Lean Internal Auditing and Response Mechanisms for Life Sciences

Lean Internal Auditing and Response Mechanisms for Life Sciences

Executive Summary

As regulatory agencies like the FDA (America), PMDA (Japan), EMA (Europe), ANVISA (Brazil), and CFDA (China) continue to increase the amount of regulation for the Life Sciences industry, companies must place an increased importance on lean internal audit protocols as well as on respond mechanisms. This can become exceedingly complex as companies expand commercial markets and need to comply with additional market regulators. Companies who manufacture products, such as drugs for human consumption, are heavily scrutinized by regulators; the slightest mishap can incur serious penalties.

There are currently a few major market offerings that companies consider to improve their lean internal auditing processes:

  1. Outsourcing – There are firms who will perform regulatory audits for Life Sciences facilities using the applicable set of guidelines. These firms will perform inspections as frequently as their clients like. This is quite an expensive option and forces a company to rely on outsiders for a critical function of their business.
  2. External consulting – Consulting firms are adept at defining strategies to maintain compliance in an ever changing regulatory environment. However, most take the approach of ensuring compliance regardless of the costs, without balancing efficiency.
  3. Information systems – Technological solutions are not created equal. The most effective internal auditing tool in an integrated system is one that identifies what areas of the business needs the most attention. Technology is a tool to enable more efficient and cost effective audits. However, without embracing precisely defined user roles, audit processes and strategy, it will be an expensive tool with limited ROI.
    Theidealsolutionin developing andimplementingaqualityandlean audit management program aims to identify the most effective protocols, create an internal cultural shift towards embracing audits, and tailor every internal process to meet the client’s needs. This methodology is as followed:
    1. Diagnosing the problem: Identify issues with the current state
    2. Designing the solution: Map the future state, clearly displaying the roadmap for the client
    3. Implementing and embedding: Culture, processes, and systems changes
    4. Sustaining & improving: Continuously improving people, processes, and systems
      By creating a lean yet comprehensive audit program, Life Science companies can not only ensure that they will not have to worry when the FDA comes for inspection, but will do so at a fraction of the costs of their competitors. In the ever more competitive global landscape, it is important to not just maintain compliance, but do so in an efficient manner while maintaining agile response mechanisms.

A man pointing at a screen on which appear charts and graphs


With the speed that information is able to spread in the age of global connectivity, individuals and organizations are held under the microscope by the general public. This is particularly true when regulators announce that a Life Sciences company has been issued a warning letter. Besides negative public perception as a result of a failed inspection, there may also be fines, recalls, or even site shut downs if there are persistent issues that are not resolved.

Life Science companies leverage lean internal audits to make sure their sites are in compliance in each and every way possible. Just to clarify, the term lean audit does not mean any corners are being cut in conducting the audit; it simply means that the quickest, most efficient and effective processes are being used in conducting the audit. The process should be as similar as possible to a regulatory inspection, to ensure that each area is examined with a fine microscope less a company risk falling out of compliance. For those companies who are active in multiple markets, there is the additional onus of needing to do audits for each series of regulations where compliance is required.

Most companies have one concern with their internal auditing process – is it effective at identifying concerns? However, when one looks at FDA inspections in aggregate for Life Sciences (see fig. 1), the FDA finds only 60-65% of inspections (annually) perfectly in compliance or have No Action Indicated (NOI) in the findings from the inspection. Approximately 30-35% of inspections annually result in a Voluntary Action Indicated (VAI) which is raised when there are areas found to be out of compliance, but it does not meet the regulatory threshold for significance. In these cases, it is more of an identification that something should be done, but the company is not found to formally be out of compliance. Finally, 4% of inspections result in an Official Action Indicated (OAI), meaning that the company was found to be significantly out of compliance and action must be taken to resolve it. 1 2 

A chart - Data does not include food or tobacco inspection; per the FDA some Life Science data may be missing due to pending enforcement actions

*Data does not include food or tobacco inspection; per the FDA some Life Science data may be missing due to pending enforcement actions

Following the results of an inspection or a lean internal audit, it is up to the company to then take action to resolve issues using the Corrective Action and Preventive Action (CAPA) methodology. The company must analyze the issue to determine a root cause and implement both a correcting mechanism for that occurrence and a preventative mechanism, so that the issue will not occur in the future. Internal audits and regulatory inspections are not the only causes of CAPAs – any investigation of an issue on site or in the supply chain will require the company to create a CAPA in order to ensure quality of their product. It is very important that CAPAs are well documented and follow through 100%, because regulators will review CAPAs when they come for inspections.

The top concern in this Audit to CAPA process for most companies is effectiveness, which per the results of the FDA’s inspections statistics, is questionable. However, what many companies are not considering is if there is a way to not only be effective, but also be efficient. The FDA itself asked this question of their own inspection processes and “to enable the Agency to more effectively allocate its limited regulatory resources, the FDA is implementing a risk-based approach to regulating pharmaceutical manufacturing.”3 Life Science companies need to use the same approach to help focus their efforts where their risk is the greatest. This is not to say that low risk sites and products do not need comprehensive internal audits, quite the contrary: in order to balance effectiveness and efficiency companies must use risk identification and quantification to direct them where they need to do additional audits, and improve their response mechanisms.

For Life Science companies, internal audits and CAPAs are significant drivers of the cost of good quality. The cost of good quality (see figure 2) is defined as appraisal (lean internal audit) and prevention (CAPA) costs. Life Science companies have a great deal of costs associated with quality, but these are two areas that are not typically investigated when a company is looking to go lean. This is likely due to the related costs of poor quality, specifically the costs associated with failing regulatory inspection. By not focusing specifically on how to make the internal auditing and CAPA process efficient, it actually ends up reducing the effectiveness of the programs because like the FDA, resources are not infinite.4 While companies typically will spend what it takes to maintain their compliance, some still will fail inspections. Focusing on efficiency can allow a company to ensure a higher inspection pass rate while dedicating less resources to their internal audit and CAPA processes.

