Blog

Archive for ISO Auditing

Auditing the Nonconforming Material Process-21 CFR 820.90-Part III

This blog, “Auditing the Nonconforming Material Process-21 CFR 820.90 identifies process interactions with the nonconforming material process. 

auditing for compliance 21CFR 829.90 Auditing the Nonconforming Material Process 21 CFR 820.90 Part III

Nonconforming material is not a “bad” thing in and of itself. In fact, having no nonconformities is conspicuous. There are three critical aspects to verify when you are auditing nonconforming materials:

  1. nonconforming materials are identified and segregated
  2. disposition of nonconforming materials is appropriate
  3. feedback from the nonconforming material process interacts with other processes

This article focuses on the third aspect–process interactions. The most efficient method for auditing process interactions is to use turtle diagrams, because turtle diagrams provide a systematic framework for identifying process linkages (http://bit.ly/Process-Approach).

Turtle Diagram Step 1

The first step of completing a turtle diagram involves identifying the process owner and obtaining a brief description of the process. This typically will not lead directly to identification of process interactions–unless the person being interviewed describes the process using a process flow diagram.

Turtle Diagram Step 2

The second step of completing a turtle diagram is where the auditor identifies inputs of raw materials and information to the process. For nonconforming materials, the key is to review the incoming inspection record and the trend of nonconformities from the supplier. In a thorough investigation of root cause for nonconforming raw materials, an investigator may recalculate the process capability for each dimension to determine if the process capability has shifted, since the original process validation by the supplier.

Turtle Diagram Step 3

In the third step of completing a turtle diagram, the auditor documents the flow of product and information when the process is done. The transfer from one process to another will often involve an in-process inspection, and updating of the product status. The best practice is to identify these in-process inspection steps in a risk control plan as part of the overall process risk controls for product realization. Although risk control plans are not required in most companies, they will become more prevalent as companies update their quality systems to a risk-based process for compliance with the 2015 version of ISO 9001.

Turtle Diagram Step 4

The fourth step of the turtle diagram identifies calibration, maintenance and validation that is applicable to the process being audited. It is common for nonconformities to occur when measurement devices are out-of-calibration, or equipment is not adequately maintained. Therefore, auditors should always ask what device was used to measure a nonconformity, and what equipment was used to manufacture product. Auditors should also review calibration and maintenance records for evidence that corrections are being made on a frequent basis.

Whenever frequent corrections are needed, the probability of devices being out-of-calibration and/or equipment malfunctioning increases. Auditors should also verify that the process parameters in use match the validated process parameters. Ideally, validation of process parameters is also directly linked to process risk analysis, and in-process inspections are performed whenever process capability is inadequate to ensure conforming parts. If an auditor observes a high frequency of nonconformities, then an in-process inspection should be implemented for containment and the validation report should be compared to current process performance.

Turtle Diagram Step 5

The fifth step of completing a turtle diagram involves identification of personnel and sampling training records. The procedure for control of nonconforming material should be required training for anyone that is responsible for initiating, investigating or completing a nonconforming product record (i.e., NCR). Critical interactions to verify for effectiveness are related to process changes. If a procedure changes, training may need to be updated. An auditor should verify that there is a mechanism for tracking which revision of the procedure each person is trained to. In addition, training records should verify that training requirements are documented, training is effective and that the person is able to demonstrate competency by correctly completing the sections of an NCR form. The auditor can review completed records to verify competency, but the auditor can also interview personnel and ask hypothetical questions.

Turtle Diagram Step 6

The sixth step of completing a turtle diagram involves identification of all applicable controlled documents, such as: procedures, work instructions and forms. The auditor should also verify that the process for control of external standards is effective. In the case of controlling nonconforming product, there are seldom any applicable external standards. However, it is critical to verify that the current forms and NCR identification methods are being used for control of nonconforming product.

Turtle Diagram Step 7

The seventh and final step of the turtle diagram is data analysis of metrics and quality objectives for a process. For control of nonconforming product, there should be evidence of statistical analysis of nonconforming product in order to identify the need for corrective actions. This is a requirement of 21 CFR 820.250. This data analysis should then be used to quantify process risks that may be used for decision-making and to explain those decisions during regulatory audits.

The above process interactions are just examples, and auditors may identify other important process interactions during the course of an audit. Each process interaction that touches a record of nonconforming product is a potential audit trail that could lead to value-added findings to prevent future nonconformities.

If you need help improving your own process for controlling nonconforming product, or with auditing in general, please email Rob Packard.

Posted in: ISO Auditing

Leave a Comment (0) →

Auditing Nonconforming Materials: 21 CFR 820.90 Compliance

This blog, “Auditing Nonconforming Materials: 21 CFR 820.90 Compliance” specifically focuses on identification and segregation of nonconforming materials. 

Identification and Segregation 3 Auditing Nonconforming Materials: 21 CFR 820.90 Compliance

Nonconforming material is not a “bad” thing in and of itself. In fact, a total lack of nonconformities is conspicuous. There are three critical aspects to verify when you audit nonconforming materials:

  1. nonconforming materials are identified and segregated
  2. disposition of nonconforming materials is appropriate
  3. feedback from the nonconforming material process interacts with other processes 

Identification & Segregation

Failure to adequately control nonconforming materials is one of the top 10 reasons why companies receive FDA 483s (http://bit.ly/FY2013-483-Data-Analysis). There is no requirement for locked cages in a Standard or 21 CFR 820 (http://bit.ly/21CFR820-90), but you must identify nonconforming materials and keep them segregated from conforming product. How you identify the nonconforming material is also up to your discretion. I do not recommend anything that is colored green, because people associate the color green with product that is accepted and released, while anything red is typically associated with danger, caution or rejected. I prefer to keep things simple. Therefore, a red sticker, red tag or placing a part in a red bin usually works.

I believe in eliminating duplication of work whenever possible. Therefore, I think it’s silly when a procedure requires you to document information on a red sticker or tag that is also on a Nonconforming Material Record (NCR). Every NCR must have traceability to the physical product, and marking the number of the NCR on the red sticker or tag is a simple way to accomplish this. (i.e., NCR # 32).

