Always Internal Audit all Line Items of applicable FDA Regulations?

[ryno fan]

Hi,

I have read that the FDA requires manufacturers to conduct internal audits of their compliance with all applicable FDA regulations at least once every 12 months. Does this mean every line item of each applicable reg. needs to be audited every time?

Thanks

[MIREGMGR]

21CFR 820.22 requires that quality audits be procedurized and conducted. 21CFR 820.20 requires, in part, that quality system requirements are effectively established and effectively maintained.

I'm not aware off the top of my head of a specific requirement for a 12 month audit cycle, though that seems reasonable as a general guideline for an enterprise that is regulatorily well organized and has evidence-based confidence that it is operating in good control.

I'm not sure what you mean by "every line item of each applicable reg. needs to be audited every time". The requirements do apply to all of the QSR that is applicable to your operations. If you conduct an audit process on a rolling basis within your repeat-cycle...which might be annually...you might do an audit each month, focusing on a different aspect of the QSR, so that you've covered everything applicable to you within your repeat-cycle period.

[ryno fan]

Thanks, MIREGMGR.

Re: 12 months, I was referring to guidance in FDA's Quality Systems Manual: A Small Entity Compliance Guide:
"Audit Schedule

Manufacturers are responsible for deciding the frequency of audits. The frequency should depend upon previous audit findings, any indications of problems, and known stability of the manufacturing process. If an audit reveals no problems, the audit intervals could be lengthened -- if problems are identified, audits may need to be conducted more often. Audits are usually conducted every 6 to 12 months, but should not exceed 12 months. "

Re: "not auditing every line item of a regulation":
For example - CFR 820.30 Design Controls covers many facets, such as design and development planning, inputs, outputs, review, verification, validation, changes, DHF. If we decided to cover only design review, verification, and validation, for example in an audit (based on known weaknesses), could we take credit as an audit of 820.30-Design Controls? Or because we audited only part of 820.30, would it not be an accurate claim?

[MIREGMGR]

In Reply to Parent Post by ryno fan

If we decided to cover only design review, verification, and validation, for example in an audit (based on known weaknesses), could we take credit as an audit of 820.30-Design Controls?

The "12 month" guidance applies to all the FDA regulations applicable to you. Any given regulation should be audited within your audit-cycle-length, i.e. 12 months or whatever. But, you might divide your overall system into say 12 chunks, and conduct an audit each month of one of those chunks. So, each chunk is audited during each audit-cycle.

You shouldn't omit any element of any regulation that FDA expects you to meet.

[ryno fan]

Thanks for the response.

[Ronen E]

"Audits are usually conducted every 6 to 12 months, but should not exceed 12 months."

Please note that in guidance documents "should" denotes a recommendation. A guidance "should" is definitely not a regulatory requirement, and if you have a reasonable justification you might be able to argue an alternative approach.