How to Prepare for Your External Audit Inspection feat. Karandeep Badwal

Hello!

Officially.

Hello! You're on mute. Ask.

How much.

Yes, yes, I can hear you.

Okay, brilliant, perfect.

So let me ask you, Shawn, did did you sign in? You signed in, as you obviously, and I signed in as you? I didn't know that we could both do that.

I don't know. Last week I had asked Dylan to start the call, and he forgot so.

No, no, but I I did, I said, Don't worry about.

Yeah, I I was worried, but it worked out fine.

Starters. I'll become Joe Hage. But But I realized last week when I was you. Look at that. Remember my name for future. That'll be interesting to see if you show up as Joe H. Next time. If you haven't figured out yet, Karen Deep. I'm I'm now partnering with Shawn, which means I'm saving $750 a year, and he is not.

In other words, I'm paying for zoom.

Now Francesco is here. Is that really him?

Bye.

It's is Francesco. Really, Francesco.

I don't know.

Hi, Bruce.

I wasn't expecting him, but he may be here.

Well, I'm gonna invite him on as a panelist and see if it is.

Joe, you're in a different room.

I am. I'm in a hotel today.

Oh!

Hyman, you have to talk to us about that sweater.

Oh, I'm off to the Christmas party in an hour. All my colleagues are already on the, on the drinks.

So you have one down. You brought one down with you. Yes.

No, I don't have anything we have to party it's already going, but it's until very late tonight, so I don't mind in your.

Foreign land. There you wear orange for Christmas.

Well, this is just the camera showing the one kind of red.

Is it red?

It is red.

Well.

Very orange.

Blame. HP. You know the Packard.

Okay.

Put them on camera.

I don't know, Joe. It looks red to me. I don't know.

I got bright orange on my screen.

Bright orange.

It's that blue dress all over here.

Vivid.

Very good.

Become a panelist. I don't care what you're doing, or if you draw, don't be like that, decline to be promoted. We want to see your face inviting you again. I was in Vivek's town for for Thanksgiving, and he was just unavailable. Fuck! Is that, Eddie? Are you praying a little bit for us?

I'm starting my holiday beard.

No, but you look a little whiter, maybe, like a white Christmas thing going.

Yeah, I'm getting older.

Yeah, I know.

We all are.

At some point. I'm going to try the shenanigan of of signing in as me. and seeing how that works. I guess now that Sean's here. I could. I could just do that. Hmm! I'm not sure.

Are signed in, as you.

No, no, I'm not actually. If I were to leave here, I'll leave a a comment in the chat. I there's sean space. I changed my name from Shawn because I signed in as Sean, because now we're sharing a zoom thing for money saving purposes. You already know about money saving. How are you doing.

Well, I'm I'm recovering. I don't know if I told the group, but I had open heart surgery like a month ago.

Oh, moronomy.

Yes, you're a long grab. The bike.

Yeah, yeah, exactly. So. I've been at home. Recovering. I was at 7 days in the hospital, and then the rest of the time I've been home recovering, and so just really starting to get out and be able to to do some things.

Well, glad you're on this side of it, Joe.

We love you.

Me too.

Were you able to, at least before you went under like, get a good sense of what medical devices were being used, and.

Yeah, absolutely.

Was there any Davinci going on in there, or was it all human.

No, I had a new valve. I had a aortic graft. I had another ablation.

Please.

So it was basically the 100,000 Mile Service.

That's fine!

And I'm just should be better than before. Actually.

If that was possible. Maya has returned. Everyone.

Hello!

Are you gonna see the likes of your dad on one of these calls.

Oh, sorry!

Are we gonna see the likes of your father on one of these calls.

Oh, I will have to ask him. Possibly. Yeah, I can. I can put a little book in his ear. Yeah.

Yeah, we we haven't seen any in a while. And, Susie, you've got your Christmas haircut already. It's a little early now, with 2 weeks to go.

Joe, you're amazing.

Actually no, I don't. I don't have my hair cut.

No.

Yeah. Well, I got it quite a few weeks ago. If that counts styled differently, maybe I don't know. Yeah, maybe that's it. Maybe.

Maybe that's it. That's the stylings of someone ready to get FDA clearance. That's what you begin to look like when you get closer to commercialization.

Hope. Yeah.

What are the dates? Do we know? I know FDA is a moving target, but.

Well, we requested an sir, and that we requested it about 2 weeks ago, and and because we have, we want to ask them. If our test methods are are appropriate.

Let me add, here, Susie SIR. Stands for.

I don't know what it stands for, but it's asking the FDA if

Submission, issue, request.

I knew she'd type in. Thank you, Michelle.

Thank you, Michelle. It's basically asking the FDA if our current methods of responding to their 2 questions is correct. And once so we're probably we are kicking it off in January. We anticipate we should be done by March, and we'll respond to the FDA before April, which is mid-april, is when we, our deadline is. And yeah, we should be approved by May.

Alright, because, you know, I need.

Let me!

I need that that

Now we won't be on the market. We're gonna conduct a pilot study, but and we will be on the market by the end of 2025 fingers crossed. That's pushing it. But that's my plan.

And do a I don't know what your policy is for investors. Do we get all of the frogs we want for ourselves and our friends.

Absolutely.

Okay.

Yes, yes, and free.

And involved in some things and and some investments that have not yielded anything but product. Actually. So I know that's something that sometimes big time companies like yours does for its investors.

Oh, yeah, yeah. Appreciate it.

I'm waiting for for. Alyssa has shipped me some screws, too. and maybe Brian will give me like a a pain prognosis to keep me off of opioids. Among all of these things I'm just trying to avoid the 100,000 mile service that you're just having.

Yeah.

It's.

I would suggest you avoid it if you can. Well, I'm glad you're recuperating. Yeah.

Better York.

Yeah, I'm good. I'm I'm getting better already.

On a brighter note. Karen deep looks. Well, I don't think anyone's operated on him except himself. He's a big, he's a big athlete. You work out all the time, don't you? Yeah. So I'm usually in the gym 3 times a week, and I tend to do M. And a couple of times a week. You're probably the fittest person on this call. I don't know about you, Flutie, do you? Oh, do you work out.

Yeah, yeah, I try to go but 4 or 5 times a week as well.

Oh, okay.

