Process Audit Timetables and Check Lists - Medical Device Industry (ISO 13485)

[E. Madsen]

This has probably been asked and answered somewhere, but I am tired of looking and looking! If someone could point me in the right direction it would be WONDERFUL!!

I have five years experience process auditing to ISO 9000 in the electronics manufacturing. I just got a job in the medical device industry (ISO 13485) for a company that has been around for a while and has less than 40 employees. They do auditing quite a bit differently and I was curious if someone could answer some basic questions for me!

My questions:
1) How long does it typically take you do prepare for a process audit? This company has audit checklists developed for each area, but people in the company say it takes anywhere from 1-3 weeks to prepare for an audit! I have never taken more than a couple hours to prepare for an audit, so am I doing something wrong?

2) How long does it take you to actually perform a process audit? Again, I am used to a couple hours at the most.

3) Are audit checklists typically controlled documents in the medical device industry?

I want to make a good impression when I do my first audits and so I appreciate answers to my questions. Also, if anyone has any additional advice that might make my audits go smoother, I would be happy to take all the advice I can get!!

Thank-you!!
Emily Madsen

[GStough]

Originally Posted by E. Madsen

This has probably been asked and answered somewhere, but I am tired of looking and looking! If someone could point me in the right direction it would be WONDERFUL!!

I have five years experience process auditing to ISO 9000 in the electronics manufacturing. I just got a job in the medical device industry (ISO 13485) for a company that has been around for a while and has less than 40 employees. They do auditing quite a bit differently and I was curious if someone could answer some basic questions for me!

My questions:
1) How long does it typically take you do prepare for a process audit? This company has audit checklists developed for each area, but people in the company say it takes anywhere from 1-3 weeks to prepare for an audit! I have never taken more than a couple hours to prepare for an audit, so am I doing something wrong?

2) How long does it take you to actually perform a process audit? Again, I am used to a couple hours at the most.

3) Are audit checklists typically controlled documents in the medical device industry?

I want to make a good impression when I do my first audits and so I appreciate answers to my questions. Also, if anyone has any additional advice that might make my audits go smoother, I would be happy to take all the advice I can get!!

Thank-you!!
Emily Madsen

Welcome to the Cove, Emily!

The amount of time needed for internal audits at this company may depend on the complexity of the processes being audited. However, I can't imagine a regular process audit requiring 1-3 weeks' prep time! For our internal audits, a few hours is usually all it takes me in prep time. Maybe you could talk to someone there who has been involved in audits in the past and find out why so much prep time is needed.

Question 2's answer is very similar the first. It usually takes our audit team anywhere from 1 to 4 hours for the actual process audit, depending on which process is being audited since some are more complex and require more time, but again, unless there are extenuating circumstances (key employee absences, etc.) I wouldn't think so much time is necessary.

Question 3 - I can't speak for all medical device companies, but in ours audit checklists are controlled documents.

One more tip: if you have a chance, why not chat with auditees and find out what the audits were like before you came on board. You may find some interesting responses and clues as to why so much time has been involved in performing internal audits.

I hope this helps. Please feel free to visit as often you like. We are here to help!

[Duke Okes]

My questions:
1) How long does it typically take you do prepare for a process audit? This company has audit checklists developed for each area, but people in the company say it takes anywhere from 1-3 weeks to prepare for an audit! I have never taken more than a couple hours to prepare for an audit, so am I doing something wrong?

Perhaps they're talking about how long before the audit they plan. It would depend on the scope of the audit how long it took to plan, but I can't imagine it ever taking more than a few hourse.

2) How long does it take you to actually perform a process audit? Again, I am used to a couple hours at the most.

I agree, but perhaps they're auditing more complex processes and auditing them to a much deeper level (e.g., sample size, number of traces, etc.)

3) Are audit checklists typically controlled documents in the medical device industry?

If they're to be used consistently by auditors and will be revised based on changes to standards/policies/procedures, they should be controlled.

