QS01-H Internal Audits Version: F01 Valid from: Replaces version: -- of: -- Author: Edith Belz Date Author signature Review: FG-QM Date FG-QS Approval: Board KKS Network Date Board spokesperson Target group: All Coordination Centres for Clinical Trials Appendixes: QS01-H-A1 QS01-H-A2 QS01-H-A3 QS01-H-A4 Audit types Annual audit schedule Audit plan Evaluation of audit findings Note: Italic text in this SOP is not to be adopted word for word in the local version; it is to be replaced by the corresponding local information.
Contents Page 1. Objective...3 2. Background...3 2.1 Types of audits at KKS...3 3. Processes...4 3.1 Forms of internal audit...4 3.2 Planning internal audits...4 3.3 Performing audits...6 3.3.1 Contents of system audits...6 3.3.2 Contents of trial audits...7 3.3.3 Content of product audits...9 3.3.4 Contents of a procedural audit...9 3.4 Conclusion of the audit...10 3.5 Reference documents for auditors during the audit...10 3.6 Audit documentation...11 3.6.1 report for an internal system audit done by a third party...13 3.6.2 Audit report of an on-site audit...13 3.6.3 Audit report for an internal system or process audit...14 3.7 Evaluation of audit findings...14 4. References...15 5. Changes from last version...15 Page 2 of 15 23.08.2006
1. Objective The objective of this SOP is to establish a quality standard for KKS for internal audits. This SOP refers to clinical trials on medicinal products but can also be used for trials that are not governed by the AMG. 2. Background According to the ICH-GCP Guideline E6 (5.1.1), every sponsor responsible for a clinical trial is required to provide independent quality assurance by means of audits. According to ICH- GCP Guideline E6 (5.19), an audit determines whether trial-related activities are being carried out in accordance with the applicable legal provisions and GCP, according to the protocol and the valid SOPs, and whether documents are being properly drafted. DIN EN ISO 9000 describes guidelines for quality management systems and establishes the terminology for quality management systems including audits. DIN EN ISO 19011 can be used as a reference for planning and performing audits. Internal audits determine the maintenance and applicability of a facility s own provisions and regulations, and are primarily a tool for improvement. Internal audits ensure that the quality management system is maintained and developed. Deviations from the requirements are found and potential improvements are identified, and measures for correction and improvement are monitored. This SOP therefore regulates the internal audit process. s may not audit their own area of responsibility (objectivity). The management of the KKS generally appoints suitable employees as auditors, if necessary, in collaboration with QMB. ICH-GCP 5.19.2 provides instructions on the selection and qualification of auditors. The sponsor is responsible for selecting the auditor. Reviewer In contrast to an audit (independent quality assurance), the person responsible for a review is not independent of the clinical trial (in-process quality control). In reviews, persons involved in clinical trials check whether a document from their clinical trial (such as the CRF, or the trial protocol) is practical, implementable, and observes the formalities from their perspective of his responsibilities. The formal audit procedure does not have to be observed. 2.1 Types of audits at KKS a) System audits are generally for investigating whether a new trial site or a corresponding facility is suitable for participating in a clinical trial. System audits are also for reviewing the overall quality management system at KKS or its individual areas. System audits for suitability testing of an trial site or corresponding facility should preferably be done at the beginning of a clinical trial. System audits can also be performed at any other time in a clinical trial. System audits can be comprehensive and deal with the entire (quality management) system or parts (procedural audits), or individual system processes. b) On-site audits are a type of system audit. On-site audits are normally performed by the investigator in the presence of the relevant monitor. Ideally, on-site audits are carried out after the first trial subject are included and initially monitored. If systematic errors are discovered at the time of the audit, they can be corrected in a timely manner, and the clinical trial can continue. Page 3 of 15 23.08.2006
c) A product audit assesses the agreement between the process of production with the quality requirements of the end product after final testing. In product audits, the protocol or CRF, for example, of a clinical trial is audited. Product audits are performed before submitting the documents of a clinical trial to the competent ethics committee or authorities. d) Process audits check whether the employees are using the KKS SOPs, and if the employees find them practical and still relevant. Process audits are usually not performed; instead, system audits that include process audits are usually carried out. These terms identifying the types of audits should be used in the documentation of audits at KKS. The type of audits must be given in the audit report under the heading Basis for the audit. The general types of audits are defined in Appendix 1. 