If you have a barcoding system, you eliminate the possibility of misreading an NCR number but it’s overkill. Another silly requirement is to attach a hard copy of the nonconforming material record to the box containing the nonconforming product. Every time you revise the NCR, you won’t remove the original and attach a new copy to the box. Furthermore, many auditors just look for a box of product in the quarantine area that is missing a hard copy of the nonconforming material record.

My preference is to have red stickers or tags placed on nonconforming product at the location it is found and then placed into a red bin. At least once a day, or whenever you perform a “line clearance”, I recommend that the contents of the red bins are moved to a centralized location for nonconformities.

At that location, there should be a log and a computer to either print out a new NCR, or to enter information into an electronic record. This centralized location should be visible to the production manager or the quality manager from their desk. The person delivering the nonconformity should complete the next entry in the log and record the number on the sticker or tag. Then, the NCR should be completed with the required information. The NCR then should be delivered to the manager’s desk in a red bin.

Some people argue that you need a large area to store nonconforming product in the warehouse–in case you have a large quantity of nonconforming product. I disagree. If you have a great deal of nonconforming material (i.e., your red bins are filling rapidly), then you need to stop production and get the situation resolved immediately. This is why you have a CAPA process.

If your inspectors are finding nonconforming product at incoming inspection, this means your supplier shipped nonconforming material. Don’t tolerate nonconforming material from suppliers. Reject nonconforming material and make your suppliers initiate corrective actions.

If the problem is with:

  • Your inspection method, you need to validate your inspection method (i.e., gage R&R studies).
  • Your inspection device, quarantine it and get another calibrated device.
  • Your specification, fix it now.

Every other type of problem found during incoming inspection should result in a buyer, or another person responsible for supplier quality management, contacting the supplier ASAP. Ideally, you want all incoming rejected product to be returned the same day it is received. 

How to Audit Identification and Segregation

When I’m auditing this process, I look first for proper identification and segregation. There are three places where auditors need to ask and observe how nonconforming material is identified and segregated: 1) incoming inspection, 2) in-process inspection and 3) final release (http://bit.ly/21CFR820-80). It is also critical that auditors verify that nonconforming materials are removed from production areas at the end of each lot as part of the line clearance procedure. If this is not done, then there is a risk of losing traceability to the lot.

Auditors should ask how nonconforming material is identified and then verify that the procedure states this. Searching for deviations from the procedure is easy if the procedure was not well written, but these are audit findings of little value. Quality Managers should address this issue when they write the procedure. What is far more important is to verify that everyone is segregating nonconforming material immediately.

  • Red bins are your “friend” and they belong on the floor.
  • Yellow typically indicates that something is waiting to be inspected.
  • Green typically means that something passed inspection and has been accepted.

Auditors should look for any situations where multiple parts are in the process of being inspected at the same time. Unless inspection is automated and involves a fixture, I don’t recommend allowing an inspector to inspect more than one part at a time.

As an auditor, once I have verified that product is adequately identified and segregated, then I look to see how nonconformities are dispositioned. That is the subject of a future blog. If you have a quarantine area that is bursting with rejected components and incorrectly built product, you need to read our next blog (http://bit.ly/MDA-Blog) about control of nonconforming materials.

Posted in: ISO Auditing

Leave a Comment (1) →

Medical Device Academy-5 Proven Audit Approaches

This article, Medical Device Academy-5 Proven Audit Approaches, reviews how our clients benefit from our tried and true audit principles.  

5 benefits internal audits Medical Device Academy 5 Proven Audit Approaches

1. Process Approach 

I am an advocate for using turtle diagrams (i.e., the process approach, http://bit.ly/Process-Approach) for auditing, instead of audit checklists. Beyond the obvious visual differences between using audit checklists and using turtle diagrams, these two tools result in very different types of observations. An auditor using a checklist typically starts with a regulatory requirement, and then the auditor samples record to verify if the records meet the requirement. Once this verification has been successful once, it is unlikely that the process will have a problem in the future.

Turtle diagrams and the process approach focus on inputs and outputs to a process–instead of specific regulatory requirements. For example, when an auditor uses the element approach to auditing, the auditor will sample one or more process validations from a master validation plan to ensure compliance with 21 CFR 820.75. However, step four of the process approach includes sampling process validation for each process being auditing. If there is a lack of process validation for any process, the auditor will identify the gap. Step four also involves verifying calibration of devices used in the process and maintenance of any equipment. Therefore, the process approach is actually sampling requirements for process validation, calibration of measurement devices and preventive maintenance for each process–instead of once for each regulatory element. 

2. Where Audits are Conducted

Most auditors spend an extraordinary amount of time in conference rooms. If I can audit your records in a conference room, I can also audit your records from my office in Vermont. Remote auditing (http://bit.ly/Remote-Audits) eliminates the cost of travel. More than half of your quality system records can be effectively audited remotely. Therefore, when any auditor on our team visits your facility, they want to spend more time seeing you demonstrate production processes and interviewing people–instead of reviewing records in your conference room. This also happens to be the only effective method to audit production and process controls, which is one of the four major quality system processes the FDA focuses on during Level 2, comprehensive QSIT inspections (http://bit.ly/QSITManual). 

3. Read Less and Listen More

Most auditors like to start with a procedure and then look for compliance with the procedure. We start with an interview of the process owner or a person performing a step in the process, then we ask for a demonstration and records and procedures last. In fact, I coach new auditors to ask people they are interviewing to show them where a requirement can be found in their procedure. This has several hidden benefits. First, auditors don’t have to spend a lot of time hunting for a requirement because the auditee will find it for the auditor. Second, the auditor will quickly learn how familiar the auditee is with the specific procedure. Finally, if the company is not following a procedure, the auditee is unlikely to be able to locate the requirement in their procedure. 

