Keywords

General Concepts

Definition and Purpose

An audit can be defined as a documented, systematic evaluation to determine whether approved policies or standard operating procedures have been properly implemented and are being followed [1, 2].

Audits represent one of the principal activities of the quality management program. They are conducted to establish whether the program is operating effectively and to identify trends and recurring problems in all aspects of facility operations. Of course, an audit can also demonstrate strengths.

A common mistake is to see the audit, particularly external audits, as the goal of the quality system. The idea – “I have just passed the JACIE audit so I can relax until the next one” – is a misunderstanding of what audits are for.

Scope

The scope of the audit can range from simple to complete. It can examine a particular process, the quality system itself (quality audits), or the whole program. The scope must be described in detail in the audit plan. Audits and the audit plan are part of the quality management system. Depending on the organization of internal audits in a center, the unit can be audited within a single (and comprehensive) internal audit or there can be different audits for different topics.

Types of Audits

Internal, third party, and external audits [3]:

  • Internal audits are performed by an individual who works in the unit but who is not solely responsible for the audited activities (see the job requirements of an internal auditor later in this chapter).

  • Third-party audits of vendors or suppliers may be performed to check that the provider has performed the service or provided the product according to the agreed criteria. In the accreditation manual [2], it is stated that a remote audit by questionnaire (document audit) is an example of how to qualify a vendor.

Another example is that of units being audited by manufacturers of CAR-T cells. In this case, the unit (clinical, collection, or processing) does not perform the audit; it is analyzed by the company’s auditor.

  • External audits are performed by some entity outside the program. There are two types:

  • Performed by external certification or accreditation body: JACIE, ISO9001, etc.

  • Inspections by the competent authority

These certification or accreditation entities require internal audits to assess the system.

It would be unnecessarily time-consuming if units had to arrange dedicated internal audits to meet the specific requirements of each accreditation body. It is therefore advisable to make sure to include all requirements in the audit procedure.

Deviations detected in third-party and external audits should be managed according to the center’s corrective action and preventive action (CAPA) policies in the same manner as those detected in internal audits.

Other ways of classifying audits are as follows:

  • On-site vs document:

On-site

The auditor visits the unit to perform the audit (on-site). The auditor may examine documents relating to the scope of the audit or procedures performed on the day of the audit, interview personnel, etc.

Document

Alternatively, the audit can consist of a review of documents submitted by the center. This type of audit is not generally recommended for internal audits and is best reserved for interim audits or for audits of remote third-party providers.

Audit for accreditation or re-accreditation vs interim audit: more details in Chap. 14 (the accreditation process).

The audits for accreditation or re-accreditation are the ones performed to check the system and obtain the accreditation.

The interim audit is performed during the accreditation cycle to assess that the quality management system is still functioning according to the standards.

This chapter is dedicated to internal audits.

Auditor Requirements

An auditor requires sufficient expertise in the subject manner to be able to identify problems and must also be a competent auditor.

Knowledge of the subject being audited is often needed to perform internal audits. The organization must be able to demonstrate how they assess auditor competency. Examples could include courses, audits performed, etc.

The auditor can be a transplant program or unit staff member as long as they are not solely responsible for the process being audited and did not perform the audited activities [2].

How to Perform Internal Audit: The Steps of an Internal Audit

The program must have a description of precisely how they perform audits, specifying for the particular unit or program all the steps that are summarized in this chapter.

Audit Calendar

There must be a calendar or schedule of audits (Table 4.1). The auditor can be included in this calendar or in another of the documents. The head of the QM program should identify areas to be audited and audit frequency [2]. The calendar should be shared with key personnel at quality meetings. Depending on the structure of the transplant program, there may be one overarching program audit schedule or each unit may develop their own calendar.

Table 4.1 Example of an audit calendar for the Clinical and Marrow Collection Facility
Full size table

Examples of audits can include the following:

  • Adherence to procedures or policies

  • Completion of records

  • Completion of training

  • Equipment maintenance according to schedule

There are mandatory audits required by JACIE or the institution, while other audits may be based on local requirements or problems and may be identified by risk assessment, for example. There must be regular auditing of critical activities; the frequency will depend on the importance of these activities, and, to some extent, on the results [2]. There is a list of the minimum requirements in the JACIE standards. Most of the topics require an annual audit. To make it simple, annual audit for all topics is a reasonable approach.

The list of audits might have to be modified or extended during the year, for example, to include follow-up audits.

Audit Plan

Preparation and planning are important parts of a good audit and must be done thoroughly. An audit plan is prepared as a specific guideline for the audit and is essential to allow the auditor to perform an effective and efficient audit.

Depending on center procedures, auditors can use either a pre-existing checklist or a specific checklist prepared by them which includes all the items to be audited. The JACIE checklist, or parts of it, could serve this purpose, depending on the scope, and other topics can then be included depending on the unit and on the quality system in use in the unit.

The use of checklists to perform the audit is not mandatory; other tools are acceptable if they cover all the topics that are to be audited.

The plan should include the actual date, location, etc.

Conducting the Audit

Depending on the audit procedure, a formal introduction may not be necessary.

During the audit, the auditor will review the process, the procedures, forms, etc., according to the audit plan. The auditor will interview the personnel to assess if what they do is performed according to the written procedures of the unit and according to the standards [4]. During the audit, the auditor collects evidence to assess adherence to standards. For the report, it is important to write down any evidence of a deviation in a particular requirement.

Closing

Depending on the procedure, a formal closing meeting may not be required. However, it may be useful to discuss the audit findings with the individual responsible for the procedure or their designee and with the quality manager.

Audit Report

The audit report is an important document and must be prepared by the auditor within a pre-defined timeframe.

The use of a template (example in Table 4.2) is recommended to ensure that all the necessary details are included. These should include the following: audit title, scope, auditor, date, location, plan, copy of the checklist or of the audit findings, summary of deviations, and signatures.

Table 4.2 Example template for an audit report form. Adapted from “A practical guide to implement quality management in a Stem Cell Transplantation Programme” [5]
Full size table

The audit report should be reviewed and approved by the appropriate personnel, such as the quality manager and the facility director. The approved audit report should be distributed to the manager of the audited area and should be shared with staff, when appropriate [2].

Internal audit reports are always reviewed in external audits (JACIE, ISO, etc.), so it is important to make sure that the necessary reports are available for the inspector.

Actions

Audits are performed to recognize problems, trends, and improvement opportunities [1], and any findings should be followed by the necessary actions. The center must identify the underlying root cause of the deviation and implement corrective and preventive actions (CAPA) (see Chap. 11) or process improvements, as required [2], ideally as soon as possible, and certainly within the required timeframe.

The corrective and preventive actions should include a scheduled date for a follow-up audit to verify that effective corrective actions have been implemented [2].

The required actions must be documented according to local procedures. The findings of the audit can be included within the established system for recording deviations, occurrences, etc. (see Chap. 11).

The center can also choose to document the actions in the audit report (Table 4.3). The effectiveness of the actions must be reviewed and documented and further audits might be necessary.

Table 4.3 Example template for corrective action plans. This table can be added to the audit report (Table 4.2) if the center decides to include the actions in the audit report instead of including them in the deviation procedure
Full size table

In subsequent audits, it is important to review stages in the process where deviations have previously been found to occur.

Communication of the Result of Internal Audits

The results of the audits, as a key component of the quality management system, must be shared at quality meetings and included in the annual report.

Audit results, corrective actions, and follow-up actions should be reported at least once a year. Review by the Program Director should be documented and there should be evidence that audit reports have been shared with the appropriate staff [2].