3. Processes 3.1 Forms of internal audit a) Audits for internal quality assurance Internal audits should be scheduled at least annually and systematically performed at KKS to ensure quality assurance according to ICH-GCP. QMB, KKS management b) Audits as sponsor The KKS can assume responsibilities on behalf of the sponsor for clinical trial activities provided this is agreed in advance (e.g. by contract or authorisation). If a system audit or on-site audit is performed for the hospital or university as the sponsor, it must first be determined if the trial site has received the audit report (see 3.5.2, last paragraph). Likewise, it must be determined if the trial site will be given an opportunity to comment on the draft of the audit report. If this is the case, the comments will become a part of the audit report. The auditor will then draft the audit report, send it to the trial site, and ask for comments by a certain date. The auditor will ensure that the deadline is adhered to, and is also responsible for preparing the audit report within an appropriate period (approximately 4 weeks for an audit report with comments; approximately 2 weeks for an audit report without comments). The recipient of the final audit report will be specified by contract, and the contract will also determine whether the trial site will receive only a letter of thanks or this and an audit certificate. The original audit certificate will be filed in the sponsor s TMF. During product audits, the person preparing the corresponding document (such as the CRF) must be given the audit report. This must be agreed on in advance. KKS Management 3.2 Planning internal audits Page 4 of 15 23.08.2006
a) Annual audit schedule for internal quality assurance audits An annual audit schedule (Appendix 2) is normally prepared at the beginning of the year. In this audit schedule, the audits of the areas/departments/facilities are distributed over the months of the year. The annual audit schedule prepared and signed by the QMB is presented for approval to the management of KKS. The annual audit schedule includes the main reasons ( Basis for the audit ) for the planned audit such as the observance of SOPs, on-site audit, or XY clinical trials. QMB, KKS management The annual audit schedule can be supplemented or changed during the year if requested by the management of KKS or if QMB consults with the management of KKS. The annual audit schedule should be announced after the employees approve it. b) Audit plan (audit schedule, audit process plan) The auditors and any associated experts will be identified or appointed by QMB itself or together with the management of KKS at the latest during audit planning. The QMB can function as the auditor. s may not audit their own project (objectivity). Experts should be involved in an audit if an auditor has to audit an area in which he or she has no expertise. The expert may not belong to the audited area. If no suitable auditors are found in KKS, external auditors can be appointed for the internal audit. QMB, KKS management In the audit plan (Appendix 3), the goal of the audit must be clearly formulated so that the results of the audit can be clearly measured in the audit report or an overall evaluation. Possible goals of the audit can be: "On-site audit - The trial site is in conformance with GCP and can be entrusted with the conduct of clinical trials," or "System audit in KKS - The applicable SOPs are observed in areas XY. The QMB generally clarifies the goal of the audit with the management of KKS and notifies the appointed auditor. The audit plan includes the schedule and basis for the audit, and assigns a responsible party for each area or department involved. This person must be available during the audits. The draft of the audit plan should be given to the audited employees approximately 2 to 4 weeks before the planned audit to allow the addition of persons or changes to the schedule (this may be organizationally necessary if, for example, pharmacies or laboratories are to be included in the audits). If inexperienced auditors are assigned an audit, the QMB assists with the process., QMB The audit determines who will be the contact during the audit (such as the trial coordinator, person drafting of the protocol, etc.). This must be clarified beforehand depending on the type of audit. QMB or auditor (in the case of internal audits with an external site, possibly with KKS management) Customer consent may have to be obtained for on-site audits. This is a QMB and Page 5 of 15 23.08.2006
