She was one of the best quality managers I’ve worked with. She wrote the document control procedure, ran document control, trained everyone on document control — and every year she audited document control, and every year the report said the same thing: no findings.
Then a notified body auditor walked in and found three in twenty minutes.
She wasn’t hiding anything. That’s the part people get wrong about auditor independence — they hear it as an accusation. It isn’t. She couldn’t see the gaps because she was the person who had decided, four years earlier, that those gaps were fine. Nobody proofreads their own handwriting.
What the requirement actually says
ISO 13485:2016 §8.2.4 is short about this, and unusually blunt. The selection of auditors and the conduct of audits have to ensure the objectivity and impartiality of the audit process — and auditors shall not audit their own work. That’s not guidance. That’s a “shall.”
FDA used to say the same thing in its own words: the old §820.22 required quality audits to be conducted by individuals who did not have direct responsibility for the matters being audited. That section is now reserved, which gets misread as “that requirement went away.” It didn’t. It moved. The QMSR incorporates ISO 13485 by reference at §820.7 and requires you to comply with it at §820.10, so independence is still fully enforceable — it’s just wearing a different clause number.
And here’s what changed the stakes. The old §820.180(c) exemption that kept internal audit reports out of an inspector’s hands is gone from the QMSR. Your audit reports are readable now — which means the auditor’s name on the report is readable too, right next to the name on the procedure being audited. That comparison used to be private. It isn’t anymore.
“Your own work” is bigger than you think
Most people apply this test narrowly — did I personally perform the task in the sample? That’s too small. The honest version is broader.
- You wrote the procedure. That’s your work.
- You approve the records that would be the audit evidence. Your work.
- You own the metric the area is judged on. Your work, and your performance review.
- You trained the operators — a finding about their execution is partly a finding about your training.
- Your direct report runs it. Independence has a chain-of-command problem too.
The rule of thumb I use: if a finding in this area would be a finding about you, you are not independent of it. Takes four seconds, catches almost everything.
The other half nobody schedules: competence
Independence is the half everybody argues about. Competence is the half that quietly does more damage.
ISO 19011:2018, the guidance standard for auditing management systems, gives clause 7 entirely to this: determine what competence the audit programme needs, establish evaluation criteria, evaluate people against them, keep it current. It splits competence into the generic kind — audit principles, process, technique, how to gather and weigh evidence — and the discipline-specific kind: device regulation, sterilization, software, process validation, whatever the area actually is.
Both halves have to be there, and a lead auditor certificate really only speaks to the first. I once watched a genuinely competent ISO 13485 auditor accept an IQ/OQ/PQ package with no documented rationale for a single sample size, because they didn’t know that was a question you were allowed to ask. The audit came back clean. FDA had a different view, and phrased it considerably less kindly than we could have.
The reverse failure is more common: the person who knows the process best makes a poor auditor of it, because they ask leading questions. “You do the second check before release, right?” is not a question. It’s a script, and everyone in the room knows their line. “Show me” is the question.
And in a device QMS, competence is a record. ISO 13485 §6.2 wants education, training, skills and experience determined, provided and documented for anyone whose work affects product quality. Auditors aren’t exempt. A 2014 certificate with no audits performed since is a training record, not evidence of current competence.
So what do you do with a team of two?
Because that’s the real question, and “hire a third person” isn’t an answer anyone can action on a Monday.
Cross-audit deliberately. Whoever doesn’t run the process audits it. Write the swap into the audit plan so it’s visible on purpose rather than by accident.
Recruit outside of quality. There’s no rule that internal auditors live in the quality department. A manufacturing engineer auditing document control, or regulatory auditing calibration, works well — and they notice things quality people stopped noticing years ago. Train them, evaluate them, record it, and you’ve widened your bench.
Declare the overlap you can’t eliminate. If someone must audit an area they touch, say so in the report and add a compensating control: a second reviewer on the findings, extra scrutiny at management review, or an external audit of that area on a defined cycle. An acknowledged limitation is defensible. An undisclosed one looks like something you hoped nobody would check.
Buy independence where you structurally can’t build it. It’s usually a short list — document control, CAPA, management review, the QMS-level processes the quality manager owns end to end. Exactly the areas where internal independence is weakest and an inspector’s interest is strongest.
Do this today
Print last year’s audit schedule and write the auditor’s name beside every area. Circle any row where that person wrote, approves, owns, or manages the thing being audited. Then count findings by auditor across your last three reports. If one auditor’s areas come back spotless every cycle, that’s worth a conversation — it might mean the area is excellent, or it might mean nobody’s really looking.
This is also the boring argument for keeping audit history in a system of record rather than a folder of Word files: who audited what, when, and what they found is either one screen or an afternoon of archaeology. When it’s one screen, the independence question gets answered honestly, because answering it is cheap. And when the honest answer is “nobody here can audit this,” that’s the corner Red Hen Admin usually gets called in to cover.
None of this is a comment on anyone’s integrity. It’s a comment on eyesight. You’ve read your own procedure two hundred times, and somewhere around the fortieth reading you stopped reading it and started remembering it. Everybody does. That’s the whole point of someone else holding the checklist.