External auditors do not just audit your production processes. They audit your internal audit program first.
ISO 13485 clause 8.2.4 requires planned internal audits at defined intervals. Certification bodies verify that your internal audits are thorough, impartial, documented, and drive corrective action. A weak internal audit program is one of the fastest paths to major certification findings.
If your internal audits feel like a checkbox exercise — same checklist every year, no findings, completed in one day — external auditors will notice.
What your internal audit program must include
- Audit schedule covering all QMS processes over a defined cycle (typically 12 months)
- Audit criteria — ISO 13485, your QMS procedures, regulatory requirements
- Auditor competence — auditors trained and independent from the area audited
- Documented audit plans — scope, objectives, criteria, schedule
- Audit reports with findings classified (observation, minor, major)
- Corrective action on findings with follow-up verification
- Management review of audit results
Pre-audit preparation checklist
1. Review the audit schedule
Is every clause and process covered in the audit cycle? Common gaps:
- Purchasing and supplier control skipped for three years
- Post-market surveillance never audited
- Design controls not in scope (required if you perform design)
- Management review audited but not production floor
Map your schedule against ISO 13485 clauses explicitly.
2. Select competent auditors
Auditors must not audit their own work. Production supervisor cannot audit production. QA manager auditing QA is acceptable only if independence is demonstrable — many companies use cross-department auditors or external consultants for impartiality.
Auditors need training in ISO 13485 requirements and audit techniques. Document auditor qualification records.
3. Prepare the audit plan
For each audit, define:
- Scope — which processes, which areas, which dates
- Auditors assigned
- Auditee contacts
- Documents to review in advance
- Interview list — who will be questioned on the floor
Send the audit plan to auditees at least one week before. Surprises erode trust and produce defensive responses instead of honest answers.
4. Gather previous findings and CAPA status
Review open findings from the last internal audit and last external audit. Verify corrective actions were implemented and effective. Re-opening old findings during an internal audit is better than an external auditor finding them first.
5. Prepare checklists — but do not stop there
Checklists ensure coverage. But effective auditors follow the trail:
- Batch record says material Lot X → verify GRN exists → verify incoming inspection → verify supplier approval
- SOP Rev 4 effective → verify training records on Rev 4 → verify no Rev 3 copies on floor
- CAPA closed → verify effectiveness check documented → verify source deviation resolved
Checklists start the audit. Traceability exercises prove the system works.
During the audit: what to look for
Contemporaneous records. Are batch records filled during production or completed afterward?
Operator competence. Can the person doing the work explain the process and show their training record?
Equipment status. Calibration stickers current? Equipment logbooks match batch records?
Quarantine control. Non-conforming material physically segregated and labelled?
Document currency. Only approved versions accessible in work areas?
Deviation handling. Open deviations with batches on hold? CAPA linked?
Take notes with specific references — batch number, SOP version, record number. Vague findings like "documentation inadequate" are impossible to close.
Writing audit reports that drive improvement
Each finding needs:
- Clear statement of non-conformance
- Reference to requirement (ISO 13485 clause, SOP number)
- Objective evidence observed
- Classification — observation, minor non-conformance, major non-conformance
- Responsible person and target correction date
"Zero findings" internal audits are suspicious. Every manufacturing operation has improvement opportunities. A healthy internal audit program finds them before customers and regulators do.
Follow-up and closure
Findings without follow-up are worthless. Track correction and corrective action to closure. Verify effectiveness at follow-up audit or scheduled verification date.
Report audit summary to management review — open findings, trends, repeat issues, audit program effectiveness.
Common internal audit program failures
- Audits delayed repeatedly due to "production pressure"
- Same person audits every department
- Findings never closed or closed without evidence
- No audit of supplier control or post-market processes
- Internal audit reports not reviewed in management review
- Checklist-only audits with no record traceability exercises
Using QMS data to make internal audits effective
Auditors with paper records spend half the audit searching cupboards. Auditors with a QMS can:
- Pull any batch record instantly
- Verify training status by person or SOP
- Review CAPA status and overdue actions live
- Check document version history
- Trace material lots forward and backward in minutes
This shifts internal audits from document retrieval exercises to genuine system evaluation.
Want audit-ready records at your fingertips? RapidFacto gives QA teams instant access to batch records, traceability, CAPA, training, and document control — making internal audits faster and more thorough. Book a demo.