Help on accessing alternative formats, such as Portable Document Format (PDF), Microsoft Word and PowerPoint (PPT) files, can be obtained in the alternate format help section.
Module 2
Information about the manufacturer
Information about the manufacturer
Manufacturer's name and address
Company identification number
Corporate Identity of the manufacturer
Description of the manufacturer
Scope of certification
Identification of critical suppliers
Contact person for the Quality Management System (QMS)
Status of any relevant QMS certification
Exclusions and non-applications of requirements in the Quality Management System (QMS)
The audit report should contain information that unambiguously identifies the manufacturer under audit.
Key facets to address include:
The name and address of the manufacturer subject to the conformity assessment procedure, as it will appear on the registration certificate, should be included in the report.
This should include the address of all locations/facilities covered by the registration and included on the certificate.
The Health Canada assigned company identification number (CID) should be included in the report in association with the name and address of the manufacturer.
This can easily be obtained from the Medical Devices Active Licence Listing (
MDALL).
If the manufacturer has no licences (and therefore no CID), an annotation of 'N/A' (or 'not applicable') should be included in the report.
When a manufacturer has multiple names or identities these should be clarified. This clarification also extends to any relationship with sister, parent and daughter companies, including subsidiaries, acquisitions, business units, and joint ventures.
When preparing this section, auditors should be mindful to frame the explanation in the context of the QMS being audited and its associated scope of activities.
This section is not intended to be an in-depth analysis of the corporate holdings of the manufacturer. It should however address the following questions:
This item can be omitted from surveillance audit reports if:
Examples:
"<Company> operates as <Company> in Canada but also markets some of its products under <Other Brand> in the US."
"<Company> operates as <Brand Name>. Devices are sold under the <Brand 1> banner in North America and Japan and <Brand 2> in Europe and Latin America."
"<Company> is a wholly owned subsidiary of <Big Group> and labels its product as <Company>, a <Big Group> company. Devices are sold under the generic <Big Group Brand> trademark owned by <Big Group>. <Company> uses marketing and distribution channels of <Big Group> for all of its products."
See Study Guide for further examples.
The audit report should provide a clear and accurate description of the manufacturer and its activities. This description should address the following points:
The number of employees should be reported. This should, where applicable, differentiate between full-time and part-time employees. The report should also mention temporary employees and off-site employees.
The description of the manufacturer should indicate the number of shifts. Where there is a single shift, the report should state as such.
If more than one shift exists, the report should detail the time periods of the shifts (start and end times) and the number of employees on each shift.
The report should include an overview of the activities and processes undertaken in the manufacturer's facilities.
This should address major functional areas (for example, design) as well as major manufacturing/production activities (for example, coating, moulding, assembly, fermentation, packaging, etc.).
Key outsourced activities should be mentioned in the overview of activities and processes.
Examples of this include:
The name and title of the most senior manager(s) of the location(s) audited should be included in the description.
If the conformity assessment procedure covers more than one physical site, all covered sites should be described. A description of the relationship between sites, their roles within the QMS and any shared QMS functions should also be included.
For surveillance audit reports, the description of the manufacturer can be limited to those parts that fall within the scope of the audit.
Example: (See Study Guide for further examples.)
"<Company> is a small privately-held company employing 42 people on a single shift at its <City> location. The company designs and manufactures acrylic teeth for restoration. All activities are performed in-house in its 40,000 square foot facility. Key activities involve production of polymer powder, mould design and machining, injection moulding, and setting. The most senior manager at the site is <Name>, the Chief Executive Officer and owner of the company."
The report should include the scope of certification as it appears on the certificate of registration. This includes activities and generic medical device groups or families.
Where the scope of certification changes during the audit (as in during an expansion to scope), the report should clearly identify this and allow the reader to determine what the scope of registration was before the audit and what it is after the audit.
In the case of a certification involving multiple locations, the report should provide the overall scope of certification as well as the site-specific scopes.
If the scope of listing is prohibitively long, it can be contained in an appendix to the report and referred to in the body of the report.
For guidance on certification scope, see GD207.
The report should identify the name, address, and product or service of critical suppliers that provide products or services used in the audited processes. The involvement of a supplier can be through an outsourced process such as sterilisation or software development.
Critical Supplier:
A supplier delivering materials, components, or services, that may influence the safety and performance of the product.
See definition in GD211
The report only needs to include those suppliers that are involved in the audited processes.
The supplier of parts/services for a production line that is not part of the scope of the audit (that is, not audited this time) does not need to be included in the report.
However, they may still be mentioned/included if they were part of the sample used when auditing supplier control.
The identification of critical suppliers can be done under a separate heading or integrated in the audit summaries (audit trail).
The name and contact information of the contact person for the QMS should be included in the report.
This person is not necessarily the QMS management representative. Nor is it automatically the Quality Manager.
Contact information should include a phone number and/or email address.
If not apparent anywhere else in the report, the status of any relevant certification or registration of the QMS of the manufacturer should be listed.
Relevant certifications are those related to medical device regulatory schemes (e.g. EU Medical Device Directive) A certification does not have to be the subject of the audit of the report to be relevant. A certification should cover the same manufacturer, facilities, and devices (or very similar ones) to be considered relevant.
'Status' means whether the certification is in good standing or is under suspension or if it has been withdrawn.
Where the manufacturer has claimed an exclusion or non-application of requirements, these should be identified in the report.
The report does not need to include the justification for non-applications (although auditors are welcome to include this.)
Reminder: