Professional Documents
Culture Documents
4 Quality Management System: Internal Audit Checklist
4 Quality Management System: Internal Audit Checklist
Refs Requirements What to look for and how Compl Auditor notes and evidence
4.1 Are outsourced processes adequately How are outsourced processes controlled? Are outputs
controlled? of outsourced processes verified? Are subcontractors
and suppliers required to operate and maintain quality
management systems (ISO 9001, for example)?
4.2 Documentation requirements
4.2.1 General
4.2.1 Are the following types of documents Are quality policy and quality objectives documented?
820.20(e) established, maintained and controlled: Where?
quality policy and quality objectives; Is there a quality manual? Operational procedures?
quality manual;
Are drawings, specifications, work instructions, work
operational procedures; orders, control plans, etc., issued and maintained as
device specifications including drawings, controlled documents (as required in 4.2.3)?
composition, formulation, components,
Are electronic documents (computer files) backed up?
software etc. (Device Master Record);
production process specifications including
equipment, production methods and
procedures, operator (work) instructions,
production environment specifications, etc.
(Device Master Record);
quality assurance procedures and
specifications including control plans,
inspection equipment and procedures,
acceptance criteria, etc. (Device Master
Record);
packaging and labeling specifications,
including methods and processes used
(Device Master Record);
installation, maintenance and servicing
INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 2 of 5
Refs Requirements What to look for and how Compl Auditor notes and evidence
4.2.3 Is the period for retention of obsolete Is a retention period defined for each type of controlled
controlled documents defined? documents? How is this period determined? Is the
retention period at least equal to the lifetime of the
device? Is it coordinated with the retention period for
corresponding records? Are regulatory requirements
INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 3 of 5
Refs Requirements What to look for and how Compl Auditor notes and evidence
considered?
4.2.3 Are document changes reviewed and Is there a clearly stated requirement that changes to
820.40(b) approved by the same function that performed documents must be reviewed and approved by the same
the original review and approval (unless function that issued the original document, or by another,
specifically designated otherwise)? explicitly designated function? Is it implemented?
Are changes in documents (mostly product and process
Are change records maintained, including specifications) backed by design change and/or process
description of the change, identification of the change records, such as engineering change notices?
affected documents, approval signatures and How is it defined/documented when document changes
date, and when the change becomes become effective?
effective?
4.2.4 Are retention periods for records defined? Is a retention period defined for each type of record?
820.180(b) How is this period determined? Is the retention period at
Are records retained for at least the period of least two years or equivalent to the lifetime of the device,
time equivalent to the expected life of the whichever is greater? Are regulatory requirements
device, and no less than 2 years? considered?
4.2.4 Are records organized and maintained to Are records stored in dry, clean locations to minimize
820.180 ensure that they remain legible, readily deterioration? Is there a system for organizing the
identifiable and retrievable, and to prevent records? Are boxes, drawers, binders holding records
deterioration and loss? properly identified? Are records easily retrievable (test by
asking for retrieval of specific records)?
Are records accessible to the regulatory Are records kept in a location that is accessible to
inspections? regulatory inspections?
Are electronic records backed up? Are electronic records backed up? Are there specific
schedules, instructions, etc. for backing up data? Where
are the back-up media (tapes, disks, etc.) kept?
4.2.4 For each type of device, is there a Device How is the DMR organized? Is it a file containing the
820.181 Master Record (DMR) including, or referring to actual specifications documents, or is it a list referring to
appropriate device specifications, production these documents and their locations? Is the DMR
process specifications, quality assurance complete, e.g., includes all required categories of
documents? Who decides, and how, which documents
procedures, packaging and labeling are included in the DMR? Are all documents included in
specifications, and installation, maintenance the DMR correctly identified, reviewed, approved and
and servicing procedures and methods? otherwise controlled? Are the DMR documents the same
INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 4 of 5
Refs Requirements What to look for and how Compl Auditor notes and evidence
4.2.4 Are Device History Records (DHR) maintained Are DHR records properly identified to specific batches,
820.184 for each manufactured batch, lot or unit? lots or units; and are the records easily retrievable? (For
(Refer also to ISO 13485 Clause 7.5.1 and other questions refer to 7.5.1)
820.184)
4.2.4 Are Quality System Records (QSR) How is it determined and documented what quality
820.186 maintained, including current and obsolete system records are maintained (in QMS Manual and lists
quality system manuals and procedures, and of procedures and quality forms, and in operational
records of quality system activities such as procedures and work instructions)? Are retention periods
specified for obsolete quality system documentation and
management reviews, corrective and for quality system records?
preventive actions, internal audits, etc.?
4.2.4 Are sufficient records maintained to provide Is there a list (or other documented specification) of
evidence of conformity and effectiveness of quality system records that are maintained by the
the quality management system? company? Are the records sufficient to demonstrate
product and process conformity, and the conformity and
effectiveness of the quality management system and its
implementation?
5 Management Responsibility
5.1 Management Commitment
5.1 Is the top management How is importance of meeting customer and other
communicating to the organization the requirements communicated? Do employees understand
importance of meeting customer and other the consequences of failing to meet requirements? Is
applicable requirements, there a quality policy? Are quality objectives defined?
Are management reviews being conducted regularly?
establishing the quality policy, Are adequate resources necessary for the quality system
establishing quality objectives, provided?
conducting management reviews, and
ensuring availability of resources?
5.2 Customer Focus
5.2 Is the top management ensuring that What measures are implemented to ensure that
customer requirements are determined and customer requirements are determined and met
are met? (processes, procedures, training, monitoring, auditing,
etc.)?
5.3 Quality Policy
5.3 Is there a documented quality policy; and Is the quality policy appropriate (relevant to the types of
820.20(a) Is it appropriate to the purpose of the products, type of market, customer expectations, etc.)?
organization? Does it include explicit commitment to comply with
requirements and maintain (or improve) the
INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 5 of 5
Refs Requirements What to look for and how Compl Auditor notes and evidence
Does it include a commitment to comply with effectiveness of the quality system? Is it related to quality
requirements and maintain the effectiveness objectives? Would achievement of the quality objectives
of the quality management system? bring the company closer to achieving its overall quality
Does it provide a framework for establishing policy? Do employees know the meaning of the quality
the quality objectives? policy and understand how they can contribute to
Is it communicated and understood achieving the policy? Is the quality policy periodically
throughout the organization? reviewed by management reviews? Has the policy ever
Is it periodically reviewed for continuing been modified since it was initially formulated?
suitability?
The remainder of Section 5 and Sections 6, 7 and 8 are not included in the Demo file
The complete checklist is 30 pages long.