How To Structure Your Internal Audit Program
By Jon Speer, Founder & VP of QA/RA, greenlight.guru
How have the first few months of 2018 treated your company? Are you confident that you’ve got a good plan for the year, including internal auditing, or are you still scrambling to catch up from issues identified late last year?
This is a scenario that plays out too often for companies, particularly when dealing with internal auditing. Make this year one of preparedness, and avoid the mad scramble by planning ahead for your internal audit program.
Let’s begin with a story. Several years ago, I was brought in to work with a company who’d had some problems with an FDA inspection. The company’s quality system and procedures were not up to scratch. It was around December, and I asked about reviewing their internal audits for the year. As I watched, the color drained from the faces of the president and senior team members — they’d just realized it was the last few weeks of the year, and they hadn’t given any thought to internal auditing, let alone done anything about it.
FDA requires companies to conduct internal audits according to an internally prepared schedule. Some processes are more critical than others, and absolutely should be audited at least once per year, while others may be audited every other year — if you can provide a reasonable explanation as to why.
Returning to our story, the company now is panicking because, according to their own documented schedule, they must conduct an internal audit of each and every process once per year. Their next move was to contact a consultant and request an internal audit before the end of the year. Does this sound like a good idea? I’ll tell you now, the answer is “no!”
The best way to conduct an internal audit is to be present, and to interact with the people in charge of the processes being audited. Given that it was late in the year, the consultant audited every process remotely, and even then managed to find a number of holes that needed to be addressed.
The company’s policy stated that any issues found in an internal audit must lead to a CAPA —a huge mistake. Just because something has been found in an audit doesn’t automatically mean that CAPA should be enacted. As we’ve discussed previously, CAPA should be reserved for systemic issues that aren’t addressed by following other procedures (such as company procedures for complaints or nonconformances). This company’s last-second audit identified at least 30 issues, and now their own policy was telling them to issue a CAPA for each one.
While the consultant completed the audit and subsequent reports by December 31 that year, the ordeal really was more of a checkbox activity for the company — something their processes told them they “had to do.” However, now they had to address 30-40 CAPAs to begin their New Year, all while patting themselves on the back because they had “checked off” the internal audit. This company already was struggling, and they buried themselves even further under the burden of CAPAs.
This was a poor way to implement internal audits, but certainly enlightening to me! At the end of the year — one of the busiest times at many companies — so many other things are going on with holidays and planning for the year ahead that a) internal audits at that time become an extra burden, and b) you risk treating the internal audit as simply a “checkbox” item, and it is ineffectively executed.
Internal audits should be rigorous. They should be one of the harder tasks performed in the company, because you want to hold the company to a high standard. Internal audits are meant to keep you and your company prepared, and they should challenge you to evaluate your processes. In addition to preparing for these audits early, consider these four tips:
1 — Spread Your Activities Out
Let’s say your company has around 30 processes that make up your standard operating procedures (SOPs). I would divide these up by quarter, grouping together those that make sense. I find that any greater frequently than quarterly tends to get a bit too noisy, but quarterly helps to create a nice, manageable spread throughout the year.
Think about it like the product realization process — the cocktail napkin sketch. I set my internal audit schedule as early in the calendar year as possible and group together those processes which have “like” purposes. Such organization helps to identify any systemic or workflow issues, provided processes are logically grouped.
2 — Structure Your Audit Schedule Appropriately
Often, people seem to use spreadsheets and choose arbitrary dates. This method doesn’t make a lot of sense and tends to prohibit good collaboration. Create an audit workflow that emphasizes visibility, helping those with primary responsibility to create a schedule, specify due dates, assign owners, set reminders and easily share with others.
This workflow facilitates creating a plan, knowing what to do and when, so visibility over results and quality events that may be linked. Being connected is a key factor for doing well with quality and compliance.
3 — Treat Internal Audits As An Opportunity
Different companies have different responsibilities and structure when it comes to internal audits. Larger companies might have a certain team assigned, while smaller entities might share responsibility across several departments. Regardless, internal audits only are valuable if you treat them as an opportunity to learn and grow.
I’ve seen companies where auditors are treated like Internal Affairs investigators in a gritty crime drama — with trepidation and an attitude of having to hide from the auditor. This is not conducive to learning from the auditor or the audit’s findings! Even if the company has ongoing issues, it’s much better to highlight them in an internal audit, so that you can work on them before the FDA intervenes.
4 — Consider Using Your Own Team
Even good consultants don’t necessarily have the time or internal knowledge of your company to notice everything. There are things that happen within a company that might not be defined in a process or procedure, but remain important to the company. This is the kind of information you want to uncover in internal audits: reduce “tribal knowledge” and get it documented.
Auditing with an in-house team can be valuable for uncovering these sorts of things. It’s doable if you spread it out over the year and, again, it provides a good learning opportunity. This is, of course, a matter of choice (a consultant can be a huge help, particularly to companies who are lacking in-house expertise on compliance), but it’s good experience for your own team, if done well.
To that end, provide training — this is key for whoever is conducting audits. Be a resource to them and structure a simple, yet effective, training program that allows them to do the job well.
In summary, I’d say don’t be “that” company — the one panicking in December, struggling to complete an internal audit before the end of the year. Treat internal audits as a valuable learning tool. Plan them out in a structured way across the year, so that each process is thoroughly vetted. And, finally, consider training your own team members to manage internal audits, and help to break down any “tribal knowledge” that might exist in your team.
About The Author
Jon is a medical device industry veteran with over 19 years of experience. He has helped dozens of devices get to market through a variety of roles, including product development, project management, quality, and regulatory. Jon also is a thought leader, speaker, and regular contributor at numerous leading industry publications. Request a free demo of greenlight.guru’s audit workflow software here.