Regulatory Open Forum

First, your external auditors are wrong! Ask them where the requirement is and how they would cite it in a non-conformance report. Such a requirement does not exist.

Sampling records in a quality audit is an interesting problem. There are two approaches.

In a convenience sample, a competent auditor uses judgement to pick samples and "get a feel" for the process. Convenience samples tend to be small, typically 3 to 10 records.

In a statistical sample, the competent auditor determines an upper bound on the error rate. Each record is classified as conforming or nonconforming and the sampling plans use the binomial distribution. The result is a statement such as, "we are 95% confident that the error rate is less than 5%". This approach comes from financial auditing in which the auditor is determining the effectiveness of the financial controls.

There is an MDSAP document that discusses sample sizes, but I can't seem to locate it at the moment. It refers to GHTF/SG4/N30R20:2006 Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers – Part 2: Regulatory Auditing Strategy.

Appendix 1 has two tables that "may be used in determining appropriate statistical sample sizes". One has a confidence of 95% and the other has a confidence of 99%. For example, if you want to be 95% confident that the error rate in the process is less than 5%, then use Table 1 row F. A sample size of 72 with no nonconforming records provides the statement "we are 95% confident that the error rate is less than 5%".

These are the same table used in the QSIT.

There is a technical reason why these tables use the wrong approach, but it is not worth the explanation.

First, your external auditors are wrong! Ask them where the requirement is and how they would cite it in a non-conformance report. Such a requirement does not exist.

Sampling records in a quality audit is an interesting problem. There are two approaches.

In a convenience sample, a competent auditor uses judgement to pick samples and "get a feel" for the process. Convenience samples tend to be small, typically 3 to 10 records.

In a statistical sample, the competent auditor determines an upper bound on the error rate. Each record is classified as conforming or nonconforming and the sampling plans use the binomial distribution. The result is a statement such as, "we are 95% confident that the error rate is less than 5%". This approach comes from financial auditing in which the auditor is determining the effectiveness of the financial controls.

There is an MDSAP document that discusses sample sizes, but I can't seem to locate it at the moment. It refers to GHTF/SG4/N30R20:2006 Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers – Part 2: Regulatory Auditing Strategy.

Appendix 1 has two tables that "may be used in determining appropriate statistical sample sizes". One has a confidence of 95% and the other has a confidence of 99%. For example, if you want to be 95% confident that the error rate in the process is less than 5%, then use Table 1 row F. A sample size of 72 with no nonconforming records provides the statement "we are 95% confident that the error rate is less than 5%".

These are the same table used in the QSIT.

There is a technical reason why these tables use the wrong approach, but it is not worth the explanation.

First, your external auditors are wrong! Ask them where the requirement is and how they would cite it in a non-conformance report. Such a requirement does not exist.

Sampling records in a quality audit is an interesting problem. There are two approaches.

In a convenience sample, a competent auditor uses judgement to pick samples and "get a feel" for the process. Convenience samples tend to be small, typically 3 to 10 records.

In a statistical sample, the competent auditor determines an upper bound on the error rate. Each record is classified as conforming or nonconforming and the sampling plans use the binomial distribution. The result is a statement such as, "we are 95% confident that the error rate is less than 5%". This approach comes from financial auditing in which the auditor is determining the effectiveness of the financial controls.

There is an MDSAP document that discusses sample sizes, but I can't seem to locate it at the moment. It refers to GHTF/SG4/N30R20:2006 Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers – Part 2: Regulatory Auditing Strategy.

Appendix 1 has two tables that "may be used in determining appropriate statistical sample sizes". One has a confidence of 95% and the other has a confidence of 99%. For example, if you want to be 95% confident that the error rate in the process is less than 5%, then use Table 1 row F. A sample size of 72 with no nonconforming records provides the statement "we are 95% confident that the error rate is less than 5%".

These are the same table used in the QSIT.

There is a technical reason why these tables use the wrong approach, but it is not worth the explanation.

I forgot that I could add a file to a response, so I've attached the GHTF guidance document I mentioned.

Remember that MDSAP does not add any requirements. Instead, provides a coordinated framework to audit the requirements that already exist.

First, your external auditors are wrong! Ask them where the requirement is and how they would cite it in a non-conformance report. Such a requirement does not exist.

Sampling records in a quality audit is an interesting problem. There are two approaches.

In a convenience sample, a competent auditor uses judgement to pick samples and "get a feel" for the process. Convenience samples tend to be small, typically 3 to 10 records.

In a statistical sample, the competent auditor determines an upper bound on the error rate. Each record is classified as conforming or nonconforming and the sampling plans use the binomial distribution. The result is a statement such as, "we are 95% confident that the error rate is less than 5%". This approach comes from financial auditing in which the auditor is determining the effectiveness of the financial controls.

There is an MDSAP document that discusses sample sizes, but I can't seem to locate it at the moment. It refers to GHTF/SG4/N30R20:2006 Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers – Part 2: Regulatory Auditing Strategy.

Appendix 1 has two tables that "may be used in determining appropriate statistical sample sizes". One has a confidence of 95% and the other has a confidence of 99%. For example, if you want to be 95% confident that the error rate in the process is less than 5%, then use Table 1 row F. A sample size of 72 with no nonconforming records provides the statement "we are 95% confident that the error rate is less than 5%".

These are the same table used in the QSIT.

There is a technical reason why these tables use the wrong approach, but it is not worth the explanation.

I forgot that I could add a file to a response, so I've attached the GHTF guidance document I mentioned.

Remember that MDSAP does not add any requirements. Instead, provides a coordinated framework to audit the requirements that already exist.

First, your external auditors are wrong! Ask them where the requirement is and how they would cite it in a non-conformance report. Such a requirement does not exist.

Sampling records in a quality audit is an interesting problem. There are two approaches.

In a convenience sample, a competent auditor uses judgement to pick samples and "get a feel" for the process. Convenience samples tend to be small, typically 3 to 10 records.

In a statistical sample, the competent auditor determines an upper bound on the error rate. Each record is classified as conforming or nonconforming and the sampling plans use the binomial distribution. The result is a statement such as, "we are 95% confident that the error rate is less than 5%". This approach comes from financial auditing in which the auditor is determining the effectiveness of the financial controls.

There is an MDSAP document that discusses sample sizes, but I can't seem to locate it at the moment. It refers to GHTF/SG4/N30R20:2006 Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers – Part 2: Regulatory Auditing Strategy.

Appendix 1 has two tables that "may be used in determining appropriate statistical sample sizes". One has a confidence of 95% and the other has a confidence of 99%. For example, if you want to be 95% confident that the error rate in the process is less than 5%, then use Table 1 row F. A sample size of 72 with no nonconforming records provides the statement "we are 95% confident that the error rate is less than 5%".

These are the same table used in the QSIT.

There is a technical reason why these tables use the wrong approach, but it is not worth the explanation.