The Sterilization Auditor Who Owns the Sterilization Process
NovaThera (380 employees) contract-manufactures Class II electrosurgical generators and performs in-house EO sterilization plus sterile barrier packaging. The annual internal audit programme covers 14 processes; sterilization and sterile packaging are audited every year. Six weeks before a notified body surveillance audit, the quality manager realizes the sterilization process audit was never scheduled. Only one employee, Dana, holds both an EO sterilization technical qualification and an internal auditor certificate - and Dana owns the sterilization validation, bioburden and endotoxin trending, the revalidation schedule, and the EO residual limits justification. A contract auditor quoted USD 9,000 for a two-day sterilization audit; the remaining departmental audit budget is USD 4,000. The quality manager proposes that Dana audit the process and that the QA manager review and sign the report, "so it is independent."
1. Assess the quality manager's proposal. Is it acceptable, and what is the governing principle?
Read the worked answer
No - independence is compromised in fact, not just on paper.
- Requirement: ISO 13485:2016 clause 8.2.4 requires internal audits to be carried out by personnel who do not audit their own work; ISO 19011:2018 requires the audit team to be objective and impartial. The principle is self-review must not be the only control, not someone else signs the report.
- Application: Dana designed, validated and owns every control she would be evaluating - validation reports, bioburden trending, revalidation intervals, residual-limit justification. She would be judging her own outputs. That is precisely the situation the clause targets.
- The fix does not work: the QA manager's signature is report review, not independent evidence gathering. Unless the QA manager also holds EO sterilization competence, the review cannot test the adequacy of sterilization controls either - it creates a documented appearance of independence without the substance.
- Aggravating factors: sterility assurance is a direct patient-harm process; a notified body is about to look at the same programme; and the conflict is being knowingly created by management. That converts a technical issue into an ethics/competence issue.
- Budget is not a criterion: a USD 5,000 shortfall is not a defensible justification for a compromised audit. The correct action is to escalate the resource decision to top management, not to downgrade independence.
2. Identify at least three viable alternatives, rank them, and explain what each preserves and what it costs.
Read the worked answer
Ranked by strength of evidence produced:
- Independent auditor from a corporate/sister-site audit team (peer audit). Preserves full independence and keeps manufacturing knowledge in-house. Cost: internal scheduling and travel, reciprocal obligations; must confirm the peer auditor is qualified for EO sterilization, not just for auditing. Verifies the auditor is outside NovaThera's own reporting line.
- Contract auditor scoped down to the sterilization process only (one day instead of two, records pre-submitted and reviewed off-site). Preserves independence and technical depth. Cost: still exceeds the remaining budget - this is a decision for top management to fund, and the overrun should be recorded, not absorbed by weakening the audit.
- Independent lead auditor plus Dana as a technical expert (not as an auditor). Preserves independence of judgement while capturing technical knowledge. Cost: requires explicit role separation (Dana answers questions and explains records; she does not select samples, determine conformance, write findings, or sign the report) and a competent lead auditor who can challenge her.
- Dana audits, with a documented risk acceptance and a compensating independent review of the resulting evidence by a qualified outsider. Weakest option: it does not remove self-review, only layers review on top of it. Acceptable only as a stop-gap with top-management sign-off, rationale recorded in the audit programme, and a corrective action to qualify a second auditor before the next cycle.
What to avoid: silently letting Dana audit, and letting the report's existence stand in for the audit's independence.
3. If Dana participates alongside an independent lead auditor, what must be true for the audit to be defensible, and how should this be documented?
Read the worked answer
Conditions for defensibility:
- Role defined in writing before the audit: Dana is recorded in the audit plan as a technical expert, with the scope of her contribution stated. She does not determine conformance, classify findings, or approve the report.
- The lead auditor is genuinely competent to lead a sterilization audit, or the team collectively holds the technical competence - ISO 19011:2018 evaluates competence of the team, so a competent lead auditor plus a technical expert is a legitimate structure; two people who are each half-competent is not.
- Sampling and evidence selection are led by the independent auditor. If Dana chooses which sterilization records are examined, independence is lost regardless of titles.
- No unilateral access to Dana's conclusions before evidence is reviewed - interview her as a process owner with open questions and corroborate her statements against records, the same as any other interviewee.
- A documented conflict-of-interest declaration from Dana, and a note that the report was reviewed by someone independent of the sterilization function, not by Dana.
- Programme-level follow-up: a recorded action to qualify an independent sterilization auditor (training and co-audit) so the same workaround is not required next year.
Documentation: audit plan (roles), audit report (team composition and role), conflict declaration, and the audit programme file showing how the independence risk was managed. If the notified body asks who audited sterilization, the honest answer with a documented rationale is far stronger than an undocumented single-auditor claim.