I don't know if Karen Deep's gonna make it across the pond, but I'd like to see you 2 arm wrestle. If that can come well, it will do so in May, in California.

And, Maya, you're you're consistently working out, too. Right?

I don't know if I would call it consistently, but I do try, you know, a couple of times a week.

How about you, Hyman? You're you're a bicyclist.

No, I'm a runner. I try to run each day, but.

Didn't you.

I have a foot injury.

Oh, you speed! Skated from the airport to.

Yeah.

To the hotel.

That would be. It was roller skating, not speed, skating.

Okay. But still, I think you're the only guest who provided his own travel like that.

I did. I? Asked the the valet person. There. Can you park my my wheel somewhere here? That was a mistake. He charged you 35 bucks for that on a bright notice. Also, it's in the in the spirit of Karen Deep's talk. We had our Iso, 3,485 audit finished today. There were no findings. Okay.

Late.

Well done!

Yep.

Maybe we have the wrong guy giving the talk.

No.

Well, that's a good setup for our friend Karen Deep. What are you gonna teach us today?

So today I'm going to be talking about how to prepare for your external audits and inspections. Now I know the philosophy is that you should always be prepared for an audit, but there's no harm in just doing a little bit of preparation and making sure your day goes well. But yes, it is a philosophy that I stand by. There's also the concept of unannounced inspections or unannounced audits. So yes, you should always be ready for an audit. But if you're in a position where it's something that's scheduled, it's always best practice, regardless of how. Think how well you think that you're doing that you do some form of preparation, because without that certification

you cannot pass regulatory, and if you do not have regulatory, you cannot legally sell. So it's definitely something that you should invest in. Now, initially, I was, gonna leave this as a bit of a open show. Is that someone talking? Okay. sure. So initially, I was, gonna leave this as a bit of an open talk. But I think it's beneficial to have some slides. But the way I'm gonna structure this today is, you know, if anyone wants to interrupt me in between or throw a question, you know, feel free to do so. I'm happy to keep this as an open talk. So I'm just gonna get my slides ready. If you just give me a second.

we share perfect. Is that visible and legible for everybody.

Absolutely. Yes, thank you.

Excellent. So yeah, so the topic of the talk today, of course, is how to prepare for your external audits and inspections. And what are the common issues and how to avoid them. So the summary of what I'm going to be talking about today, of course, is what are the things that you can start doing straight away to start preparing for your internal audits and or inspections. Now, what's the difference between an audit and inspection? And this is something that we can talk about with the differences of the EU and the Us. In the EU, and even the Uk. For the matter we have authorized and notified bodies. These are bodies appointed by the Union to come and conduct audits for you.

whereas when you have something like the Us. FDA is the FDA themselves come in to do, and they don't do audits on you instead. What they do is inspections, but the principles between them are more or less exactly the same. So process of which you'll have to prepare for an audit or an inspection is more or less the same right? So disclaimer. This is a very important one. So again, external audits are critical for regulatory compliance. But, like I said, you should always always be prepared for order any given time anyone is familiar with the EU as well. A lot of companies, especially if there's any startups listening here today.

Once you achieve your Ce mark, or even your Ukca mark. If you go and read the regulations, it specifically states there that at least once every 5 years they will come down and conduct what's known on you as a unannounced audit. Now I've been on the other end of it. I'm pretty sure there's people in school, and maybe been at the other end of it. It's where the auditors knock on your door one day, completely unannounced, ask for the name, and come and conduct an audit on you, so you should assume and be ready that an audit can happen at any given time. and always make sure that your quality management system, your regulatory everything is up to date, and it's important to note that when you have these unannounced audits, let's just say all of your regulatory staff are off.

You cannot use that as an excuse. And if you say, Hey, the regulatory guys or the quality guys are here, I can't help you. You will immediately fail that audit. Hence the importance of teaching quality and regulatory throughout your whole organization, and make sure that there's just one person or one department, because if that person is not there that day. When this unannounced audit happens, you can potentially fail the audit. So that's something that I put down as a disclaimer. So when it talks about the importance of culture as well, it's important. So if we go back to the previous slide, it's important to encourage employees to view audits as opportunities for growth rather than threats. You need to understand that when you're having your audits or inspections, they ain't necessarily turning up to look for faults. This ain't the police, or anything like that. They're just there to make sure that you're compliant, you know, if you're a medical device company. The last thing that you want is to go out and start causing harm because you're contradicting yourself. The whole point of working in Med Tech.

See? You change how people say diseases, injuries, etcetera. And the last thing you want is to be noncompliant, or maybe some of your process. They have potential risks. So it's something that's very, very important, and something that you should very much be aware of. So another thing as well that you think of as well stay up to date with the regulations. So of course, you have the EU Mdr. You have FDA. Cfr. But there's also various different white papers released. There's also guidance documents by the FDA within the EU. We have things like the Mdcg. We have team notified body. It's important that you keep up to these with these things, because the regulations can be sometimes gray areas. It could just be a couple of lines. It may not necessarily be clear, but it's the standards and guidance documents that tell you what this sort of best practices effectively are. So make sure you do that. So the key takeaway. What I'm going to say here is.

you know, if you run an organization and you have some onboarding process. Have a piece that's dedicated to quality and regulatory. Have a piece that tells people what an audit is all about. And even just before the audit, you know, go around your organization regardless of the size, maybe conduct a meeting and let people know, saying, Hey, you know, on this particular day we're going to have an audit. You may be questioned. This is what you can do. And another thing that I've seen in many organizations, of course, is if somebody's questioned on an area or a space which is outside of their sort of regular day to day work.

There's nothing wrong with you turning around and saying to the orders, and Hey, you know that's outside of my scope of work. But if you want to know more about this, go and speak to so and so person. And it's important that people know how to answer that question. There's nothing wrong with saying, Hey, that's out of my scope. But this is the person that should speak to. So it's important that we drill that into the company culture. So it goes down here. It's all to do with preparation. Preparation is key number one, of course, is organize all of your documentation required for the audit. Now, this is a very, very interesting.

When I walk into organizations, I say to them, Hey, guys, how do you go about backing up your documentation. It's automatic and sharepoint, etc. It's automatic in G drive. Okay? Great. What if Microsoft shutdowns tomorrow? It can happen if anyone remembers in August 2020. There was a point where Google Drive went down for a few hours. Imagine you was in the middle of an audit. You can't say to the orders, and hey, you know we can't access our files now for the next 4 h. So one trick that I've always employed is before an audit happens. Do a manual download of all your documents and records, maybe the night before.