factor when for example KKS wants to audit its monitor in a clinical trial, but the trial site is not the KKS itself. The customer s consent to an audit must be obtained in writing; at the same time, an agreement needs to be reached with the customer about how to handle the audit report and whether to prepare a letter of thanks or audit certificate. When the audit plan is submitted, the persons to be audited will be notified of their requirement to participate and be asked for any additional documents that may be needed such as the protocol, monitoring reports, etc. A deadline for returning the proposed change to the audit plan will be set, and the auditor will sign the audit plan. If necessary, the responsible auditor will provide the names of other coauditors or accompanying experts. If inexperienced auditors are assigned audits, the QMB will assist with this process. KKS management, QMB The finalized audit plan is given to the contact person of the area to be audited. Contact persons must be informed that they are responsible for notifying all the persons and facilities that will be audited, and that they must be available during the audit. 3.3 Performing audits The audit commences with the introduction of the auditor. After the introduction, the auditor briefly explains the purpose, scope and time required for the audit. The audit procedure depends on the purpose as well as the trial site, facility, area, or department to be audited. Any necessary changes to the audit plan must be briefly determined. Furthermore, depending on the planned scope of the audit (such as a system audit of all areas), it needs to be determined if each of the affected members can see the complete audit report, or if the audit report should be divided into the corresponding areas, and each party or area concerned will be provided with the part of the audit report that concerns them. All employees concerned should be present at the introductory discussion. The audit plan identifies who these individuals are. A reference should also be made to the final audit discussion, which all those concerned should also attend. The audit shall be carried out according to the audit plan. In the case of external audits (on-site audits), the persons need to be identified who the auditor can contact if necessary when the auditor is performing tasks by himself, such as SDV. If two auditors are performing the audit, it should be mentioned in the introductory discussion at the latest that none of the audited persons need to be present during these phases. The auditors should have the opportunity to discuss the progress of the audit without interference as needed. 3.3.1 Contents of system audits The following should be audited in system audits, which determine whether an trial site or another facility can participate in a clinical trial: Organizational diagrams Quality management manual Page 6 of 15 23.08.2006
SOPs Qualification and continuing education of the personnel Personnel workload Workplaces, task descriptions, job descriptions Computer systems Technical facilities Equipment including secure access to the investigational drug Emergency management Archiving options Data protection Documentation instructions and templates for maintaining the cold chain (such as the centrifuge manual, refrigerator temperature logs) System audits can also be used to review the quality management system of the KKS as a whole or its individual departments. System audits can be comprehensive, or they can deal with the (quality management) system, or parts thereof (process audit), or individual processes. System audits at the KKS should be planned according to the individual requirements. The topics listed can be cited in the audit plan under "Basis for the audit (subject/process)". The audit involves tours of the facilities, an inspection of documents, and interviews with responsible parties and employees. Discussions during the audit should occur at the audited employees work place. 3.3.2 Contents of trial audits Trial audits can occur at any time during a clinical trial. Ideally, on-site audits are performed after the first patient or healthy subject has been included and the first monitoring visit has taken place. The trial site is normally informed of the intention to perform an audit approximately 4 to 6 weeks before the planned deadline, first by telephone, and then shortly after this in writing. The letter to the investigator should include the date of the audit, the names of the auditors and any accompanying experts, an overview of the topics, and a general timeframe. The letter should again inform the responsible investigator that his presence is required during the audit. The auditor will inform the clinical trial monitor of the audit date in writing. The auditor should obtain the following documents, preferably from the monitor, before the audit: SOPs Protocol including amendments Subject/Patient Information Informed Consent Declaration CRF Monitoring handbook Monitoring reports If applicable, additional documents concerning the trial such as laboratory instructions Trial site-specific documents: Page 7 of 15 23.08.2006
List of the staff involved in the clinical trial Overview of SAEs/AEs Overview of investigational medicinal products (drug accountability) List of previous monitoring visits If applicable: overview of randomization In the audit of an trial site, the investigator should provide the auditor with a description of the trial covering the following points directly after the introductory discussion: The organization of the clinical trial The participating assistants and their jobs and responsibilities Methods of recruitment Subject/Patient Information and method of obtaining the Informed Consent Declaration The recruitment rate of trial subjects The schedule of examinations and samples according to the protocol Any deviations from the protocol Any problems that have arisen The randomization procedure The location(s) of the protocol and its availability to the staff involved The investigational medicinal products procedure and