The audit a manufacturer never sees coming

An internal audit plan, done well, still assumes advance notice: a schedule, a scope, a team that walks in prepared. MDR Annex IX, Section 3.4 removes that assumption for one specific audit a device manufacturer under the QMS-and-technical-documentation conformity assessment route has to sit for — and a readiness procedure built for the audits a manufacturer can schedule doesn't cover the one it can't.

What Section 3.4 actually commits the notified body to

Under Annex IX's conformity assessment route, Section 3.4 requires the notified body to randomly perform unannounced audits on the manufacturer's site — and, where appropriate, the sites of the manufacturer's suppliers and subcontractors — at least once every five years. The notified body may combine that visit with the periodic surveillance assessment the same section otherwise runs, or carry it out separately, in addition. Nothing in the clause lets a manufacturer negotiate the visit onto its own calendar; the entire mechanism only works because the manufacturer doesn't know when it's coming.

The visit tests product, not just paperwork

An unannounced audit under 3.4 isn't a document review with a different name. The notified body tests an adequate sample of the devices actually produced, or an adequate sample drawn from the manufacturing process itself, against the technical documentation on file — checking that what's coming off the line still matches what the technical file says should be coming off it. The notified body sets the sampling criteria and testing procedure before the visit, on its own terms; the manufacturer finds out what's being sampled when the auditor names it, not before.

The plan exists, and it's not the manufacturer's to see

The clause requires the notified body to establish a plan for its unannounced audits — and explicitly bars disclosing that plan to the manufacturer. That's a deliberate asymmetry, not an oversight a manufacturer can work around by asking its notified body for a heads-up before the next visit. A quality system that treats the notified body relationship as fundamentally cooperative on scheduling has one relationship left that runs the other way, by design.

What a readiness procedure holds instead of a date

An internal audit plan can rehearse: brief the floor, stage the records, walk the likely path a week ahead of the scheduled date. None of that works against a visit with no scheduled date. What a manufacturer's own procedure has to hold instead is standing readiness — production records current on any given day, not brought current for a known visit; a defined process for badging in an unannounced auditor and routing them to whoever can authorize sampling on the spot; and traceability from a sampled unit back to its own batch and technical-file revision without a scramble to reconstruct it. A procedure that only describes how the team behaves once notified has described the wrong audit.

An unannounced-audit readiness procedure built around this asymmetry — standing record currency, a same-day escort and sampling-authorization path, and traceability that doesn't wait for warning — is previewed in the launch catalog, alongside the internal audit plan it deliberately doesn't resemble. If your site runs a different standing-readiness discipline, the shelf takes that correction directly.