So at worst you may be lost 12 h worth of records that may not be fully up to date, but always manually do that. Anything can happen, and especially we live in the modern age. You could have cybersecurity attack. Anything can happen that makes means that you can't necessarily access your files. So make sure you have all your documentation required for the audit. Also, like I said fair. So it might be that you're relying on the quality and regulatory guide to lead the audit. What's it to say? They don't turn up to work on Monday. Anything can happen. They might fall ill. They might get caught in traffic, you know. You can't turn around and say to you, or to say, hey? Sorry the guys

so make sure that other people in the organization have access to the documentation, but not just that. Know what specific documentation that they should be looking for and all the records. The next one, of course, is conducting an internal review to ensure your process aligned with the regulations, so it doesn't necessarily have to be a full blown internal audit. Maybe just a light version of it and make sure everything is up to date. Has there been changes in standards. Has there been new guidance documents put out there? Has there anything like that? And I think often the best way of doing this in a recorded is, of course, management review meetings.

Why not conduct a management review meeting? Maybe one or 2 weeks before your actual audit? Because you now have a recorded document, a recorded record of how the state of your quality management system is, and any areas of concern. If you spot any areas of concern, you can open a corrective action. You can start doing things like that, because when you're sitting in an audit, and there's an issue that might be identified if you've already opened a corrective action on it, it shows that you've already identified the issue and are doing something about it. And that's showing something to the auditor rather than trying to hide that issue. So you know, there's nothing wrong with having corrective actions open.

and I think with a lot of companies is, they often get the Kappa process mixed up. They think the less cap as they have the better off they are. Now. There may be a certain element of truth when it comes to corrective actions, but not preventive actions. Preventive action shows that you're being sort of proactive. You're trying to actually look to see where the issue actually is, whereas a corrective action is, you're fixing it after it's already happened. But again. the difference between a major minor, not conformity, and maybe a major nonconformity if you haven't addressed it. Whereas, for example, if you're doing something about it, and generally that can fall to a minor nonconformity, or in some cases may not be a nonconformity. Also, by all means, if you spot any issues, just open any corrective actions, stop putting some actions in place.

and of course do compliance checks as well, depending on what the audit is about. Is it an EU Mdr audit? Is it an Iso. 1, 3, 4, 8, 5 audit. Is it an FDA audit, or is it rest of the world audit? And then, of course, the main thing about it is, of course, establishing a checklist for the key areas to be covered in the audit. What is the audit scope? It may not be that the audits covering every area. It may just be one of your manufacturing sites. So for your if you're a company that has maybe 10 different manufacturing sites, and maybe this particular day is just going to be that particular manufacturing site.

What are you doing in that manufacturing sky? What is the scope of your certification and just checklist basically for what the key areas are doing. The audit and also the key personnel. And my recommendation here is always have a delegate for every process you have in your company. and it's important that you write that in your procedures as well. So don't just say the Quality Manager will be doing. X. My recommendation is the quality management or a suitable delegate. What that means is that tasks can be delegated so it might be. The quality manager does everything. But let's just say they're not available. They're on vacation. Or maybe they've got some training. Make sure that there's another person that they can delegate it to, and maybe it's better word could be a suitably trained delegate. So it's not just somebody that maybe works in a different department. And then you hand your quality management system to them.

It's basically somebody's been suitably trained to do that particular task. That's the most important piece here. Make sure that they're trained to do that. And the wording that's often used in the regulations and standards, of course, is competence. What is met by competent? It doesn't necessarily mean that you hold a certificate. It just means that you're able to do the job. You can demonstrate that through training records you can demonstrate that through certifications, etc. And these all important things to consider. So those are my key takeaways. Here for us is the pre preparation. Pre-preparation is key. You can do things like mock audits, etc, and one of my favorite techniques. If you're working in a particular sort of traditional brick and mortar business, which is majority of what medical devices are, why not have the quality management? Go around and speak to the people as if they were the auditor.

Throw a few questions at them and see how they react. Now, if somebody can't answer the question, it's not necessarily their fault. They shouldn't be in trouble for it. Then you identify. Okay. This person maybe needs a little bit more training, or maybe they don't understand certain things, because the language that an auditor speaks or an inspector speaks, maybe slightly different to the language of which you speak internally. It could be that they know the answer to the question. But maybe just don't understand the wording, so just go around and make sure people are trained and fully aware what's going being on. And that's basically it.

So having a scribe. So this one is not necessarily in preparation. Again, you should prepare a scribe. What I mean here is this is really a really really good tool of which I've always used an audit. So if I'm sitting on an audit, it's hard for me to sit down and make notes of what the auditors asking or the inspectors asking for. But it's really good to just have someone in the room almost like, you know, if you go into a courtroom, you know, there's always be someone sitting in the corner taking notes. Just have a script and dedicated individuals to document the whole process, you know. At 9 o'clock they asked for this document. Then they went to this environment. They did this, they did that, etc. And you can even put this in some of your public pages within your own internal company. So people can see what they

audit. Process is in real time, and they can see what the auditor comments are. So, for example, if they're saying that in a few minutes time the auditor mentioned that we're going to be going to the production environment. Then maybe somebody in production and see. So the auditor is going to be here in a few minutes. Maybe we need to readjust some work, and maybe we can get some records ready, etc. So that's something that you need to do as well. And then, of course, these notes come in very, very useful post audit follow-up. So if any of us ever been on an audit or inspection, and there's not conformities found. You're usually required to give some reasoning or write a report back to whoever the inspecting body is at the time to let them know what sort of evidence you're going to be providing, or what corrective actions effectively

so mock audits. Now, I think this is a really really helpful tool. So again, they are internal audits. But what I'm talking about is a mock audit. Now, the difference here with the internal audit is, you're just focusing on certain areas, etc. A mock audit is treated as if it was the actual external audit. How would it happen. The auditor comes in at 9 o'clock. When the inspector comes in. At this time you go and ask you asking random questions and need to remember, this auditor inspector does not know anything about your company, or maybe just knows the bare minimum. Treat it as if you don't know anything about the company and come up with questions. What typical questions are you going to be asking the different members of staff when you're going around and just get people used to that audit language, you know, for example, to certain words, etc.

and then use this to basically identify any gaps. And then this is where you're going to start seeing which particular members of staff, or which particular areas of the company basically need time to work. But it's also about building confidence with your team as well. So once they've got to this mock audit scenario, and they dealt with the pressure, and they dealt with the certain types of questions. When the real day actually comes, they know how to go about it, whereas if you have somebody who's in the company particularly, let's just say that somebody's just come fresh out of college or fresh out of school.

and they've only been working in the company for a few weeks, and all of a sudden, there's this external audit. They're probably not going to know what to do, and that's not their fault, but it's if you train them before and saying, Hey, look! This person may ask you these types of questions, and this is what you need to do. It gives them that level of confidence. So when they get up that day, and they're in the company, and they're being inspected, or they're having questions throughout them. At least, then that person knows what to do so again. Key here is communication with auditors. As well.

