Compliant. Connected. Complete.

Tech Paper:
MasterControl Audit™

The Complete Solution for Managing

the Quality Audit Process
Introduction
To fully appreciate what audit is to a quality system, think of it as something like a medical examination. Even people in
the best of health, like professional athletes, need a medical exam to evaluate their physical fitness.

Likewise, even the best of quality systems need to be examined. For FDA-regulated and ISO-certified companies, audit
is a necessary procedure for evaluating a quality system’s general health and for diagnosing problems in order to correct
them. This principle is explained well in the FDA’s Quality System Regulation Manual for medical device manufacturers,
which states: “Without an effective quality audit function, the quality system program is incomplete — there is no
assurance that a manufacturer is consistently in a state of control.”

For this reason, quality audit is incorporated in a number of regulations enforced by the Food and Drug Administration,
such as 21 CFR Part 820 (Quality System Regulation), which requires medical device manufacturers to monitor their
quality systems through audits.

Similarly, the Current Good Manufacturing Practice (CGMP) regulations for pharmaceuticals (21 CFR Parts 210-211)
and for blood and blood components (21 CFR Part 606) include general requirements for regular evaluation of quality
standards. These requirements are reiterated in guidances and guidelines. For example, the “Guidance for Industry
Quality Systems Approach to Pharmaceutical CGMP Regulations” recommends internal audits and supplier audits.
The “Guidelines for Quality Assurance in Blood Establishments” call for comprehensive audit of the quality assurance
program.

ISO-certified companies face similar requirements. In fact, these companies were among the first to embrace the use of
audit as a quality and compliance tool. In 1987, ISO (International Organization for Standardization) first published the
ISO 9000 standards, which greatly increased interest in quality audits among manufacturers and other types of businesses.

Today, widely used standards such as ISO 9001: 2000, ISO 14001:2004, and ISO 13485 all require internal audits of the
quality system, or the environmental management system in the case of ISO 14001: 2004. Under these standards, audit
serves as a mechanism for evaluating and improving quality.

Audit Types
Audits can be categorized according to the parties auditing and being audited, such as first-party, second-party, and third-
party audits. It can also be categorized according to purpose — either for compliance or performance.

A first-party audit (also known as internal audit or self-audit) means that those auditing and those being audited all belong
to the same organization. A second-party audit refers to a customer conducting an audit on a supplier or contractor. Third-
party audits are almost always compliance audits. The process is conducted either by a regulatory agency such as the FDA
or an independent party such as an ISO registrar. ISO conformity assessments are not carried out by ISO itself, but by
private-sector third parties or regulatory bodies in countries where ISO standards have been incorporated into the law.

A compliance audit is the most common type of audit and can be performed as a first, second, or third-party audit. The
goal of a compliance audit is to see if activities, processes, and systems meet regulatory requirements.

A performance audit evaluates compliance, but it also looks at how a company can improve business results and achieve
company goals.

MasterControl Audit ™ Page  Tech Paper

 Figure 1 - MasterControl Audit is an integrated part of the MasterControl quality management
suite that automates and manages compliance and performance audits.

Compliance Audit Process

This paper will focus on compliance audits, which generally follow the process outlined below:

Planning and Scheduling – During this phase, the company decides when an audit will be conducted, who will
be auditing whom, which processes and systems will be covered, and the types of resources needed. The plan will
include the scope, objectives, and agenda. It will provide a detailed schedule from start to finish, including the
processes being audited and the standards/regulations that serve as a basis for the audit, date and time, the auditors
involved, etc.

Execution – During the actual audit, the lead auditor manages the process, including communicating any changes
to the plan and the progress being made. He or she makes sure that the process is on track.

Reporting – The audit team presents a report to all parties concerned. The report will include the team’s
observations, findings, and conclusions.

Follow-up Activities – Audits typically generate a number of findings that need follow-up and resolution. Follow-
up activities might include the following:

• The owners of the processes that were audited will respond to nonconformities revealed by the audit.
The reply will include root cause investigation, proposed corrective/preventive action (CAPA), and a
deadline for CAPA completion. The lead auditor or the audit team will review the response and may
reject it if the root cause investigation or the proposed CAPA is inadequate.

MasterControl Audit ™ Page  Tech Paper

 • For companies with a formal and separate CAPA process, the corrective action process will kick in.

• The auditor or someone else will be assigned to verify that all issues were resolved. If there was a
CAPA implementation, this person will verify that the root cause has been eliminated.

