'Burn Them Out, Turn Them Over': Add Auditor Exhaustion, 'Boutique' Approach To The List Of Notified Body Challenges

From not enough notified bodies and auditors, to a slew of new or updated international standards and regulations coming into force, the medtech industry is facing a number of NB challenges – and now they can add auditor burnout as a concern. "Because some of these notified bodies have such huge demand, they're burning people out really fast," industry expert Kim Trautman says, noting that device-makers can expect to see "boutique" notified bodies popping up over the coming decade. Also: Johnson & Johnson's regulatory director explains how the dearth of notified bodies and auditors is affecting the global medical products giant.

In the past, when Johnson & Johnson's Philip Steele needed a notified body to audit one of the medical products giant's many worldwide facilities, all he had to do was pick up the phone and select a date.

But nowadays the company's director of regulatory compliance has trouble booking audits – especially for the Medical Device Single Audit Program (MDSAP) – and it isn't getting any easier for J&J to gain a foothold on an NB's increasingly tight schedule.

"I cannot get on the [notified body] schedule – and we're J&J. We usually have the pull. But even I don't have the pull to get us scheduled." – Philip Steele

"We took about 45 of our sites and put them into MDSAP; those 45 sites are now going through their surveillance program for the program," Steele said in May at MedCon 2019 in Cincinnati, OH. "But there are scheduling delays. I have a couple of sites that I can't even get on the [NB's] schedule.

"Just, physically, I cannot get on the schedule – and we're J&J," he marveled. "We usually have the pull. But even I don't have the pull to get us scheduled."

MDSAP, created by the International Medical Device Regulators Forum (IMDRF), allows firms to undergo one audit by an accredited third party to satisfy quality regulations for the US, Canada, Brazil, Japan and Australia.

Further, Steele says, "we cannot get the auditors that we need. For example, at some locations we do sterilization on site, and we need a sterilization expert to accompany the audit. That person's so overbooked that we can't get them on the dates that the lead auditors are available."

And J&J has begun receiving MDSAP audit plans from its notified body a scant seven days before an audit, which poses time-crunch problems for the manufacturer as it prepares to be audited.

"Because of the many challenges that the notified body is facing, audit plans – which we used to get a month before – are now coming a week before," Steele said.

It's no secret what some of those "challenges" are: not enough notified bodies, not enough auditors, and too many new regulations coming into force soon, including the EU's Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR) in 2020 and 2022, respectively. (Check out Medtech Insight's interactive global regulatory timeline here.)

During a separate discussion at MedCon, Bassil Akra, VP of notified body TÜV SÜD Product Service, confirmed that NBs are indeed swamped.

"We're going to have a tough time, all of [the notified bodies] together, because the waves are coming. We don't have just the Medical Device Regulation that is coming in – we are also dealing with 13485," Akra said.

Device-makers use international standard ISO 13485 to ensure quality systems compliance with regulators in a variety of countries, including Canada, Japan, Australia and the 28 member states of the European Union.

Firms that use the standard had to be certified to the 2016 version of ISO 13485 by 1 March 2019, or risk enforcement action.

Firms would "call me and ask, 'Can we have MDSAP tomorrow?' And it's like, 'No, no, no, you can't have it tomorrow. This is not how it's done.'" – Bassil Akra

Adding to the regulatory pain is apathy on the part of device-makers that believed they could wait until the last moment to schedule an audit – especially firms that had to be audited to MDSAP at the start of 2019 so they could continue selling product in Canada. (MDSAP replaced Health Canada’s Canadian Medical Devices Conformity Assessment System [CMDCAS] program on 1 January.)

When it comes to MDSAP, "most of the manufacturers said, 'Oh, we don't care. We don't sell in Canada. It's not important for us. We will not do it,'" Akra said. "But by the end of last year, when they got nervous, all of them wanted to have an MDSAP audit immediately. They'd call me and ask, 'Can we have MDSAP tomorrow?' And it's like, 'No, no, no, you can't have it tomorrow. This is not how it's done.'"

'It's Only Going To Get Worse'

Like a medtech Paul Revere, industry expert and former longtime FDAer Kim Trautman has been cautioning industry over the past few years about the "perfect storm" of regulatory convergence. (Also see "'Perfect Storm' Arrives: Clock Ticking For Device Firms To Conform To ISO 13485, MDSAP, EU & ASEAN Regs" - Medtech Insight, 11 May, 2017.)

"And it's only going to get worse," Trautman, who is executive VP of international regulatory compliance services at NSF International, warned at MedCon. "The next five years will be even more challenging."

That's because, as notified bodies hire more auditors to cover their ever-increasing workload, there will be a "learning curve" for those auditors that could spell frustration for companies.

"Because some of these notified bodies have such huge demand, they're burning people out really fast." – Kim Trautman

"With the influx of [new auditors] that are coming in because of the need for the EU MDR and IVDR, that influx of people and that learning curve is going to seem very perpetual and redundant for manufacturers," Trautman said.

And she offered another dire warning: "Because some of these notified bodies have such huge demand, they're burning people out really fast. Just go look at resumes. You'll find people that are notified-body auditing for about two-and-a-half or three years, and then they get really tired of being on the road 24/7. It's just exhausting, and so they burn them out, turn them over."

That, she said, will likely lead to "constant learning curves."

TÜV SÜD's Akra confirmed that his notified body is "hiring like crazy" in a recent Medtech Insight Q&A feature. (See sidebar story above.)

"As a notified body, we have been hiring for the MDR and IVDR for the past three, four years. But it will not be sufficient because we can't find all of these experts. They are not available out there," Akra said. "The market is getting really tough. And this is the point where we expect for IVD to be a big problem because there will not be enough notified bodies.

"And this is where I believe that IVD is going to be the biggest big bomb that we will see in the next two years," he added. "A large number of manufacturers didn't even recognize the impact of the IVDR, which is actually much bigger than the MDR."

And The Hits Just Keep On Coming

Even more trouble is on the horizon for industry after London-based notified body Lloyd's Register Quality Assurance (LRQA) announced on 12 June that it would withdraw from the NB business for the current EU Medical Devices Directive (MDD) and In Vitro Diagnostic Devices Directive (IVDD) – as well as for the new MDR and IVDR. (Also see "Just Three UK Medical Device Notified Bodies Left As LRQA Pulls Out " - Medtech Insight, 13 Jun, 2019.)

"Following recent market developments, we have made the strategic business decision to exit from these services. We are also withdrawing our application to become a Netherlands-based EU notified body for these services," the NB said in a 13 June statement.

"We will, however, continue to provide ISO 13485 and Medical Device Single Audit Program (MDSAP) third-party certification and medical devices-related training to clients both in the UK and worldwide."

'Boutique' Notified Bodies

NSF's Trautman says industry will begin seeing more and more "boutique" notified bodies pop up that will specialize in one or two specific types of audits.

"Notified bodies have not all applied to be certified under the EU MDR and IVDR for all product codes because they have to have a minimum of two experts for every code they apply for – and that's why you're going to see over the next decade an advent of a lot more boutique notified bodies," she said.

"For a while, everyone was trying to consolidate notified bodies where they could, and now it's just simply not going to be possible because there might be a few big [notified bodies that audit to] all the product codes, but they only have a certain amount of capacity, especially when we get into the IVDR – there are 80 new product codes in the IVDR."

Trautman warned that not every notified body that gains an IVDR designation will be able to audit to that many procodes.

That means firms "may see some variability, because you may see this advent of boutique notified bodies, depending on the different codes," she said.