I once asked a Quality Manager how big his team was. He said, “You’re looking at it.” Then, after a beat: “I also do the shipping.”
That is not a story about a badly run company. That was a profitable Class II manufacturer, fifty-odd employees, a clean file, a real product. It’s just that quality was one person, and that one person was also the document control department, the training department, the complaint-handling department, and — on Thursdays — the person who printed the labels.
If that’s you, here’s the part nobody softens: the regulation does not have a headcount exemption. ISO 13485 §8.2.4 asks exactly the same thing of a team of one that it asks of a team of thirty. Audits at planned intervals. Criteria, scope, frequency and methods defined. Auditors who don’t audit their own work. Records that show it happened. And since the QMSR pulled ISO 13485 in by reference — and dropped the old §820.180(c) exemptions along the way — those records are now something an FDA investigator can ask to read.
What breaks first when the department is one person
It’s never the intent. Solo quality people are, in my experience, the most conscientious people in the building. Three things fail anyway, and they fail in a predictable order.
First, the schedule slides. Audits are the only thing on your plate with no external party waiting on them. A complaint has a clock. A shipment has a customer. An audit has… you. So it moves to next month, and next month, and then it’s the first week of December and you’re auditing the entire quality system in four days. I’ve written about why that December sprint is a red flag rather than a program — but when you’re solo, it isn’t laziness. It’s arithmetic.
Second, independence quietly collapses. You wrote the CAPA procedure. You own document control. You trained the operators. So when it’s time to audit any of that, the only available auditor is the process owner, which is the one thing §8.2.4 says out loud you can’t do.
Third — and this is the subtle one — findings get soft. Not dishonest. Soft. Because you already know who’s going to have to fix it, and it’s you, in a week you don’t have. So the nonconformity becomes an observation. The observation becomes “discussed with the team.” I have watched genuinely excellent quality managers do this without ever noticing they were doing it. The tell is a finding log where nothing is ever a major.
What you can actually fix in-house
Some of this is solvable without spending a dollar.
Borrow independence from outside quality. Independence means independent of the audited process, not a separate department. Your manufacturing engineer can audit document control. Your regulatory lead can audit training. You audit production. Nobody grades their own homework, and the org chart didn’t have to change — but they do need real competence: ISO 19011 clause 7 is about knowledge of the standard, the sector and audit technique, not about a certificate on the wall. Train them properly and keep the training record, because that record is part of the evidence.
Stop auditing everything, every year, at the same depth. Risk-based means the sterile barrier process and the CAPA system get looked at more often and harder than the calibration of the office thermometer. A program that covers the whole system across a rolling cycle beats an annual sweep that gets 40% finished.
Cut the audits into pieces you can actually finish. Four half-days across the year beats one heroic week that never happens. A half-day audit with three real findings, written to a requirement with the evidence attached, is worth more than a hundred-line checklist with “Y” down the column.
Write findings for the version of you who’s reading them in six months. Requirement, evidence, no editorializing — that format exists precisely so a stretched person can pick it up cold and still know what happened.
What outsourcing is — and what it isn’t
You can contract the auditing. Plenty of manufacturers do, and no notified body is going to blink at an internal audit performed by competent contracted personnel. What you cannot contract is the responsibility: under §4.1.5, an outsourced process stays yours, and the controls over it belong in a written agreement. An external auditor doesn’t make the audit program somebody else’s problem. It makes it somebody else’s work, on your record, under your name.
So if you go that route, ask for the things that actually matter: demonstrable competence in the standard and your device sector; genuine independence (an auditor who also wrote your SOPs has the same problem you did); findings written to a requirement with objective evidence; and the deliverable handed back in a form you can put in front of an inspector, not a PDF that lives in someone’s email.
And ask what happens after the report — because that’s where most audit programs actually die. A finding needs a correction, a decision on whether it warrants a CAPA, a root cause that isn’t a person, an effectiveness check, and eventually a line in the data you analyze under §8.4 and take into management review under §5.6. That chain is the whole point. One person doing all of it from memory and a spreadsheet is not a system; it’s a hostage situation.
This is the part Red Hen Admin does for a living. We run the internal audit program as a managed service — the schedule, the audits, the findings, the follow-through — with Candor as the system of record underneath it: audits that come due on their own, findings with a lifecycle instead of a status column, trends you can actually read, and management review inputs that assemble themselves. It won’t guarantee you a clean inspection; nothing does, and anyone promising otherwise is selling something. What it does is make “audit-ready” an ordinary condition rather than a two-week emergency, and give the solo quality person something that has been in short supply: a second set of eyes that isn’t also theirs.
Three things to do today
Open your audit schedule and find the date of the last completed internal audit. Name one person outside quality who could competently audit one process, and put their training on the plan. Then look at your last five findings and ask, honestly, whether any of them would have been written differently if somebody else had to fix them.
Being the whole quality department isn’t a failing. It’s a resourcing decision somebody else made, and you’re the one holding it. The regulation isn’t going to grade you on a curve for that — but nothing in it says you have to be the only one looking, either.