21 CFR 820.22 - Quality Audit (QMSR)

What it says

Manufacturers must establish procedures for conducting quality audits and conduct such audits to assure the quality system is in compliance with established requirements and to determine its effectiveness, with audits conducted by individuals who do not have direct responsibility for the matters being audited, and audit results documented and corrective action taken as necessary.

Paraphrased for plain-language clarity. Always verify against the current published regulation text.

What it means in practice

• Internal audit independence, requiring auditors without direct responsibility for the audited area, mirrors the same underlying principle of independent oversight seen throughout quality system frameworks, from quality unit independence to Qualified Person certification.
• An audit programme is expected to genuinely assess effectiveness, not simply confirm procedural compliance, meaning a well-designed internal audit programme should be capable of identifying systemic issues before an external inspection would.
• Audit findings requiring corrective action are expected to feed into the same CAPA system used for other quality data sources, rather than being tracked and resolved through a separate, disconnected audit-specific process.

What FDA inspectors look for

• Whether internal audits are genuinely conducted by personnel independent of the areas being audited, not by individuals with a conflict of interest in the outcome.
• Whether internal audit findings are substantive and reflect genuine critical evaluation, rather than consistently reporting minimal or superficial findings that seem inconsistent with what external inspection subsequently reveals.
• Whether audit findings requiring corrective action are tracked through to genuine resolution via the CAPA system, not left open indefinitely or closed without adequate verification.

Related regulations