4. Start at the End with Problems

Most people prefer to follow a process from beginning to end. More specifically, the beginning is step one of a procedure and the end is product and paperwork resulting from the process. Since most product and paperwork is done correctly, we seldom find anything wrong with a process if we start at the beginning. Alternatively, we can start at the end of a process with a cage of nonconforming material, or a log sheet of complaints. Then we can work our way back to the beginning of the process, and hopefully we will see what went wrong in the process during our investigation. Therefore, my internal audit agenda often begins with a tour of the facility that will arrive at the location where quarantined product is stored. Then I work my way back through the process to incoming inspection, then the purchasing process, and finally to the design controls process where specifications were initially created. Using this approach often results in discovery of problematic processes that have the potential to cause other problems beyond the one example we found in the quarantine area. 

5. Focus on Effectiveness Checks

The last sub-clause of ISO 13485, Clause 8.5.2 is specific to the requirement for verifying effectiveness of corrective actions. This is not the same as verifying implementation. If an internal audit identifies that there are no maintenance records, then you might attempt to prevent recurrence by creating a procedure that requires maintenance records. A copy of the procedure, records of procedure review and approval and training records are evidence of implementing the corrective action.

Effectiveness verification requires more (http://bit.ly/CAPA-effectiveness-checks). You need to go back and verify that maintenance records are actually being created and maintained. Therefore, whenever we write an audit finding, we also review potential corrective actions with the client and suggest possible effectiveness checks to ensure corrective actions actually work.

If your company needs help with internal auditing and would like a quote, please contact Glenn Melvin: glenn@robertpackard.wpengine.com or +1.561.308.3093. We also are teaching a lead auditor course if you would like your auditing team to learn these proven techniques: http://bit.ly/Lead-Auditor-Course.

 

 

Posted in: ISO Auditing

Leave a Comment (0) →

How to Audit Your Labeling Process for 21 CFR 820 Compliance

audit labeling How to Audit Your Labeling Process for 21 CFR 820 ComplianceThis article reviews how to audit your labeling process for 21 CFR 820 compliance with the six requirements of section 820.120.

The most common cause of recalls is labeling errors (http://bit.ly/FDA-recalls-webinar). Therefore, one of the best ways to avoid a recall is to perform a thorough audit of your labeling process. Unfortunately, most auditors receive no specific training related to labeling. The primary reason for the lack of labeling-specific training is because most auditor training focuses on ISO certification requirements.

ISO 13485 only requires the following labeling requirements: “The organization shall plan and carry out production and service provision under controlled conditions. Controlled conditions shall include, as applicable…g) the implementation of defined operations for labeling and packaging.” ISO 14969 is the guidance document for ISO 13485, and the guidance includes additional recommendations for control of the labeling process to prevent errors. Unfortunately, auditors are trained to audit for compliance to regulations, while guidance documents are neglected almost entirely. ISO labeling requirements are vague. Therefore, auditors need to focus on the six requirements of 21 CFR 820.120 (http://bit.ly/21CFR820-120-Labeling)–the section of the FDA QSR specific to labeling. Labeling process flowchart1 How to Audit Your Labeling Process for 21 CFR 820 Compliance Most auditors are taught to develop a regulatory checklist to verify requirements. However, the process approach (http://bit.ly/Process-Approach-Blog) to auditing is a more effective approach to identify ways that the labeling process can break down. Below examples of how the two approaches differ is provided for each of the six requirements:

1. Labeling Procedure

Most auditors, and FDA inspectors, request a copy of a labeling procedure to verify compliance with the first requirement. In their notes they record the document number and revision of the procedure. The auditor may also review the procedure to ensure that the procedure includes each of the other five regulatory requirements listed below. The process approach to auditing also verifies compliance with the requirement for a procedure, but auditors using the process approach ask the process owner to describe the process, and the process description provided is compared with the procedure.

I also teach auditors to ask the process owner to identify where in the procedure each requirement can be found. This eliminates the need to spend valuable audit time reviewing a procedure, and forces the process owner to demonstrate their familiarity with the procedure.

2. Label Integrity

A lack of labeling integrity is seldom raised as an observation by auditors, unless labels are falling off of product, or if the label content is illegible. During hundreds of audits, I have never noticed a label falling off the product, but I have seen customer complaints about labels falling off. Another way to assess if there is a problem with labeling integrity is to ask how the labeling specifications were established, verified and validated. The user environment is frequently the determining factor for labeling specifications. For example,

  • Does the label need to be waterproof?
  • Is the print likely to be exposed to abrasion that could rub off the ink?
  • Are the storage conditions likely to include high heat and humidity that could cause the adhesive to fail? 

This type of approach links the labeling of product to customer focus and design inputs (http://bit.ly/DesignInputs).

3. Labeling Inspection

Inspection of labeling is more than visual examination. A thorough inspection requires a systematic review of the label content to ensure that the label information matches the requirements for the specific production lot. The requirements specify verification of:

  • correct expiration date
  • control number
  • storage instructions
  • handling instructions

There is also a requirement to document the date of inspection and the person that performed the inspection. An auditor can verify that the labeling inspection is being performed by reviewing records of the inspection, but you will rarely find an inspection record where the label is nonconforming. If you follow the process, you might ask the process owner where nonconforming labeling is recorded. The nonconforming material records should be an output of every inspection process. Auditors should also ask for metrics regarding a process. The frequency of labeling mix-ups and labeling errors identified during inspection is an important metric that can be used as an indicator of weaknesses in labeling operations.

4. Labeling Storage

Most auditors will verify that labels are stored in a location to prevent deterioration or damage, but the greatest risk is actually the mix-up of labels. Therefore, it is important to control the location of labels, so that the incorrect labels cannot be accidentally distributed to the wrong manufacturing line. 

In 21 CFR 820.150, (http://bit.ly/21CFR820-150) there is also a requirement to establish “procedures that describe the methods for authorizing receipt from and dispatch to storage areas and stock rooms.” Therefore, as an auditor you might consider asking the process owner what the input to the labeling distribution process is (e.g., a work order) and which distribution records are created during the process. A labeling requisition and/or “pick list” from production planning is often used as an input to the labeling process, while distribution of labeling to manufacturing often requires a log entry for distribution from a stockroom, or assignment of a lot number to the batch of labels that must be entered in a log.

