Planning a Constrained Surveillance Audit With a Prior Major NC
You are lead auditor for a three-day surveillance audit of a contract manufacturer with two buildings. Building A makes Class II surgical staplers. Building B makes single-use biopsy needles and performs in-house ethylene oxide sterilization. The previous audit issued one major nonconformity in complaint handling and one minor nonconformity in equipment calibration. The draft audit plan allocates Day 1 to opening and building A production, Day 2 to building B production and sterilization, and Day 3 to document review and closing. The client's quality manual excludes design and development, but the certificate scope statement includes design transfer. The team includes one auditor with surgical stapler experience and one technical expert in microbiology; no team member has reviewed sterilization validation records before. The client has 420 employees and 38 open CAPAs. The program manager asks you to finalize the plan and sampling approach.
1. Critique the draft audit plan and identify the preparation gaps.
Read the worked answer
The plan is time-constrained and front-loads production tours while leaving document review to Day 3, when it is too late to follow leads. A three-day audit for 420 employees, two buildings, in-house sterilization, 38 open CAPAs, and prior nonconformities requires risk-based prioritization. The previous major complaint-handling NC must be followed up, and the minor calibration NC should be sampled. Sterilization validation should be reviewed before the site visit so the auditor knows what to test. The technical expert can advise on microbiology, but the audit team still needs an auditor competent to evaluate sterilization validation and process control; a technical expert does not replace auditor competence. The scope conflict must be resolved before the audit: if the certificate includes design transfer, excluding design and development may be inconsistent. Clarify the scope, the applicable regulatory requirements, and the audit criteria with the client and certification body.
2. How would you redesign the audit plan and justify the changes?
Read the worked answer
Use a process-based plan with team meetings at the start and end of each day. Day 1: opening, management and QMS processes, complaint handling and CAPA follow-up, and a targeted walkthrough in building A. Day 2: building B production, sterilization validation and change control, calibration, and release. Day 3: complete record sampling, follow up leads, team review, and closing. Allocate explicit time for the prior major NC and for the 38 CAPAs, sampling by risk rather than evenly. Build in time for the technical expert to review sterilization records alongside the auditor. The justification is that high-risk and previously nonconforming processes get more coverage, and document review is used to prepare and follow leads, not as an end-of-audit formality. If the time is still insufficient, propose an extension or a separate sterilization-focused audit rather than silently reducing coverage.
3. What sampling approach would you specify for the 38 open CAPAs and the two buildings?
Read the worked answer
Sample CAPAs by risk and status: all CAPAs linked to the prior major NC, all overdue CAPAs, CAPAs involving product release or sterilization, and a random selection of the remainder to test the process. For the buildings, sample across shifts, product families, and process stages rather than only completed records. In building B, include at least one sterilization load before and after any significant change, plus calibration records for critical instruments. Document the rationale so the sample is defensible. The sample should be large enough to test whether the process is effective, not just whether records exist. If the sample reveals a systemic issue, follow the trail and adjust the plan.