Effective Internal Auditing

Good Manufacturing Practices (GMP) regulations worldwide, as well as the Food and Drug Administration (FDA) and International Conference on Harmonization (ICH) guidances, require that companies have in place an internal quality audit program. For example, the FDA regulation for medical devices establishes that each manufacturer shall establish procedures for quality audits and conduct such audits to assure that the quality system complies with the established quality system requirements, and to determine the effectiveness of the quality system[1]. Also, the ICH Q10 guidance establishes that management should have a formal process for reviewing the pharmaceutical quality system on a periodic basis, which include self-assessment processes, including audits, and external assessments, such as regulatory inspections and findings, and customer audits[2].
Auditing is a powerful management tool in establishing how effectively a company controls the quality of its products and ensures compliance. The ISO 19011 is an international standard that sets forth guidelines for management systems auditing[3]. This book presents many auditing tools and techniques needed when conducting effective internal and external audits. An audit can be conducted against a range of audit criteria, separately or in combination, including:

• Requirements defined in one or more management system standards.
• Policies and requirements specified by relevant interested parties.
• Statutory and regulatory requirements.
• One or more management system processes defined by the organization or other parties.
• Management system plan(s) relating to the provision of specific outputs of a management system.

This book provides guidance for all sizes and types of organizations and audits of varying scopes and scales, including those conducted by large audit teams, typically of larger organizations, and those by single auditors, whether in large or small organizations. The material presented here should be adapted as appropriate to the scope, complexity, and scale of the audit program. The book concentrates on internal audits conducted by personnel of the audited organization (first party) and audits conducted by organizations on their external providers and other external interested parties (second party). This document can also be useful for external audits conducted for purposes other than third-party management system certification.
The material presented through this book is intended to apply to a broad range of potential users, including auditors, organizations implementing management systems and organizations needing to conduct management system audits for contractual or regulatory reasons. Users can, however, apply the material presented when developing their own audit-related requirements. It can also be used for the purpose of self-declaration and can be useful to organizations involved in auditor training or per...