Internal Audit NCRS and CAPAs

#1
Hello!

I am working as a "Quality Systems Associate", but performing all the duties of a normal quality manager. I am running our QMS in conformance with the ISO 13485 standard, and I'm pretty new to it all (been in my position 4 months).

We recently conducted our internal audit near the end of October, and I just received the list of NCRs. The audit report also lists suggested corrective actions for each NCR. My question is:
Do I need to actually open a separate CAPA report for each NCR found during our internal audit (there were 19)?

That seems pretty unnecessary for some of these NCRs, which have been corrected with something as simple as labeling some materials with "Do Not Use". However, if I do not write up a CAPA report for each non-conformance, how do I show proof that the corrective actions have been put in place?

Any help is much appreciated!:thanx:
 
Elsmar Forum Sponsor
#2
Hello!

I am working as a "Quality Systems Associate", but performing all the duties of a normal quality manager. I am running our QMS in conformance with the ISO 13485 standard, and I'm pretty new to it all (been in my position 4 months).

We recently conducted our internal audit near the end of October, and I just received the list of NCRs. The audit report also lists suggested corrective actions for each NCR. My question is:
Do I need to actually open a separate CAPA report for each NCR found during our internal audit (there were 19)?

That seems pretty unnecessary for some of these NCRs, which have been corrected with something as simple as labeling some materials with "Do Not Use". However, if I do not write up a CAPA report for each non-conformance, how do I show proof that the corrective actions have been put in place?

Any help is much appreciated!:thanx:
Welcome - Can I ask why such a delay? To answer your question, you can bundle ncs into a few corrective actions. Depends on the content. If the auditors were competent they might have combined ncs anyway...
 
#3
We are a subsidiary of a larger German company, and due to my inexperience we had our QMR from that company fly out to do our internal audit. He then flew back to Germany, where he also has multiple other job responsibilities beyond his QMR duties, and he fell behind in completing the audit report. (It's also holiday season in Germany, and they have had a lot of days off recently).

A lot of these NCRs are just such simple fixes, I don't see why they need an entire CAPA report and investigation done.

Also, one of our NCRs was for an insufficient CAPA procedure, and lack of an official CAPA report. Per the CAPA suggestion from the auditor, I have written a new CAPA procedure, and created a CAPA report template (8D Report). Do I really need to now open a CAPA report saying I have created the CAPA procedure and report template?
 
I

isoalchemist

#4
It depends on how you have written your system. My preference is to generate a CAPA for each distinct NC found in the report (i.e. you can bundle similar ones if they exist). IMHO NC's in an audit report (internal or external) should be treated at a higher level than NC off the floor (which may just be a "Fix It").

Yes, write up the CAPA for the CAPA system. The interesting part is not the procedure, but understanding the root cause of why it was insufficient in the first place.
 
#5
We are a subsidiary of a larger German company, and due to my inexperience we had our QMR from that company fly out to do our internal audit. He then flew back to Germany, where he also has multiple other job responsibilities beyond his QMR duties, and he fell behind in completing the audit report. (It's also holiday season in Germany, and they have had a lot of days off recently).

A lot of these NCRs are just such simple fixes, I don't see why they need an entire CAPA report and investigation done.

Also, one of our NCRs was for an insufficient CAPA procedure, and lack of an official CAPA report. Per the CAPA suggestion from the auditor, I have written a new CAPA procedure, and created a CAPA report template (8D Report). Do I really need to now open a CAPA report saying I have created the CAPA procedure and report template?
This one internal audit in the year? If so, oh dear...

I'd bundle them. Not seeing the actual nc statements, which is important to know they are "valuable" and not a bunch of nitpicky things (which given the number - 19, could well be). I'd be more worried that this is one audit a year. Added to this, if the findings are somewhat "minor" in nature (not grade), you might be better to run your own audits and if you have to (politics etc) allow the guy from Germany to come over, do that as well.
 

