Notified body · QMS · MDR
What happens during a notified body audit?
The auditor does not only read procedures. The auditor follows evidence through your actual product lifecycle.
A prepared manufacturer can retrieve the right record, explain the decision behind it and show that the same process is used in practice. This guide turns an audit from an abstract inspection into a sequence your team can rehearse.
Complaint 2026-014
Device family · software version · marketWhat should happen?
What was documented?
What does the owner explain?
What actually happened?
Do the four answers tell the same story?
Sampling, interviews, observation and record tracing
Periodic audits at least once every 12 months under Annex IX
Possible at the manufacturer and relevant suppliers
Correction alone is not the same as corrective action
Start with the audit purpose
Which audit are you facing?
The agenda, depth and consequences differ. Select the closest audit type to see where the notified body is likely to concentrate its sampling.
Can the system support certification?
The notified body tests design and implementation across the full certification scope
Expect a broad assessment of the QMS against the MDR and the applied standards, including the sites, processes and device technologies within scope. System readiness matters more than a polished set of newly issued procedures.
Does the approved system remain effective?
Surveillance follows change, performance and the response to previous findings
The audit is sampled, but not superficial. Typical entry points include previous nonconformities, changes, complaints, vigilance, PMS and PMCF outputs, CAPA, supplier performance and production records.
Is continued certification justified?
Recertification combines lifecycle history with a renewed system-level decision
The notified body considers the certification cycle, relevant changes, surveillance results, complaints, vigilance, PMS, device performance and the continuing suitability of the QMS and certification scope.
Does routine operation match the certified system?
The organisation must be ready without staging a special audit version of the QMS
Auditors may arrive without disclosing the date in advance and can focus on a recently manufactured product, a process or a critical supplier. Reception, escalation, site access, document retrieval and staff availability must therefore be planned.
The audit route
How the audit normally unfolds
The notified body’s procedure and audit plan govern the details. This sequence helps the team understand what each phase must achieve.
Plan and document review
The notified body confirms scope, sites, audit team, timing and sampled processes, and reviews submitted QMS information.
Scope and logistics
The parties confirm objectives, communication routes, guides, safety arrangements, working rooms and the audit timetable.
Interviews and tracing
Auditors sample records, interview process owners, observe operations and move between connected QMS and device evidence.
Clarification and evidence
The manufacturer resolves misunderstandings, retrieves missing records and confirms the factual basis of potential findings.
Findings and response
The audit team presents conclusions. The manufacturer then responds using the format and deadlines set by the notified body.
An auditor can follow an issue beyond the scheduled process. A complaint may lead to risk management, clinical evaluation, software change control, supplier records, vigilance reporting and management review.
The evidence trail
Four layers must support the same conclusion
A procedure can be compliant on paper while implementation fails. Audit readiness means that requirements, records, staff explanations and observed practice remain aligned.
What applies?
MDR provision, harmonised standard, common specification, internal procedure, certificate condition or contractual control.
What should happen?
The approved process defines responsibilities, inputs, decisions, acceptance criteria, outputs and retained records.
What did happen?
A current, attributable record demonstrates that the process was followed for the selected device, batch, change or event.
Did it work?
Trend data, verification, follow-up or management review shows whether the action achieved its intended outcome.
The procedure was updated, but staff still use the previous workflow.
The record exists, but the rationale or acceptance criteria are missing.
The corrective action was closed, but effectiveness was never demonstrated.
What auditors trace
Eight system areas that must connect
The notified body samples rather than rereads every file. Weak interfaces between processes are often more revealing than an isolated formatting error.
Scope, roles and QMS control
Certification scope, regulatory strategy, PRRC responsibilities, document control, training, internal audits and management review.
Design and technical documentation
Design controls, GSPR evidence, verification and validation, risk controls, usability, software and change management.
Clinical evaluation and PMCF
Clinical claims, state of the art, equivalence where used, data appraisal, PMCF outputs and updates to the clinical evaluation.
Suppliers and outsourced processes
Qualification, criticality, quality agreements, monitoring, changes, purchasing controls and access to critical suppliers.
Manufacturing and release
Validated processes, environmental controls, traceability, acceptance activities, calibration, batch records and release authority.
PMS, vigilance and trend reporting
Complaint intake, reportability decisions, serious incidents, trend signals, PSUR or PMS reports and safety corrective actions.
Nonconformity and CAPA
Containment, corrections, root causes, systemic corrective actions, implementation evidence and effectiveness checks.
Labelling, UDI and registrations
Approved labels, translations, UDI assignment and control, registrations, economic operators and market-specific information.
Retrieval under pressure
Prepare evidence by trigger, not by folder name
The audit question usually begins with an event or sample. Your retrieval map should show where that event connects to the rest of the system.
Complaint file, investigation and reportability decision
Risk management, clinical evaluation, vigilance, CAPA, trend analysis and PMS outputs
Change request, impact assessment and release record
Requirements, cybersecurity, validation, risk controls, labelling and notified body notification assessment
Inspection record and material nonconformity
Supplier monitoring, purchasing controls, disposition, CAPA, affected batches and risk review
Literature review, PMCF result or complaint trend
Clinical evaluation, benefit-risk determination, PMS plan, risk file, IFU and corrective action
Supplier notification and change assessment
Verification, validation, risk management, technical documentation, purchasing data and regulatory notification
After the evidence gap
A credible response fixes the system, not only the sampled record
Notified bodies use their own grading terminology and response deadlines. Obtain the applicable procedure before the audit and use its exact format.