[jem63]

Originally Posted by E. Madsen

This has probably been asked and answered somewhere, but I am tired of looking and looking! If someone could point me in the right direction it would be WONDERFUL!!

I have five years experience process auditing to ISO 9000 in the electronics manufacturing. I just got a job in the medical device industry (ISO 13485) for a company that has been around for a while and has less than 40 employees. They do auditing quite a bit differently and I was curious if someone could answer some basic questions for me!

My questions:
1) How long does it typically take you do prepare for a process audit? This company has audit checklists developed for each area, but people in the company say it takes anywhere from 1-3 weeks to prepare for an audit! I have never taken more than a couple hours to prepare for an audit, so am I doing something wrong?

2) How long does it take you to actually perform a process audit? Again, I am used to a couple hours at the most.

3) Are audit checklists typically controlled documents in the medical device industry?

I want to make a good impression when I do my first audits and so I appreciate answers to my questions. Also, if anyone has any additional advice that might make my audits go smoother, I would be happy to take all the advice I can get!!

Thank-you!!
Emily Madsen

Welcome to the Cove!

I always say you will get out what you put into it. if you plan well for an audit you will be prepared and come out of that audit with good information and earned respect from those who were audited.

Audit planning and the process of auditing will be determined by a number of variables, here are some;

- the size of the process
- the ammount of information that needs to be reviewed
- the scope determined by the audit lead
- ability of the audit team
- how much scope creep the audit team allows to happen

I have been auditing for 10+ years so planning comes easily- part time over a few days for development.

On average, the audit itself depending on schedules, opend and closed within a week with about 4 to 6 hours dedicated to the audit.

checklists
We retain our audit checklists with the completed audits but do not retain the notes taken during the audit.

Remember that an audit checklist is a guide to assist the auditor during the audit and to help maintain consistency. This can be from an easy shopping list to a 10 page developed guide moving from stage one to the end of the audit. What you do will ultimately depend on the strength of the audit team conducting the audit. Personally, if i have a newer auditor I try to put in more information so they can see the course that the audit will take.

[freelovefest]

In answer to the first question, I doubt it usually takes 3 weeks to do the prep, but usually 3 weeks in advance is a good time to start prepping. There is certainly a lot more time put into prep for a medical audit. The first step is to determine what standards are required. For the company I am working with now I have to audit to 13485, 9000, 14971, QSR, CMDR, and MDD. This is a lot to consider for each audit. I have been doing this a while so I am familiar with all the requirements, but for some people it takes a long time just to determine what regulatory requirements need to be examined as part of the audit.

The other part of prep is determining the scope. For a validation process audit in example, you may need to review the risk management, the design history file, the device master record to determine what processes are used, as well as FMEAS and other such documents, not to mention post market info to see if it should have been included in risk, or resulted in more stringent validation. This usually will take a while to hunt down, and even longer to review so I can see how it might take a week to review everything adequately. It is not uncommon to have 30 IQ/OQ/PQ documents to review for one process. You are in a smaller firm so I doubt this level of detail exists, but it might.

As far as how long it takes to do the audit, after you do all the required prep, the actual audit takes only an hour or two with the right people and the right questions. The bulk of time, atleast in my experience, is certainly spent on prep and review of all information which is related to the process. Even an audit in Manufacturing will result in examining training, environmental controls, possible sterilization, document control, bio-burded testing, etc. It all depends on how you scope your audits and systems, but there is certainly a lot more to consider than a regular 9000 audit for an electronics manufacturer. It just depends on how thorough you want to be, and how much management really wants you to find and examine.

Remember, you don't get to audit with the resources you want, but the ones you have. Still, by putting more time into prep and planning, you will have a quicker audit, and more defensible findings to present to people who may not readily agree with your conclusions. The more you know about all the processes that interact with the one you are auditing, the more likely you will find serious high risk system issues as opposed to minor lapses in discipline.