Be very careful, and listen to what the auditor says, and give them the information of which they ask for don't start going off onto different topics and other things and start throwing them extra records and things that's usually a recipe for disaster. So if they ask for a specific record. give them that record. Don't just start giving them other things, and you know, trying to impress them. Just give them what they've asked for. That's very important. and I'm not saying that you should hide anything but avoid volunteering unnecessary extra information, you know. If they say to me, hey? Can you show me your risk management report? You can do that, but they don't start pulling out your pulse, market surveillance and various sort of different things complaint, logs, etc, unless they ask for that. But by all means give them what they ask for.

But don't just start throwing extra things up. So I've just seen.

Sounds like the same advice. You give somebody on the stand.

Yeah, effectively. Just answer the yeah, it can. It goes back to a courtroom. Your solicitor will say to you, look, just answer the question that you've been there, and don't start saying extra things. But by all means, if you ask, then answer those questions. So that's very important.

One of the things that I.

Very clear and concise.

Nelly.

Sure. Go ahead!

One of the problems I have with new auditees is they? They think they know what the auditor is gonna ask, and that they can answer the question before it's even asked, and it's like that. And it's like I have a slide deck for teaching people how to be in an audit, and one of the very things I say to them, silence is your best friend, because people, the human nature has a need to fill silence with conversation, and it's and that's 1 of the downfalls with automations. And then I also say, Hey, if I kick you under the table, shut up as as a facilitator.

Yeah, Nelly, I very much agree with you on that point. So thank you for bringing that up. It's like, I know what you mean auditors do use that technique where they'll ask you a question and you answer it, and they just go silent. And then there's some people out there who just start saying, Oh, but we have this, and we have that, and that's how they catch you. So I'm not saying the auditor is here to catch you. It's just a case of they just go silent. And if you've answered the question fine, you know, if there's a little bit of a pause, that's okay. And by all means you can follow that up and say, You know, do you require anything else? There's nothing wrong with asking that question. If there's a bit of a silence. Do you require any of the documentation, and also be aware in the audit or the inspection? For that matter.

there's going to be times where the inspector or the auditor is going to be needing a bit quiet time. But you've given them a record, and they may need a few minutes, you know, to sort of get over it and have a look, etc. By all means use that time to maybe start preparing for the next part of the audit. Get some of your records together, get some examples together. and that's basically it. And another trick as well. I'm not trying to say auditors or inspectors are malicious in any way, but if they're saying something like Hey, you know, I need to go to the bathroom, or I need to go to the kitchen, etc. Accompany them.

because if they're walking around and they're on their own, they may spot something, or they may talk to somebody, and that particular person may say something, or maybe misguide them. So that's something that you should always be aware of. So, you know. Keep an eye on them as well. But again it comes down to the thing. The auditors are not there to look for faults. They're just here to make sure that you compliant, and if they find something wrong they will write that up. They're not just there to 100% find something on you. So, for example, like Luke was saying earlier. He had no nonconformities. I'm pretty sure the auditor wasn't just sitting there saying, Hey, you know, it's the end of the day. I need to quickly find a nonconformity. I can't go back with the black report. No, because the auditor is making notes and everything, and if they don't find any nonconformities with you brilliant.

And another thing here, and nonconformity isn't necessarily a bad thing. You know what I mean. It's kind of it could just be something minor that needs fixing. It's just something that's not there. And this is a trick. And I really warn people. So please be wary of this. You have the regulations, and you have the standards. But if you write something in your procedure to say that we are going to be doing XYZ. And you do not do it, you get a nonconformity against your own procedure. So what I mean by that is, if you start saying something like in your procedures. We're going to be doing management reviews every 3 months, but then you only be doing every 4 months. That's a nonconformity.

whereas if you have in your procedures something that we will do them at minimum once a year, and you do them every 3 months or 4 months. That's acceptable. So what I say in your procedures is, make sure that you have a little bit of breathing room either way. Don't over commit. Just put down, you know. We may do them more often, etc. But don't start writing things in your procedures, of which you don't necessarily think that you can follow, because then you get a Nonconformity, not because you've not been compliant to the standards and regulations. It's just that you haven't been following your own processes. So that's the kind of one that we need to look to as well.

Interesting question for you, Karen Deep is one of the things when I implement a Qms, I always say we're gonna do an annual with the option to do more right. I mean, I'm I'm working with a Qe. Person who classics. He's, you know. He's used to the old method where you prescribe a monthly, and you do a monthly one and all the rigor war, and I'm like trying to talk him out of it. I'm like, look, you're a new startup. That's something like your big Boston scientific and your Abbott laboratories would do. What would you tell that person? Because I really counsel? Just put one a month year in there, because that's acceptable for the standard.

My response to be with that person is, stop trying to impress the auditor and generate tons and tons of records of the audits. Just so it looks good on paper. But instead focus on what's going to benefit you as a company. Because if you're doing monthly audits, it's gonna cost a lot of resources and times, and being a startup, resources are scarce. Get those resources and allocate them elsewhere. So Natalie, like you mentioned once on your order. It doesn't mean that you do it once a year. If this particular person sees a particular area of concern, they can do these audits as much as often, but doing audits for the sake of audits, is not going to benefit the company, and it's just a waste of resources.

Thank you. I like that.