5. Labeling Operations

It is insufficient to review DHRs for the labeling process. When you interview the process owner, you should determine who is responsible for creating and inspecting labels. Then, I coach auditors to go and view labeling operations at the source. By interviewing operators and asking them to demonstrate entry of variable data for labels and printing of labels, you can answer each of the following questions without even asking:

  • Is validated software is being used?
  • Are label templates protected from inadvertent changes?
  • How do operators ensure that labels from different lots are not mixed up?

Interviewing inspectors can determine if calibrated tools are being used to verify labeling dimensions and the proper placement of labels. You should also observe how inspectors ensure that variable data is correct.

6. Control Number

Most auditors will sample DHR records to verify that lot control numbers are recorded for each batch of product. However, when an auditor is focusing on records, the auditor is unlikely to identify any aspects of label handling that could result in mix-ups. In order to ensure that handling and segregation of different lots is adequate, an auditor has to observe line clearance procedures and to verify that each lot of labels is clearly identified with regard to the lot number, quantity and the released status. If the identification information about the label is separated from the physical labels, the potential for labeling mix-ups increases.

One final aspect of labeling and control numbers to consider is the impact of new UDI regulations (http://bit.ly/what-is-UDI). Labeling will need to indicate the date of manufacture and expiration of product. This information needs to be incorporated into the variable content of labels. Therefore, if labels are pre-printed, it may be necessary to reprint labels when the date of manufacture changes. This additional requirement is likely to force companies into on-demand printing of labels and automated software control systems. Auditors can verify the successful implementation of labeling process changes by auditing for compliance with the revised procedures.

Note from Jon Bretz: UDI states that production identifiers (PI) consist of Manufacturing Date, Expiration Date, Lot/Batch Number, Serial Number. The rule also states that if a labeler does not use any of the listed PI they do not need to have it on their labels. This will most likely apply to Class I device labelers only as Class II and III labelers usually have one or more of the PI on their labels. Due the variable nature of the PI, many labelers are adding in-line label verifiers to make sure their labels are readable by scanners.

Posted in: ISO Auditing

Leave a Comment (0) →

4 Ways to Make the Best Use of Medical Device Remote Audits

remote audits blog 4 Ways to Make the Best Use of Medical Device Remote AuditsThis blog identifies how to use medical device remote audits effectively, save time and resources, and when you should not conduct audits remotely.

Most audits are performed onsite at the location where the processes are being performed, and are the most effective approach to internal and supplier audits. But conducting an audit from your desk makes more efficient use of your time as an auditor. A large percentage of audits are conducted from conference rooms where the auditor spends an inordinate amount of time reviewing documents and records, or waiting for documents and records to be delivered. 

In 2006, the first edition of the ISO 17021 standard for certification of quality systems by certification bodies was released. ISO 17021 requires that initial certification audits be conducted in two stages. Stage 1 has several requirements, but the first element of Stage 1 is performing a review of quality system documentation. In most cases, the Stage 1 and Stage 2 audits are conducted onsite, but if the auditee is located in a remote location (such as New Zealand), Stage 1 audits will sometimes be conducted via conference call. 

Prior to ISO 17021, a review of quality system documentation was the only task performed prior to the initial certification audit, and the documentation review was typically conducted remotely as a “desktop” audit. Desktop audits have been used for decades as a way of auditing quality system documentation without traveling. However, desktop audits can be much more than a review of quality system documentation. You can interview auditees on the phone, review records, even ask auditees to demonstrate activities real-time using a web camera.

Documentation can also consist of much more than text. Raw data, statistical analysis and photos can be used to communicate additional information. The more multimedia content provided to auditors remotely, the closer a remote audit becomes to auditing onsite. Internal auditors and supplier auditors are not bound by the same requirements as certification bodies, and audits may be conducted onsite or remotely. In fact, the most recent version of ISO 19011 (2011), includes a comparison table for onsite and remote auditing in Annex B.

Medical Device Remote Supplier Audits

The use of remote audits to qualify suppliers is not recommended for four reasons:

  1. onsite visits facilitate the building of supplier-customer relationships
  2. touring facilities and watching demonstration of processes improves understanding of a supplier’s processes better than reading documents and records can
  3. Cleanliness and capabilities of suppliers are best evaluated onsite, where camera angles can be used to crop out important details
  4. sometimes suppliers misrepresent their capabilities by showing photographs on their website of other companies.

After you have qualified a supplier, however, you may not need to audit them onsite regularly. If a supplier’s performance is good and risks associated with nonconforming components supplied are minimal, then you have a justification for conducting a remote audit. However, if a supplier’s performance is poor, you may want to use a remote supplier audit as a precursor to an onsite supplier audit to investigate the reasons for nonconforming components (i.e., a “for cause” audit). Regardless of the situation, the amount of time spent in your supplier’s conference room should always be  by reviewing documents and records remotely. This will reduce the amount of time required at each supplier, and enables you to audit two suppliers during the same trip.

Medical Device Remote Internal Audits

It might not occur to you that there would be any need for remote internal audits. However, not all internal audits are performed by a person working at your location. Larger companies have multiple sites, and many of the internal audits are performed by auditors from corporate headquarters and other locations. In the case of internal audits performed by auditors from other locations, travel time can be minimized by performing part or all of the internal audit remotely. This approach can also work for consultants hired to conduct internal audits. There is no need to spend money on the cost of travel for a consultant if the consultant is only going to be auditing documents and records. The following are great examples of processes that can be audited remotely:

  1. CAPA
  2. Management Review
  3. Internal Auditing
  4. Supplier Controls
  5. Complaint Handling
  6. Adverse Event Reporting

Medical Device Remote Re-audits

21 CFR 820.22 indicates that re-audits may be required where corrective actions have been taken in order to verify effectiveness of the actions taken: “Corrective action(s), including a reaudit of deficient matters, shall be taken when necessary.” However, if nonconformities identified during an audit are categorized as “high-risk”, it may be important to conduct a verification of corrective action effectiveness as soon as possible.