storage conditions The procedure for reporting SAEs/AEs Special features of the laboratory Whether and how the general practitioner or any other attending physicians (in the hospital) will be informed about the subject s participation in the clinical trial The feasibility of the clinical trial with regard to workload (how many clinical trials are being carried out, staff relieved of regular duties to perform clinical trial work, etc.) Finally, the auditor should have the participating assistants describe their activities in the clinical trial. Furthermore, the auditor will check the following points on site: Documentation in the Investigator Site File and Trial Master File (singlecentre trial) Documentation and reporting of SAEs/AEs Storage of the investigational medicinal products Equipment, if applicable Whether there are any evident deviations from the protocol Database Data protection Archiving Contracts/agreements Subject/Patient Information and Informed Consent Declaration Monitoring log Drug accountability Laboratory data are reference ranges available Laboratory are interlaboratory proficiency certificates available Are all the necessary medical records available SDV: 100% for at least one trial subject's medical records with CRF. The number of items when performing SDV depends on the clinical trial. Page 8 of 15 23.08.2006
In an on-site audit, the auditor should not mention findings concerning the quality of the monitor s work during the final discussion at the general session. The auditor should not harm the reputation of the monitor as an intermediary between the sponsor and trial site, and as the person responsible for quality control. If any such findings have been made concerning the quality of the monitor s work, they should be discussed with the monitor personally. Usually the trial sites do not receive audit reports since they also include findings concerning the monitor. Generally speaking, the sponsor is responsible for ensuring that the monitor implements the appropriate measures for improvement and is also responsible for monitoring their implementation. 3.3.3 Content of product audits In product audits in clinical trials, the CRF or protocol is usually audited. The purpose of the audit is to check whether the documents prepared meet all the necessary requirements. The requirements may be specified in the following documents, or may be specifications from the following institutions: - ICH-GCP - Directives - Laws (such as the German Drug Law, Medical Devices Law, Federal or State Data Protection Law) - Regulatory requirements and standards for adhering to recognized national and international standards of science and technology - Ethics committees - Authorities - SOPs in force The documents and specifications that are to be used must be listed in the audit report under the heading Basis for the audit. At the beginning of the audit, it must be noted that the author of the CRF or protocol is responsible for processing the findings in the audit report. A product audit generally does not involve the interview phase (including the introductory and final discussion). When the audit report is supplied to the author of a document, the author should be informed that the auditor can be approached with any specific questions. 3.3.4 Contents of a procedural audit In process audits, SOPs usually form the basis of the audit. The primary objective of a procedural audit is to check if the SOPs at KKS are used in practice by the employees, or if they are practical and relevant for the employees. In addition, the audit can also serve to check if the applicable SOPs meet all the necessary requirements and contain the best methods for carrying out processes. The requirements can be generated by the following documents or specifications from the following institutions:, QMB - ICH-GCP - Directives - Laws (such as the German Drug Law, Medical Devices Law, Federal or State Data Protection Law) - Regulatory requirements and standards for adhering to recognized national and international standards of science and technology Page 9 of 15 23.08.2006
- Ethics committees - Authorities It is generally best to perform this type of audit in interviews with employees. Documents should be inspected after the interview phase. The inspections are to demonstrate that the SOPs are being adhered to (for example in specific clinical projects). The QMB monitors the processing of the findings in the audit report. 3.4 Conclusion of the audit After the actual audit is over, a final discussion is held with the audited persons. All of the people affected by the audit should be present. This should be communicated at the latest in the introductory discussion. In the final discussion, positive feedback is presented in addition to information on potential or necessary improvements. However, the auditor is not acting as a consultant, in contrast with the monitor. The auditor's main task is to prepare a well-founded audit report for the sponsor (manager of KKS or QMB, or the sponsor). The auditor should not mention or discuss highly critical findings (for example concerning lack of conformity with GCP at the trial site) at the final session. Random samples are generally taken in the audit due to the time constraints, and the audit report should always refer to this fact. The