Internal Auditing Frequency Requirements in a Medical Device Company

H

htquality

#1
Hello,
We are a small Medical Device company certified to ISO 13485 and I am currently putting our 2012 Internal Audit Schedule together. Typically, our internal audits have been covering the entire Quality System on an annual basis, equally divided into 4 quarterly audits. Now, our CEO is trying to push back, saying that we have been doing really well with our NB and internal audits and that we could use the resources elsewehere. I though that it was a requirement that we cover the entire QS every year, but could not find it in the Standard (13485) to show him. Is it a requirement or if we could skip some sections next year?
 
Elsmar Forum Sponsor
#2
Hello,
We are a small Medical Device company certified to ISO 13485 and I am currently putting our 2012 Internal Audit Schedule together. Typically, our internal audits have been covering the entire Quality System on an annual basis, equally divided into 4 quarterly audits. Now, our CEO is trying to push back, saying that we have been doing really well with our NB and internal audits and that we could use the resources elsewehere. I though that it was a requirement that we cover the entire QS every year, but could not find it in the Standard (13485) to show him. Is it a requirement or if we could skip some sections next year?
I don't have a copy of 13485 in front of me, but I know for a fact that this idea of covering the whole system once a year is just a myth! You don't, otherwise it would say so in there. Now, maybe your NB has a contractual requirement to do this, but possibly not. I believe 13485 simply echoes what ISO 9001 says and you should focus not on doing a number of audits, but look at 'status and importance'. Does the boss understand what that means? It will help you if he does!
 

somashekar

Staff member
Super Moderator
#3
Hello,
We are a small Medical Device company certified to ISO 13485 and I am currently putting our 2012 Internal Audit Schedule together. Typically, our internal audits have been covering the entire Quality System on an annual basis, equally divided into 4 quarterly audits. Now, our CEO is trying to push back, saying that we have been doing really well with our NB and internal audits and that we could use the resources elsewehere. I though that it was a requirement that we cover the entire QS every year, but could not find it in the Standard (13485) to show him. Is it a requirement or if we could skip some sections next year?
Like all other requirement within the ISO13485, the internal audit is also a requirement. Is it an annual requirement ??? Well, the standard does not say so.
About status and importance .... only when you perform good internal audits continually, will you come to know the status and importance.
Please also know that internal audits of QMS are good check and balance tool aka financial audit. It is not to find a fault but a sample check exercise that is planned to monitor. Remember that Internal audit are a part of measurement, analysis and improvement. Even to maintain you must measure and analyse and internal audit just facilitates that.
Imagine a situation that your NB (CB) auditor makes his annual audit and comes up with one or few NC's and later finds that you have never even internal audited to capture your QMS measurement and analysis between his annual audit visits ... ? Major for you.
 
T

treesei

#4
ISO 13485 requires internal audit but does not specify the frequency. However, the industrial norm is to try to cover all elements/processes at least once a year. There was a recent article that said this was also what the US FDA expected. It was published in one of those "silver" "gray" sheets but I cannot remember which one. If a company is starting IA program, I would recommend that it start at once a year for each element/process. Then based on the data accumulated, perhaps do some adjustment.
 
L

Laura Halper

#5
(Sorry I'm a little late joining the game. Have been out of town and got behind.)

I can confirm that the FDA expects internal audits of the QMS to be done at least annually. I have seen the FDA issue a 483 to a company who had changed their audit frequency from annually to bi-annually. They made the change using their change control procedure with the justification that they were not identifying systemic problems in their annual audits. The FDA cited them for not doing annual audits, stating that doing internal audits at least annually was current "state of the art" for device companies.

Happy Holidays to everyone.
 

Ajit Basrur

Staff member
Admin
#6
Yes, the requirement is minimum once a year but the actual frequency may be changed based on the "health" of your system.

Based on the diagnosis of the health of the qms as described by htquality, the OP, I feel twice a year should be okay to try with. :)
 
L

Laura Halper

#7
I understood Htquality to say that each element of their quality system is currently audited once a year. They divide the entire system into four sections and audit each section once a quarter. They are not auditing the entire QMS four times a year. The CEO wants to reduce the frequency of audits so that the entire system would be audited less frequently than once a year (for example, once every two years).

In my experience, the FDA considers auditing the entire QMS once every two years to be unacceptable.
 
#8
OK, I have a copy of the standard and the internal audit requirements (regarding how often to audit) are exactly the same as ISO 9001. So, there's a big difference between:-

What the FDA expect, or

What a CB/NB auditor will accept, and

What the standard actually says!

The words 'status and importance' are used, but the words 'once a year' aren't! Here's a clue!

If you substitute the words 'risk and impact' for status and importance, you must ask yourself, is everything this organization does which has risk to customers, regulations, $$$ etc, only happening an an annual basis? Because unless it is (highly unlikely) then you'll have to do more audits...plain and simple!

Let's not forget that ISO 19011 actually mentions risk now!
 
Last edited:

Ajit Basrur

Staff member
Admin
#9
I understood Htquality to say that each element of their quality system is currently audited once a year. They divide the entire system into four sections and audit each section once a quarter. They are not auditing the entire QMS four times a year. The CEO wants to reduce the frequency of audits so that the entire system would be audited less frequently than once a year (for example, once every two years).