Completion – This refers to the closure of both the CAPA case and the audit process.

Common Challenges
Quality audits, like routine medical examinations, are most effective when planned in advance and conducted regularly.
FDA-regulated and ISO-certified companies are required to undergo third-party compliance audits, but they should
also conduct internal quality audits and supplier audits. Contract research organizations are also likely to be audited by
customers. All of these audits combined can be daunting for companies that rely on a paper-based or a hybrid system. The
following are some of the common challenges faced by such organizations.

Poor Planning/Scheduling - A paper-based or hybrid process would call for face-to-face meetings and
conference calls during the initial phase. Checklists and questionnaires must be printed and photocopied. Follow-
up work would entail uncoordinated phone calls, e-mail messages, and personal reminders. The process can be
bogged down if there are multiple audits (such as customer audits, an ISO audit, or an FDA inspection) taking
place at the same time, or if these audits occur several times a year.

Inefficiency - A manual system’s inefficiency poses serious problems during audits. For example, easy access to
documentation is key during an FDA inspection or ISO audit, but this may be difficult in a paper-based system.
For internal auditors, data capture under a manual system is prone to error. It is also cumbersome for auditors,
who go out in the field to inspect facilities, to transfer data from paper forms, checklists, and spreadsheets to
a software application upon their return to the office. The problem becomes worse if there are several auditors
working as a team, using large checklists, generating voluminous paperwork, and conducting multiple audits
under tight deadlines.

Lack of Connectivity - For regulated companies, audit findings may lead directly to corrective/preventive actions
(CAPAs) that are critical to compliance. But under a manual system, the audit process is not connected to the
CAPA, training control, change control, and other quality processes. This lack of connectivity could mean poor
data collection and slower CAPA and change implementation.

Lack of Control - Regulated companies must follow written procedures and any deviations from the procedures
must be justified and documented. This may be a difficult task in a manual or hybrid system, which lacks
centralized control over document changes. Companies with such systems complain of having multiple versions
of SOPs being used on the shop floor.

Lack of Oversight - It’s difficult to generate accurate and timely reports and trends using disparate tools
(electronic spreadsheets, paper documents and checklists). Without an effective reporting tool, managers are
unable to see the big picture that audit findings may reveal. Without connectivity, it is almost impossible to
monitor the entire quality system. The audit process should be visible to all employees concerned so they can be
held accountable for their actions.

MasterControl Solution
MasterControl Audit™, an integrated part of the MasterControl quality management suite, automates and manages the
audit process in an efficient and cost-effective manner. Here are some of its powerful features and how they address the
challenges discussed earlier.

MasterControl Audit ™ Page  Tech Paper

 Sustained Compliance - MasterControl not only helps regulated companies attain compliance, but helps
sustain it by optimizing quality processes and keeping the quality system always ready for both performance and
compliance audits.

• Increased Efficiency - MasterControl eliminates most of the legwork during the planning and scheduling
stage by automating task assignment, follow-up, escalation, review, and approval of documents. Automation
increases efficiency and simplifies the compliance environment, making it easier to stay compliant.

• Advanced Scheduling - A company’s entire audit plan for the year can be scheduled and managed within
MasterControl. Additionally, all the tasks required to perform each audit, such as checklist preparation,
finding creation, follow-up audits, etc., are managed by the system.

• Best-Practice Electronic Forms - MasterControl provides two important forms to collect and track data
throughout the audit process.

• Audit Summary – This form is essential in preparing for an audit. It tracks basic information such
as: type of audit, date, description, objective, scope, audit area, and lead auditor. It is also the tool
for gathering such information as: standard or regulation that serves as the basis for the audit, audit
agenda, audit team members, and checklists.

Figure 2 - MasterControl Audit offers electronic, “best-practice” forms to collect and track data throughout the audit process.

MasterControl Audit ™ Page  Tech Paper

 • Audit Finding – This form tracks all the findings resulting from the audit. It integrates risk
management by providing a section for evaluating risks and gathering the following information: risk
category, severity, risk of recurrence, and whether CAPA is required. It also ensures proper closure by
tracking verification of the process owner’s response to the finding.

• Centralized Repository - All audit-related documents will be stored in a secure, centralized repository,
making it easy to search and retrieve them during an FDA inspection or an ISO or a customer audit.

• Revision Control - MasterControl provides automatic revision control to ensure that only the current version
of a document is available. When a user makes a change in the InfoCard (the MasterControl tool that provides
basic information for every record), the user must enter a reason for the change. The software tracks all
changes made to the InfoCard.