following formulation can be used: "Because random samples are used in an audit, it is possible that additional problems or deviations exist which have not been identified by this audit." The QMB or individual department is responsible for specifying improvement measures emerging from internal system and process audits. If the department is responsible, it must decide how the information is to be communicated to QMB (QMB may need to be consulted) and how QMB will be informed of how the improvement measures have been implemented. If necessary, a followaudit will be conducted. QMB 3.5 Reference documents for auditors during the audit Checklists can be used for the audit, such as checklists from SOPs on preparing the trial protocol. The checklists cite topics and points that are to be dealt with. Check-off categories are provided in checklists such as done, not done, and not applicable. The checklists are to be individually adapted to the audited trial site or facility and the purpose of the audit. If checklists are used, they are to be archived as an audit log. The audit log serves as the basis for the audit report. All of the documents that are used for preparing and performing the audit belong to the auditor and are to be archived by the QMB of KKS. These documents may not be filed in the trial folders (ISF etc.) at the facility. The audit log (surveys and checklists) can be destroyed after the findings of the audit report have been completely processed. In addition, question lists can be prepared for the audit. Question lists contain specific questions that are posed to the audited persons. Fields for the responses are provided in the question lists. The questions lists are stored in the same way as the checklists. Page 10 of 15 23.08.2006
The question lists and the checklists help auditors perform audits in a structured manner, especially those who are not so experienced. However, audits are always influenced by special aspects and considerations regarding the institutions and persons involved, and the auditor can deviate from the question lists and checklists if needed in an audit. As needed, the auditor chooses the checklists relevant for the audit from the Appendixes of the relevant SOPs, checks their applicability, and adapt them to the situation of the clinical trial. 3.6 Audit documentation An audit report is to be prepared after an audit. The management of KKS will determine if an audit report by inexperienced auditors needs to be reviewed before passing it on to the department audited. The QMB (if not the auditor) or the management of KKS can review the audit report. The reviewer checks if the formulations are unambiguous and objective, there is adequate evidence to support the findings, and the content is correct. KKS management The basic data are again listed in the audit report, brief positive feedback is provided, and the findings are listed. Recommendations on improvements can also be provided in audits. If the management of the KKS reviews the audit report of inexperienced auditors, the audit log can also accompany the audit report. This gives the management of the KKS an opportunity to support any observations that were not recorded in the audit report but led to a finding or recommendation in the audit report. The findings should be evaluated. Definitions for the evaluation can be found in Appendix 4, and should be adapted to the audit as needed. The definitions should accompany the audit report so that the facility audited can determine the seriousness of the findings and the urgency of rectifying them. Reasons for the findings can be provided if needed. If arranged beforehand, the audit report draft should be sent to the audited persons for their comment within 14 of the audit. The audited facility should include a statement on the findings in the comments, e.g. that the finding will be rectified by a particular date by a particular person; or that the finding is not applicable for the following reasons, etc. The auditor is responsible for finalizing the audit report within an appropriate period (approximately 4 weeks for an audit report with comments; approximately 2 weeks for an audit report without comments). The auditor is responsible for ensuring that the deadline given for the comments is adhered to. The comments provide the auditor with information on how a facility is dealing with the findings or plans to deal with the findings. If an audit certificate is provided, the findings must be evaluated. The auditor can decide whether to provide an audit certificate based on improvements in (at least) the most problematic findings. If comments on the audit report are given to the auditor that the auditor finds unacceptable, the audit certificate will not be issued. The auditor will communicate this fact to the audited persons and will attempt to find a solution. If necessary, the QMB or management of, QMB, KKS management Page 11 of 15 23.08.2006
