Internal Control Checklist

4       Quality Management System
4.1       General requirements
4.1 820.5	Is the quality management system documented, implemented and maintained?	Are processes needed for the quality management system identified and established (process map)? Is the sequence and interaction between these processes determined (process map)? Are criteria and methods for the operation and control of quality system processes established (operational procedures)? Are required resources available? Are quality system processes monitored and measured (internal audit, customer feedback, manufacturing process performance, etc.)?	Y
4.1	Are outsourced processes adequately controlled?	How are outsourced processes controlled? Are outputs of outsourced processes verified? Are subcontractors and suppliers required to operate and maintain quality management systems (ISO 9001, for example)?
4.2       Documentation requirements
4.2.1    General
4.2.1 820.20(e)	Are the following types of documents established, maintained and controlled: § quality policy and quality objectives; § quality manual; § operational procedures; § device specifications including drawings, composition, formulation, components, software etc. (Device Master Record); § production process specifications including equipment, production methods and procedures, operator (work) instructions, production environment specifications, etc. (Device Master Record); § quality assurance procedures and specifications including control plans, inspection equipment and procedures, acceptance criteria, etc. (Device Master Record); § packaging and labeling specifications, including methods and processes used (Device Master Record); § installation, maintenance and servicing procedures and methods (Device Master Record); § other documents needed to ensure the effective planning and operation of the quality system; and § records (ref to ISO 13485 4.2.4)?	Are quality policy and quality objectives documented? Where? Is there a quality manual? Operational procedures? Are drawings, specifications, work instructions, work orders, control plans, etc., issued and maintained as controlled documents (as required in 4.2.3)? Are electronic documents (computer files) backed up?	Y
4.2.2    Sales Process Orders
4.2.2 820.20(e)	Does the Sales Orders   include: § the scope of the quality management system and exclusions, § operational procedures or references to them, § description of the interaction between the processes of the quality system, and § outline of the structure of the quality system documentation?	Is the sales order addressing all relevant requirements? Are exclusions from Section 7, Product Realization, documented in the quality manual (if any)? Are operational procedures included or referenced in the quality manual? How is the interaction between the processes of the quality system documented (process map, flowcharts, etc.)?  How is the structure of the quality system documentation outlined in the manual?	Y
4.2.3    Control of documents
4.2.3 820.40(a)	Is there a written procedure defining the controls needed to § review and approve documents prior to issue, § review, update and re-approved documents, § identify changes and current revisions of documents, § make relevant and current documents available at points of use, § ensure that documents are legible and identifiable, § identify and control the distribution of documents of external origin, and § identify retained obsolete documents and prevent their unintended use? Is the procedure fully implemented?	Is there a written procedure for control of documents? Are controlled documents reviewed and approved? How is the approval evidenced (signature)? Is there a process for reviewing, updating and re-approving documents? Are documents identified with their revision level? How are changes identified (change brief, highlighted, etc.?) What measures are implemented to ensure that relevant and current documents are available at points of use (distribution lists, current master lists, etc.)? Are documents uniquely identified (unique title and /or code-number) and are they legible? Is there a process for receiving, reviewing, approving (for use) and distributing documents of external origin (form customers, regulators, suppliers, etc.)  When obsolete documents are retained, is it for a specific, stated reason? Are obsolete documents clearly marked to distinguish them from current revisions? What other measures are implemented to prevent unintended use of obsolete documents?	Y
4.2.3	Is the period for retention of obsolete controlled documents defined?	Is a retention period defined for each type of controlled documents? How is this period determined? Is the retention period at least equal to the lifetime of the device? Is it coordinated with the retention period for corresponding records? Are regulatory requirements considered?
4.2.3 820.40(b)	Are document changes reviewed and approved by the same function that performed the original review and approval (unless specifically designated otherwise)? Are change records maintained, including description of the change, identification of the affected documents, approval signatures and date, and when the change becomes effective?	Is there a clearly stated requirement that changes to documents must be reviewed and approved by the same function that issued the original document, or by another, explicitly designated function? Is it implemented? Are changes in documents (mostly product and process specifications) backed by design change and/or process change records, such as engineering change notices? How is it defined/documented when document changes become effective?