John Broomfield

Staff member
Super Moderator
#6
Hello!

I am working as a "Quality Systems Associate", but performing all the duties of a normal quality manager. I am running our QMS in conformance with the ISO 13485 standard, and I'm pretty new to it all (been in my position 4 months).

We recently conducted our internal audit near the end of October, and I just received the list of NCRs. The audit report also lists suggested corrective actions for each NCR. My question is:
Do I need to actually open a separate CAPA report for each NCR found during our internal audit (there were 19)?

That seems pretty unnecessary for some of these NCRs, which have been corrected with something as simple as labeling some materials with "Do Not Use". However, if I do not write up a CAPA report for each non-conformance, how do I show proof that the corrective actions have been put in place?

Any help is much appreciated!:thanx:
palebluedot,

In the six weeks that have elapsed since the audit, the managers responsible may already have taken action.

Follow-up to confirm the actions they have taken since the audit to fix the nonconformities and, where necessary, to remove the root causes.

Then update your corrective action records accordingly.

In future, of course, you will be careful for your office not to be seen as the cause of delay or condoning delay in corrective action.

John
 
#7
Many of the corrective actions have already been successfully implemented, as I had taken notes during the internal audit and got to work on fixing many of the problems while I was waiting for the official audit report. Luckily, none of the NCs that were found affected the customer, so we do not have any customer's awaiting a CAPA report. Most of the NCRs were for things like document control, due to overall sloppiness with all of the managers in the past.
One of our NCRs was for having test materials in our quarantine stock. It is our policy that anything in quarantine must have accompanying paperwork that describes why it was quarantined. Since the test materials were samples we requested, and were not being used in production, we did not have any paperwork for these materials. The auditor gave us an NCR for Control of Nonconforming Product, and declared the material's "inspection status was not clear". As a result, I added control of test materials to the relevant document, and labeled the sample materials as "Sample - For Testing Only - Do Not Use", and relocated these materials to our usable stock.
This was a very simple fix, which is why it seems strange to me that it would need an entire CAPA report written out for it. But according to everyones responses, I would need to write a report for this anyway, correct?

I apologize if this seems obvious to everyone, but it's my first time in this situation.
 
#8
CAPA is - outside of a regulated environment - an overblown requirement. It treats all audit nonconformities the same and, in fact, if you draw a parallel with product non-conformity, sometimes you simply disposition the thing, shrug your shoulders and get on with life. The idea of doing some in-depth, root cause analysis on everything is bizarre and, IMHO totally unnecessary. Some audit findings can be treated as they say in the Forrest Gump movie; "Sh*t Happens"...
 

John Broomfield

Staff member
Super Moderator
#9
palebluedot,

The situation you describe is made strange to you by your own management system not by the standard.

Create a place to record the fixes made to your management system where investment in root cause removal is unwarranted by the cost/risk. These records are important for future verifications of the effectiveness of your evaluations of the need for corrective action.

Usually the corrective action procedure covers such corrections as well as the removal of root causes.

