ISO 13485 from zero, episode nine: the internal audit programme.

Why audit yourself?

This is episode nine of ISO 13485 from zero. The system is built and running. Now we check it. The internal audit is how a medical device company proves to itself, before any external auditor arrives, that the system works as designed and meets the standard and the regulations.

How do you build the audit programme?

ISO 13485 requires a documented procedure and a planned programme that takes into account the status and importance of the processes and areas, and the results of previous audits. That means risk weighting. Processes that affect device safety, that have had problems, or that have changed recently get audited more often or more deeply. Every process, and every requirement of the standard, should be covered over the audit cycle, usually within a year. Before a first certification audit, cover the whole system once.

Template for this step: the audit checklist, audit plan and report templates are in the ISO 13485 Internal Audit Kit ($79).

How do you keep auditors independent?

Auditors must not audit their own work. In a small company that takes planning. Train people from different areas to audit each other, and use an outside auditor for the areas the quality lead is responsible for. Record each auditor's competence: training, experience and the audits they have observed or led.

What are audit trails?

The most useful internal audits follow the product, not the procedure. Pick a released batch and follow it back through its batch record, the materials and their supplier approvals, the equipment and its calibration, the operators and their training, and the inspection results. Pick a complaint and follow it to the investigation, the reportability decision, any CAPA, and the update to the risk file. Pick a design change and follow it through review, verification, risk assessment and the updated device file. These trails test several processes at once, and they reveal the gaps between processes, which is where systems usually fail.

How do you write findings?

State the requirement, what was found, and the objective evidence, with record references. Grade findings consistently, and do not soften them. A finding written vaguely gets a vague fix.

What does follow-up involve?

Management responsible for the area audited must make sure corrections and corrective actions are taken without undue delay. Track every finding to closure, verify that the actions worked, and report the results to management review. Audit records, including the plan, the report, the findings and the follow-up, must be kept.

The ISO 13485 Internal Audit Kit includes the procedure, programme, plan, report templates and a clause-by-clause checklist in Excel with the evidence to look for. Previously: CAPA. Next episode, the last: management review and readiness.