Q: I’ve found conflicting information on how frequently to perform internal audits. The ISO standards and the Quality System Regulation don’t have any frequency recommendations, but FDA’s Quality System Inspection Technique (QSIT) Guide recommends every 12 months. I’ve been in organizations that audit their complete systems annually, and I’ve also been in organizations that conduct internal audits every two years.
What’s the industry standard? And what frequency do regulators expect?
A: You’re correct that FDA regulations don’t specifically address audit frequency. However, you’ll find many FD-483 observations that have been issued for failure to audit frequently enough. Those 483s typically result from FDA inspections where the Agency finds problems it thinks the company should have discovered and addressed through routine internal audits — well before the Agency had to point them out.
FDA believes an internal audit is a tool that should be used by management to perform an overall assessment of the Quality System. In general, the audit should be performed frequently enough to detect problems and to prevent non-compliances (adulteration and misbranding) from occurring while assuring the overall health of the Quality System.
[pullquote align=”right” cite=”” link=”” color=”” class=”” size=””]The Agency has accepted less frequent audits when you demonstrate your schedule is clearly risk-based.[/pullquote]
Although there are exceptions, FDA’s expectations for pharmaceutical manufacturers are pretty clear – you should audit annually. On the other hand, the Agency’s expectations for device manufacturers have been less specific. But as you’ve found in the QSIT Guide, FDA’s Center for Devices and Radiological Health (CDRH) generally recommends you audit all aspects of your Quality System every 12 months, which allows your audit schedule to cross calendar years.
The Agency has accepted less frequent audits when you demonstrate your schedule is clearly risk-based. But my advice is that annual audits should be your goal, especially in moderate to large firms. Also, if you make significant changes to your systems, you should increase the audit frequency to assess the effectiveness of those changes. If your systems have undergone a lot of changes, FDA likely would question if a two-year audit plan is frequent enough.
Answered by Martin Browning, President and Co-Founder of EduQuest (22 years as an FDA investigator, co-author of FDA’s Part 11, and contributor to the 21 CFR 820 Quality System Regulation). Martin also is the chairman of EduQuest’s FDA Auditing of Computerized Systems and Part 11/Annex 11 training course.