John
 
Thread starter Similar threads Forum Replies Date
dubrizo Are you documenting Internal Audit findings as NCRs? Internal Auditing 18
H AS9100 Checklist for Internal Audit needed AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 1
A What are the pros and cons of using an audit software for internal auditing? General Auditing Discussions 4
F Internal Audit before Pre-Assessment ISO 17025 related Discussions 2
Q Internal audit plan template Internal Auditing 5
L Internal audit during COVID-19 restrictions ISO 13485:2016 - Medical Device Quality Management Systems 5
O ISO13485 implementation - Are internal audits expected before stage 1 audit? Design and Development of Products and Processes 3
B Using Unreleased Documents & Process Maps for Internal Audit purposes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
N Small Company - Internal audit process - Who does the audit? Internal Auditing 16
J Does anyone have an excel IATF 16949 Internal Audit checklist I could use? IATF 16949 - Automotive Quality Systems Standard 7
G Addressing Non-Conformances from an Internal Audit that are not product related ISO 13485:2016 - Medical Device Quality Management Systems 11
S Internal audit discrepancy - We missed a few audits that were scheduled Internal Auditing 12
Raffy ISO 14001 9.2.2 Internal Audit Programme Content Internal Auditing 5
N Internal Audit Schedule – Who gets to set the schedule? Internal Auditing 16
V IATF 16949 9.2.2.1 Internal Audit Program - "Process Changes" IATF 16949 - Automotive Quality Systems Standard 11
G Non Conformance During ISO 9001 Audit - Not All Internal Audits Completed General Auditing Discussions 19
B Using external FDA and ISO 13485 audit as internal audit Internal Auditing 6
T Internal Audit Schedule when Hiring Out Internal Auditing 7
D ISO 9001:2015 Internal Audit Training Advice Internal Auditing 10
M Internal audit consultant ISO 13485 (English speaker) Consultants and Consulting 3
S Implementing a 45001 Health & Safety standard - Internal audit plan wanted Internal Auditing 1
F Internal Audit - Procedure example Internal Auditing 5
C Internal Audit - Process Clause Matrix / Audit Checklist ISO 13485:2016 - Medical Device Quality Management Systems 7
CPhelan Internal audit - Combine similar nonconformities in one or keep separate? Internal Auditing 6
M Internal Audit Plan in Retail Internal Auditing 10
D Management of NC after internal system audit IATF 16949 - Automotive Quality Systems Standard 7
A Purchasing - Internal Audit Questions Internal Auditing 8
N Comprehensive Compliance Matrix for Internal Audit Checklist Other Medical Device Regulations World-Wide 1
W Where to begin with an ISO 9001:2015 internal audit Internal Auditing 13
D Internal audit forms or checklists for a medical/veterinary laboratory General Auditing Discussions 5
E Informational Internal Audits - Wear multiple hats what can and can't I audit (so I'm not auditing my own work) Internal Auditing 144
E ISO 9001:2015 - Internal Audit Plan Clauses General Auditing Discussions 8
S Internal Audit Checklist for Application/Software development IEC 27001 - Information Security Management Systems (ISMS) 1
S Internal Audit - Risk and Opportunity (ISO 9001:2015 ) Internal Auditing 1
F API Spec Q1 9th Edition Surveillance Audit - Questions about internal audits. Oil and Gas Industry Standards and Regulations 23
Ashland78 IATF 16949 Internal Audit Checklist Manufacturing and Related Processes 11
Ed Panek Root Cause CAPAs from internal audit ISO 13485:2016 - Medical Device Quality Management Systems 16
K Student wanting Case Study about Internal Audit Report Internal Auditing 1
R How far apart can you schedule separate areas or departments in your internal audit? Internal Auditing 4
D Auditing Our Outsourced 2nd-3rd Party Internal Audit Company ISO 13485:2016 - Medical Device Quality Management Systems 6
A API Spec Q1 9th Edition - 12 month Internal Audit Schedule Audit Nonconformance Oil and Gas Industry Standards and Regulations 10
J Microsoft Teams to manage Internal Audit System? Internal Auditing 3
tony s An organization's Internal Audit Office certified to ISO 9001:2015 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 28
Tagin Does ISO 9001:2015 require a full internal audit annually? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 21
S GM/VP softgrading internal audit finding - need feedback from an audit guru! General Auditing Discussions 11
M Internal Audit Assessment Criteria - ISO 13485:2016 Internal Auditing 21
V Process and Internal Audit Criteria matrix wanted Internal Auditing 8
S Internal Audit Completion Memorandum Internal Auditing 2
T Example wanted - Template for internal audit IATF 16949 IATF 16949 - Automotive Quality Systems Standard 1
a_bardi Is it possible to exclude internal audit from qms scope? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5

Similar threads

Top Bottom