Is it an onsite audit mandatory as part of ISO 13485 certification?

[Parul Chansoria]

I am a single person company, my home is basically my office and my product is a SaMD. Will the certification bodies require an onsite visit before they issue certificates? Or they can audit virtually using Zoom/Teams etc.?

@Mangafanga
In my experience, I have always seen ISO 13485 Stage II audit being an onsite one, however the Stage I audit can be remote.

This is also applicable for SaMD products, as the Auditors like to interact with the Innovators, in person, and want to see that the processes are implemented effectively. I understand that a lot of this can be done via screen share and zoom meetings, and they did that during the pandemic, but now they are back to normal.

If you are concerned about cost, you can request your Notified Body (NB) or Certification Body (CB) for a remote audit suggesting that all your developmental tools and documentation and processes are online or cloud based. If they do not agree, you can propose a hybrid audit, where they can reduce the number of days onsite. When you propose this to the NB, it would be wise to take a risk based approach.

All the best!
Parul
Regulatory and Quality Expert

 

[QuinnM]

Hi, Our company received our first 13485 certification a few months ago. We produce software for SaMDs and SaMDs. The stage 1 and 2 audits were remote; virtual. The first surveillance audit is planned for the end of 2024 and will be remote; virtual.

 

[Parul Chansoria]

That's good @QuinnM - I am sure you have made a good case for the NB to accept a remote audit.

 

[Ed Panek]

COVID caused a bit of a watershed among NB in my perception. Trying to send auditors flying around to meet people around the globe with a dangerous (or perceived dangerous) virus lurking caused this I think. If you are purely SaMD and there is no or little physical production, an onsite audit might provide little value vs a remote one.

 

[Hemoscd13#]

Hi, Our company received our first 13485 certification a few months ago. We produce software for SaMDs and SaMDs. The stage 1 and 2 audits were remote; virtual. The first surveillance audit is planned for the end of 2024 and will be remote; virtual.

Who was your Notified Body?

 

[QuinnM]

Who was your Notified Body?

We use DEKRA. Our products are AI/ML models, all software.

 

[Ed Panek]

Yes.

Running 13485 alone could be challenging. You would of course know 100% of the QMS but will you have resources to document everything? We have just 3 people in our group for a company of 30 and it’s not easy.

 

[Hemoscd13#]

My company is a 100% virtual developer of SaMD apps. My NB is insisting on auditing a physical location per the standard but we don't have one. They are suggesting that we rent office space for an audit. My concern is that the audited address on the cert will be different from the corporate address. Has anyone come across this issue?

 

[Chrisx]

Why can't they audit the corporate address? I have heard of very small medical device companies operating out of a person's home. The NB audits their home. Our FDA inspector also told me she had also audited a person's home. I think most regulated markets require identifying an address on the label. In the US, you have to register with the FDA, which includes an address. I'm not sure there is anyway to commercialize the device without an address somewhere. Regulatory authorities are going to want to know that there is some location where someone will be held accountable for the safety and performance/effectiveness of the medical device, even if it is SaMD.

 

[Hemoscd13#]

Since we are a 100% virtual company we don't have a physical address to audit.