So education and training. So that's another one. So maybe that the question you just touched on to is educating people. Train your employees on the regulatory standards. Now I'm not saying, Go to the company and start saying, You know, these are the FDA. Cfr. 8, 20. This is Iso 1, 3, 4, 8, 5. Read the standards and become a regulatory expert. But just let them know what this stuff means. It's shocking to some companies where I walk in their medical device manufacturers, and particularly the old school brick and mortar businesses, and say, Hey, you know what are the standards and regulations that you work to. They're just looking at me blank now. I'm not asking them to remember it off by heart, but I would expect them to say something like well, I don't know what standards we work to, but if you speak to the regulatory manager or something, and you've got that big iso, 1, 3, 4, 8 5 certificate in the coffee room.

But then no one even knows what it means. So it's important that people understand that. Get the education piece in there. Let people understand that.

You know what's interesting during internal audits, I actually will do mock like. For example, I just did an internal audit for a company, and they've had the same auditor for like 5 years. And they've just basically tell them everything they like. Just open the door, said, Here's my dirty laundry, here's everything. And so I came in as an internal auditor, and I noticed it immediately. And I asked the executive management. Hey, I'm gonna I'm gonna come in hard and say, this is not how you're supposed to respond. And they go. Yeah, do that. And I literally had one person very resistant, like, I have a relationship with this audit, I said, I don't care if you have a relationship, you're exposing a liability for the company. So it's very interesting to talk about during your as an internal auditor, you can actually get an early warning sign that an auditee is a risk to the company. So at the end of an audit report I always give them. Here are your oddities that are at risk

that could cause a problem in an external audit.

I'm not going to mention the name of the company I once had a client, and they would make sure that certain people would take annual leave on the day of the audit, just because for that reason is that they may say something wrong, or get the company in a bit of a pickle. Now I'm a little bit against that. But then I get the same time. It's kind of yeah. I agree with you, Nelly. It's kind of. It's not necessarily that person's doing anything wrong. But if they don't give information that's really gonna put you in a bit of a pickle.

Well, when I say at risk, I'm usually saying these people need additional coaching. They need additional mentoring, because, you know, I never want to tell people to put them on vacation, but it's like this person, literally. And still afterwards they were getting ready for their inspection, and the management rep came in and did auditor training. And that person raises their hand goes. Well, I have a relationship. I'm gonna do what I want. And the the CEO went. I'm gonna have a meeting with you after this training session because it was something new. They didn't know they were. You know, they're actually a label company being audited by an iso auditor, and so they thought they were doing the right thing. And when I came in and said, No, you guys are creating more liability. It was interesting.

I won't apologize.

No, it's definitely a point. Again, it's it's all. It's all about dealing with people. The documents are there, the records are there. It's all to do with people, and that's generally where it can go wrong as well. Another one as well. Again, it's certification is a little bit of a pain point for mine. So I did, my Iso. 1, 3, 4, 8, 5, lead auditor out of spite rather than requiring it. And it was just because I was sitting in multiple audits, and I was constantly questioned. You know, for example, where is your lead auditor certificate? And then my argument was, this is, would you rather have a guy who has a lead auditor certificate? Who's doing no audits?

Would you prefer someone with no certification has done 100 plus audits. I know which one I would pick, but it was something I did out of spite. So, in my view, here is, if you are going to go down the audit path definitely. Go out and get these qualifications. You may not necessarily need them, but it's just something to keep the auditors a little bit quiet again, because the wording used is competent, not certified, not qualifications, just competence. And it's up to you to prove that one.

Yeah. So, Karen Deep, I've had the same experience, like I've had an auditor. Now, mind you, I have been doing this since. The 1st iso was released pretty well, not not the 1st one, but you know the second one, as as things kept going, and I was responsible for building the audit program around all the changes. And I have built and run audits, for. you know, going on 20 years now, and I had somebody tell me. Oh, but you don't have a certificate to do it. and I'm like, no, I have 20 years of experience actually doing it, not taking a test. And then then that also happened. seems like that. That's happened twice in my career. I'm trying to think of the second one.

But yeah, and so I would just recommend that there are several, you know, kind of inexpensive test that you can go, you know, if you know what you're doing, and and just kind of pencil with it. So you get something to.

Shut him up. But I also because I in the early years as well, Michelle, I actually implemented a training course with internal, and I have a slide deck and training program that I could put people through, and then Bqc. Will give you a shirt that if you've done it, internal audit training. Now, it's not the certificate that you know with the code, but what it is. It says I've been through training that shows competency. And so. and I built that into pretty much every audit program. So when I was at Boston 15 years ago, I actually know Abbott, I qualified a labeling person to be an auditor, and then he didn't get his iso cert for 5 years. But he he's now doing audits, that's all he does. But my point is, you don't have to go to an external program. You can do an internal one and give a training certificate.

saying this person satisfied our competency internally, and that's who counts. I don't know if that's helpful or not, but it works.

Maybe I'll get my. I have a guy on my team who probably has about 10 different types of certifications for all kinds of standards and all kinds of audits. Maybe I'll just get him to say he trained the trainer type situation E, even though I was the one that hired him right out of college and taught him everything he knows. So I'm gonna have him certified me that I knew what I was doing when I trained him.

They're just looking for evidence of training. That's what I've learned. And so when I 1st developed the program and I've gone through numerous notified body and FDA. And they're like, Oh, wow! I've never seen that. It's built into my procedure. It says I can try. I can qualify an auditor internally. And here's how I do it. They go through training and on the job, and they accompany somebody for so many audits, and then they get tested, and then they're, you know. So that's the program I put in there, and they're satisfied with that approach. I've never, I mean, I've qualified not in the last 5 or 10 years in the small business industry, but when I was doing the larger ones I qualified anywhere from 5 to 10 auditors internally.

and it stood up during an audit.

That's great!

Perfect. So yeah, Nelly Michelle, I agree with you on that one. It's I've seen examples of like that other companies where the trainer would just get some sort of certification to sign, saying, I've trained this person on Iso, FDA, Mdr. Etcetera, that's become acceptable. So yeah, I agreed. You don't necessarily have to do external ones. I just did that for peace of mind, you know, if it's externally done, and it's the sake of a few days and the cost of a couple 1,000. It was. Just get it out of the way, and then I could just peacefully continue, and especially when you're in the consultant space nearly. And Michelle, I'm saying as well sometimes when you're onboarding a client they want to see certificates, so in some cases you may lose a client just because you don't have the internal auditor or the external auditor.

or, for example, a recent one that I did a year and a half ago is eumdr practitioner. One of my clients was how bent on me having that particular qualification, even though it didn't necessarily need it. So I suppose, from a business points of view, it may still be worthwhile having these certifications, because it could help you secure that client.

