Regulatory Open Forum

It is correct that during the inspection the FDA investigator is not allowed to read the internal audit report and the text of management review (all related to 21CFR 820)?

I heard that they are still allowed to verify that these activities and records were done and exists, but not allowed to read the content of these documents. What is true?

Good morning,

FDA is allowed to review your internal audit log demonstrating that the internal audits were performed (area audited, date, auditor, date report submitted to management), but they may NOT review the actual internal audit reports. The rationale for this is that concern about what FDA might read could result in less than fully honest and accurate internal audit reports, thus defeating the entire purpose of internal audits. 

I hope this is helpful,

It is correct that during the inspection the FDA investigator is not allowed to read the internal audit report and the text of management review (all related to 21CFR 820)?

I heard that they are still allowed to verify that these activities and records were done and exists, but not allowed to read the content of these documents. What is true?

As "a matter of policy", FDA has voluntarily elected not to review internal audit or management review reports.  But FDA may still request evidence that these were done.  While FDA might reach such conclusion based on looking at other quality data, it ultimately can request a more formal certification of not just completion of the audits and management reviews, but that also that any required corrective action has been undertaken.

When my firm does internal audits or management reviews for our clients, we always automatically give a Certificate of Completion with our reports. That Certificate is then automatically given to the FDA inspectors thereby making that aspect of their inspection succinct and brief.

However, don't be fooled: FDA has reminded us that it may seek production of these reports in litigation under applicable procedural rules or by inspection warrant where access to the records is authorized by statute.

Good morning,

FDA is allowed to review your internal audit log demonstrating that the internal audits were performed (area audited, date, auditor, date report submitted to management), but they may NOT review the actual internal audit reports. The rationale for this is that concern about what FDA might read could result in less than fully honest and accurate internal audit reports, thus defeating the entire purpose of internal audits. 

I hope this is helpful,

It is correct that during the inspection the FDA investigator is not allowed to read the internal audit report and the text of management review (all related to 21CFR 820)?

I heard that they are still allowed to verify that these activities and records were done and exists, but not allowed to read the content of these documents. What is true?

And note that this changes under the QMSR:

(Comment 55) FDA received numerous comments regarding the lack of an exception for management review, quality audits, and supplier audit reports, which formerly existed in the QS regulation, at § 820.180(c). Most such comments requested that FDA maintain the exceptions set forth in § 820.180(c), some suggested that FDA adopt specific language to do so, and the remainder requested that FDA clarify whether such records are exempted from inspector access. One commenter in particular noted that the current quality system inspection technique (QSIT) guide also states that management review, internal audit, and supplier audit records are exempted from inspection. Several comments expressed concern that the exception was necessary to ensure manufacturers' audit and management review reports continue to be complete and/or useful.

(Response) FDA disagrees that it should maintain the exceptions set forth at § 820.180(c). One of the primary purposes for this rulemaking effort is to move as closely as possible toward global harmonization and alignment. From a global perspective, the exceptions the comment references are not available to manufacturers being inspected by other regulators or being audited by other entities ( e.g., MDSAP auditing organizations), and thus, such manufacturers will not be additionally burdened by making these records available. Similarly, FDA does not consider it to be a large burden to the manufacturers who may have taken advantage of the exceptions to make these records available, as such records are maintained in the regular course of business and should be readily available. Additionally, FDA notes that its investigators have already had access to data used to inform management reviews, such as nonconformances and complaints, and any corrective actions resulting from internal and supplier audits.

FDA emphasizes that robust management review, as well as internal and supplier audit programs, are fundamental to the culture of quality discussed previously in this rulemaking and which FDA expects firms to embrace. Further, FDA intends to modify its inspectional processes consistent with this rulemaking, and does not consider this rulemaking to be the appropriate vehicle to describe any future implementation activities, including inspectional processes.

As "a matter of policy", FDA has voluntarily elected not to review internal audit or management review reports.  But FDA may still request evidence that these were done.  While FDA might reach such conclusion based on looking at other quality data, it ultimately can request a more formal certification of not just completion of the audits and management reviews, but that also that any required corrective action has been undertaken.

When my firm does internal audits or management reviews for our clients, we always automatically give a Certificate of Completion with our reports. That Certificate is then automatically given to the FDA inspectors thereby making that aspect of their inspection succinct and brief.

However, don't be fooled: FDA has reminded us that it may seek production of these reports in litigation under applicable procedural rules or by inspection warrant where access to the records is authorized by statute.

Good morning,

FDA is allowed to review your internal audit log demonstrating that the internal audits were performed (area audited, date, auditor, date report submitted to management), but they may NOT review the actual internal audit reports. The rationale for this is that concern about what FDA might read could result in less than fully honest and accurate internal audit reports, thus defeating the entire purpose of internal audits. 

I hope this is helpful,

It is correct that during the inspection the FDA investigator is not allowed to read the internal audit report and the text of management review (all related to 21CFR 820)?

I heard that they are still allowed to verify that these activities and records were done and exists, but not allowed to read the content of these documents. What is true?

And note that this changes under the QMSR:

(Comment 55) FDA received numerous comments regarding the lack of an exception for management review, quality audits, and supplier audit reports, which formerly existed in the QS regulation, at § 820.180(c). Most such comments requested that FDA maintain the exceptions set forth in § 820.180(c), some suggested that FDA adopt specific language to do so, and the remainder requested that FDA clarify whether such records are exempted from inspector access. One commenter in particular noted that the current quality system inspection technique (QSIT) guide also states that management review, internal audit, and supplier audit records are exempted from inspection. Several comments expressed concern that the exception was necessary to ensure manufacturers' audit and management review reports continue to be complete and/or useful.

