Internal Audit

An internal audit is a systematic, independent examination of an organization's quality system or processes that is performed at defined intervals and sufficient frequency to determine whether its activities and results comply with established procedures and are effectively achieving quality system objectives.

The concept of an Internal Audit is a mandated and fundamental component of formal Quality Management Systems (QMS), particularly under regulatory frameworks like the FDA's Quality System Regulation (QSR) for medical devices (21 CFR Part 820) and international standards such as ISO 9001 and ISO 13485.

In the context of Human Cell, Tissue, or Cellular or Tissue-Based Products (HCT/Ps), a quality audit is specifically defined as a documented, independent inspection and review of an establishment’s activities related to Core Current Good Tissue Practice (CGTP) requirements, aimed at verifying the degree of compliance with the quality program under review.

Frequently Asked Questions (FAQs) Associated with Internal Audit

The sources detail the requirements, objectives, personnel responsibilities, and documentation associated with conducting internal audits.

1. What are the main objectives of an Internal Audit?

The core purpose of conducting internal audits is to verify that the quality system is functioning correctly, identify areas for improvement, and ensure compliance with specified requirements.

Specifically, the objectives include confirming that the quality system:

• Complies with the organization's own requirements for its quality management system.
• Complies with the requirements of the relevant International Standard (e.g., ISO 9001, ISO 13485).
• Is effectively implemented and maintained.
• Is suitable to achieve quality system objectives.

Internal audits help identify areas of non-conformance and opportunities for improvement, facilitating continuous improvement.

2. What are the regulatory and standard requirements for Internal Audits?

Internal audits are a mandatory activity for quality assurance systems:

• FDA Quality System Regulation (21 CFR Part 820): Manufacturers must establish procedures for quality audits and conduct them to ensure the quality system complies with established requirements and to determine its effectiveness.
  • The term "Quality audit" is formally defined as a systematic, independent examination performed at defined intervals and sufficient frequency to determine compliance and effectiveness.
  • Management with executive responsibility must certify in writing that the required quality audits (including supplier audits, where applicable) have been performed, documented, and that any required corrective action has been undertaken.
• ISO 9001:2015: The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system conforms to its own requirements and the standard's requirements, and if it is effectively implemented and maintained (Clause 9.2).
• ISO 13485 (Medical Devices): This standard emphasizes management reviews, process control, documentation, and the review of corrective actions and preventative actions (CAPA), implicitly covering internal audits. Audits are a necessary part of the QMS implementation for compliance with medical device regulations like EU MDR.
• HCT/P (Human Cells, Tissues, Products): Establishments must periodically perform for management review a quality audit of activities related to core CGTP requirements.

3. What criteria govern who performs Internal Audits?

To ensure objectivity, audits must be conducted by individuals who meet strict criteria:

• Independence: Audits shall be conducted by individuals who do not have direct responsibility for the matters being audited. It is considered healthier for internal auditors to audit outside their usual management line to maintain a degree of independence in their judgments.
• Resources: Manufacturers must provide adequate resources, including the assignment of trained personnel, for assessment activities, including internal quality audits.
• Auditor Role: The role of the external auditor (and by extension, the internal auditor who mirrors this practice) is to determine the effectiveness of the quality management system.

4. What is required for planning and executing an Internal Audit program?

The organization must plan, establish, implement, and maintain an audit program:

• Planning: The program must include frequency, methods, responsibilities, planning requirements, and reporting. It must take into consideration the importance of the processes concerned, changes affecting the organization, and the results of previous audits.
• Criteria and Scope: The organization shall define the audit criteria and scope for each audit.
• Execution: Audits should be conducted according to a documented procedure (often detailed in the Quality Manual). The auditor looks for noncompliance with documented procedures and assesses if procedures lack necessary components.
• Documentation: All audit activities and results, including the dates and results of audits and reaudits, shall be documented. The Internal audit program itself is a mandatory record for ISO 9001 compliance.

5. How do Internal Audits link to Corrective and Preventive Action (CAPA)?

The relationship between internal audits and CAPA is crucial for continuous improvement:

• Audit Findings Trigger CAPA: Audit findings are primary triggers for CAPA. The organization must take appropriate correction and corrective actions without undue delay based on the results of the audits.
• Management Review Input: Relevant information on identified quality problems and corrective and preventive actions must be submitted for management review.
• Reaudits: When deficiencies are found, corrective action(s), including a reaudit of deficient matters, must be taken when necessary. For HCT/P establishments, this includes reaudits of deficiencies to ensure corrective actions are effective.

6. What educational opportunities are available related to Internal Auditing?

Training is available to help personnel develop the necessary expertise:

• Training Courses: Organizations offer specific training, such as the ISO 9001 Internal Auditor training course, which teaches participants how to effectively implement an internal QMS audit against the requirements of ISO 9001:2015.
• Webinars: Educational resources, such as webinars, exist on topics like "How to Perform an Internal Audit Remotely".

‍