Internal Audit Confidentiality - Exempt from review by the FDA under 820.180(c)?

[Copacetic]

If a corporate quality auditing function has a quality system independant of the business units that it audits, are the audit records still exempt from review by the FDA under 820.180(c)?

[Stijloor]

A Quick Bump!

Can someone help?

Thank you very much!!

[sreenu927]

Hi,

Usually, internal audit records are not auditable by FDA, say, site specific internal audit or corporate audits. As Corporate audits are still internal considering the auditors as inter-company staff.

As part of your process, internal audit might be conducted yearly twice or once. FDA may check the audit plan for the same and check whether confirming to the process (SOP) or not. If Corporate audit is not captured in your quality management system, then FDA won't ask for plan and obviously won;t ask for report.

In that case, I guess audit reports by a 3rd party, excluding the registration bodies, could be non-auditable.

Regards,
Sreenu

[v9991]

even if that copr.audit is independent...it depends upon the scope-reference/dependence you have mentioned in the procedure specific to your unit...if you have referenced...it in some way, (viz., as part of your internal audit schedule is carried out by corporate team) then it may fall under scope of audit.

confidentiality/exemption of Internal audit(Quality systems of your unit) reports may be stretching the inference tooo far...
instead, i would like to say they may not be core/spl-focus of FDA audits.

two reasons....
1) QS audits is part of QSR part 820...

Sec. 820.22 Quality audit.
Each manufacturer shall establish procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system. Quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited. Corrective action(s), including a reaudit of deficient matters, shall be taken when necessary. A report of the results of each quality audit, and reaudit(s) where taken, shall be made and such reports shall be reviewed by management having responsibility for the matters audited. The dates and results of quality audits and reaudits shall be documented.

also other reference at ...
http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/QualitySystemsRegulations/MedicalDeviceQualitySystemsManual/ucm122726.htm#exhibits

2) and warning letters as recent as 2011...
http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2011/ucm268034.htm

10. Failure to establish adequate procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system. Quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited. Corrective action(s), including a reaudit of deficient matters, shall be taken when necessary. A report of the results of each quality audit, and reaudit(s) where taken, shall be made and such reports shall be reviewed by management having responsibility for the matters audited, as required by 21 CFR 820.22. For example:
You did not implement Section 5.2 of your Internal Audits procedure, P-822, Rev B, which requires the initiation of the internal audit based on the master schedule, in that you began internal audit procedures on June 22, 2010, although the Internal Audit Plan, F-822-001, for this audit was not created until June 23, 2010. Further, the record for this audit plan was not approved by the Quality System Management Representative as required under Section 5.1 of the procedure.
Your Internal Audits procedure, P-822, Rev B, does not require a report of the results of each quality audit be reviewed by the management responsible for the matters audited, and your records do not demonstrate such reviews have taken place.

http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2011/ucm289796.htm

5. Failure to maintain adequate procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system. Quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited, as required by 21 CFR 820.22.

For example, your firm's procedure titled "Quality Procedure QP007, Internal Audits, Rev 6", dated November 13, 2009, under item 5.6, states, ''The auditor shall be independent from the area that is being audited. In other words the auditor shall be from another department that is not responsible for being audited." Your firm's Internal Audit Plan and evidence of quality audits from 2008-2010 were reviewed by the Quality Assurance Specialist, Quality Manager, or Vice President of Operations. These personnel performed quality audits for areas under their direct responsibility, including review of Device History Records, batch record review, review of sterilization records, review of returned goods authorizations, and review of complaint files and non-conforming material.

[JaxQC]

Another item that falls into the same group is Management Reviews. As evidence, show a blank template showing that it covers the specific line items that the FDA requires and a single page “sign in” cover page show that event took place. They don’t get to see the actual details of the review (filled in form).