The Cost of Good Quality - a graph

Figure 2: The Cost of Good Quality

 Existing Solutions

In the Life Sciences market there are typically two approaches to improving lean internal audit and resulting CAPA process, external consultants and information systems:

Outsourcing – This can be a good option for a company when they have had very recent struggles with the effectiveness of their own internal audit processes. This will allow the company to quickly identify compliance gaps by having a regulator quality inspection without the penalties a regulator can hand out. The longer term agreements are a little less appealing because they can be quite expensive and they force the company to rely on an outsider rather than building up internal capabilities. This is a problem because if the outsourcing company has turnover and does not keep up their quality, it will be difficult to identify the problem proactively and instead appear when the regulatory inspection fails. Additionally, there can be a conflict of interest in allowing the outsourcing company to help define audit frequency and strategy, or the Life Sciences Company must define their own frequency and strategy without being involved in the auditing themselves.

External consultants – These resources are typically very successful at ensuring internal audits are effective at maintaining compliance. The approach is very much to maintain compliance regardless of costs. What they typically lack are process optimizations that allow internal auditors to do more with less, and a technological solution that can further enhance the effectiveness of the team, reporting quality, and real-time identification of risks.

Information systems – In the modern era there are many different software based solutions which track and trend information and allow real-time reporting of metrics. Not all of them are fully integrated to have each quality; ERM, financial, and compliance systems communicate to produce high impact – simple reports for management’s evaluation. But there are some options which can do this. The main concern with implementation of information systems is typically the perception it comes only at a very high cost and the fear that the provider has not fully evaluated and optimized processes around the system. An information system will be an underutilized tool with a very limited ROI, unless processes around it are enhanced, user roles and responsibilities are defined, and response mechanisms are put in place.

The Ideal Solution

To deploy the most effective lean internal auditing program that will prevent regulators from finding OAIs and VAIs is not necessarily costly. In fact, the most effective program is efficient and therefore able to pay special attention to high-risk areas while giving management the confidence that compliance will be assured through identification of all potential concerns. To ensure compliance it is critical not just to identify concerns, but to correct and prevent them quickly and comprehensively and enhance the response mechanisms process. To ensure this, the ideal solution involves four key phases:

the four elements of finding a solutionDiagnosing the problem – the purpose of this phase is to understand the current state. How is the company doing with compliance? How efficient are their internal audit and subsequent response programs? Typical activates include:

  • Conducting regulatory (e.g. FDA, EMA, PMDA, CFDA, ANVISA, etc.) inspection level audits in compliance
  • Analyzing the current state, defining a future state, and determining what gaps exist in:
    • The schedule for internal audits, and any factors that could provoke a lean internal audit
    • Reporting and response mechanisms
    • Past inspection and internal audit findings
    • All relevant information systems
  • Observing current lean internal auditing and CAPA procedures
  • Interviews with key stakeholders:
    • Corporate leadership
    • Site leadership
    • Internal audit team members

Designing the solution – during this phase the future state is defined in specific detail, and a plan is developed to take a company from their current state to their ideal state. Typical activities include:

  • Creating an optimal internal audit schedule and team composition
  • Design of comprehensive lean audit and response mechanisms strategies which address all regulations form every governing body – taking special consideration that different international markets may have different regulations
  • Definition of metrics and KPIs for the audit team to use to focus efforts on troubled areas
  • Selection of the most ideal integrated information system to enable easy reporting form all quality, compliance, and risk management systems.
  • Development of a highly efficient CAPA process
  • Creation of project plan for network-wide implementation and the identification of pilot sites

Implementing and embedding – During this phase the plan designed in the previous phase is put into place. Key considerations during this phase are:

  • To ensure alignment network wide, typically through regular reporting and key stakeholder meetings
  • Constantly reviewing metrics to better focus further improvement efforts
  • Deployment of any new information system and the processes to maximize its utility

Sustaining & improving – The final step is an ongoing effort that begins with a scheduled reevaluation of the current state, typically 1 year after implementation begins. It includes utilizing the reporting mechanism and defined metrics to measure success and identify troubled areas. The critical element of this phase is to make sure that the initiative not only sticks, but is regularly evaluated for further improvement. As regulations periodically change, it is important to make sure the program keeps pace with any changes.


An immense amount of pressure is put on Life Science companies not only to maintain compliance with one or more regulators, but also to compete in a global environment. In order to manage this, companies need to deploy lean audit teams which identify all possible concerns, and must also have lean response mechanisms which allow comprehensive follow through in a swift and efficient manner. Consider this methodology and the significant advantage it will bring to facilities during increasingly competitive times.

By Tom Ambrogio and Adit Babureddy, consultants


1 "Abbreviation Definitions: Inspections." FDA.gov. Food and Drug Administration, n.d. Web.
2 "Inspections Database." FDA.gov. Food and Drug Administration, n.d. Web.
3 "Pharmaceutical CGMPs for the 21st Century - A Risk-Based Approach Final Report." FDA.gov. Food and Drug Administration, n.d. Web.
4 "Cost of Quality." American Society for Quality. ASQ.com, n.d. Web.

Brian Hsing

Director and Head of US Operations at Tefen USA

Monopoly Building, Operational Excellence, Change Management & Supply Chain Expert

Talk to Brian Hsing

Fill the form for some quick advice


Let's work together!

shijiebei 365bet manbetx 188bet xinshui caipiao 95zz tongbaoyule beplay 88bifa 18luck betway bwin hg0088 aomenjinshayulecheng ca88 shenbotaiyangcheng vwin w88 weide