Internal Audit Procedure

This procedure establishes the process for planning, conducting, reporting, and following up on internal quality audits of the QMS. Internal audits verify that the QMS conforms to ISO 13485:2016, applicable regulatory requirements, and the organization's planned arrangements, and that it is effectively implemented and maintained.

This procedure applies to all internal audits of the Quality Management System, including: - System audits (assessing overall QMS effectiveness against ISO 13485 clauses) - Process audits (assessing specific processes for conformance and effectiveness) - Product audits (assessing specific products against specifications and DHF requirements) All QMS processes shall be audited at least once during each audit cycle (typically 12 months). Higher-risk processes or those with recent nonconformances may be audited more frequently.

Quality Manager: Responsible for the overall audit program, including developing the annual audit schedule, ensuring auditor qualification, reviewing audit reports, and tracking closure of findings. Lead Auditor: Plans and conducts individual audits, prepares the audit plan, leads opening and closing meetings, compiles findings, and writes the audit report. Audit Team Members: Assist the Lead Auditor in conducting audit activities and documenting findings. Auditee Management: Ensure availability of personnel and records, implement corrective actions for findings within agreed timeframes. Management Representative: Ensure adequate resources for the audit program and review results at Management Review.

4.1 Annual Audit Schedule - The Quality Manager develops the Annual Audit Schedule (FRM-IA-001) considering: - Status and importance of processes - Results of previous audits - Changes to the QMS or regulatory environment - Customer and regulatory requirements - Risk level of processes - The schedule shall ensure all QMS processes are audited at least once per audit cycle - The schedule is approved by the Management Representative 4.2 Auditor Qualification - Internal auditors must have completed formal auditor training (e.g., ISO 13485 Internal Auditor course, minimum 16 hours) - Auditors shall not audit their own work or department (independence requirement) - Auditor qualifications are documented in the Auditor Qualification Log (FRM-IA-002) - New auditors shall participate in at least one audit as an observer before leading an audit 4.3 Audit Preparation - Lead Auditor prepares an Audit Plan (FRM-IA-003) including: audit scope, criteria, date/time, auditee, audit team assignments, and checklist - Distribute the Audit Plan to the auditee at least 5 business days prior - Review relevant documents (SOPs, previous audit findings, CAPAs, complaints) before the audit 4.4 Audit Execution - Opening Meeting: Confirm scope, introduce team, explain the process - Evidence Collection: Interview personnel, review documents and records, observe processes and facilities - Document findings using the Audit Checklist (FRM-IA-004) with objective evidence - Closing Meeting: Present preliminary findings to auditee management, discuss timelines for corrective actions 4.5 Finding Classification - Major Nonconformity: Absence or total breakdown of a required process; noncompliance that would result in regulatory citation; patient safety risk - Minor Nonconformity: Isolated lapse in following a procedure; single instance of incomplete documentation - Observation/Opportunity for Improvement (OFI): Not a nonconformity but a recommended improvement 4.6 Audit Report - The Lead Auditor completes the Audit Report (FRM-IA-005) within 10 business days of audit completion - The report includes: audit scope and criteria, audit team, areas audited, summary of findings, classification, and required corrective actions - The report is distributed to auditee management and the Quality Manager 4.7 Corrective Action & Follow-Up - Major findings: Corrective action required within 30 days; CAPA initiated per SOP-CA-001 - Minor findings: Corrective action required within 60 days - The Quality Manager tracks all findings to closure - Verification of corrective actions may be performed during the next scheduled audit or through a focused follow-up audit

- Annual Audit Schedule (FRM-IA-001) - Auditor Qualification Log (FRM-IA-002) - Audit Plans (FRM-IA-003) - Audit Checklists (FRM-IA-004) - Audit Reports (FRM-IA-005) - Corrective action records linked to audit findings

- ISO 13485:2016 Clause 8.2.4 Internal Audit - ISO 19011:2018 Guidelines for Auditing Management Systems - FDA 21 CFR 820.22 Quality Audit - SOP-CA-001 CAPA Procedure