Our last audit lessons piece came from a contract lab audit with zero observations. Today, we want to pull some very important learnings from an audit that uncovered quite a few gaps, since they tend to be problems we see over and over.
Earlier this year, we ran a four-day quality audit of a manufacturing site, one of several in a larger organization that supplies products to customers under quality agreements. Findings cited ISO 13485:2016, the site’s own procedures, and, for a complaint-handling finding, FDA’s drug CGMP regulations in 21 CFR Part 211.
The result was 11 findings and 3 recommendations, with 4 findings flagged as duplicates. The final report also includes the site’s responses (root causes, corrections, owners, and target dates), and some of the best lessons below come from those. To the site’s credit, several of its root cause analyses looked past individual mistakes to the procedures or setups behind them.
Learn more and get in touch if you need audit support now or in the future. We’re in the midst of 2027 audit planning for many teams right now. Get our free audit planning Excel workbook here.
1. Check that last audit’s fixes are still in place
Repeat audit findings are common across all kinds of sites we assess. Three of the repeat findings here traced to the site’s previous audit.
The issue opened to track the corrective action for a supplier management finding was closed with no action, and the risk still existed (more on that in lesson 4).
A pest control records finding came back again because, per the site’s response, the earlier correction targeted gaps in the procedure and wasn’t implemented to address the documentation errors we found before. Also, a calibration procedure still allowed the use of a deviation that an earlier corrective action was supposed to remove.
The site’s response said that action had been assigned incorrectly and that it chose to define requirements for using a deviation instead. But that change wasn’t communicated to the auditor, though the action and updated procedure were sent and accepted. No unapproved deviations were found, and our report considered this one to have a low probability of adversely affecting product quality.
The lesson here is that a closed record only proves someone closed it. Before your next audit, check each prior finding against the current procedure revision, recent records, and the floor. If you change course on a corrective action, write the reasoning into the CAPA record. If you close a tracking item with no action, document why.
2. If a procedure says a meeting happens, it should actually happen
This is a nitpicky procedure-versus-reality issue we see from time to time. The site’s CAPA procedure required quarterly CAPA Review Board meetings. It had been in effect for about over a year at the time of the audit, and the board hadn’t met once. The team said CAPAs had been created so rarely that, in most cases, none were open to report on, which is what they felt justified a meeting.
A second finding involved a monthly Quality Council. The management review procedure referenced the meetings and listed topics for them, but no procedure defined the council’s purpose, membership, decision-making authority, documentation, or required outputs.
The team said the council was meant to make all associates aware of the previous month’s issues, not to report on the status of activities, but that the procedure didn’t clearly describe that, so it wasn’t documented.
This isn’t the most egregious issue in the world, but it’s a good reminder that auditors read a procedure and then ask for the records it promises. A board with nothing to review can still meet and record that, or the procedure can say what happens when nothing is open.
For any recurring meeting in your procedures, write down what it’s for and what it should produce, and check that against what happens in the room.
This is one of those seemingly minor things that might not cause a noticeable problem, but leaves investigators wondering what else your procedures say you should do that you might not be following through on.
3. Contractors who touch your records need your standards
This was an interesting one that manifests in a lot of different ways. In this case, external pest control technicians filled out work orders, which site employees then reviewed and approved.
Multiple forms were incomplete or blank, had missing information with no reason given, or showed scribbling, cross-outs, and write-overs. The report found the site’s training for these providers inadequate, and its review and approval not enough to make sure the records met GDP requirements.
Separately, a lab scale was in active use without a calibration status label or any other indication that it was approved for use. The third-party calibration provider hadn’t labeled it, and the site hadn’t received the certificate, so it couldn’t show the scale was in calibration. The site traced this to having no defined requirements for external calibration contractors on labeling, certification timelines, and traceability.
A contractor filling in a GMP record is creating your record! Train them on your GDP expectations and make sure whoever approves the record checks it. For calibration providers, we always recommend including labeling and certificate turnaround times directly and clearly in your requirements, and not returning equipment for use until you have evidence that it actually passed.
4. A contract clause won’t tell you when a supplier changes
The site’s quality agreements with customers (we reviewed more than one) require it to notify a customer when a supplier change (like a manufacturing location or formulation) could directly or potentially affect the customer’s product.
At the time of the audit, though, the site couldn’t demonstrate that it was actually overseeing supplier change notifications or the customer notifications that should follow.
Procurement said that the purchase order terms covered this. Those terms bar substitutions or changes to the order, or to its specifications and drawings, without the company’s prior written authority. The site’s corrective action is a documented process to verify that the received material was produced at approved locations.
A clause like that tells a supplier what not to do. But it won’t tell you when a supplier does it anyway. If you’ve promised customers notice of supplier changes, make sure you’re carrying that promise into your supplier agreements, checking at receipt, and deciding who passes a supplier’s notice to the customer (and how fast). We see suppliers get in trouble with the regulator and their own customers here.
5. When a complaint’s conclusion changes, reopen the scope
A customer complaint raised a concern about specific labeling requirements for some of the site’s products. The investigation concluded that no correction or corrective action was needed based on lab testing that indicated the products didn’t contain a particular material. Site management said that information later received from corporate confirmed a component supplied with the product did contain that material, and the site sent the revised conclusion to the original complainant.