(Response) FDA disagrees that it should maintain the exceptions set forth at § 820.180(c). One of the primary purposes for this rulemaking effort is to move as closely as possible toward global harmonization and alignment. From a global perspective, the exceptions the comment references are not available to manufacturers being inspected by other regulators or being audited by other entities ( e.g., MDSAP auditing organizations), and thus, such manufacturers will not be additionally burdened by making these records available. Similarly, FDA does not consider it to be a large burden to the manufacturers who may have taken advantage of the exceptions to make these records available, as such records are maintained in the regular course of business and should be readily available. Additionally, FDA notes that its investigators have already had access to data used to inform management reviews, such as nonconformances and complaints, and any corrective actions resulting from internal and supplier audits.

FDA emphasizes that robust management review, as well as internal and supplier audit programs, are fundamental to the culture of quality discussed previously in this rulemaking and which FDA expects firms to embrace. Further, FDA intends to modify its inspectional processes consistent with this rulemaking, and does not consider this rulemaking to be the appropriate vehicle to describe any future implementation activities, including inspectional processes.

As "a matter of policy", FDA has voluntarily elected not to review internal audit or management review reports.  But FDA may still request evidence that these were done.  While FDA might reach such conclusion based on looking at other quality data, it ultimately can request a more formal certification of not just completion of the audits and management reviews, but that also that any required corrective action has been undertaken.

When my firm does internal audits or management reviews for our clients, we always automatically give a Certificate of Completion with our reports. That Certificate is then automatically given to the FDA inspectors thereby making that aspect of their inspection succinct and brief.

However, don't be fooled: FDA has reminded us that it may seek production of these reports in litigation under applicable procedural rules or by inspection warrant where access to the records is authorized by statute.

Good morning,

FDA is allowed to review your internal audit log demonstrating that the internal audits were performed (area audited, date, auditor, date report submitted to management), but they may NOT review the actual internal audit reports. The rationale for this is that concern about what FDA might read could result in less than fully honest and accurate internal audit reports, thus defeating the entire purpose of internal audits. 

I hope this is helpful,

It is correct that during the inspection the FDA investigator is not allowed to read the internal audit report and the text of management review (all related to 21CFR 820)?

I heard that they are still allowed to verify that these activities and records were done and exists, but not allowed to read the content of these documents. What is true?

And note that this changes under the QMSR:

(Comment 55) FDA received numerous comments regarding the lack of an exception for management review, quality audits, and supplier audit reports, which formerly existed in the QS regulation, at § 820.180(c). Most such comments requested that FDA maintain the exceptions set forth in § 820.180(c), some suggested that FDA adopt specific language to do so, and the remainder requested that FDA clarify whether such records are exempted from inspector access. One commenter in particular noted that the current quality system inspection technique (QSIT) guide also states that management review, internal audit, and supplier audit records are exempted from inspection. Several comments expressed concern that the exception was necessary to ensure manufacturers' audit and management review reports continue to be complete and/or useful.

(Response) FDA disagrees that it should maintain the exceptions set forth at § 820.180(c). One of the primary purposes for this rulemaking effort is to move as closely as possible toward global harmonization and alignment. From a global perspective, the exceptions the comment references are not available to manufacturers being inspected by other regulators or being audited by other entities ( e.g., MDSAP auditing organizations), and thus, such manufacturers will not be additionally burdened by making these records available. Similarly, FDA does not consider it to be a large burden to the manufacturers who may have taken advantage of the exceptions to make these records available, as such records are maintained in the regular course of business and should be readily available. Additionally, FDA notes that its investigators have already had access to data used to inform management reviews, such as nonconformances and complaints, and any corrective actions resulting from internal and supplier audits.

FDA emphasizes that robust management review, as well as internal and supplier audit programs, are fundamental to the culture of quality discussed previously in this rulemaking and which FDA expects firms to embrace. Further, FDA intends to modify its inspectional processes consistent with this rulemaking, and does not consider this rulemaking to be the appropriate vehicle to describe any future implementation activities, including inspectional processes.

As "a matter of policy", FDA has voluntarily elected not to review internal audit or management review reports.  But FDA may still request evidence that these were done.  While FDA might reach such conclusion based on looking at other quality data, it ultimately can request a more formal certification of not just completion of the audits and management reviews, but that also that any required corrective action has been undertaken.

When my firm does internal audits or management reviews for our clients, we always automatically give a Certificate of Completion with our reports. That Certificate is then automatically given to the FDA inspectors thereby making that aspect of their inspection succinct and brief.

However, don't be fooled: FDA has reminded us that it may seek production of these reports in litigation under applicable procedural rules or by inspection warrant where access to the records is authorized by statute.

Good morning,

FDA is allowed to review your internal audit log demonstrating that the internal audits were performed (area audited, date, auditor, date report submitted to management), but they may NOT review the actual internal audit reports. The rationale for this is that concern about what FDA might read could result in less than fully honest and accurate internal audit reports, thus defeating the entire purpose of internal audits. 

I hope this is helpful,

It is correct that during the inspection the FDA investigator is not allowed to read the internal audit report and the text of management review (all related to 21CFR 820)?

I heard that they are still allowed to verify that these activities and records were done and exists, but not allowed to read the content of these documents. What is true?

It is correct that during the inspection the FDA investigator is not allowed to read the internal audit report and the text of management review (all related to 21CFR 820)?

I heard that they are still allowed to verify that these activities and records were done and exists, but not allowed to read the content of these documents. What is true?