Sometimes, effectiveness can be determined by reviewing quantitative metrics, but if a re-audit is needed, then a remote re-audit may allow the auditor to verify effectiveness of corrective actions without the necessity of being onsite. If verification of corrective action effectiveness can be performed by reviewing documents and records, a remote re-audit is appropriate. Other corrective actions, especially those involving production and process controls, typically require onsite verification.

Remote Audit Team Members

Most medical device companies have a limited number of qualified auditors, and auditing is almost always a secondary job duty. However, audits often require specific technical knowledge that only one or two auditors may possess. Therefore, it may be extremely difficult to schedule a team audit when all the required auditors and auditees are available. There is another option to postponing your audit. You might consider having some of your auditing team members audit remotely from their desks, while the rest of the team conducts an onsite audit. For example, most lead auditors can conduct a process audit (http://bit.ly/Process-Approach-Blog) of incoming inspection, storage and shipping. However, auditing surface mount assembly lines for fabrication of printed circuit boards requires more technical knowledge of this type of process. Technical expertise is also needed in order to audit sterilization or CNC machining.

By working together, onsite audit team members can take directions from a technical subject matter expert working remotely and gather information needed to properly audit any process. This approach minimizes time requirements for subject matter experts, and remote audits by team members minimizes the cost of travel.

If you are interested in learning more about Turtle Diagrams and the process approach to auditing, please register for our webinar on the process approach to auditing. If you are interested in learning more about how you can use remote audits to save time and money, please contact me (http://robertpackard.wpengine.com/robert-packard/), or Glenn Melvin (http://robertpackard.wpengine.com/consulting/). We can help you identify immediate opportunities.

Posted in: ISO Auditing

Leave a Comment (1) →

5 Criteria for a Certified Internal Auditor Program

5 criteria 5 Criteria for a Certified Internal Auditor ProgramThis article identifies 5 criteria for a certified internal auditor program of medical device lead auditors for quality systems auditing and supplier auditing.  There are five criteria that are important to a certified internal auditor program:

  1. formal training by a qualified trainer
  2. an exam to demonstrate effectiveness of training
  3. practical experience
  4. observation of actual audits by an experienced lead auditor
  5. documentation

Internal auditors do not need a certificate from a third-party (i.e., someone other than your company or your customers), and training programs do not need to be accredited. Your company can save money and develop an in-house certification program. The only reason why third-party certification and accreditation are needed is: 1) if your internal auditor procedure requires it, or 2) if you are training to become a third-party auditor working for a certification body or registrar. Therefore, I don’t recommend writing a procedure that requires a certificate from a third-party or an accredited program. Write your internal auditor training requirements to allow flexibility, but ensure you include each of the five elements listed above.

1. Formal training by a qualified trainer

Formal training is planned and has a documented curriculum. The curriculum can consist of one long course over several days, or you can limit the duration of each class to an hour over several months and you can develop a schedule to fit individual needs. Training should be customized to a certain extent for each internal auditor, but most programs have at least one primary lead auditor course that everyone must complete. Formal training must also be delivered by a qualified trainer.

2. An exam to demonstrate effectiveness of training

I have written about the use of exams to document training effectiveness: http://bit.ly/TrainingExams. You can use a combination of multiple choice questions, fill-in-the-blank, short answer and essay questions for an exam. However, for demonstrating the effectiveness of auditor training, there is one method of evaluation that is superior to all others–actually writing nonconformities. If you provide a hypothetical scenario to an auditor, the auditor should be able to write a complete nonconformity. This exercise tests the auditor’s ability to identify the applicable regulatory requirements, assess conformity, grade nonconformities and select the appropriate wording of the nonconformity and associated objective evidence. The only downsides to writing nonconformities are: 1) they are harder for instructors to grade, and 2) the grading is subjective.

3. Practical experience

The most common way to document previous experience of internal auditors is to include a copy of the person’s resume in their training record. However, I recommend using a tracking log for all audits to identify which auditors conducted which audit. Ideally, you want to use an electronic database that allows you to search the database using the name of the auditor as a search field. Your database should also indicate which role the auditor was fulfilling: 1) lead auditor, 2) team member, 3) trainee, or 4) observer. Sometimes, the person may have more than one role (e.g., team member and trainee or lead auditor and observer).

4. Observation of actual audits by an experienced lead auditor

It doesn’t matter if training is remote and recorded, or live and in-person, but remote and recorded training needs to balanced with observation of actual audits by an experienced medical device quality system auditor. “Observation” needs to be defined, but I recommend using a controlled form to document observations. Attaching a completed observation form to a copy of auditing notes and a copy of the audit report creates a complete record to demonstrate observation of each audit by a trainee. Just don’t make your controlled form overly burdensome. A single page is fine–as long as it consists of more than yes/no check boxes. “Experienced” also needs to be defined, but I recommend the following combination of qualitative and quantitative experience. First, an experienced lead auditor must have documented formal training, but the formal training does not need to be third-party training. Second, an experienced lead auditor should have completed at least 100 audits. One hundred is an arbitrary number, but that number represents more than 1,000 hours of audit preparation, auditing and report writing. Anything less than 1,000 hours is inadequate to be qualified to begin training others.

5. Documentation

Documentation must include all of the above elements. You need to document the training plan for each internal auditor, and it must meet minimum training requirements–which should be documented in your internal auditing procedure. Your documentation should include minimum criteria for qualification of a trainer–often a resume, and adding the person to your approved supplier list is sufficient. You should document the results of any formal quizzes and exams for training effectiveness. Auditing experience for each person should be documented. Specifically, you should have a form listing a description of the scope, and dates for each audit during the certification process. Observations of auditors need to be documented, and any corrections or recommendations for improvement should include documented follow-up. If an auditor already has extensive experience prior to joining your company, your procedures should allow for a written justification, instead of repeating the training. If your company uses a software tool to manage training, I recommend creating a separate training group for internal auditors, rather than incorporating internal auditing into another job description and/or training curriculum.

