit
team member(s) with the appropriate qualification must support the audit simultaneously through ICT.
In this case, the audit duration should consider the additional time needed by the audit team members
to review the concerned processes.

5. Audit planning and duration

As part of the audit planning, notified bodies must consider the manufacturer’s capability, and
suitability to support hybrid audits (IT systems, paper based vs. electronic QMS documentation and
records etc.). The overall audit duration should be established based on the principles provided in
IAF MD 59 and IAF MD 910.

According to GHTF/SG4/N30, approximately 20-30% of the audit duration is allocated to auditing of the
production and service controls subsystem. Consequently, at least 25% of the overall hybrid audit
duration must be allocated to the on-site portion of the audit. The on-site portion of the audit should be
appropriately increased to reflect the increase factors applied in the audit duration calculation that are
applicable to manufacturer’s production activities that physically occur at the audited facility.

The on-site portion of the audit can be reduced in duly justified cases. Examples include (but are not
limited to):

• facilities where no production activities physically occur that would require an auditor to be
on-site to review them, e.g. facilities only producing software as medical device (SaMD),
where production activities only utilise simple processes or all production activities are fully
outsourced (“virtual manufacturer”), and no product is physically handled
• facilities where only administrative activities take place such as human resources
management, purchasing or other management processes without physical product
handling

However, also in these cases, the on-site portion of the audit must verify the existence of the facility
and, as relevant, evidence of product compliance such as purchasing documents, production and
inspection records.

9
IAF MD 5:2023 Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems.
10
IAF MD 9:2023 Application of ISO/IEC 17021-1 in the Field of Medical Device Quality Management Systems (ISO 13485).

Notified Bodies Coordination Group

NBCG-MED 2024-1 Page 5 of 5