As far as control of checklists, if these are something you use everytime I would control them, but if they are created for each audit, that is a different story. Hope this is helpful in some way

[Doug Tropf]

The timelines you reference seem excessive. I made a 13485 process audit checklist from scratch in preparation for our first "process oriented" internal audit. Making the checklist took longer than the actual audit.

We have not made the checklist a controlled document although I understand the reasoning for doing so.

The "ISO 9001 Auditing Practices Group" has some very informative guides
on process auditing on their web site - and they are free.

Good luck.

[DRDDO]

Hollo I am new comer, DRDDO --> actually Dr. D Do.
In fact Audit based on process, most checklist I have seen based on requirement.
It is not easy to create process checklist.
More detail in: Document: ISO/TC 176/SC 2/N 544R
Thanks,
Dr. D DO

added in edit: Removed copyrighted material. Please do not post copyrighted material on the Cove
Gert Sorensen

[Weiner Dog]

Originally Posted by E. Madsen

This has probably been asked and answered somewhere, but I am tired of looking and looking! If someone could point me in the right direction it would be WONDERFUL!!

I have five years experience process auditing to ISO 9000 in the electronics manufacturing. I just got a job in the medical device industry (ISO 13485) for a company that has been around for a while and has less than 40 employees. They do auditing quite a bit differently and I was curious if someone could answer some basic questions for me!

My questions:
1) How long does it typically take you do prepare for a process audit? This company has audit checklists developed for each area, but people in the company say it takes anywhere from 1-3 weeks to prepare for an audit! I have never taken more than a couple hours to prepare for an audit, so am I doing something wrong?

2) How long does it take you to actually perform a process audit? Again, I am used to a couple hours at the most.

3) Are audit checklists typically controlled documents in the medical device industry?

I want to make a good impression when I do my first audits and so I appreciate answers to my questions. Also, if anyone has any additional advice that might make my audits go smoother, I would be happy to take all the advice I can get!!

Thank-you!!
Emily Madsen

Is the company also regulated by the FDA?

The key is to have a quality system that encompasses FDA and ISO (and other regulations, such as Australian and Japanese, if applicable). You find the worst case scenarios from the FDA regulations and the ISO/EN/AAMI/ANSI requirements (and others...). If you met the worst case for "X", then you should have no problem meeting "Y". The problem is that there are differences. For example, the QSR notes to establish essential design outputs; whereas ISO/EN/AAMI/ANSI requirements note to establish essential design inputs. To comply to all, you have to establish essential design inputs and essential design outputs.

If it takes you three or more weeks to prepare for an audit inspection (even for internal audits), then something system-wise may need to be fixed.

Unless there are major problems, Level I/II FDA QSIT audits usually take ~ a week. Level III FDA compliance/ for cause audits can take a few days to many weeks (or more) depending upon the situation. (I believe ISO audits take a few days to a week too.)

There are many audit checklists (including ones noted in FDA's QSR manual). However, it is not wise to solely rely on these checklists, because doing so, you may miss certain areas.

Good resources are FDA's QSIT manual and C/P 7382.845. http://www.fda.gov/cdrh/devadvice/ http://www.fda.gov/cdrh/comp/gmp.html http://www.fda.gov/ora/cpgm/default.htm

How about conducting a mock FDA audit? After doing so, see what needs fixed administratively. Consultants can help, if you are bogged down.

FYI- When I was with FDA, it took me a day or so to prepare to an audit. This is because I not only had to read the prior inspection report (EIR) and company supplied written procedures (if voluntarily sent), but also check the various internal and external FDA websites for registration, listing, MDR, CAR, etc info. It takes about the same time for me to prepare for a similar audit as a consultant. It should take about the same time or less for you- because your audit team (unlike a governmental official or consultant) already knows the inner workings of your firm. (As an analogy: FDA, ISO, & consultants only see the tip of the iceberg. You see the part hidden underneath the water....)