T-003-004 Internal audit checklist

Purpose

To establish a guide to ensure coverage of the topics to be audited, always based on the standard UNE-EN ISO 13485:2018.

QMS

CAP NORM	DESCRIPTION	CONFORMITY (Y/N)	COMMENTS	DOCS CHECKED AND AUDITOR NOTES
General requirements	Is the QMS documented, implemented and maintened in accordance with ISO 13485 or equivalent?
General requirements	Are outsourced processes adequately controlled?
Documentation requirements	Are the following types of documents established, maintained and controlled: - quality policy and quality objectives; - quality manual; - operational procedures; - device specifications; - production process specifications; - quality assurance procedures and specifications; - maintenance and servicing procedures and methods; - other documents needed to ensure the effective planning and operation of the quality system
Documentation requirements	Does the quality manual include: - the scope of the quality management system and exclusions, - operational procedures or references to them, - description of the interaction between the processes of the quality system, and - outline of the structure of the quality system documentation?
Documentation requirements	Is there a written procedure defining the controls needed to - review and approve documents prior to issue, - review, update and re-approve documents, - identify changes and current revisions of documents, - make relevant and current documents available at points of use, - ensure that documents are legible and identifiable, - identify and control the distribution of documents of external origin, and - identify retained obsolete documents and prevent their unintended use?
Documentation requirements	Is the period for retention of obsolete controlled documents defined?
Documentation requirements	Are document changes reviewed and approved by the same function that performed the original review and approval (unless specifically designated otherwise)? Are change records maintained, including description of the change, identification of the affected documents, approval signatures and date, and when the change becomes effective?
Control of records	Is there a documented procedure for the identification, storage, protection, retrieval, retention, and disposition of records?
Control of records	Are retention periods for records defined? Are records retained for at least the period of time equivalent to the expected life of the device, and no less than 2 years?
Control of records	Are records organized and maintained to ensure that they remain legible, readily identifiable and retrievable, and to prevent deterioration and loss? Are records accessible to the regulatory inspections? Are electronic records backed up?
Control of records	For each type of device, is there a Device Master Record (DMR) including, or referring to appropriate device specifications, production process specifications, quality assurance procedures, maintenance and servicing procedures and methods?

Management responsibility

CAP NORM	DESCRIPTION	CONFORMITY (Y/N)	COMMENTS	DOCS CHECKED AND AUDITOR NOTES
Management commitment	Is the top management - communicating to the organization the importance of meeting customer and other applicable requirements, - establishing the quality policy, - establishing the quality objectives, - conducting management reviews, and ensuring availability of resources?
Customer focus	Is the top management ensuring that customer requirements are determined and met?
Quality policy	Is there a documented quality policy; and - is it appropriate to the purpose of the organization? - does it include a commitment to comply with requirements and maintain the effectiveness of the quality management system? - does it provide a framework for establishing the quality objectives? - is it communicated and understood throughout the organization? - is it periodically reviewed for continuing suitability?
Planning	Are measurable quality objectives established? Are the objectives consistent with the quality policy?
Planning	Is the quality system planned to meet requirements and quality objectives? Is the integrity of the quality system maintained when changes are implemented?
Responsibility, authority and communication	Are responsibilities and authorities defined, and are they communicated throughout the organization? For personnel who manage, perform and verify work affecting quality, is their interrelation defined, and do they have sufficient independence and authority to perform these tasks?
Responsibility, authority and communication	Is there a management representative for the quality management system? Are our responsibilities defined, to include: - ensuring that processes needed for the quality system are established, implemented and maintained, - reporting to top management on the performance of the quality system and need for improvement, and - promoting the awareness of regulatory and other requirements?
Responsibility, authority and communication	Are appropriate communication processes established within the organization? Are information and data regarding the effectiveness of the quality system regularly communicated?
Managament review	Is the quality management system periodically reviewed to ensure its continuous suitability, adequacy and effectiveness, and to identify opportunities for improvement?
Managament review	Does the input into management reviews include: - results of audits, - customer feedback, - process performance and product conformity, - preventive and corrective actions, - actions from previous reviews - changes, - recommendations for improvement, and - new or revised regulatory requirements?
Managament review	Does the output from management reviews include decisions and actions related to: - improvements of the quality system and its processes, - improvements of product related to customer requirements, and - resource needs?

