Auditors Expectations

MATCHING THE AUDITORS EXPECTATIONS Quality Management System 

All suppliers should be able to describe their QMS to the auditor. Indeed, the auditor will expect the supplier s QMS to be formalized and documented. The QMS should contain all procedures, internal standards and guidelines that are required when developing, maintaining and qualifying the product. 

The supplier must not only be able to show that there is a QMS but also that it is actively used. SAP manages quality management documents and quality item lists electronically and thus ensures that employees have constant access to the most up-to-date information. Because it is managed electronically, it is possible to construct automatic workflows to ensure that the process steps prescribed are followed. It is important to note that suppliers do not have to conform with U.S. 21 CFR 11 governing the use of electronic records and signatures. Customers should nevertheless expect suppliers to ensure that electronic records are secure and that their integrity cannot be compromised by data corruption or unauthorized manipulation. 

This is essentially a facilitating role in many supplier organizations and is supported by development team members with specific project quality responsibilities. 

In addition to the central quality group, each deveiopment department headed by a program director has an assigned quaiity management team. The quality of the product (or certain parts of the product) shouid be the top priority for the quality management team. The main tasks of these decentralized quality management teams are as follows  

---

When a new SOP is to be written or when an outdated one is to be revised, some very important protocols must be considered. First, the scientists who will be conducting the work must be involved. They are most familiar with the laboratory facilities and equipment and can most likely provide very useful input. Second, a standard format must be followed so that all SOPs look alike and provide information the company employees and laboratory auditors expect. The format typically includes a document number, a descriptive title, a revision number, an effective date, a statement of purpose, a statement of scope, the procedure itself, references (such as the... 

Complain to the certification body whenever the auditor performance does not meet expectations. 

The certification body shall regularly evaluate auditor performance in determining effective implementation of ISO/TS 16949. Auditors should expect their performance to be regularly evaluated by their CB and that the person performing the evaluation is a qualified auditor. 

Certification body shall notify the lATF of all scheduled audits including witness audits and shall allow lATF members or their designates to attend. Auditor should expect to be informed that an lATF member may attend. If the date of the audit has to be changed it cannot be extended by more than three months from the date of document review (see Annex 1 of the Rules). 

You can expect to receive both accreditation body witness auditors and lATF witness auditors on any initial audit and subsequent surveillance audit but not at the same time. 

You can expect the auditor to identify opportunities for improvement but not offer advice as to how such opportunities may be realized. 

While the plan itself is not auditable by third parties, it may be auditable by second parties i.e. customers. The third party or registrar is entitled to examine the plan to ascertain that it is what it proclaims to be. The particulars are of no concern except those aspects relating to quality, such as the resources, quality objectives, customer satisfaction plans, and performance metrics. Whatever is stated on these aspects, the auditors will expect to see evidence that the business plan is not merely a wish list and that provisions have been made to enable implementation through the quality system. 

An auditor would expect to find staff consulting the rework instructions when carrying out rework. However, information in documents can be memorized or become habit through familiarity with the process. Rework instructions are often unique to the nonconformity and therefore personnel cannot rely on prior knowledge. This is addressed as a supplementary requirement in clause 4.14.3. 

An audit should also catalog the hardware used at a site. Older hardware can be operating well within its expected efficiency range and still be wasteful. The auditor needs to know about old devices and their performance specifications, as well as what is newly avail-... 

An auditor can expect batch records in the United States to be generally more detailed than those found in Europe. European batch records are more of aguide with extensive references to corresponding SOPs and written work instructions. Either system is acceptable as long as all necessary data are documented and the employees are trained adequately. 

Suppliers should be advised at the outset of an audit that they wiU be accorded the opportunity to review and correct a draft of the Audit Report before it is issued, as we have mentioned above. There should also be some agreement as to the timetable expected for the issue of a draft report. It is not proper for a supplier to seek to approve the audit report since that could amount to an attempt to gag the auditor. By permitting the audit in the first place, the supplier has effectively given the auditor permission to exercise his/her professional impartiality and this freedom may not subsequently be withdrawn. The contents of the report are the auditor s opinions and should not be influenced except where they are based on factual misconceptions that must be corrected by the supplier. The auditor has a duty of care to the supplier to permit this. The supplier should retain a copy of the draft Audit Report with a note of their review comments. A final copy of the approved and issued report must also be furnished to the supplier by the auditor as the basis for future business relationships. 

The person performing an IT vendor audit needs to know the standards used, understand how an IT developer organization works, and what to expect of them. Being a GMP auditor does not make a person competent to perform IT vendor audits. It might be wise to obtain help from an external consultant if your company does not have the skills internally. 

Induction training in QA may comprise the general audit procedures employed at the company, key audit SOPs and documentation requirements in QA. A thorough review of the regulatory framework for GCP is recommended, as QA auditors are expected to be experts for clinical trial regulations and all GCP aspects. It would impair the QA auditors credibility if they knew less than the auditees of the requirements that must be adhered to in drug development. 

Many firms rely on a C of A supplied by the supplier in lieu of actually performing required testing. This becomes a more proactive means of assuring the quality of the material. Acceptance of a C of A is possible after a partnership is established with the supplier through a formal qualification and evaluation of the supplier s capabilities and reliability. Typically the process involves an initial questionnaire, followed by an audit by trained auditors and purchasing representatives. This helps determine if the supplier is qualified to produce the material consistently and in accordance with the firm s expectations. The material then needs to be approved for use in the manufacturing process this is typically done with three distinct... 

The auditor should seek a procedure defining the assembly of structured test plans. Ideally, actual test plans should be traceable to the design and include a formal review for comprehensiveness before any testing commences. Test reports summarizing the outcome of functional testing would normally be expected as evidence that the testing was actually carried out and that the product met its defined requirements. 

The auditor will have to work with a wide variety of people. He or she will be interviewing a full gamut of personalities and job descriptions, ranging from the facility manager to temporary workers who have no knowledge of the plant culture. This means that the auditor will have to be empathetic, i.e., he or she needs to understand where people are coming from, and what they can be expected to know. (Empathy is different from sympathy in that the auditor may relate to a person s concern but still retains his or her detachment and objectivity.)... 

Where feasible, the report should be presented in a meeting, particularly if it contains difficult or sensitive findings. The auditor should expect to be questioned and challenged as to his conclusions, and it is best if he can do this face to face. 

To determine what is really happening, an auditor must explore the safety management systems in place, what is expected of them, and which systems are effective or ineffective in controlhng an entity s risks. That, in effect, results in culture appraisal. 

Another key characteristic of the audit instrument is that of reliability. If an instrument is reliable, it should provide the same results when administered multiple times at the same time. A key factor that can influence the reliability of the audit instrument is the auditor completing the instrument. If two auditors using the same instrument and the same time complete an audit, one would expect to obtain the same findings. Factors that influence how one auditor may obtain results that are different from another in this situation include the wording of the audit items, the instructions provided, and the auditor training and understanding of the audit process. 

However, it may be that none of these scenarios apply, in which case the Road Safety Auditors may have simply made a bad mistake, and overlooked a potential accident problem that other Road Safety Auditors would have been expected to identify. In this case there is a possibility of liability against the Road Safety Auditors. 

Several months prior to the audit, the lead auditor and a location coordinator should be identified. These two individuals should begin coordinating activities, office space, transportation and expectations. The location coordinator should forward to the auditor copies of all plant procedures (classification procedures, design standards, list of all Safety Instrumented Functions with assigned SIL, control room locations, management-of-change procedures, testing procedures, etc.). 

---