Lecture 5: Internal Audits and Compliance

Introduction to Internal Audits in ISO 13485

• Internal audits systematically evaluate QMS compliance
• Integral to ISO 13485:2016 for medical device manufacturers
• Help identify non-conformities and areas for improvement
• Enable continuous improvement in quality processes
• Provide evidence of compliance for external audits

Key terms: Internal Audit

Importance of Internal Audits for Compliance

• Ensure adherence to ISO 13485 specifications
• Strengthen process control and traceability
• Monitor risk-based approaches and their effectiveness
• Prevent deviations from regulatory standards
• Build a compliance-ready culture within the organization

Key terms: Risk-based Approach

Understanding ISO 13485 Requirements

• ISO 13485: a standard for QMS specific to medical devices
• Focus on regulatory and customer requirements
• Incorporates risk management throughout processes
• Stresses product lifecycle traceability
• Mandates controlled process documentation

Key terms: Traceability

Key Principles of Internal Auditing

• Independence of auditors ensures objectivity
• Systematic and consistent process enhances reliability
• Evidence-based approach ensures validity
• Focus on risk and opportunities for improvement
• Confidentiality of findings to build trust

Key terms: Evidence-based Audit

Executing the Audit: Step-by-Step Process

• Define audit objectives and schedule
• Develop an audit checklist based on ISO 13485
• Conduct opening meeting to outline scope
• Perform systematic evaluation of processes
• Verify records against documented procedures

Key terms: Clause 8.2.4, Process approach

Interviewing Personnel During Audits

• Prepare open-ended, topic-specific questions
• Establish rapport to ease interviewees
• Verify competency of employees handling critical processes
• Document all responses systematically
• Cross-check responses with evidence

Key terms: Competence verification, Open-ended questions

Observing Processes and Practices

• Match observed practices to SOPs
• Identify deviations in real-time processes
• Pay attention to environmental and safety compliance
• Take descriptive, unbiased notes
• Document interactions between departments

Key terms: Process observation, Class ISO 7

Collecting Evidence: Techniques and Tools

• Use sampling methods for efficiency
• Employ visual aids like photos/videos
• Understand what constitutes acceptable evidence
• Ensure traceability of evidence to findings
• Use specialized audit software for data management

Key terms: Traceability, Acceptable evidence

Documenting Audit Findings

• Ensure documentation is clear and concise
• Capture objective evidence of non-conformities
• Use standardized templates for consistency
• Avoid ambiguous or subjective language
• Differentiate between observations and non-conformities

Key terms: Objective evidence, Observations

Follow-Up Actions Post-Audit

• Corrective Actions Address Non-Conformities
• Assign Responsibilities for Each Action
• Define Deadlines for Resolution
• Verify Changes and Ensure Effectiveness
• Document and Communicate Outcomes

Key terms: Corrective Action

Monitoring Implementation of Actions

• Establish Key Performance Indicators (KPIs) for Monitoring
• Schedule Regular Progress Reviews
• Analyze Data Trends for Compliance
• Escalate Delays or Obstacles Promptly
• Use Risk-Based Thinking to Prioritize Follow-Up

Key terms: Risk-Based Thinking

Example of an Audit Report

• Audit report includes a clear summary of objectives and scope
• Present findings classified as compliant, non-compliant, or opportunities for improvement
• Ensure objective evidence supports each finding
• Provide a clear corrective action plan template for non-conformities
• Demonstrate adherence to ISO 13485 criteria in report structure

Key terms: Corrective Action Plan

References

• ISO 13485:2016 (2016) Medical Devices: Quality Management Systems. Geneva: ISO.
• Tummala, V.M.R. and Schoenherr, T. (2011) Assessing and Managing Risks Using the Supply Chain Risk Management Model. International Journal of Production Research.
• ISO 13485:2016 and ISO 14971:2019 standards documentation.
• ISO 19011:2018 (2018) Guidelines for Auditing Management Systems. Geneva: ISO.
• ISO 13485:2016. Clause 8.2.4 Internal Audit.
• ISO 13485:2016. Clause 6.2 Human Resources.
• ISO 13485:2016. Clause 6.3 Infrastructure.
• ISO/IEC 19011:2018. Guidelines for auditing management systems.
• Mears, P. (1995) Quality Improvement Tools and Techniques. NY: McGraw-Hill.
• ISO (2016) ISO 13485: Medical Devices — QMS Requirements for Regulatory Purposes. Geneva: ISO.
• Maxwell, J. (2012) KPI Handbook: Developing Metrics. Boston: Wiley.
• ISO (2016) ISO 13485: Medical Devices – Quality management systems – Requirements for regulatory purposes.
• Drucker, P. (1993) Managing for the Future: The 1990s and Beyond. Boston: Harvard Business Review Press.
• ISO (2016) ISO 13485: clause 5 (Leadership).
• ISO 13485:2016, Clause 8.2.2.1 Internal Audits.
• ISO 19011:2018, Guidelines for Auditing Management Systems.
• ISO (2016) ISO 13485: Medical devices, 3rd edn. Geneva: ISO.
• Burtis, C.A. and Bruns, D.E. (2014) Quality and Auditing Strategies. Oxford: Wiley.
• Brown, L. (2020) Effective Quality Audits for Medical Devices. Boston: McGraw Hill.
• ISO (2016) ISO 13485:2016. International Organization for Standardization.