Yeah, I mean, I have my search, too, and I've had them for a long time. But when you're starting out it's hard to figure out, do I spend my money on a cert class, or do I get internally so? I always start people internally so they're comfortable with it, and then recommend. They go through the certificate program.

Definitely. So. So another technique of which we can do is the post internal audit follow up so obviously review your audit followings and observations, you know, implement Kappa's. Now, this is one thing as well. Not everything requires a Kappa. If it's just a simple typo or something like that, just fix it. You don't need a Kappa. You don't need a full recalls analysis, etc. Don't open Kappa's for the sake of opening Kappas, and I think one of the metrics. That sort of boils. My blood, in a sense, is when companies say we are going to make sure that we reduce the amounts of Kappas to X amounts. Now, if you say you're going to reduce the amount of corrective actions to X amount, I accept.

but preventive actions are great, the more preventive actions, you have the better. Right? So again, that's 1 of the metrics as well, and I feel as though why companies open cap is this number one is to impress auditors, and then number 2 just do some sort of quality, metric or quality, objective or something which is sort of not realistic. So that's.

I tried to. 3rd reason that they open Kappa is because they don't know how to correct the Nonconformance. So what I've done is in Bqc land. In my Ncr process I created a 1 page or Ncr form that says I'm doing a process. Ncr, and all it is is to I've noticed an issue. I've corrected it. There's no root cause there. It's a 1 time event, and then I sign off on it. So it's kind of like, and it can be a small capa you could do root cause. But what I found more often is they come to me, and they say I need to issue a Kappa because I found a non performance. I want to correct. And I want a record showing. I corrected it. That's

so. I did that I did that in the Ncr process.

Yeah, I mean, something like that's acceptable as well. So it's just again, a non conformity doesn't, as you said, you know, just have some sort of record there. And again, nearly what it comes down to is record that, you know. Don't just say, Oh, we fixed it because we did. XYZ. Have some sort of record there that you've done it, because again it goes back to the quality. Philosophy is, if it's not recorded, it didn't happen. By all means you can say, yes, we did the audit. Okay, great. Where's the report? So again, it's all to do with recording documentation. That is the key here. So education and training, we've already sort of covered. So we can skip past that one at.

I don't think that's really it. So yeah, thank you guys for listening. I was, gonna keep this as an open talk. So again. I'm going to put the all question here right now to the audience is, what is your biggest fear when it comes to external audits or inspections? You know. What are your concerns? Is it an area you maybe don't understand.

And.

Where do you guys stand on that question?

I have something.

Please.

So in my humble opinion, a quality management system is only you write down what you do, and then you do what you have written down. And it's essentially as simple as that. But with a very beautiful quality management system, you can still make shitty products. And yeah, usually when it's sometimes it just it just looks good on paper, but in in reality it's it can be hard, I mean, if if you put your tolerances just this wide, and everything is okay. It falls within your tolerances. But I had a coffee table discussion with an auditor once, and he had a good tip, he said, like you do, incoming inspection of of some goods, and you measure if it's good enough.

And then formerly we had just 2 bins. You had the good bin and the bad bin, and that's good enough for your quality management system. But, he said. if you start doing a measurement, why don't you note down what you just have measured. because then over time, you can see if there is a drift in your measurements towards the bad or towards the good, and you can do preventive actions on the basis of your measurements of incoming goods alone. And I think that was a very good tip that would make a quality management system, increase the quality.

Yeah, I agree with you on that one, Luke. It's it's very easy to just tick the boxes and impress an auditor. And again, even when you go and audit. If you are compliant and you tick every box great, you get your certification. But it doesn't necessarily mean it's an optimal quality management system. It doesn't necessarily mean it's actually making a great impact on this. So again, I think that's maybe another point that we can allude to here is, don't just chase the certification or just say, Hey, look, we're comply, or we're following regulations. Make something actually benefits you as a company. You know your quality management system should accelerate your company should benefit you, it should be a return on investment is if you put this much in. This is how much you get out. That's the way that it should be. So don't just try to be compliant, but actually go out there and try to make an impact and actually focus on qualities.

Yes.

Very intrigued I've been by your pixelated girl with earring. You're on mute. You're on mute, Luke Luke. You're on mute.

Mute. Okay, I'm sorry. Are you on mute? And it's from my old hometown, Delft. To be honest for me. I came from Delft. It's 1 of my favorite paintings. actually the site on Delft. This one is my favorite one, because it's Delft. But this is the girl with the pale earring. It's a good movie, also, with.

Call it right.

Yeah. You answered, Yeah.

But why? Pixelated I don't know. Maybe there's there's royalties on the actual.

Thanks for having.

Question in the chat.

Yeah, I I thought it was. I thought it was in so interesting the way you put this reply to the auditor asking an employee a question where he doesn't or she doesn't feel really like it's their area of expertise. And so in the middle of writing that down. You said something else interesting which distracted me, and by the time I finally got down to it, so what I had was. it's all right for someone to say That is outside my area of, and I can't remember the responsibility, competence. Let me refer you to an employee whose area of responsibility this is what. So that's what I wrote down. But what did you actually say? I would I loved it.

So the wording that I would say is that the question that you've asked me is something that's outside of my scope of work. But then, if this is an area of work of you want to know more about, go and speak to this particular person and that. But again, it's also important that that person knows who to go to. You can't just say, Hey, look! That's not my department, and I don't know what to do. It's more important for the auditors that you show who is doing what in the company. And you guys speak to each other, and you know who to speak to.

Yeah, I didn't want to write down responsibility, because that that ticks off some quality people and probably auditors. And hey, everybody's responsible for quality, and you know, and and the whole 9 yards. And it's sometimes it's important how you answer a question.

I actually take a different approach, Rick. What I tell my oddities is that if you don't know the answer, even if you know who it is. I say, what you're my response I recommend to say I don't have the answer right now. Can I follow up with you? And then, if I was a different person who's responsible, I bring them into the room and say I looked into it, and I'm not responsible for this person is, do you want to ask them questions? And so then that makes.