4.2.4    Control of Records
4.2.4	Is there a documented procedure for the identification, storage, protection, retrieval, retention, and disposition of records?	Are there documented instructions how to identify, organize, store, protect, and retrieve records?  Are storage locations for records defined?	Y
4.2.4 820.180(b)	Are retention periods for records defined? Are records retained for at least the period of time equivalent to the expected life of the device, and no less than 2 years?	Is a retention period defined for each type of record? How is this period determined? Is the retention period at least two years or equivalent to the lifetime of the device, whichever is greater? Are regulatory requirements considered?	Y
4.2.4 820.180	Are records organized and maintained to ensure that they remain legible, readily identifiable and retrievable, and to prevent deterioration and loss? Are records accessible to the regulatory inspections? Are electronic records backed up?	Are records stored in dry, clean locations to minimize deterioration? Is there a system for organizing the records? Are boxes, drawers, binders holding records properly identified? Are records easily retrievable (test by asking for retrieval of specific records)? Are records kept in a location that is accessible to regulatory inspections? Are electronic records backed up? Are there specific schedules, instructions, etc. for backing up data? Where are the back-up media (tapes, disks, etc.) kept?	Y
4.2.4 820.181	For each type of device, is there a Device Master Record (DMR) including, or referring to appropriate device specifications, production process specifications, quality assurance procedures, packaging and labeling specifications, and installation, maintenance and servicing procedures and methods?	How is the DMR organized? Is it a file containing the actual specifications documents, or is it a list referring to these documents and their locations? Is the DMR complete, e.g., includes all required categories of documents? Who decides, and how, which documents are included in the DMR? Are all documents included in the DMR correctly identified, reviewed, approved and otherwise controlled? Are the DMR documents the same (and the same revisions) as those used in production?	Y
4.2.4 820.184	Are Device History Records (DHR) maintained for each manufactured batch, lot or unit? (Refer also to ISO 13485 Clause 7.5.1 and 820.184)	Are DHR records properly identified to specific batches, lots or units; and are the records easily retrievable? (For other questions refer to 7.5.1)	Y
4.2.4 820.186	Are Quality System Records (QSR) maintained, including current and obsolete quality system manuals and procedures, and records of quality system activities such as management reviews, corrective and preventive actions, internal audits, etc.?	How is it determined and documented what quality system records are maintained (in QMS Manual and lists of procedures and quality forms, and in operational procedures and work instructions)? Are retention periods specified for obsolete quality system documentation and for quality system records?	Y
4.2.4	Are sufficient records maintained to provide evidence of conformity and effectiveness of the quality management system?	Is there a list (or other documented specification) of quality system records that are maintained by the company? Are the records sufficient to demonstrate product and process conformity, and the conformity and effectiveness of the quality management system and its implementation?	Y
5       Management Responsibility
5.1       Management Commitment
5.1	Is the top management § communicating to the organization the importance of meeting customer and other applicable requirements, § establishing the quality policy, § establishing quality objectives, § conducting management reviews, and § ensuring availability of resources?	How is importance of meeting customer and other requirements communicated? Do employees understand the consequences of failing to meet requirements? Is there a quality policy? Are quality objectives defined? Are management reviews being conducted regularly? Are adequate resources necessary for the quality system provided?	Y
5.2       Customer Focus
5.2	Is the top management ensuring that customer requirements are determined and are met?	What measures are implemented to ensure that customer requirements are determined and met (processes, procedures, training, monitoring, auditing, etc.)?	Y
5.3       Quality Policy
5.3 820.20(a)	Is there a documented quality policy; and § Is it appropriate to the purpose of the organization? § Does it include a commitment to comply with requirements and maintain the effectiveness of the quality management system? § Does it provide a framework for establishing the quality objectives? § Is it communicated and understood throughout the organization? § Is it periodically reviewed for continuing suitability?	Is the quality policy appropriate (relevant to the types of products, type of market, customer expectations, etc.)? Does it include explicit commitment to comply with requirements and maintain (or improve) the effectiveness of the quality system? Is it related to quality objectives? Would achievement of the quality objectives bring the company closer to achieving its overall quality policy? Do employees know the meaning of the quality policy and understand how they can contribute to achieving the policy? Is the quality policy periodically reviewed by management reviews? Has the policy ever been modified since it was initially formulated?	Y
Taken from ISO demo