PIP: how a secret silicone swap exposed Europe's audit blind spot

Here is an uncomfortable observation from twenty years of chasing nonconformities: nobody defrauds a test. They defraud the space between tests. PIP is the purest example on record – certificates renewed, dossiers in order, factory lying – and for years no control bridged the gap. When French inspectors finally opened the drums in 2010, the silicone inside had never met the specification the company was certified against.

The situation

Poly Implant Prothèse, founded by Jean-Claude Mas, grew into one of the world's largest breast-implant makers, selling into more than 60 countries from a plant outside Toulon. Under the Medical Device Directive then in force, implants sat in class IIb, which meant a notified body reviewed the design dossier. PIP's paperwork passed. It passed repeatedly, for roughly a decade. The dossier described medical-grade gel; the production floor, reportedly from about 2001, was filling shells with industrial silicone bought at a fraction of the price, and the drums went into hiding whenever auditors were due. The certificates stayed current, complete and completely beside the point.

How it unfolded

Surgeons began reporting ruptures at rates well above the norm. The vigilance system every device regime relies on was whispering for years before anybody aggregated the signal. In 2010 the French regulator inspected, tested the gel and found it was not the approved material. Marketing was suspended; PIP collapsed into liquidation in 2011.

Then came the split response that turned a quality scandal into a trust scandal. France recommended precautionary removal for affected women. The UK's expert review found no unusual toxicological risk and advised against routine removal. Two authorities, one crisis, two messages – and roughly 300,000 women left doing their own risk assessment at kitchen tables. In 2013, Mas was convicted of fraud.

Root-cause anatomy

Technical: nothing at PIP tied the physical material to the approved specification. No incoming identity testing of raw gel – no spectroscopy, no comparison against a reference. No sampling of finished product from production lots for destructive verification. The design dossier and the factory floor lived in separate realities, and only one of them was ever inspected.

Organisational: deliberate, top-down fraud under commercial pressure – industrial gel cost a fraction of the medical-grade equivalent – enabled by an assessment model with three structural weaknesses. Audits were announced, which converts inspection into rehearsal. Reviews were document-led rather than process-led. And the assessor was paid by the assessed, which rewards leniency in a competitive certification market. Remove any one weakness and PIP does not survive to 2010. Leave all three and it was only a question of which manufacturer exploited them first.

Where the quality system failed

Name the gates and watch each one wave the fraud through.

Incoming material control failed first, on a certificate of analysis. A CoA is a claim, not a measurement. The audit methodology compounded it: the file was the centrepiece, the running process barely featured – precisely the failure that VDA 6.3 process audits exist to prevent. Audit the line while it runs, not the archive after it stops. Change control never stood a chance, because the discipline assumes changes are declared and fraud is by definition an undeclared change – the single input that gate cannot see. Then CAPA and vigilance: rupture complaints accumulated unaggregated, year on year, and no trend threshold ever fired.

Trust is not a control. A signature is not a test. Paper proves a file existed; only the laboratory proves the material did.

What would have caught it

• Unannounced process audits – arrive unbooked, follow the drum, watch the gel being mixed. Europe legislated exactly this into MDR 2017/745 after the fact.
• Incoming identity testing – a spectral check of each gel lot against a reference standard takes minutes and costs a few euros. The cheapest control in the entire affair is the one nobody ran.
• Destructive testing of sampled finished units from real production lots, with retained samples per batch.
• Vigilance thresholds – the surgeons were the sensor. Nobody was reading the output.

The split French–UK response adds a fifth, non-technical control: a joint communication protocol agreed before a crisis, not improvised during one. When authorities contradict each other in public, patients inherit the risk decision that was supposed to be made for them.

My take

I have lived the honest cousins of this failure, never anything so cynical. In automotive supplier quality I watched a raw-material source change quietly behind flawless certificates; it surfaced only because we ran our own incoming verification instead of filing the CoA and moving on. Building a greenfield QA/QC organisation for 900-plus people at SNOP, the first principle I installed was that material is a claim until measured – identity checks at the gate, then QRQC the moment reality disagreed with the paperwork. My side-life in ethical hacking taught me the uncomfortable symmetry: fraud is social engineering of a quality system, and the attacker studies your control precisely in order to go around it. Any system that only constrains the honest is theatre. PIP did not lack paperwork. It lacked one opened drum.

Europe rewrote its device regulation – unannounced audits, implant cards, traceability – because 300,000 women paid for a lesson a laboratory would have sold for the price of an afternoon's testing. That arithmetic belongs on every quality leader's wall. In automotive resin as in silicone gel, the drum you never opened is the risk you have already accepted.