Are you afraid of saying that's outside of my role, that that would.

No.

Link to the auditor.

I have absolutely no problem about it. What I've what I have found is the simplest answer that you teach your audit ease is the one they're gonna remember. And so.

No matter what.

Yeah, exactly. And so it does. And and the other problem is, I've actually had. I've had some terrible audit experiences where the person says I don't know. And then this person's responsible. And now they start throwing people under a bus and don't realize they're doing it. And so I've just not a wrong answer like I said. I keep it simple, Stanley, and so my oddities can remember it. But I I it's also to prevent people from getting diarrhea of the mouth.

Charming. Remind us. Your military background, right?

Yeah. Coast. Guard.

Yeah, okay, Miss Friedman, you're looking lovely today. Have you ever been audited.

No, I have not, but I have a great regulatory person, so I'm not concerned.

Good answer, Alexandros. You took yourself off camera, but in your comments. It seems as though this topic really resonates with you. Have you been audited.

Yes, hello to everybody. I have to go now to Basel. I have one appointment, but I will answer you very quickly. Yes, I we have various audits in external I made internal. What I can say is, yes, it's important that that both sides. They feel comfortable that you don't play one power game, because otherwise it it, it must be kept the natural communication, in my opinion. Not having too much dominance as audit when you are in in the company. What I wanted also to mention is the certification. There is a hot discussion about this. A lot of institutes offer certifications in our days, and there are more and more, and this generates, of course, to many people the the scare. Oh, if I am not certified, what will happen? Yeah. But we as experience, we see that

it goes also without certification. Yeah, because, I can. We cannot say that the certification is something negative, or it it brings disadvantages. It is one, let's say. our extra. Let's say advantage in your Cv documents but it it can work also otherwise, because at least the audit is not just. Specific knowledge. It is also a natural communication. Human communication and what it might. What I wanted to share with you is for example, I was by BSI in the past, and we made some trainings, and what I never have an.

Sorry you're with BSI, and you made some. What with the assignment.

I I was by BSI, and and I started there some trainings, for example, and the it has been offered to me. If I want to get the lead Auditor to follow the full course, to run with other auditors we. I was in York. Yes, and I in York. We made some trainings and what I remember was, for example. one lead auditor must reach his aim with the with the less, with very less questions, and I haven't never really understood what is behind of this. Why, somebody has to make less questions to reach. Let's say the

the end aim I can do many small questions and find, let's say, what? Where? Where? Exactly, it's hanging. The Qms, yeah. Or in general, in in the company, the organization is something which is lack of training or.

What was their logic?

I never have understood the real. Really, this.

You never!

What I want.

Is that the answer, Karen? Deep, do you have a thought on that.

Yes.

Sorry.

Maybe you can. You can do you? Have you heard about this? That one, let's say experienced auditor must do very less questions and understand exactly what happens. Not correct in this company. Yeah.

Yes and no. I mean an experienced auditor usually walks into a company as maybe has a list of things that they would typically see in most companies and has particular areas that they probably know that they need to dig into. But I don't quite agree with that statement, because when you're going to audit a company, you should always go in with a fresh mind, and just be ready to expect the unexpected. It's quite easy to go into auditor mode, and just assume that all companies operate in and around the same way. So yes, I agree to a certain extent, is an experienced auditor usually walks into the room and probably knows where the problem areas are going to be. But then, at the other end of the scale, they should always treat it as a completely fresh order, and just not going with assumptions, because the moment you go with assumptions about a company's not missing areas.

Yes.

And thank you very much for this and my final phrase. Thank you very much, Joey, for giving me the possibility to to tell something about this. My last phrase is that in BSI, for example, they understand the certification that you run with a lot of our in a lot of audits together, listening to these audits. Yeah, let's say 6 months long. And then you do the exam. which is relative, strict. Yeah. And then you do some hours again, you do. You lead again. One audit with the guy with a is applying the exam to you. Yeah.

And then if you pass, then you are leads, certified auditor. That is what the Certification Institutes understands practically. But, as I mentioned before, I am also in this opinion that the experience counts the normal human communication and the of course you are there to bring one added value to the company not to play the police. Thank you very much. and I will watch you now by ears, because I will have to run to the my train. Thank you very much.

Before you go.

If we don't talk a very nice Christmas to everyone. Yeah.

And you. But before you go quickly how many languages, how many languages do you speak.

English, German, and and Greek.

What I find amazing is that your knowledge is so impressive that you can conduct business in another language. It's 1 thing for me to say, yeah, I speak Spanish, but I wouldn't be able to be an effective marketing strategist in Spanish. You can be an effective regulatory person in a foreign tongue, which is very impressive. That's number one, number 2 is, how global are we? One of our guess just says, Well, I actually have to go to Basel right now. So that's impressive. And then 3, rd was that Karen Deep's answer.

We are global clear joy. We are global.

Know Karen.

Also one, yes.

I was just gonna say, Karen Deep's answers sounded like the beginning of a joke. An auditor works walks into a company so that that sounds like the setup for a funny joke.

Yes, I wanted also to ask. I am from my natural, very open person. How can I say? I must say really honest things. The situation in the Med Tech at the moment in Europe is really difficult. We have, we see, unemployment. I must say we know the reasons. Yeah. I wanted also to ask how it is the situation in Uk, because, as Uk based person, you have a little difficulties to work in Europe, I have some colleagues which are Uk based. So let's say, we have one out of crisis at the moment in Medtech, because not, of of course, of interest, of economy reasons

but because of the over regulation, and that the startups and the middle sized companies cannot go through these 1st steps to bring, let's say in the in this level, the product that maybe one big giant can buy this project, all these topics that also Michelle analyzed very well in her webinars. We know the situation, but I must say, it's really hard. Let's hope that the situation will change. Yeah.

I I agree with you, Alexandra. I'm in the Uk. Love to chat with you, but I know you have a train to catch. So it is. It is a difficult situation over here. but

I prefer to be honest. Why, that's why I don't like to post and Linkedin to follow. I have bad mood, I say that honest. not a bad mood in mention, aggressive or something. But I am disappointed because we wanted to correct this world, this Meta world, and we make everything so complicated, and I try always to bring ideas. I think one idea which will help European the European economic market. Let's say, let's forget Europe. I believe this one for free service, like FDA, is doing one for free service. not from notified bodies, from one over authority over the notified bodies which can answer the 1st questions for one startup. In our days. I was in Basel, in Novartis last week in Pavilion. There are some talks there, and I met some Swiss politicians.

