Q: Question regarding internal audits: is it acceptable for a manufacturing site to NOT have an established internal audit program?
In place of internal audits, the manufacturing site uses the results of external audits conducted by regulatory authorities, standards assessment organizations, and other bodies external to the company.
I’d be interested to hear your point of view, considering your experience as both FDA investigators and as third-party external auditors for industry.
A: Manufacturing sites regulated by the FDA must have an internal auditing program.
The program can be purely internal, purely external (contracted out), or any combination of the two (which generally works better, especially if there is a lot of “push-back” from those being audited).
The word “establish” is also critical to understand (please review the FDA definition in 21 CFR Part 820.3(k)) and note that it means internal audits must have procedures, must be documented, and must be effective. The internal audit program is critical to demonstrate management control of the overall Quality System.
While regulatory authorities, standards organizations, and other outside bodies — including customers and contracting companies — conduct audits of manufacturing facilities, none will or ever should be as in-depth, critical, probing, and focused as those conducted under the site’s own internal audit program.
[pullquote align=”right” cite=”” link=”” color=”” class=”” size=””]No one should know the Quality System better than the management responsible for its effectiveness.[/pullquote]
No one should know the Quality System better than the management responsible for its effectiveness. No one has a greater responsibility than management. All of those auditors mentioned in your question conduct only “snap-shot audits” of the events they see during the short time-frame of their audit.
Internal auditors (and those external auditors given full access to all elements of the QS and CAPA system) should be involved in the entire problem identification and resolution process. Such a high level of involvement simply is not possible for outsiders.
At the same time, external “mock” regulatory audits can be helpful in reinforcing compliance with management and preparing for a regulatory audit. As you probably know, EduQuest frequently provides mock FDA audit services for our clients.
The unasked question you must consider: What is the true purpose of the internal audit? The internal audit program is a tool used by management to assess the effectiveness and adequacy of the Quality System to produce the products manufactured.
It also is used to assess the other tools (management review, the CAPA system, complaint process, change management process, etc.) for effectiveness.
An internal audit is not necessarily management’s best or most effective tool — but it is a necessary one and is absolutely required by regulations.
Answered by Martin Browning, President and Co-Founder of EduQuest, who served 22 years at the U.S. FDA as an expert field investigator. At FDA, he also helped to develop the Quality System Regulation (21 CFR Part 820) and served as FDA’s liaison to the international ISO 9000 Committee. Martin is the developer and chairman of EduQuest’s three-day training class on FDA Auditing of Computerized Systems and Part 11/Annex 11 Compliance.