What Really Matters

What really matters is whether your internal auditor training is effective and internal auditors are competent. Certificates make pretty training records to post on the wall of your cubicle. Competent internal auditors identify quality issues before you receive an FDA 483, or a nonconformity from your certification body. Competent auditors also add value, by identifying ways to make processes more efficient and opportunities to save money. If you are looking for a qualified trainer to provide formal training, in a public venue or in-house, please visit the following webpage: http://bit.ly/Lead-Auditor-Course.

Posted in: ISO Auditing

Leave a Comment (0) →

An Auditor’s Best Practices in Issuing a Major Nonconformity

%name An Auditors Best Practices in Issuing a Major Nonconformity

From the opening meeting through the audit and closing meeting, the author describes an auditor’s best practices in issuing a major nonconformity.

As an auditor, one of the most important (and difficult) things to learn is how to issue a nonconformity—especially a major. This is normally done at the closing meeting of an audit, but the closing meeting is not where the process of issuing the nonconformity begins. Issuing a nonconformity actually starts in the opening meeting.

ISO 19011:2011 is the official guidance document for auditors of Quality Management Systems. Section 6.4.2 of this Standard explains best practices for an opening meeting. The last five items in this section are critical to preparing the client for potential nonconformities:

  1. Method of reporting audit findings, including grading, if any
  2. Conditions under which the audit may be terminated
  3. Time and place of the closing meeting
  4. How to deal with possible findings during the audit
  5. System for feedback from the auditee on findings or conclusions of audit
  6. Process for complaints and appeals
Methods of Reporting and Grading Nonconformities

The auditor should be crystal clear in their description of minor and major nonconformities, or any other grading that will be used. The auditor should also make it clear that they are looking for conformity, rather than nonconformity. This is an audit—not an inspection. Typically, a minor nonconformity is described as “a single lapse in the fulfillment of a requirement,” while a major nonconformity is described as one of the following: 1) “a total absence in the fulfillment of a requirement,” 2) “repetition of a previous nonconformity,” 3) “failure to address a previously identified minor non-conformity”, or 4) “shipment of non-conforming product.” When the auditor is in doubt, then the finding is minor, and never a major. For a major nonconformity to be issued, there can be no doubt.

Conditions for Termination

The option to terminate an audit is typically reserved for a certification audit where a major nonconformity is identified and there is no point in continuing. Termination is highly discouraged, because it is better to know about all minor and major nonconformities right away, instead of waiting until the certification audit is rescheduled. The certification body will charge you for their time anyway.

Another reason for termination is when an auditor is being unreasonable or inappropriate. This is rare, but it happens. If the audit is terminated, you should communicate this to upper management at the certification body and the company—regardless of which side of the table you sit. For FDA inspections, this is not an option. For audits performed by Notified Bodies, there is the possibility of suspension of a certificate in response to audit termination. Therefore, I always recommend appealing after the fact, instead of termination. Appealing also works for FDA inspections.

How to Deal with Findings

All guides and auditees should be made aware of possible findings at the time an issue is discovered. This is important, so that an auditee has the opportunity to clarify the evidence being presented. Often, nonconformities are the result of miscommunication between the auditor and auditee. This happens frequently when the auditor has a poor understanding of the process being audited. It is a tremendous waste of time for both sides when this occurs. If there is an actual nonconformity, it is also important to gather as much objective evidence as possible for the auditor to write a thorough finding, and for the auditee to prepare an appropriate corrective action plan in response to the finding.

%name An Auditors Best Practices in Issuing a Major Nonconformity
Feedback from the Auditee

As an auditor, I always encourage auditees to provide honest feedback to me directly and to management, so that I could continue to improve. If you are giving feedback about an internal auditor or a supplier auditor, you should always give feedback directly before going to the person’s superior. You are both likely to work together in the future, and you should give the person every opportunity to hear the feedback first-hand.

When providing feedback from a third-party certification audit, you should know that there will be no negative repercussions against your company if you complain directly to the certification body. At most, the certification body will assign a new auditor for future audits and investigate the need for taking action against the auditor. In all likelihood, any action taken will be “retraining.” I never fired somebody for a single incident—unless they broke the law, or did something that was unsafe. The key to providing feedback, however, is to be objective. Give specific examples in your complaint, and avoid personal feelings and opinions.

Complaints and Appeals

As the auditee, you should ask for the contact information of the certification body during the opening meeting. Ask with a smile—just in case you disagree, and so you can provide feedback (which might be positive). As the auditor, you should always make contact information for the certification body available. If you are conducting a supplier audit or an internal audit, you probably know the auditor’s boss and there is probably no formal complaint or appeals process. In the case of a supplier audit, the customer is always right—even when they are wrong.

During the Audit

During the audit, you should always make the guide(s) and process owner(s) aware of any potential nonconformities as you find them. This is their opportunity to clarify the objective evidence for you and to explain why there is not a nonconformity. Often, at this point in the audit, I will refer to the Standard. I will identify specific requirement(s) and show the process owner. I will say, “This is what I am trying to verify. Do you have anything that would help address this requirement?” If the process owner is unsure of how to meet the requirement, often, I will provide an example of how this requirement is addressed in other areas, or at other companies.

If the audit is a multi-day audit, I will review the potential nonconformities at the end of the day and give the auditee the opportunity to provide additional objective evidence in the morning. If it is the last day of the audit, or it is a single-day audit, I will give auditees until the closing meeting to provide the objective evidence. Often, I will use this opportunity to explain what would be considered a minor nonconformity and what would be a major nonconformity. Usually I can say, “This is definitely not a major nonconformity, because…”

%name An Auditors Best Practices in Issuing a Major Nonconformity

Closing Meeting

The closing meeting should be conducted as scheduled, and the time/location should be clearly communicated to upper management in the audit agenda and during the opening meeting. Top management won’t be happy about nonconformities, but failure to communicate when the closing meeting will be conducted will irritate them further.

