The independent, third-party audit is an essential component in any executive’s toolkit of sustainable quality and compliance. Such reports can come in all shapes and styles, from the high-level two to three-page summary to a minutely detailed, three hundred page bound monograph. How best to ensure a report that meets your needs?
It all starts with five core considerations:
- Define criticality
- Clarify prioritization
- Avoid paying for filler
- Request a draft
- Substitute language
Define Criticality
What is a “critical” finding or audit observation? A missing signature on a training form? A clinical site’s expired medical license? A lost copy of a production batch record? Depending on the context, each of these can be critical. Thus, early agreement on what is a “critical” finding is an important first step.
Because auditors rely upon records and documents as proof of compliance and controls—or the lack thereof—we can use the same “critical” threshold definition I explain in my workshops on record retention, defensive data integrity, and other aspects of lean compliance: something is critical if the incorrect record, the missing document, blank signature, etc. will directly lead to a high risk or likelihood of patient injury, product failure (including efficacy loss), regulatory or statute noncompliance, or significant financial loss. In other words, it’s easy to find examples of FDA Warning Letters or product liability litigation citing a very similar audit observation. In all such cases, the emphasis should be on “will directly lead to….”
In this manner, if the auditor finds a missing signature on a training record, this observation should immediately take on less significance than if the auditor discovers that a site is missing a certificate of sterility. A questionably sterile product holds far more risk to patient safety, product efficacy, regulatory noncompliance and even significant financial loss (due to product liability lawsuits) than does a missing signature on a training attendance sheet.
Either require the auditor to provide, ahead of time, their non-conformity grading scale or consider negotiating this type of clause into any third-party auditor proposal, statement of work or contract:
“Audit findings shall be deemed critical if the finding could directly lead to, or otherwise reasonably result in, patient injury, product failure, regulatory or statute noncompliance and/or financial loss in excess of [insert an appropriate sum for your organization].”
Clarify Prioritization
While non-conformity level-setting should help minimize the number of critical findings to those that are truly critical to fix, this can still leave an organization at a loss of where to begin. Get a strong head-start by asking the auditor to provide his/her professional recommendations as to resolution priorities.
Although such recommendations will need to be independent of other considerations such as resources at your disposal, longer-term business plans, organizational politics and so on, it still makes sense to get the expert’s independent opinion. Consider negotiating this type of clause into any third-party auditor proposal, statement of work or contract:
“In the report, the Auditor shall provide his/her professional opinion as to the priority, in terms of resolution, for each critical finding or observation.”
Assuming the audit does not uncover widespread critical failures and breakdowns, this priority list can be further divided into those activities that can be accomplished within 90 days or less, and those activities that will likely require a longer time frame. Be aware, however, some auditors prefer to keep such time frame divisions to a more informal level of discussion.
Avoid Paying for Filler
Long-winded explanations, regurgitations of complete sections from regulations—these are just some of the items that can act as “filler” in an audit report to give it more weight than it actually has. I can still remember, more than 15 years ago now, paying nearly $30,000 (USD) for an audit report that was made up of more than 70% of cut-and-paste excerpts and scanned pages from various regulations, guidance documents, and statutes. In other words, I paid over $20,000 for freely available information that I already knew and to which I had ready access.
We never used that consulting company again, and their boilerplate, bound report also weakened my own credibility within our organization.
To avoid this happening to you, encourage the auditor to either skip this type of filler or place it into appendices at the end of the report. Consider asking the auditor to include a typical audit report table of contents as part of the statement of work or proposal. If the table of contents does not include appendices, you run the risk of the filler being interspersed throughout the report.
Thus, add an appendix suggestion into the table of contents, or negotiate for a clause in your agreement such as:
“If lengthy excerpts from regulations, guidance documents, warning letters, and other publicly available items are to be included as part of the audit report, such items will only be referenced in the text of the main audit report and are to be reproduced in appendix format.”
Request a Draft
Some auditors do not like to provide drafts of their report for fear that their integrity will be compromised. I understand that worry as this was my philosophy when I first started conducting mock FDA audits and gap assessments.
Ironically, when I was an auditing client, I was just as adamant about receiving a draft to review prior to the audit report’s finalization. If nothing else, as an executive accountable for the areas that were audited, a preview of the report could give me the time necessary to plan resolutions to the findings and speak intelligently to how I would closeout any observations and gaps.
Both sides of the argument have pros and cons. Over the years, I’ve come to embrace a compromise position that usually uses this type of clause:
“Review of the draft audit report will include correction of specific errors and oversights, as well as suggestions to modify the report’s tone, the examples cited under each observation, substitute language, and other reasonable improvements that do not negatively bias the documented audit observations, conclusions and recommendations.”
In other words, I understand that the audit report may be used in contexts that are not just confined to a typical internal quality audit report. Thus, we need to make sure you (the client) are comfortable with language used, the recommendations, the priorities suggested, and so forth. Correcting errors and misinterpretations, and compromising around tone and framing language doesn’t alter the facts on the ground (e.g., the observations), but it can help avoid inadvertently aggravating issues inside your organization.
Ultimately, because the third-party auditor is in your pay and the audit report is a “work-for-hire” document, you should feel comfortable with the audit report and its implications in your organization. The clause above is one practical approach to giving clients the input they want while allowing me to maintain a high-degree of integrity without a hint of high-handedness.
Substitute Language
Lastly, we need to “close the loop” of the audit report by clarifying our expectation of the auditor him/herself. Because many auditors in the industry tend to be independent, small businesses—often owned and run entirely by one or two people—ensuring that the auditor can meet your timelines, even in the event of illness or other situations, is an important consideration.
One clause that I now add into my own auditing agreements with clients is a clause that comes from the keynote and workshop speaking industry. In these fields, it’s common for a conference to be built around one or two high-profile speakers rather than companies. Thus, most speaking contracts have a substitution clause in them that is easily adaptable to auditing contracts:
“If the Auditor is delayed or cannot appear, Auditor will promptly notify [your organization] to arrange a mutually agreeable change of date, time and/or substitute auditor. Any benefits, deposits, and/or advance reimbursements under this agreement shall be transferred to the substitute auditor, if any. If a change of date, time, or a substitute auditor cannot be mutually agreed upon, this agreement is cancelled.”
Final Thoughts
Suggesting a mock FDA audit or an independent compliance gap analysis is easy. Negotiating the contract and getting a final audit report you can live with can be much more challenging. This article should help you succeed.
If you need expert compliance advice or would like private corporate training on streamlining your quality system, contact Cerulean today.
About the Author
John Avellanet is the Managing Director & Principal of Cerulean Associates LLC. He is the author of Get to Market Now! Turn FDA Compliance into a Competitive Edge in the Era of Personalized Medicine (Logos Press), co-author of Pharmaceutical Regulatory Inspections (Euromed) and Best Practices in Biotechnology Business Development (Logos Press), and the writer of the ComplianceZen.com blog. Reach out to Mr. Avellanet for compliance consulting and auditing help or for an expert speaker – contact Cerulean today.