Can CEO perform internal audit

[piccoto]

Hi,
We are a small medical device company. I'd like to certify our CEO as an internal auditor. Can the CEO do internal audits?

I didn't think there was any problem with that, until one of our employees had mentioned that in the last FDA inspection the inspector said that the CEO cannot perform internal audits

Thanks for any feedback!

 

[Paul Simpson]

As far as I am aware there is nothing to prevent your CEO from auditing the system, provided he / she is competent.

I presume the query has been raised for reasons of independence but it is unlikely there is anything the CEO is directly involved in delivering under the standard that he / she could not audit.

 

[Jen Kirley]

Hi,
We are a small medical device company. I'd like to certify our CEO as an internal auditor. Can the CEO do internal audits?

I didn't think there was any problem with that, until one of our employees had mentioned that in the last FDA inspection the inspector said that the CEO cannot perform internal audits

Thanks for any feedback!

If the CEO is competent, objective and impartial, certainly he/she could do internal auditing.

 

[AndyN]

Hi,
We are a small medical device company. I'd like to certify our CEO as an internal auditor. Can the CEO do internal audits?

I didn't think there was any problem with that, until one of our employees had mentioned that in the last FDA inspection the inspector said that the CEO cannot perform internal audits

Thanks for any feedback!

The FDA person is probably thinking the CEO can't be "independent"...

 

[Jen Kirley]

...one of our employees had mentioned that in the last FDA inspection the inspector said that the CEO cannot perform internal audits

I don't suppose the FDA inspector cited a specific requirement? In a 1991 online paper, (B.3.b) "FDA recommends that the applicant specifically hire an outside consultant to conduct the audit and to lead the audit team, if a team is necessary." but I do not know the current requirement, if any.

 

[Jen Kirley]

Here it is: the FDA Rule "Quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited."

Subpart B--Quality System Requirements, Sec. 820.22 Quality Audit

 

[piccoto]

Thanks for the link (1991 online paper). Though it refers to PMA audit and "restoring FDA's confidence in company's integrity" and our audit was just a "random" audit.

Is the CEO considered as directly responsible for the warehouse, for instance? if the CEO would audit the warehouse he would be auditing the warehouse manager. Then I would say that the warehouse manager is directly responsible to the matter being audited (and therefore HE can't do the audit). Does this make sense?

 

[mihzago]

I think the FDA's view is that the CEO has a direct responsibility for the entire company and all of its activities. CEOs are held responsible for anything that happens in the company.
There was one notable enforcement action a while ago (I don't remember the company) where the CEO was sent to prison for some egregious activities in the manufacturing facility, despite the CEO claiming that he was not aware of any of it happening.

 

[pkost]

I think the FDA's view is that the CEO has a direct responsibility for the entire company and all of its activities. CEOs are held responsible for anything that happens in the company.
There was one notable enforcement action a while ago (I don't remember the company) where the CEO was sent to prison for some egregious activities in the manufacturing facility, despite the CEO claiming that he was not aware of any of it happening.

I would argue that a CEO is accountable, but not necessarily directly responsible. The CEO may not have been aware, but he has a responsibility to to ensure that the company is operating legally. He does this by putting in policies, providing sufficient resource and implementing thorough oversight/governance activities.

Without knowing the specific case you are referring to I can only guess, but if the activities were so bad, it is possible that the court believed that he/she did know what was going on and chose to ignore it/lie to the court. Equally, he may not have operated with adequate diligence


If it can be argued that a CEO is directly responsible for all activities, I would extend the logic to say that the CEO must be competent in all activities that his business carries out (as should every director for their respective areas of responsibility etc etc). This would be a ludicrous situation and rather unrealistic

 

[mihzago]

'Accountable' may be a more appropriate word, as you suggested; however, the main point here is that a company must established independence.

Here's an excerpt from the Preamble:

"56. Some comments stated that requiring ``individuals who do not have direct responsibility for the matters being audited'' to conduct the audits is impractical and burdensome, particularly for small manufacturers.

FDA disagrees with the comments. Both small and large manufacturers have been subject to the identical requirement since 1978 and FDA knows of no hardship, on small or large manufacturers, as a result. Small manufacturers must generally establish independence, even if it means hiring outside auditors, because the failure to have an independent auditor could result in an ineffective audit.

Manufacturers must realize that conducting effective quality audits is crucial. Without the feedback provided by the quality audit and other information sources, such as complaints and service records, manufacturers operate in an open loop system with no assurance that the process used to design and produce devices is operating in a state of control. ISO 9001:1994 has the same requirement for independence from the activity being audited."

With that, in my opinion, you would have a very difficult time trying to justify having the CEO audit the production facility.