At the closing meeting, the auditee should never be surprised. If an issue remains unfulfilled at the closing meeting, the auditee should be expecting a minor nonconformity—unless the issue clearly warrants a major nonconformity. Since a minor nonconformity is described as “a single lapse in the fulfillment of a requirement,” it is difficult for an auditee to argue that an issue does not warrant a minor nonconformity. Typically, the argument is that you are not consistent with other auditors. The most common response to that issue is, “Audits are just a sample, and previous auditors may not have seen the same objective evidence.” The more likely scenario, however, is that the previous auditor interprets requirements, instead of reviewing requirements with the client, and ensuring both parties agree before a finding is issued.

If a finding is major, the auditee should have very few questions. Also, I often find the reason for a major noncconformity is a lack of management commitment to address the root cause of a problem. Issuing a major nonconformity is sometimes necessary to get management’s attention.

Regardless of the grading, all audit findings will require a corrective action plan—even an FDA warning letter requires a CAPA plan. Therefore, a major nonconformity is not a disaster. You just need to create a more urgent plan for action.

Posted in: ISO Auditing

Leave a Comment (0) →

The Audit Program Manager: 4 Areas of Auditor Competency

rookie The Audit Program Manager: 4 Areas of Auditor Competency

Passing a webinar on auditing does not make you competent.

This blog reviews an audit program manager’s four areas of auditor competency; experience, skills, training and education.

Does your company ask incoming inspectors to update CAD drawings when there is a design change? Of course not. Your company has engineers that are trained to use SolidWorks, and it takes a new engineer awhile to become proficient with the software. Auditing is a skill that you learn—just like SolidWorks.

I’ve never met a manager that wondered where the value was in having an engineer update a drawing, but many managers view internal and supplier audits as a necessary evil. Instead of asking the expert how few audit days you can get away with, ask the expert: “What is the purpose of auditing?”

The purpose of internal auditing is to confirm that the management system is effective, and identify opportunities for improvement. The purpose of supplier auditing is to confirm that a supplier is capable of meeting your needs, and identify opportunities for improvement. Therefore, if an auditor has no nonconformities, and no opportunities for improvement were identified—what a waste of time!

To receive value from auditing, you need auditors that are competent. In clause 6.2.1 of the ISO 13485 Standard it states, “Personnel performing work affecting product quality shall be competent on the basis of appropriate education, training, skills and experience.” As the audit program manager, ensure you recruit people that demonstrate auditing competency.

Education

First, educational background is important for auditors. You cannot expect someone who has never taken a microbiology course in their life to be an effective auditor of sterilization validation. Likewise, someone that has never taken a course in electricity and magnetism will not be effective as an auditor for active implantable devices. Therefore, determine what types of processes the auditor will be auditing. Then ensure that the person you hire to be an auditor has the necessary education to understand the processes they will be auditing.

Training

Second, an auditor needs to be trained before they can audit. The auditor needs training in three different aspects: 1) the process they will be auditing, 2) the standard that is the basis for assessing conformity, and 3) auditing techniques. If you are going to be auditing Printed Circuit Board (PCB) manufacturers with Surface-Mount Technology (SMT), then you need to learn about the types of components used to make PCBs, and how these components are soldered to a raw board. I know first-hand that anyone can learn how SMT works, but it took me a few months of studying.

If your company is only selling medical devices in the United States, then you will need to learn 21 CFR 820 (i.e., – the QSR). However, if your company also sells devices in Europe or in Canada, you will need to learn ISO 13485, the Medical Device Directive (MDD) (93/42/EEC as modified by 2007/47/EC), and the Canadian Medical Device Regulations (CMDR). I learned about ISO 13485 in a four-and-a-half day lead auditor course in Florida,  MDD in a three-day CE Marking Course in Virginia and the CMDR in a two-day course taught by Health Canada in Ontario. A 50-minute webinar on each regulation is not sufficient for auditing.

Finally, you need training on the techniques of auditing. A two-day course is typically needed. I took a 50-minute webinar and passed a quiz before conducting my first internal audit, but I had not developed my skills at that point. 

Skills

Third, an auditor needs communication, organizational and analytical skills to be effective as an auditor. Communications skills must include the ability to read and write exceptionally well, and the auditor needs to be able to verbally communicate with auditees during meetings and interviews. The most difficult challenge for auditors is covering all items in their agenda in the time available. The auditor rarely has more time than the need to audit any topic, and audit team leaders must be able to manage their own time, as well as simultaneously managing the time of several other auditors. 

Experience

Last, but certainly not the least important aspect of auditor competency, is experience. This is why third-party auditors are required to act as team members under the guidance of a more experienced auditor before they are allowed to perform audits on their own. This is required, regardless of how many internal or supplier audits the person may have conducted in the past. More experienced auditors are also required to observe new auditors and recommend modifications in their technique. Once a new auditor has completed a sufficient number of audits as a team member, the auditor is then allowed to practice leading audits while being observed. After six to nine months, a new auditor is finally ready to be a lead auditor on their own. An internal auditor does not need the same degree of experience as a third-party auditor, but being shadowed two-three times is not sufficient experience for an auditor (first or second-party). For more information about this topic, please read my blog posting on auditor shadowing.

Posted in: ISO Auditing

Leave a Comment (0) →

Internal Audit Training for New Hires

 

welcome aboard Internal Audit Training for New Hires

The author discusses a few proven internal audit training strategies (i.e., shadowing, auditing process owners) for new hires.

Once you have identified someone that you want to “hire” as an internal auditor, your next step should be to develop an “Onboarding” plan for them with their boss. If you are hiring someone that will be a dedicated auditor, please ignore my quotation marks above. In most companies, however, the internal auditors are volunteers that report to another hiring manager. Therefore, as the audit program manager, you need to get a firm commitment from the auditor’s boss with regard to the time required to train the new auditor and to actually perform audits on an ongoing basis. 

Winning Over the Boss

In my previous posting I said that, “The biggest reason why you want to be an auditor is that it will make you more valuable to the company.” The auditor’s boss may or may not agree with this statement, but the boss knows that the salary is coming out of their budget either way. Therefore, talk with the auditor’s boss and determine what the auditor’s strengths and weaknesses are. Find out which skills the boss would like to see the auditor develop. By doing this, the two of you can develop a plan for making the auditor more valuable to their boss AND the company. 