Contain and correct
Control immediate product or compliance risk and correct the specific evidence identified.
Define the true problem
Confirm the requirement, objective evidence, affected products, sites, processes and time period.
Analyse root cause
Explain why the system allowed the gap. Repeating the finding in different words is not a root cause.
Assess the extent
Look beyond the sample to determine whether the same condition affects other records or device families.
Implement corrective action
Change the system, responsibilities, controls, resources or competence needed to prevent recurrence.
Verify effectiveness
Define what evidence, sample size, owner and timeframe will demonstrate that the action worked.
Four-week readiness sprint
Use the final month to test implementation
Do not spend the final week rewriting the entire QMS. Prioritise high-risk gaps, recent changes, overdue records and the evidence most likely to be sampled.
Define scope and owners
- Confirm sites, products and processes
- Review the audit plan and prior report
- Assign process owners and deputies
- Create the evidence request route
Run vertical traces
- Sample complaints, changes and CAPAs
- Trace recent production and release
- Check clinical and PMS updates
- Verify supplier-control evidence
Interview and rehearse
- Brief staff on audit behaviour
- Test process-owner explanations
- Practise fast document retrieval
- Resolve conflicting information
Control the audit logistics
- Freeze the controlled evidence set
- Confirm rooms, access and escorts
- Prepare opening-meeting facts
- Run the unannounced-audit protocol
Address conditions that may affect product safety, regulatory reporting, certificate scope or the validity of released product before presentation and formatting issues.
Inside the audit room
Give every participant one clear role
A large audience slows the audit. Use a small core team and bring subject-matter experts in when the audit trail reaches their process.
Controls the audit flow
Coordinates the agenda, introductions, breaks, rooms, site access and availability of process owners.
Communicates with the auditor
Clarifies questions, confirms requests and prevents several people from answering simultaneously.
Explains the real process
Describes responsibilities and decisions, then supports the explanation with current objective evidence.
Retrieves controlled records
Logs requests, checks document status and supplies the exact record without opening unrelated material.
Preserves the factual trail
Records samples, questions, documents shown, commitments, potential findings and required follow-up.
Manages emerging risk
Regulatory and quality leaders assess ambiguous issues and approve any commitment made during the audit.
Audit-day control
Eight checks before the opening meeting
Select the items as the team confirms them. The checklist resets when the page is reloaded.
Risky audit habits
Four approaches that weaken credibility
Audit behaviour does not replace compliance, but poor behaviour can make a manageable evidence question unnecessarily difficult.
Answer the question directly, then explain the process and show concise objective evidence.
An identified, assessed and controlled issue is more credible than pretending that no problem exists.
Late uncontrolled changes create inconsistent procedures, training gaps and missing implementation records.
Auditors expect the people responsible for the process to understand and implement it.
Practical questions
Questions before the audit
The notified body’s contract, certification rules and audit procedure remain essential because classification terms, logistics and deadlines can differ.
No. A quality management system audit evaluates whether the manufacturer’s system is appropriately designed, implemented and maintained. A technical documentation assessment examines device-specific evidence. The two activities are connected because auditors may use a device, complaint, change or production batch to trace how the quality system operates in practice.
For surveillance under MDR Annex IX, the notified body performs periodic audits at least once every 12 months. The precise programme, duration and sampled topics depend on the conformity assessment route, certification scope, sites, device portfolio, previous results and the notified body’s procedures.
Yes. Under MDR Annex IX, the notified body randomly performs an unannounced audit at least once every five years at the manufacturer and, where appropriate, at suppliers or subcontractors. It may be combined with periodic surveillance or performed in addition to it.
An on-site audit remains the normal basis for assessing implementation. A notified body may use remote or hybrid elements where the applicable legal framework, MDCG position and its documented procedures allow this. A manufacturer cannot assume that an audit will be remote merely because records are available electronically.
The manufacturer normally submits containment or correction where needed, a root-cause analysis, corrective action, evidence of implementation and an effectiveness plan. Classification terms and response deadlines follow the notified body’s procedure. For an initial assessment, unresolved significant deficiencies can prevent certification; during surveillance they can lead to additional assessment or certificate action.
Yes. MDR Annex IX permits audits at the premises of suppliers or subcontractors where appropriate. The manufacturer should identify critical outsourced processes, maintain effective supplier controls and ensure that quality agreements and contracts provide the access needed for regulatory audits.
Primary sources
Check the legal framework and your notified body’s rules
The MDR establishes the conformity assessment and surveillance framework. The notified body then applies its documented certification and audit procedures to your scope.
Regulation (EU) 2017/745
MDR Articles 10 and 52, Annex VII and Annex IX requirements for QMS assessment and surveillance
European Commission notified body overview
Official explanation of notified bodies and their conformity assessment role
MDCG 2022-17 on hybrid audits
MDCG position on possible hybrid audit elements under the MDR and IVDR
Commission Recommendation 2013/473/EU
Audit, assessment and unannounced-audit principles for notified bodies in the medical-device field
Test the evidence before the auditor does
Need a focused notified body audit readiness review?
MDRC can run process interviews, trace representative records, review previous findings and build a practical remediation plan around your certification scope.