• Analytics and Reporting - MasterControl’s advanced analytics and reporting capability increases
management oversight. It provides the ability to dynamically capture, trend, and link data needed to solve
problems and improve processes. Customizable reports include:

• Audit Summary – Gives a concise view of all the in-process audits and their status.

Figure 3 - MasterControl Audit provides a variety of real-time reports about the audit process that
enable managers to be more proactive in improving the quality system.

MasterControl Audit ™ Page  Tech Paper

 • Audit Detail – Gives a detailed view of the audit findings, including related CAPAs.

• Findings by root cause.

• Audits by Standards – Lists audits categorized by standard (i.e., ISO 9001:2000, Sec. 8.2.2) or by
regulation (i.e., FDA QSR Part 820.22).

• Audits by Auditor – Lists audits categorized by the auditors conducting them.

• Open Findings – Lists open findings categorized by owners.

• Solid Audit Trail - For companies covered by the FDA’s 21 CFR Part 11, MasterControl provides a secure,
time-stamped audit trail as required by the regulation. MasterControl documents the identity of anyone who
creates or modifies an electronic record, when the action occurred, and the changes made.

Integrated Quality Management Suite - MasterControl connects the audit process with other quality processes
for a holistic approach to quality management.

• Integrated Process - MasterControl streamlines the audit process by integrating its different phases: planning
and scheduling, execution, findings/reporting, verification, and completion.

• Easy Access - MasterControl is Web-based so it can connect employees, auditors, suppliers, contractors, and
others involved in the audit process regardless of location.

• Form-to-Form Launching - A CAPA form can be launched directly from another form, such as an Audit
Finding form. Pertinent information from the Audit Finding form will be automatically entered into the CAPA
form, reducing possible errors from manual data entry. It also shows the history of the entire process. Links
are maintained so users can review a completed process and see what triggered the CAPA.

• Dependent Routing - Completion of a task can be made dependent on another task to give managers
more control of the workflow and reduce cycle time by prompting users immediately to their next task. An
innovative dependency tree illustrates relationships between dependent processes.

Enterprise-wide Solution - MasterControl can handle every department’s forms- and documents-based
processes, making it an ideal enterprise-wide solution.

• Integrates with Other Applications - MasterControl can integrate with other applications like ERP, LIMS,
accounting, and human resources applications to accommodate departmental needs.

• Easy to Search - A standardized Google-like search window is available throughout the application, which
means all authorized users throughout the organization can search and retrieve audit-related tasks and
documents.

• Easy to Find - MasterControl’s Organizer, similar to Windows Explorer, is an easy-to-use tool that helps
users find and access documents quickly. Every department can maintain its own Organizers and documents
can be stored in multiple Organizers. System administrators can control and automatically update the
documents through a dynamic link in the InfoCard.

• Automation of Forms-Based Processes - Any forms-based process unique to a department (i.e., PTO
forms for HR, customer satisfaction survey forms for Customer Service Department) can be automated. A
department can keep the look and function of existing forms or create entirely new ones.

MasterControl Audit ™ Page  Tech Paper

Conclusion
More and more regulated companies realize that an effective quality audit system is generally a good indicator of overall
compliance. Even the FDA has said that its analysis of factory inspections show that manufacturers without an adequate
quality audit system usually don’t have an adequate quality system.

Choosing a software solution can play an important role in optimizing an organization’s audit program, not only to help
ensure compliance, but to improve performance throughout the enterprise and help attain business goals.

About MasterControl Inc.

MasterControl Inc. has been at the forefront of providing quality management software solutions since 1993. Hundreds of
companies worldwide use MasterControl to help ensure compliance with FDA regulations such as 21 CFR Parts 11, 210-
211, 820, 606; ISO quality standards such as ISO 9000, ISO 13485, ISO 14000; and Sarbanes-Oxley Act requirements.
In addition to providing off-the-shelf products, MasterControl also offers comprehensive technical and customer support,
including product training, implementation, and validation services.

For additional industry white papers about automating quality and regulatory processes, visit www.mastercontrol.com,
or call, 800-825-9117.

© 2006 MasterControl Inc. All rights reserved.

MasterControl Audit ™ Page  Tech Paper

MasterControl Inc.
6340 S. 3000 E. Suite 150
Salt Lake City, UT 84121

P. 800.825.9117
F. 801.942.7088
www.mastercontrol.com