I once asked a quality manager to show me the last three years of internal audit findings. She handed me a binder. A good binder, honestly — tabbed, chronological, every finding signed and closed. Real work went into it.
So we sat down and read it. Forty-one findings. Twelve of them, across four completely different processes and three different auditors, came down to the same thing: training records that hadn’t kept up with revised work instructions. Nobody had ever noticed, because nobody had ever read the binder sideways. Each finding had been closed correctly, one at a time, for three years running.
That’s the failure mode this post is about. You can do every previous step right — gather real evidence, write clean findings, chase root cause past the nearest human — and still end up with a very tidy record of problems your organization never learned anything from.
First: the report has to be readable by someone who wasn’t there
ISO 13485 §8.2.4 is short about this. Records of the audits and their results have to be maintained, including identification of the processes and areas audited and the conclusions. That’s the floor, not the ceiling.
The ceiling is a report the process owner can act on without calling you. That means: what was audited and against which criteria, what was sampled and how much, the findings with their evidence, and a conclusion that actually concludes something. “Several observations were noted” is not a conclusion. “The process conforms, with two nonconformities in record retention that do not affect product release” is.
The other thing §8.2.4 asks for, and the thing most programs quietly skip: follow-up. Management responsible for the audited area has to ensure correction and corrective action happen without undue delay, and the follow-up shall include the verification of the actions taken and the reporting of verification results. Note the second half. Verifying is not enough — you have to report that you verified. If your closure record is a signature and a date, you’ve done the work and thrown away the evidence.
Then: stop treating findings as events and start treating them as data
This is where §8.4, Analysis of Data, comes in — the clause everyone can find in the standard and almost nobody can point to a real output for. It requires a documented procedure to determine, collect, and analyze data demonstrating the suitability, adequacy, and effectiveness of your quality system. Audit results are explicitly part of what feeds it, alongside feedback, product conformity, process trends, and suppliers. And the records of the analysis have to be maintained.
Analysis means something more than counting. Twelve findings this year versus fourteen last year is not a trend, it’s arithmetic. What you’re looking for is the shape:
- By clause or process — where do findings cluster? Document control and CAPA are the usual suspects, and if that’s you, you’re in ordinary company.
- By root cause category — if you’ve been honest in your RCAs, this is the most valuable cut you own. Three findings with different symptoms and the same systemic cause are one problem, and you should be spending like it’s one problem.
- By recurrence — a finding in an area you closed a CAPA on last year isn’t a new finding. It’s an effectiveness failure, and it should be routed as one.
- By source — does the internal audit find things first, or does the notified body? If it’s consistently the latter, your program has a sensitivity problem, not a paperwork problem.
None of this is hard. What makes it hard is doing it retroactively, from a binder, in the week before management review. The trick is to categorize each finding at the moment you write it — clause, process, cause category — so trending is a filter and not an archaeological dig. This is exactly the sort of thing a system of record earns its keep on; it’s also the sort of thing that quietly rots in a spreadsheet with four different spellings of “documentation.”
Finally: management review is where findings become decisions
ISO 13485 §5.6.2 lists twelve required inputs to management review, and audit results are one of them. Sitting right alongside complaints, regulatory reporting, corrective action, preventive action, and follow-up from the last review — which is a hint about how they’re meant to be read. Together.
The weak version of this agenda item is a slide reading “8 audits completed, 12 findings, all closed.” That’s attendance. The useful version answers three questions: what are our findings telling us about where the system is weak, what are we going to do about it, and what will that cost.
Because §5.6.3 is about outputs, and the outputs are decisions — improvements needed to maintain the suitability, adequacy, and effectiveness of the QMS, product improvements tied to customer requirements, changes needed for new or revised regulatory requirements, and resource needs. That last one is the whole point. Management review is the only forum where the quality system gets to ask for money and people, on the record, with evidence attached. Findings are the evidence. Don’t waste them on a status count.
One more thing, and it’s new
Under the old QSR, §820.180(c) exempted management review records, internal audit reports, and supplier audit reports from FDA review during a routine inspection. That exemption was not carried into the QMSR. FDA’s reasoning was straightforward — manufacturers already hand these to notified bodies and MDSAP auditing organizations, so the shield was out of step with everyone else. We covered the implications when the rule landed.
I’d gently suggest this changes less than people fear. A trend analysis showing you found a systemic weakness and funded the fix is a good look in front of anyone. What reads badly is a three-year run of closed findings with no analysis behind them and no evidence that anyone in management ever saw the pattern. That was always a weak program. Now it’s a legible one.
What to do today
Pull every internal audit finding from the last twenty-four months into one table. Tag each with the clause, the process, and the root cause category. Sort it. I promise you’ll see something — most people do inside of an hour, and it’s usually the thing they’ve been vaguely annoyed about for a year without being able to prove it.
Then take the top two clusters to your next management review with a number attached. Not “documentation is a recurring issue,” but “seven of nineteen findings trace to work instructions revised without a training record update; here’s what fixing the mechanism costs.”
That’s the difference between an audit program that generates paperwork and one that generates leverage. Same findings. Somebody just finally read them sideways.