Resource management

CAP NORM	DESCRIPTION	CONFORMITY (Y/N)	COMMENTS	DOCS CHECKED AND AUDITOR NOTES
Provision of resources	Are adequate resources provided to implement and maintain the quality management system?
Provision of resources	Are adequate resources provided to meet regulatory and customer requirements?
Human resources	Do personnel performing work affecting product quality have appropriate education, training, skills and experience? Are adequate records of their qualifications maintained?
Human resources	Are competence requirements for personnel defined and training needs identified? Is training provided, or are other actions taken to satisfy the competence requirements? Is the effectiveness of training (or other actions taken) evaluated?
Human resources	Are personnel made aware of the relevance and importance of their work and how they contribute to the achievement of the quality objectives? Are personnel made aware of the device defects which may occur from the improper performance of their specific jobs? Are personnel who perform verification and validation activities made aware of defects and errors that may be encountered as part of their job functions?
Infrastructure	Is the needed infrastructure, to include - buildings, workspaces and associated utilities, - manufacturing equipment, and - supporting services, determined, provided and maintained?
Work environment	Are requirements for the work environment determined? Is the environment adequately managed?

Product realization

CAP NORM	DESCRIPTION	DOCS CHECKED AND AUDITOR NOTES	CONFORMITY (Y/N)	COMMENTS
Planning of product realization	Are the product quality objectives and requirements determined?
Planning of product realization	Are production processes developed and established? Are adequate equipment, operators and other resources specific to the product provided?
Planning of product realization	Are there defined requirements for verification, validation, monitoring, inspection and test activities specific to the product? Are the criteria for product acceptance determined?
Planning of product realization	Are there defined requirements for records needed to provide evidence that production processes and resulting product meet specified requirements?
Planning of product realization	Are there documented requirements for risk management throughout the product realization? Are records arising from risk management maintained?
Customer-related processes	Are product requirements defined and documented, and include - requirements specified by the customer (including delivery and post-delivery); - requirements not stated by the customer, but necessary for specified or intended use; - statutory and regulatory requirements related to the product; and - any additional requirements determined by the company?
Customer-related processes	Prior to the commitment to supply the product, are requirements related to the product reviewed to ensure that - requirements are defined, - any discrepancies and ambiguities are resolved, and - company is able to meet the requirements?
Customer-related processes	Where product requirements are not documented (not communicated in writing), are the requirements confirmed before accepting the order?
Customer-related processes	When changing or amending orders, are relevant documents amended, and are the changes communicated to the relevant personnel?
Customer-related processes	Are there defined and implemented arrangements for: - communicating the product information, and - handling enquiries, orders and change orders?
Customer-related processes	Are effective arrangements defined for communicating with customers regarding customer feedback and customer complaints, and advisory notices?
Design and development	Are design and development processes and activities documented in procedures? Are product design activities planned, to include - the design stages; - the review, verification, validation and design transfer activities appropriate to each stage; and - assignment of responsibilities and authorities? Is the design planning output documented, reviewed and approved, and is it updated as the design progresses?
Design and development	Are design inputs determined and documented, and include, as applicable, - functional, performance and safety requirements according to the intended use and needs of the user, - statutory and regulatory requirements, - information from previous similar designs, - outputs of risk management? Are there procedures for addressing incomplete, ambiguous or conflicting design input requirements? Are design inputs reviewed for adequacy and approved by a designated person?
Design and development	Are design outputs provided in a form that is suitable for verification against design input requirements? Are design outputs documented, reviewed, and approved prior to release?
Design and development	Do design outputs - meet design input requirements, - provide necessary information for purchasing and production, - contain acceptance criteria, and - specify product characteristics that are essential for its safe and proper use?
Design and development	Are there design project records (Design History File) demonstrating that design was developed in accordance with the approved design plan and with regulatory and quality system requirements?
