How to Ace Medical Device Audits with HHG GROUP?
The auditor asks for the service history of a specific ventilator by serial number. The answer that ends the conversation is a single record showing what was done, when, by whom, and against which…
The auditor asks for the service history of a specific ventilator by serial number. The answer that ends the conversation is a single record showing what was done, when, by whom, and against which specification. The answer that starts a finding is four systems, two spreadsheets and a phone call to the supplier of a device nobody remembers buying. Audit readiness is the difference between those two afternoons.
Last updated:
What an audit actually examines
Medical device audits have moved from occasional formalities to routine, high-stakes events, and their scope has widened. Modern inspections look at equipment maintenance records, calibration logs and procurement histories as well as design and manufacturing documentation. For a hospital, that means the audit is largely a test of the asset record.
Five pieces of evidence carry most of the load, and each one is either retrievable or it is not.
| Evidence | For a device in service | For a device purchased used |
|---|---|---|
| Identity | UDI or serial number on the asset record | Same, plus the identifier on the label as received |
| Regulatory status | Class and premarket reference for the model | Same, matched before purchase |
| Recall position | Dated status check in the register | Dated status check before delivery |
| Service history | Records against a stated specification | Plus the specification the refurbisher worked to |
| Reprocessing (if reusable) | Manufacturer’s validated instructions and the cycle records | Same, and the instructions must not have been lost |
Where hospitals actually fail
Three failure patterns recur. Fragmented records, where maintenance histories sit across departmental systems so that no single record is complete. Reactive preparation, where documents are gathered at the last minute and internal audits become fire drills rather than gap-finding exercises. And provenance gaps, which is the fastest-growing category: a device bought through an informal channel often arrives without clear documentation of prior ownership, service history or compliance status.
The provenance problem is structural rather than clerical. It cannot be fixed at audit time, because the information did not exist at the moment it could have been captured. That is why the fix belongs in procurement, not in the compliance office.
The checks that close the provenance gap
Four public records answer it, and all four can be run before payment.
Class and premarket route. The FDA assigns every device to Class I, II or III by risk; a Class I or II device that is not exempt needs a 510(k), and Class III requires premarket approval. Devices@FDA searches those submissions, so the model can be matched against the clearance that names it — including the intended use, which is part of what was cleared.
Identity. The UDI System identifies devices from manufacturing through distribution to patient use, and the identifier resolves in AccessGUDID. This is what attaches an audit record to the unit in the room.
Recall position. Correction and removal actions are published in the FDA’s recall and early-alert database, and a dated statement of status belongs in the file.
Condition. For refurbished devices, the FDA’s Remanufacturing of Medical Devices guidance, finalised in May 2024, separates servicing — returning a device to the specification it was cleared with — from remanufacturing, which changes performance, safety characteristics or intended use and places the manufacturer’s responsibilities on whoever did the work. Ask which applies and for the specification used.
Where the device is reusable and destined for a UK site, add the MHRA file: registrations in Great Britain, a UK responsible person for devices from outside the UK, UKCA marking and conformity assessment, labelling, and post-market surveillance.
A worked example: the cost of not having the record
This is a model with stated assumptions, not a measurement. The purchase price is a live listing; the labour figures are placeholders.
Take a Microline MiSeal universal power unit and instrument set listed at $11,500. Assume an audit takes four hours of staff time per device where the record is complete, and fourteen hours where it is scattered across systems, at $55 an hour loaded.
Across a 300-device fleet with a 20% record gap, the difference is 60 devices × 10 extra hours × $55 = $33,000 of audit labour, before any finding is raised.
Change one assumption. If the facility can produce nothing at all for those 60 devices, the cost is not labour but a finding, and the remediation is measured in weeks rather than hours. The register is the cheap half of that trade.
Preparing without a fire drill
Audit readiness is a by-product of operating discipline, and it is built in four steps. Make the asset register the system of record and populate the fields in the table above. Capture the record at the moment of service, because it is never reconstructed faithfully later. Reconcile the register on a cycle so the gaps surface while they are explainable. And run an internal sample audit quarterly on a rotating basis, rather than a full rehearsal the month before an inspection.
The last step is the one that turns preparation from a project into a state. A facility that samples twenty devices a quarter has found most of its gaps a year before anybody asks.
References
- FDA: Classify Your Medical Device — risk class and the premarket route.
- FDA: Medical Device Databases — Devices@FDA and quarterly registration and listing.
- FDA: Medical Device Recalls and Early Alerts.
- FDA: Remanufacturing of Medical Devices — final guidance, May 2024.
- FDA: Reprocessing of Reusable Medical Devices.
Make the register the answer. Listings carry the model, the condition and the seller, so the evidence an audit asks for can be captured at purchase.
FAQ
What records does a medical device audit actually ask for?
Equipment maintenance and calibration records, procurement history, and for each device its identity, regulatory status, recall position and — if it is reusable — the reprocessing instructions and cycle records. The test is whether each can be retrieved for a specific unit.
Why is provenance an audit risk rather than a purchasing issue?
Because the information only exists at the moment of purchase. A used device bought through an informal channel without prior ownership or service records cannot be documented later, so the fix belongs in procurement: run the four public checks before payment.
How much does poor record-keeping cost?
In the worked example above, scattered records cost about $33,000 of extra audit labour across a 300-device fleet with a 20% gap — before any finding is raised. A finding is a different order of magnitude.
Is a full internal audit rehearsal necessary?
A rotating quarterly sample of twenty devices finds most gaps a year before an inspection, at a fraction of the effort. A single rehearsal the month before does the same work at the worst possible time.
Does a clean FDA record mean a device will pass a hospital audit?
It establishes that the model may be used; it says nothing about the unit’s service history, its recall position today or whether the refurbishment stayed within the cleared specification. Those are the hospital’s own records to produce.
Part of the Verification & Authenticity guide.
