The Auditor Who Knew the Product Too Well
Your audit team of four is assigned to audit a medical-device sterilization supplier. One auditor, Priya, spent six years as the quality manager at this exact facility and left 18 months ago. She is the only team member with ISO 13485 and sterilization-process expertise, and the audit window is fixed by the customer's regulatory deadline. The audit program manager assigns her to lead the process-validation portion. During planning, Priya drafts the audit checklist from memory of the facility's procedures and proposes to skip the document review of the validation master plan because 'I wrote it and I know what's in it.' She also mentions she is still in contact with two former colleagues there. The client has not been informed of her prior employment.
1. Identify the independence and competence issues and recommend how the audit program manager should resolve them.
Read the worked answer
Independence issues:
- Priya audited her own former work product (she wrote the VMP). Auditing one's own work is a fundamental independence breach.
- An 18-month gap is generally too short for the 'cooling-off' expectation for a quality-management role; many programs require 2–3 years, and the customer/regulator may impose its own rule.
- Ongoing personal contacts at the facility create a familiarity/threat-to-objectivity risk.
- The client was not informed - a transparency failure that can undermine the audit's credibility even if the finding is technically sound.
Competence issues:
- She is the only qualified person, which creates a genuine resource conflict: removing her entirely may leave the team without the expertise to audit process validation competently.
Recommended resolution:
- Disclose the prior employment to the client and obtain documented acceptance or objection.
- Reassign the lead role on process validation to another team member; Priya may serve in an advisory/technical-expert capacity without audit decision authority, or be removed entirely if the client objects.
- Require independent verification - the checklist and conclusions must be built from the actual documents and objective evidence, not memory.
- Address the deadline by escalating the resource gap to the program manager: either extend the window, borrow a qualified auditor, or formally document the residual risk of a reduced-scope audit. Do not silently accept the conflict to hit the date.
2. Priya says skipping the VMP document review is efficient because she wrote it. How should the program manager respond, and what does this reveal about audit planning?
Read the worked answer
Response: The document review is not optional. Priya's memory is (a) 18 months stale, (b) potentially wrong, and (c) not audit evidence. Auditors must verify against current, objective evidence - the document as it exists now, with its current revision and change history. Skipping it would mean the audit conclusion rests on an auditor's recollection, which is indefensible if challenged.
Moreover, the VMP may have been revised since she left; changes she did not make are exactly what an audit should examine. Her familiarity is a risk to thoroughness, not a shortcut.
What this reveals about planning:
- Audit planning must be evidence-driven, not expert-memory-driven. Checklists should be derived from criteria (standards, procedures, prior findings), then validated against current documents.
- Prior knowledge is valuable for hypothesis generation - where to look, what to probe - but hypotheses must be tested with evidence.
- The plan should include a document-review step with a defined output so it cannot be informally waived.
- The program manager should treat 'I already know' as a red flag in planning review, particularly for auditors with prior employment at the auditee.