Design and development	Are design reviews conducted to evaluate whether the design is on track toward meeting input requirements, and to identify any problems and propose necessary actions? Do participants at each review include all functions concerned, any specialists needed, and a person who does not have direct responsibility for the design stage being reviewed? Are records of the reviews and the resulting actions maintained?
Design and development	Are designs verified to ensure that design outputs have met the design input requirements? Are records of the verification results and any related actions maintained?
Design and development	Are designs validated to ensure that the resulting product is capable of meeting the requirements for user needs and intended uses? Are records of the validation results and any related actions maintained?
Design and development	Are design changes reviewed, verified, validated, as appropriate, and approved before their implementation? Are changes evaluated with respect to their effect on constituent parts and on the product already delivered? Are records of changes maintained, to include their reviews/evaluations and any necessary actions?
Purchasing	Are suppliers and the supplied product adequately controlled to ensure that the product conforms to specified purchase requirements?
Purchasing	Are suppliers evaluated, and is the supplier selection based on their ability to provide products conforming to specified requirements? Are supplier evaluation and selection (approval) criteria established? Is there an approved supplier list? Are records or supplier evaluations and related actions maintained?
Purchasing	Do purchasing specifications include, where appropriate, - requirements for approval of product, procedures, processes and equipment; - requirements for approval of personnel, and - quality management system requirements? Do purchasing documents include an agreement obliging suppliers to give notification of changes to their product or service?
Purchasing	Are purchasing specifications (data) approved before they are forwarded to suppliers?
Purchasing	Are there established and implemented activities necessary for ensuring that purchased products meet specified requirements?
Purchasing	When intending to perform product verification at supplier premises, are verification arrangements and methods defined in the purchasing documents?
Production and service provision	Are adequate product specifications available?
Production and service provision	Are adequate production specifications available, to include, as applicable: procedures, requirements, work instructions, reference materials, and reference measurement procedures?
Production and service provision	Are release, delivery and post-delivery activities implemented?
Production and service provision	Are there Device History Records (Batch Records) for each manufactured batch, lot or unit? Are the following records included in the DHRs: - the date of manufacture, quantity manufactured, and quantity released for distribution; - the acceptance records demonstrating that the device is manufactured in accordance with the DMR; - the primary identification label and label used for each production unit; - any device identifications and control numbers used; and - other traceability information to the extent specified?
Production and service provision	Where the results of a production process cannot be fully verified by subsequent inspection and test, are these processes validated? Are validation results documented and approved? Are appropriate arrangements established for these processes, including - criteria for their review and approval, - monitoring and control of process parameters, - personnel qualifications, and - use of specific methods and procedures. Are there process monitoring and control records for these processes, including date, methods, data, equipment, and the process operators? When changes or process deviations occur, are these processes revalidated? Are the results documented and approved?
Production and service provision	Where computer software is used for production and/or service provision automated processes), are such software applications validated prior to initial use? Are validation results documented? Are all software changes also validated?
Production and service provision	Are products suitably identified throughout product realization to prevent mix-ups? Are returned medical devices identified to distinguish them from conforming product?
Production and service provision	Are there procedures or specifications defining the extent of product traceability and the records required?
Production and service provision	Throughout all product realization stages, are products identified with respect to their acceptance status to indicate the conformity or nonconformity of the product?
Production and service provision	When customer provides product for use or incorporation into the final product, is customer property identified, verified, protected and safeguarded? Are customers notified in any event of loss, damage or unsuitability of their property?

