Internal audits are a critical activity for every medical device firm. Not only are they mandatory per 21 CFR 820.22 and Clause 8.2.4 of ISO 13485:2016, but they are also fundamental in ensuring continuous review and improvement of a quality management system. Although there are numerous positive outcomes of an effective internal audit, it can be a daunting task if not implemented correctly. Medical device firms should strive to not only satisfy the regulatory requirement for internal audits but use them as a continuous improvement tool.
The very first step in ensuring effective internal audits is implementing a robust audit management program in your QMS. Your program should include the scope of regulations (i.e. ISO, FDA, etc.), an audit schedule with rationale, what qualifications are necessary for the personnel conducting the audits, and any other fundamental pieces that will facilitate conducting the internal audits. The regulatory requirements for internal audits are generally vague, just saying that you shall conduct them at planned intervals and use them to assure your quality system is effective and in compliance with established requirements.1 This creates a critical gray area for many med device firms, leaving it up to them to determine how often to conduct internal audits and what the process looks like. Creating an effective audit schedule should be the major first step in your audit management program. Determining what frequency, you should conduct audits on what processes will help you create and justify this schedule; for many small start-ups, a once annual internal audit may be sufficient, while for larger firms, it may require quarterly.
A signature trademark of an effective internal audit is being more thorough than the FDA. Internal audits are the time to catch and correct any compliance risks and make sure your QMS is prepared for a regulatory inspection. Firms should draft audit checklists within the bounds of their audit scope (i.e. what regulations you are auditing against). Within these checklists, there should be processes to be checked off, which are then broken down into a list of relevant procedures, and then even further broken down in a sampling of records. If your checklists take high level processes and break them down into their individual components and records, you can ensure that you’ve captured everything.
Any findings that come out of your internal audit should be analyzed and reported on to management, typically during management review at a minimum. Findings should translate into CAPA’s, which act as inputs to improve the QMS. All medical device firms should be conducting internal audits not only because it satisfies a regulatory requirement, but also because they can act as great continuous improvement tools. If you need help building or implementing an internal audit program for your medical device firm, EMMA International’s team of experts can help! Give us a call at 248-987-4497 or email info@emmainternational.com to see how we can help.
1FDA (April 2019) 21CFR820.22 retrieved on 08/19/2020 from: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=820.22
