FDA Expectations for Internal Audits

Q: What are FDA’s expectations for internal audits? For example, how frequently should we conduct internal audits? And what documents does FDA expect to see to prove we’re actually doing the audits?

A: First of all, FDA expects you to audit your complete Quality System. It doesn’t matter if you do this in one audit or in a variety of audits throughout the year. But each calendar year, you should conduct an internal audit of your Quality System.

FDA also expects you to perform a trend analysis of your quality data. This requirement comes from the CAPA regulations and — for pharmaceutical companies — it’s also part of the GMP regulations.

As for documentation, FDA wants to see your written procedures for conducting internal audits.

Your procedures should include:

– Who’s responsible for conducting internal audits,
– What kinds of things you review during your audits,
– How you conduct them, and
– What’s your schedule for doing audits.

You should have a schedule showing the date of the last audit and when the next audit will occur.

You should have a schedule showing the date of the last audit and when the next audit will occur. It’s also important to have an audit report cover page or a completed schedule showing the date of the audit, who conducted it, and what was covered during the audit. You want to make sure FDA doesn’t see the actual audit report, but at a minimum you should have this kind of documentation to show the Agency.

If for some reason you don’t follow the audit schedule you set, you need to show — with scientific justification — why the audit didn’t happen. Otherwise, FDA could cite you for not meeting your own schedule and for not having documented evidence of a scheduled audit.

Answered by Denise Dion, EduQuest VP of Regulatory and Quality Services (18 years as an FDA investigator and co-editor, FDA Investigations Operations Manual) and lead instructor of EduQuest’s The CAPA Compliance Clinic: FDA Rules for Effective CAPA Systems, Failure Investigations and Complaint Management.