Measurement, analysis, improvement

CAP NORM	DESCRIPTION	DOCS CHECKED AND AUDITOR NOTES	CONFORMITY (Y/N)	COMMENTS
General requirements	Are measurement, analysis and improvement processes planned and implemented to - demonstrate conformity of the product, - ensure conformity of the QMS, and - maintain the effectiveness of the QMS?
General requirements	Are applicable methods determined, including statistical techniques, for the measurement, analysis and improvement processes? Are sampling plans based on valid statistical rationale? Are they documented? Are there procedures to ensure that sampling methods are adequate and that when changes occur the sampling plans are reviewed?
Monitoring and measurement	Are methods determined for obtaining and using information related to whether the company has met customer requirements? Is there a system for obtaining and analyzing customer feedback to provide early warning of quality problems? Is customer feedback used as input into the corrective and preventive action processes?
Monitoring and measurement	Are internal audits planned and conducted to determine whether the quality management system conforms to requirements and whether it is effectively implemented and maintained?
Monitoring and measurement	Are audit criteria, scope, frequency and methods defined and documented? Is the audit process objective and impartial?
Monitoring and measurement	Are corrective actions taken to eliminate detected nonconformities and their causes? Are corrective actions followed up to verify the actions taken and to report the verification results?
Monitoring and measurement	Are quality system processes monitored and measured? When planned results are not achieved, are corrections and corrective actions taken to ensure conformity of the product?
Monitoring and measurement	Are all product acceptance activities (in-process and final inspections and tests) carried out in accordance with planned arrangements and documented procedures? Are in-process products controlled to prevent their use (further processing) before the required acceptance activities are completed?
Monitoring and measurement	Are there effective measures implemented to prevent release of product for distribution before - all activities required in the DMR are completed, - the associated data and documentation is reviewed, and - the release is dated and is authorized by a signature of a designated person(s)?
Monitoring and measurement	Are acceptance and release records maintained and include - identification of acceptance activities performed and, where appropriate, the methods and equipment used, - the results, and - dates and signatures of individual performing the acceptance activities? Are these records included in the DHR?
Control of nonconforming product	Are nonconforming products properly identified and controlled to prevent their unintended use or delivery?
Control of nonconforming product	Are nonconforming products evaluated to determine the nature and causes of the nonconformity and to disposition whether to - eliminate the nonconformity (rework), - authorize their use, release or acceptance (accept as-is by concession), or - preclude their original use or application (scrap or re-grade)? Does the evaluation include the determination of a need for an investigation and notification of the persons or organizations responsible for the nonconformity? Are records maintained of the nonconformities and any subsequent action taken?
Control of nonconforming product	Are actions taken to mitigate the effects of nonconformity when a nonconforming product has been shipped (or its use has started)?
Control of nonconforming product	If product needs to be reworked, are the rework processes documented and approved? Are reworked and repaired products re-verified to demonstrate their conformity? Is a determination made whether there are any adverse effects of rework upon the product? Is this determination documented? Is it included in the DHR?
Analysis of data	Are appropriate data on the performance of the quality management system collected and analyzed, to include - customer feedback, - product conformity, - characteristics and trends of processes and products (including opportunities for preventive actions), and - suppliers?
Improvement and corrective/preventive action	Are changes necessary to maintain the suitability and effectiveness of the quality system identified and implemented, through the use of - quality policy - quality objectives, - audit results, - analysis of data, - corrective and preventive actions, and - management reviews?
Improvement and corrective/preventive action	Is there a procedure for issue and implementation of advisory notices? Is this procedure capable of being implemented at any time?
Improvement and corrective/preventive action	Is there a procedure for receiving, reviewing and evaluating complaints? Are all complaints, including oral complaints, documented?
Improvement and corrective/preventive action	Are complaints reviewed and evaluated to determine whether an investigation and/or corrective action are necessary? Are all complaints involving the possible nonconformity of a device investigated (unless a similar investigation was already performed)? When no investigation and/or corrective action are made, is there a record with a justification why investigation was not required, and with the name of the person who is responsible for this decision?
Improvement and corrective/preventive action	Are actions taken to eliminate causes of existing and potential nonconformities to prevent recurrence?
Improvement and corrective/preventive action	Is there a documented procedure for - analyzing sources of quality and quality performance data to identify existing and potential causes of nonconforming product or other quality problems; - investigating the causes of nonconformities; - identifying and implementing the actions needed to correct and prevent recurrence of nonconforming product or other quality problems; - verifying the effectiveness of corrective and preventive actions; - reporting quality problems and associated corrective and preventive actions to management review, - maintaining records of corrective and preventive actions and their results?

Record signature meaning

• Author: JD-004 Author name
• Review: JD-005 Reviewer name
• Approval: JD-001 Approver name

Template signature meaning

info

Delete this section when you create a new record from this template.

• Author: JD-004 María Diez
• Review: JD-005 Alfonso Medela
• Approval: JD-001 Andy Aguilar