A common finding when auditing is discovering that the organisation or department that you are auditing is not following their own internal procedure or policy. This is a non-conformity, and should be raised as such. The problem is – what clause of the standard actually states that you should follow your procedures? On investigation this is not as easy to find as you might like to think!
In European Union GMP (EU GMP) the main chapter to look at is Chapter 4 on Documentation (Chapter 4 Documentation OLD). This was updated recently, but the one that has been in place for many years is here. Amazingly despite the fact that the chapter is very detailed on what documents and records a site should have, there is no mention of actually having to follow any of them! This is a problem and auditors needed to look elsewhere in GMP to find a clause that stated “you must follow your procedures”. If you looked in Chapter 5 on Production then clause 5.2 provides the answer “all handling of materials and products, such as receipt and quarantine, sampling, storage, labelling, dispensing, processing, packaging and distribution should be done in accordance with written procedures”. In addition Chapter 2 on Personnel also has clause in relation to the responsibilities of the Head of Production (clause 2.5) which states “to ensure that products are produced and stored according to the appropriate documentation”. This should be the end of this discussion, however a gap remains. What about Quality Control personnel? Do they not have to follow their testing procedures? For this we can look in Chapter 6 on Quality Control where it states at clause 6.2 that “all these operations should be carried out in accordance with written procedures”. So there we have it – it is there, but you just need to hunt around a bit to find it. In order to improve the situation and to cover the need to follow procedures that are not Production and QC related then Chapter 4 was updated in 2011 with a new clause 4.1 which states that “all types of document should be defined and adhered to” so now you don’t have to refer to clauses 5.2 and 6.2 as you can refer to the more obvious clause 4.1 contained within the recently updated chapter on Documentation (Chapter 4 Documentation NEW).
In USA GMP there is also a requirement to follow your procedures and this can be seen at clause 211.100b of 21CFR211 where, for Production, it states “written production and process control procedures shall be followed” and clause 211.160a, for Quality Control, where is states “the requirements in this subpart shall be followed and shall be documented”.
In audits against ISO 9001 then it is very difficult to find a clause that states “you must follow your procedures”. It certainly does not say to do this at clause 4.2.3 that covers Control of Documents. The clause to use for not following procedures in ISO 9001 is clause 4.1f which states that the organisation shall “implement actions necessary to achieve planned results”. Here the key word is “implement” – in other words you must do what you say you are going to do. The word “implement” is also stated in the opening line of clause 4.1 too. So as a strange coincidence the clause for following your procedures in both EU GMP and ISO 9001 is clause 4.1.
I hope this is of interest – feel free to comment or drop me an email [email protected]