Designing a risk-based audit programme for a multi-site sterilization provider
A certification body's audit programme covers MediChain, a sterile-services provider with six sites in two countries and 1,400 staff. The programme is: annual surveillance at head office only, one auditor-day per site, and recertification every three years with a two-day head-office audit. In the last cycle major nonconformities were raised at site 3 (backup generator load testing not performed for 18 months) and site 5 (no monitoring of a single-source sterilization consumables supplier); both were closed on desktop review. Site 6 was acquired four months ago, runs a different sterilization technology, and has not been added to the scope. The CB proposes moving to 100% remote surveillance next cycle to cut travel costs. Resourcing is tight: the only auditor on the panel with sterilization expertise is a former MediChain operations manager who left eight months ago, and that person is booked on the MediChain audit.
1. Identify the weaknesses in the programme design and the risk-based adjustments you would make.
Read the worked answer
Three design problems are visible without any new evidence.
- Head-office-only surveillance cannot see what fails. Both last-cycle majors were site-level - equipment testing and supplier monitoring - and both were closed on desktop review, meaning the CB never verified implementation where the work actually happens. Site sampling must be risk-based and must include sites with prior nonconformities plus the largest and smallest sites, with the rationale recorded.
- The programme does not react to change. Site 6 was acquired four months ago and uses a different sterilization technology. The CB must review the programme whenever client changes affect it; a new technology on a new site is about as clear a trigger as exists. Either bring it into scope with a reassessed competence and duration, or record a justified decision agreed with the client.
- One auditor-day per site is an assumption, not a calculation. Duration should follow processes, shift patterns, interfaces and findings. Sterilization often runs around the clock, so a day shift only audit samples the easiest half of the system.
The next cycle should also re-verify the two prior majors on site rather than on paper, because closing an equipment-testing failure at a desk is exactly where a certificate goes wrong.
2. What do you do about the former MediChain operations manager being the only auditor with the needed expertise?
Read the worked answer
An ex-employee with eight months' separation, who held operational responsibility for the sites now being audited, presents a familiarity and self-interest threat of the highest order. "The only auditor with the expertise" is a resourcing failure, not a justification.
There are several legitimate routes to competence: a technical expert working under a lead auditor (a technical expert does not audit and must still be screened, but the arrangement changes the analysis); a contracted auditor with the technology background; a partner resource; or deferring the audit until competent independent resource exists. The auditor must declare the relationship in writing. The CB's impartiality function must document the analysis and outcome, and the client's acceptance of the auditor does not cure a self-review or familiarity threat.
If no independent competent auditor can be found, the honest options are to recruit or to decline the work - not to send the former manager back in. The programme manager should also check whether this person audited MediChain before, and whether other clients in the same market raise similar threats.
3. How do you decide which activities can be delivered remotely, and what must be justified to an accreditation assessor?
Read the worked answer
Remote delivery is legitimate for parts of a BCMS, but not all of it. Decide activity by activity rather than programme-wide.
- Suitable for remote: document and record review, interviews, management review evidence, BIA outputs, observation of a desktop simulation.
- Requires on site: witnessing a generator load test, walking a site to check physical protection and environmental controls, observing shift handover, and verifying that a newly acquired site actually operates as its documents claim.
Set the practical conditions in advance: connectivity, access to records during the session, camera use, confidentiality of recordings, and who is present. Record in the report which activities were remote and on what justification.
Cost is not an audit criterion. The CB may propose a hybrid programme, but it must be able to defend the resulting assurance level to an accreditation assessor - "we saved travel" is not a defensible rationale, whereas "records review and interviews remote; equipment testing and site walkdown on site, sampled by risk" is.