In my experience, the FDA considers auditing the entire QMS once every two years to be unacceptable.
Yes, you are right - in theory, htquality does an annual audit and thus meet the minimum requirements.
 
#10
I'd also add, if the 'boss' wants reduced audits then either:-

They don't know/understand what the audits are there for (did anyone really explain)

The audits are too complex and expansive (just like the NB does at their 'stage 2').

Instead, two things should be changed (scope/focus and criteria) to follow the issues which customers/management are interested in.
 
Thread starter Similar threads Forum Replies Date
S ISO 9001:2015 Internal Auditing Internal Auditing 8
A What are the pros and cons of using an audit software for internal auditing? General Auditing Discussions 7
S Risk based internal auditing Internal Auditing 6
F AS9100D Internal auditing requirements Internal Auditing 11
R Does any here use an internal auditing tool that works on different platforms? Internal Auditing 3
W Does anyone have an API Q2 checklist for internal auditing? Oil and Gas Industry Standards and Regulations 1
blackholequasar Internal Auditing Inspiration - Getting volunteers to perform internal audits. Internal Auditing 22
W Internal Auditing carried out by a 3rd party - Review of previous audits AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 3
S Internal Auditing for API Spec Q1 - auditor qualification requirements Oil and Gas Industry Standards and Regulations 6
E Informational Internal Audits - Wear multiple hats what can and can't I audit (so I'm not auditing my own work) Internal Auditing 149
N Online Internal Auditing Course for ISO 13485 - Suggestions ISO 13485:2016 - Medical Device Quality Management Systems 8
U Internal auditing - Company employees or contract second party Internal Auditing 10
K Internal Auditing - Umbrella QMS and Multiple Standards Oil and Gas Industry Standards and Regulations 4
D Auditing Our Outsourced 2nd-3rd Party Internal Audit Company ISO 13485:2016 - Medical Device Quality Management Systems 6
G AS9101 Rev F - Worksheets for internal auditing AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 11
S ISO 13485:2016 and MDSAP internal auditing ISO 13485:2016 - Medical Device Quality Management Systems 6
S ISO 9001:2015 - Internal Auditing - Audit to the Standard? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
R Internal Auditor auditing Internal Audit Procedure (AS9100) Internal Auditing 18
M Is Automated Internal Auditing Possible? Internal Auditing 13
C Internal Auditing Requirements (ISO 9001:2008) Internal Auditing 3
L Auditing Design and Development in ISO 9001 (Internal Audit) Internal Auditing 1
sswaim Auditing Internal Laboratory Personnel for Competence General Auditing Discussions 4
K Internal Auditing a previous Nonconformance? Internal Auditing 19
P Recommended books on ISO 27001:2013 Implementation and Internal Auditing IEC 27001 - Information Security Management Systems (ISMS) 4
M Are auditing checklists required for Internal Audits? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 13
B ISO/TS16949 Internal Auditing - How many auditors? Internal Auditing 4
B PFMEA, Internal Auditing, Corrective Action Training In Native Language (China) Training - Internal, External, Online and Distance Learning 1
Gman2 Internal Auditing Requirements before ISO 9001 Registration ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
S Auditing TS 16949 Cl. 7.6.3.1 - Internal Calibration Laboratory Requirements IATF 16949 - Automotive Quality Systems Standard 8
T ISO 9001 Internal Auditing Auditor Training in Amsterdam Training - Internal, External, Online and Distance Learning 1
S In an internal auditing desert and I'm the only one here.... AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 15
G Internal Auditing in a Multi-Site Environment ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 17
B Internal Auditing of MDD and CMDR Requirements Other Medical Device Related Standards 5
O Internal Auditing in small Engineering company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
T Looking for a webinar on Internal Auditing General Auditing Discussions 3
R On Auditing Internal Audit Process - How Independence can be Established Internal Auditing 4
D Auditing Abroad - Internal Audits of our European Sister Companies ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 16
R Auditing a process outside the realm of the formal Internal Audit ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 9
G New to Internal Auditing - Best questions to ask? Internal Auditing 17
M Auditing the Internal Audit Process - 8.2.2 General Auditing Discussions 2
J Auditing the Internal Auditing Process - Audit Nonconformance General Auditing Discussions 3
S Internal Auditing related to RISK Internal Auditing 9
W Internal Auditing - Observational Checklist for a Behavior Based System Internal Auditing 3
R Internal Auditing Checklist - Major NCR because the Checklist was not Completed Internal Auditing 17
V Depth of Internal Auditing and Training aspects in Research & Development (R & D) Internal Auditing 4
N Good Internal Auditing Training Courses Training - Internal, External, Online and Distance Learning 13
L Internal Auditing Reports / Documents - Design and Content Document Control Systems, Procedures, Forms and Templates 1
N Recommend internal auditing training 101 please (Tucson or Phoenix, AZ) Training - Internal, External, Online and Distance Learning 1
L Internal Auditing - How can I audit my QMS independently? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
C Internal Auditing - How to make it useful? Internal Auditing 36

Similar threads

Top Bottom