And I told they, really, I took the microphone. I say, we have innovation. The problem is how we can support this innovation by making their life easier if because like sarks like sarks, excuse me for the expression. All the companies are going to our startups. Let's come here. Of course it is business. I fully respect that. Yeah. But in the eyes of the startups we are sarks. Yeah, we are sarks. We want to charge every question, everything. Let's help this innovation in the medical devices by bringing this for free service, like in the U.S.A. That is what I can share with you.

Alexander is that I used to be an investment banker. the stock markets across Europe. It's the same problem that airlines across Europe. It's as if in Europe. If it was the Us. Was Europe, every State would have its own airline would have its own stock market, have its own regulatory framework. They all still feel that they want to have their independence about things, but they still want to. It's so it it layers and layers, complexities. In all of these things.

We are. We are many opinions under one small geographic area. I really us, has that really easier? Yeah. And different mentalities, you know. For example, i, 1 practical example, BSI wanted with British from from Uk, with the English speaking auditors audit in Germany that could never work. Yeah. So imagine that is also one cultural issue. So in the Germany you must hold German if you audit someone, because.

Example.

Otherwise they will not hear you.

Alexandros as your friend. May I remind you you have a train to catch.

Excuse me, excuse me.

And I just. I don't want you to miss your train, because I know you get passionate about it.

It is one cultural event in Basel for one Greek archaeological event. I will take the next. It's okay for me. It's also important, this talk that we do. Now I will take the next. It's okay or otherwise. I will hear you with the iphones and.

Yeah, put your earphones in.

The the Uk. Again with Brexit, did about the stupidest thing possible. because then they create had to. Because of Brexit. The Uk has had to create this U. Kca mark that no one's using. And yet they've had to establish a governmental agency because they can't say, Oh, no, no, we're not going to do it anymore. But they're also accepting Cemark and accepting FDA as if they're Argentina.

Karen Deep did that resulted in extra work for you? Have you had extra billable hours because of Brexit.

Not necessarily. It's just a lot of companies are saying, you know what sub the Uk, we're just gonna go to Europe. It's too much.

Start the UK.

That's pretty much how it's been.

And like, I say, the Uk is, is actually, when it comes to regulating medical devices, is actually like, pretend the Ukca thing doesn't actually exist. If you've got ce. If you've got FDA, you can come into the Uk.

It reminds me of Canada, how they have. You know, it's like empty sap. They you have to do it. But their volume is like 10% of the Us. So is it worth.

I don't know if there are any Canadians on the call. Canada can't even afford its own country dialing code. Are they really a country.

Yeah, yeah, yeah.

Shawn is Johan you, John? Confirmed for next week. Do you know? Believe? So? Yeah, okay, so he's gonna about machine learning. And AI for FDA clearances. So that will be interesting, I think, for most of the folks who found Karen deep as fascinating as we have.

Thank you. One funny thing that I heard from an Mdsap auditor was people trying to make friends with the auditor to try to get them on their side so that they can can help convince the management that they need to change the way that they do things. And this was like, in the category of never, ever do this. Never, ever think that the auditor is your friend and your ally against the management to get you what you want, you know, to improve the quality management system, or to, you know, get more resources. I don't know comments.

Sounds reasonable to me. I I don't have an opinion on that, but thing is, as you know, Shawn is very much co-leading, if not leading 10 x prep. And figuring out who the speakers are, and the like. I am just thinking now in light of this conversation about Brexit and the like. Perhaps a relevant topic for us this year will be the Med Tech landscape under a new administration. I think.

I posted a thread on slack on that very topic.

Today.

No, I think it was last week week before maybe.

We did a web a webinar on that yesterday with Ed Dohert.

Yeah, how did that go.

Yeah, it went really well. And he.

Maybe some of those folks would like to reprise in person.

Yeah. I'll yes, that'd be good. Okay.

What? What was the outcome. I'd be interested to hear.

Allow me, if you allow me, excuse me sometimes it is the human competition. If you can imagine. Here in Switzerland we have competition between Basel and Zurich.

That means.

What, how we should understand practically the competition that the one city like to be more let's say viral in med tech or in Pharma like the other one, and it is like separate country. So if you can imagine now how this recomplicates our Metach world.

If you come next week, which will be our last for 2024 wear red or green. and and you can get away with the tie, Andre, if that's all you can muster. Have you spoken with Mrs. Domino yet about may.

No, I forgot, Joe.

Is she there?

No.

How convenient he'll do anything to get out of this, you know. You know. What if we if we do 10 x 2026. What do you guys think about moving it to New Jersey? Maybe your house can. How many people can you accommodate in your house, Andre?

As many as you want, Joe, but we gotta.

No, seriously. You know how many acres there in in New Jersey do you have? Not that many? But we do have to deal with the drones right now, what is that.

100 86 sightings.

It's nice.

We don't know. We had 3 over my house in my area last night.

Maybe they were still looking for the this guy they found in Pennsylvania.

That they found the guy in Pennsylvania.

But dedication.

Yeah. But but would New Jersey acknowledge that they yeah.

I don't know if you know. But in CI think it's in Seattle, or maybe it's in New York with that people are posting basically wanted signs on other Ceos.

Yes, yes, like in New York City.

Down, how many to go.

Yeah. New York city. They got.

Wanted, posters.

That is despicable. I am disgusted by that.

Yeah, me, too.

I am just. Oh, I get when I see the news I get livid, and the sailor comes out so.

I I canceled my all my new subscriptions on November 6.th I can't.

Yeah.

Alright! Sorry! Merry Christmas! Everyone.

Merry Christmas.

In red or green, red or green.

I'll be done.

This time.

Take care!

Next week is, it will be our last. Thank you, Alexandros. It'll be our last in 2024. We're gonna take off for Christmas and New Year's as we do. and so.

Soon! All right.

Hey, Alexandro, if you can make it across the pond for May 6, th we'd love to meet you in person.

Here. I'll wear this next time.

There you go! What.

My Christmas crown.

I love it, Nelly.

Oh, yeah, 0. Don't forget.

It would be worse.

Okay.

See you next week.

Hey, guys.

Sorry.

Bye.