The internal audit is the systematic review planned and carried out by the manufacturer itself to determine whether the quality management system complies with the organisation\u2019s own specifications, the requirements of the standard, and applicable regulatory requirements, and whether it is effectively implemented and maintained. For medical device manufacturers, it is governed by Section 8.2.4 of ISO 13485:2016 and is one of the processes for which the standard explicitly requires a documented procedure. The obligation also follows indirectly from Regulation (EU) 2017\/745, whose Article 10(9) requires a quality management system with monitoring, measurement, data analysis and product improvement. The internal audit is therefore the manufacturer\u2019s own early-warning tool, not an external audit. <\/p>\n
Section 8.2.4 of ISO 13485:2016 requires audits at planned intervals to determine whether the system conforms to the planned and documented arrangements, the requirements of the standard, the requirements defined by the organisation itself, and applicable regulatory requirements, and whether it is effectively implemented and maintained. The documented procedure must define responsibilities, planning and implementation requirements, records, and reporting. The European version of the standard, including the corrigenda and Amendment A11:2021, is listed as a harmonised standard under the Regulation, so its application establishes a presumption of conformity for the relevant system requirements. Article 10(9) of the Regulation specifies the system elements to be covered in the audit, including risk management, clinical evaluation, assignment of the unique device identification, post-market surveillance, vigilance reporting, and the control of corrective and preventive actions. <\/p>\n
The basis is an audit programme that covers all processes, sites and applicable requirements over a defined cycle. The standard does not require a fixed annual frequency, but planned intervals; frequency and depth must be defined on a risk basis. Proven criteria include process maturity, error and nonconformity history, results of previous audits, changes to products, processes, suppliers or legal bases, and criticality for product safety. Each individual audit requires audit criteria, scope, an audit plan, and a documented classification of findings. Audit findings must be assessed by severity, supported by root-cause analysis, and assigned deadlines; the effectiveness of the actions must be verified and must not be confused with their implementation. <\/p>\n
Auditors must not audit their own area of responsibility. In small organisations, independence is often ensured through reciprocal auditing between departments, by engaging external auditors, or by audits performed by management outside its operational area; what matters is that the arrangement is documented and traceable. Qualification requirements include knowledge of the standard, applicable legislation, the audited processes, and audit techniques; ISO 19011 provides the recognised guidance. Evidence of qualification forms part of the audit records and is routinely reviewed during external audits. <\/p>\n
Audit results are a mandatory input to management review and must be assessed there together with feedback, complaints, process performance data, regulatory notifications, and the status of actions. This overall view leads to decisions on resources, system changes and improvement objectives. Systemic findings feed into the corrective and preventive action (CAPA) process, which Article 10(9) of the Regulation explicitly requires, including effectiveness verification. A common practical weakness is an audit programme that is formally complete, but whose findings do not result in traceable root-cause analyses and effectively verified actions. <\/p>\n
The internal audit is not a conformity assessment. The Notified Body\u2019s system audit under Annex IX, Chapter I of the Regulation serves to issue and maintain a certificate; it includes the initial assessment, regular surveillance audits and, under Annex IX, Section 3.4, unannounced audits that take place at least once every five years on a random basis. The results of this audit may lead to restriction, suspension or withdrawal of a certificate\u2014something an internal audit can never do. The related term audit \/ inspection explains the general systematics of the types of assessment. The study audit must also be distinguished from the internal system audit: it verifies compliance with the protocol, Good Clinical Practice and standard operating procedures in a specific clinical investigation or at a service provider, is study-specific, and is initiated by the sponsor. <\/p>\n
Manufacturers that conduct or outsource clinical investigations must include the associated processes in their audit programme. In particular, the selection and oversight of service providers, control of investigational devices, data management, event assessment and reporting pathways, and the feedback of study results into clinical evaluation and risk management must be audited. If this coverage is missing, gaps arise that will become visible in the Notified Body\u2019s surveillance audit. <\/p>\n
Conversely, internal audits provide evidence that outsourced study services are actually controlled, as Article 10(9) requires for supplier management. Full-service CROs such as Mediconomics support manufacturers in describing the interfaces between study conduct and the quality management system in an audit-ready manner and in closing findings with robust evidence of effectiveness. <\/p>\n
Is a complete internal audit required every year?<\/strong><\/p>\n The standard requires planned intervals, not an annual frequency. A programme that covers all processes within a defined cycle and audits critical areas more frequently is common practice; the rationale must be risk-based. <\/p>\n May external auditors conduct internal audits?<\/strong><\/p>\n Yes. Responsibility for the programme, assessment of findings and actions remains with the manufacturer. Engagement, qualification and independence must be documented. <\/p>\n Must the Notified Body be granted access to internal audit reports?<\/strong><\/p>\n Yes. The audit programme, reports, findings and evidence of effectiveness are quality management system records and are among the documents reviewed during the system audit. <\/p>\n The internal audit is the systematic review planned and carried out by the manufacturer itself to determine whether the quality management system complies with the organisation\u2019s own specifications, the requirements of the standard, and applicable regulatory requirements, and whether it is effectively implemented and maintained. For medical device manufacturers, it is governed by Section 8.2.4 […]<\/p>\n","protected":false},"author":10,"featured_media":0,"parent":0,"template":"","meta":{"_acf_changed":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"glossary-cat":[24],"class_list":["post-7752","glossary","type-glossary","status-publish","hentry","glossary-cat-medizinprodukte-ivd"],"acf":[],"related_terms":"","external_url":"","internal_reference_id":"","_links":{"self":[{"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/glossary\/7752","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/glossary"}],"about":[{"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/types\/glossary"}],"author":[{"embeddable":true,"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/users\/10"}],"version-history":[{"count":0,"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/glossary\/7752\/revisions"}],"wp:attachment":[{"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/media?parent=7752"}],"wp:term":[{"taxonomy":"glossary-cat","embeddable":true,"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/glossary-cat?post=7752"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Regulatory References<\/h2>\n
\n