KKS will be asked for their input. The general location where the audit certificates are filed must be indicated. The comments from the facility audited form part of the audit report. The original version of the finalized audit report is sent to the QMB/KKS management/sponsor. The employees audited can be given a copy of the audit report. The distribution list for the audit report should be agreed at the beginning of the audit (interview) with the employees of KKS. If the audit takes place at an external location (such as an on-site audit), the distribution list for the audit report should be determined with the persons concerned when the audit ends. Audit reports are to be filed with the QMB separate from the trial folders for the clinical trial. The documents from the QMB are to be archived separately from the trial folders. The audit certificates for on-site audits and product audits (protocol, CRF) are to be filed in the TMF. The original or a copy of audit certificates for on-site audits is also to be filed in the ISF. The audit certificates do not contain an evaluation of the audit, i.e., there is no proof of quality, they document only that an audit has occurred. QMB Trial coordinator If the audits are contracted out, copies of the audit certificates are created for the trial folders at the KKS and for filing at QMB when the originals for on-site audits or product audits are prepared by the auditors. Page 12 of 15 23.08.2006
3.6.1 report for an internal system audit done by a third party The audit report of system audit conducted by a third party should contain the following information: Cover sheet: - Goals and scope of the audit - Sponsor - Address - Address of the person who will receive the original audit report - Distribution list of those people who will receive a copy of the audit report - Type of audit - Period of the audit - Audited trial sites/facilities/system/subsystem process/division/department - Basis for the audit - (s) Subsequent pages: - General Information - Summary - List of results (depending on the purpose of the audit) = findings including evaluations - Definition of the evaluation - Comments from the trial site/audited facility - Signature of auditor(s) 3.6.2 Audit report of an on-site audit The audit report of an on-site audit should include the following information: Coversheet: - Goals and scope of the audit - Sponsor - Address - Address of the person who will receive the original audit report - Distribution list of those people who will receive a copy of the audit report - Type of audit - Period of the audit - Title of the clinical trial including the trial design - EudraCT No. if applicable - Code (brief trial ID) for the clinical trial - Audited trial site - Basis for the audit - (s) Subsequent pages: - General Information - Summary - Signatures of the auditors - List of the results on the: Personnel and organization Devices and equipment Page 13 of 15 23.08.2006
Required regulatory documents Subject/Patient Information and Informed Consent Declaration Investigational medicinal products Monitoring SAE/AE/ADR CRF, review of the trial subject files (raw data) = findings including the evaluation - Definition of the evaluation - Comments from the trial site - Signature of the auditor(s) The audit certificate should contain the following information: - Audited trial site - Confirmation that the audit was performed according to applicable laws and GCP guidelines - Title of the clinical trial including the trial design - Code (brief trial ID) for the clinical trial - EudraCT No. if applicable - Monitor responsible, if applicable - Period of the audit - Signature of the auditor(s) If a letter of thanks instead of an audit certificate is sent to the trial site, the same information should be included in a letter of thanks. 3.6.3 Audit report for an internal system or process audit The audit report for an internal system or process audit should contain the following information: Cover sheet and subsequent pages: - Audited area/process - Goals and scope of the audit - Type of the audit - Period of the audit - Responsible parties/participants (distribution list) - Findings and any additional evaluations - Summary (with positive feedback) - Improvement potential > recommendation to KKS management The audit report should include fields for: - A statement by KKS management on improvement potential, and - A notice of performance from QMB after a follow-up measures have been taken. This enables management to influence internal improvement measures and track the performance of the measures and their effectiveness. 3.7 Evaluation of audit findings Audit findings are generally evaluated. Definitions of the evaluation can be found in Appendix 4. If necessary, the definitions should be adapted to suit the audit performed. The evaluation definitions should accompany the audit report so that the facility audited can assess the seriousness and urgency of rectifying findings. Page 14 of 15 23.08.2006
4. References German Drug Law (AMG) of 12 December 2005 (BGBl. I p. 3394) Medical Devices Law (MPG) of 7 August 2002 (BGBl. I p. 3146) ICH Topic E6, Note for Guidance on Good Clinical Practice (GCP) (CPMP/ICH/135/95), 1997 Regulation on the Application of Good Clinical Practice when Conducting Clinical Trials with Medicinal Products for Human Use (GCP Regulation GCP-V). Berlin: Federal Ministry for Health and Social Security. 9 August 2004. (BGBl. I 2004 S. 2081) DIN EN ISO 9000:2000 DIN EN ISO 9001:2000 DIN EN ISO 19011:2002 "Guidelines for quality auditors planning and performing audits according to DIN EN ISO 9001:2000", Hanser-Verlag 5. Changes from last version None first version Page 15 of 15 23.08.2006