Making Re-Introductions

Ideally, auditors are extraverted and have worked at the company long enough to know the processes and process owners that they will be assigned to audit—especially if they will be auditing upstream and downstream from their own process area. In the past, the auditor may have been a customer or a supplier, but now the relationship with a process owner will change. Auditors are required to interview process owners, and this involves asking tough questions that might not be appropriate in the auditor’s normal job duties. Therefore, as the audit program manager, you should re-introduce the auditor to the process owner in their new capacity as auditor. During this re-introduction, it is important to make three points:

  1. The auditor is going to be trained first
  2. You will be shadowing the auditor during the audit, and
  3. The auditor’s job is to help the process owner identify opportunities for improvement

By making the first point, you are reminding the process owner of the scheduled audit—well in advance. You are also informing the process owner that this auditor will have new skills, and the process owner should have some tolerance for mistakes that new employees make. You might also mention that you would like to get the process owner’s feedback after the audit, so the auditor knows which areas they need to improve upon to become better auditors. The second point should put the process owner at ease—assuming the process owner has a good relationship with you as the audit program manager. It is important to be descriptive when “shadowing” is mentioned. Both the process owner and the auditor may not understand the process or the purpose of shadowing. The following blog posting might help with this: “How do you shadow an auditor? Did you learn anything?”

The third point is the most critical step in onboarding a new auditor. For an auditor to be successful, they must ADD VALUE! As an auditor, you cannot pretend to add value. The process owner should know their process, and they probably know which areas are weakest. The audit program manager should encourage the process owner to list some specific areas in which they are having problems. Ideally, the process owner would be informed of this need prior to the re-introduction. Then the process owner can be better prepared for the meeting, and hopefully, they will have a few target areas already identified. Targets with associated metrics are the best choice for a new auditor, because these targets reinforce the process approach to auditing. 

Next Steps for Internal Audit Training

Once your new auditor has been re-introduced to the process owners they will be auditing, you need to begin the training process. As with any new employee, it is important to document training requirements, and to assess the auditor’s qualifications against the requirements of an auditor. Every new auditor will need some training, but the training should be tailored specifically to the needs of the auditor. The training plan for a new auditor should include the following:

  1. A reading list of company procedures specific to auditing, and external standards that are relevant
  2. Scheduled dates for the auditor to shadow another experienced auditor
  3. Scheduled dates for an experienced auditor to shadow the auditor during the first two process audits (upstream and downstream)
  4. Goals and objectives for the internal audit program; and
  5. Any training goals that the auditor’s boss has identified for the auditor

 

Posted in: ISO Auditing

Leave a Comment (0) →

Effective Recruiting for the Auditor Position

help wanted Effective Recruiting for the Auditor Position

Stop begging people to help you audit. Learn how to recruit auditors more effectively.

This blog shares thoughts related to effectively recruiting for the auditor position. One suggestion may surprise you.

Nearly 100% of the people I train as auditors were not hired specifically to be auditors. Instead, auditing is something extra that they were asked to do, in addition to their regular job. This situation creates three problems for the audit program manager:

  1. You have difficulty getting enough people to perform the audits
  2. Most auditors will come from your department, so who is going to audit you?
  3. Auditors have little or no motivation to develop their auditing skills

Stop begging for “volunteers” from other departments and start recruiting.

When I am recruiting someone to audit, I always get asked two questions:

  1. Who/What will I be auditing?
  2. What will I have to do?

You need to motivate people to become auditors, because it requires extra work. The answer to #2 should be specific. I recommend creating a “sell sheet” that explains the process of performing an audit. I also like to create sell sheets that are educational. Therefore, I recommend adapting the flow chart in ISO 19011:2011 (Figure 2 on page 15). I would add time estimates for each step of the process (6.2 – 6.7). This will serve as a training tool for future auditors, and will eliminate fear of an unknown time commitment for your potential recruit.

In order to answer #1, I recommend you assign the recruit processes that are upstream and downstream. I have recommended this concept in previous postings, but essentially you are assigning the person to audits of internal suppliers and internal customers. By doing this, utilizing the process approach will be more natural to the auditor and they will have a vested interest in doing a thorough audit. This also creates a situation where the auditor is typically assigned to at least two process audits per year.

The next question is one that your potential recruit will never ask, but they are always thinking…

Why should I become an auditor?

The biggest reason why you want to be an auditor is that it will make you more valuable to the company.

Auditors are required to interview department managers and ask tough questions. This gives the auditor a better understanding of the organization as a whole, and it gives them insight into how other managers work. This insight is pure gold.

If you want to be effective and get promoted, you need to demonstrate value to your boss and top management. If you don’t understand what other departments need, how can you help them? No manager will promote a selfish, power-hungry hog. They promote team players that make others better. Auditing gives you the insight necessary to understand how you can do that.

Auditing other departments will also give you insider information as to where new job openings will be. Sometimes you can’t wait for your boss to get promoted. In that case, you might want to know more about other departments in your company.

Each corporate culture is different, but the audit program manager needs to “sell” the recruit on volunteering to be an auditor.

Where to find recruits

Due to the cross-functional nature of auditing, I have found that my own personal experience working in multiple departments was invaluable. I have a better understanding of how a department functions than other auditors, because I have worked in that department at another company. Operations, engineering and research experience are extremely valuable for auditing, but I believe the experience that transfers best to auditing is any position where you are addressing customer complaints and returns—such as technical support or service.

If your company is large enough to hire full-time auditors, I recommend searching for potential auditors at your suppliers and their competitors. These people will bring unique knowledge that is critical to a successful supplier selection process, and these individuals will increase the diversity in your company—instead of duplicating knowledge and expertise.

Posted in: ISO Auditing

Leave a Comment (0) →
Page 1 of 2 12
Follow

Get every new post on this blog delivered to your Inbox.

Join other followers:

Simple Share Buttons
Simple Share Buttons