Treat Your Internal Audit Like an Escape Room, Not a Checklist
I've sat through a lot of internal audits over the years, on both sides of the table. Most of them follow the same script. The auditor opens the checklist, asks whether a procedure exists for clause X, asks to see a record, confirms the record is signed and dated, and moves on. Three days later there is a report with two minor findings and a lot of "compliant" boxes. Everyone feels good.
Six months after that, FDA or the notified body shows up and finds the thing the internal audit walked right past.
I think the problem is how we picture the job. A checklist audit treats the QMS like an inventory: is the item on the shelf, yes or no. The audits that actually find something treat the QMS like an escape room. You walk in, you look around, and you start pulling on whatever doesn't look right until you understand how the room works. Nobody gets out of an escape room by confirming that the furniture is present.
Why the checklist keeps missing things
The checklist isn't wrong. It's useful for confirming coverage. The problem starts when the auditor treats it as the entire investigation. Checking whether a procedure exists tells me little about whether the process actually works.
A QMS can have every procedure in place and still be broken in ways that matter. Some examples from my own experience, with the details filed off:
A CAPA procedure that was textbook, and a complaint trend that had been investigated and "closed" three separate times with three different root causes.
Signed supplier quality agreements for every critical supplier, and nobody had looked at incoming inspection trend data in over a year.
A complete, signed risk management file that was obviously written after the design was frozen, because none of the risk controls traced to anything in the design history file.
Each of those problems could slip through a superficial clause-by-clause audit. All three were real, and two eventually turned into FDA 483 observations.
What the escape room version looks like
In an escape room, one clue leads to the next. A good audit works the same way. I might pick up a complaint and follow it through the investigation, any CAPA, the risk management review, and any resulting design, labeling, or training changes. When the trail stops unexpectedly, I ask why. Was the complaint evaluated for its impact on the risk management file? Was the decision documented? Does the evidence support leaving the risk estimate unchanged? If a required assessment never happened, that's a finding. An unexplained handoff tells me where to investigate.
A few habits that separate the auditors who find things from the ones who fill in forms:
Show me, don't tell me. Anyone can explain their process. Pull a production lot at random and trace it. Pick a design change and follow it from the request to the released drawing. Choose a complaint from last quarter and ask to see where it ended up.
Chase what doesn't fit. A revision date that precedes the change request. A training record signed the day after the work was done. A supplier audit that was "waived" with no documented rationale. Small inconsistencies are usually the loose thread on something bigger.
Treat the whole thing as one system. Design controls, production, suppliers, complaints, and post-market surveillance are not separate rooms. ISO 13485 QMS processes and ISO 14971 risk management activities need to work together, and the interesting failures often show up at the handoffs.
Talk to the people doing the work. Operators and technicians know exactly where the procedure and reality diverge. If they're afraid of you, you'll never hear it. If they trust you, they'll show you the workaround everybody uses.
FDA changed its inspection program
If you want evidence that this is more than my opinion, look at what FDA did this year.
When the Quality Management System Regulation took effect on February 2, 2026, FDA retired QSIT, the Quality System Inspection Technique that had structured device inspections for more than twenty years. In its place came a new compliance program, CP 7382.850, Inspection of Medical Device Manufacturers.
QSIT was already a process-based approach, but its subsystem structure made it easy for companies to prepare one area at a time. Management Controls looked tidy, CAPA looked tidy, Design Controls looked tidy, and nobody looked hard at the seams between them. I have helped companies prepare that way.
The new program puts more explicit attention on risk and those connections:
Risk guides the inspection. CP 7382.850 organizes QMSR requirements into six QMS areas and four Other Applicable FDA Requirements. Investigators review risk management information and can follow issues across processes, focusing their attention where risk warrants it.
Two inspection models replace the old inspection levels. Model 1 generally applies to non-baseline surveillance, compliance follow-up, and for-cause inspections. Model 2 applies to baseline surveillance and PMA preapproval inspections, with more prescribed minimum elements. Either way, the investigator still has to work through the applicable requirements.
Your internal audit reports are reviewable. The former exemption under 21 CFR 820.180(c) is not retained in QMSR. FDA may now review internal audit, management review, and supplier audit reports, including records created before the effective date.
So what does that mean for your internal audit program? An investigator using the new program can move across connected QMS processes, following risk and evidence to decide where to look deeper. If your own audits never get beyond isolated clause checks, they are unlikely to uncover the same weaknesses.
And those internal audit reports may now be examined during an inspection. Forty boxes marked "compliant" with no sign that the auditor challenged process effectiveness may raise questions. A clean audit is defensible when the evidence supports it. An audit that never looked beyond the boxes is harder to defend.
How I run them
I still use a checklist. It helps ensure I cover the applicable requirements. But it doesn't dictate the investigation. The checklist tells me what I need to cover; the evidence tells me where I need to go.
Start with risk, not the clause list. Before I open a procedure, I ask where a failure would hurt a patient or sink a submission. That is where the hours go.
Sample with a purpose. I select representative records and follow them across the quality system. One complaint traced through investigation, risk assessment, corrective action, and effectiveness verification can reveal more than fifty isolated records. When the evidence suggests a broader problem, I expand the sample.
Interview the floor. Operators, inspectors, and technicians, not just the quality manager.
Write findings as a clear chain. State the applicable requirement, the objective evidence of what failed, and what that failure could mean for the process or product. The clause number belongs in the report, but it should not be the whole explanation.
Close the loop. A finding without a real root cause is a puzzle you will meet again next year, probably with an FDA investigator in the room.
The bottom line
QMSR has aligned U.S. requirements more closely with ISO 13485, and FDA's updated inspection program makes risk and process connections more explicit. For internal audits, the job is to show the system works. Having the right documents on the shelf doesn't prove that.
A clean checklist audit feels good for about a week. An audit that finds the thing you didn't know was broken makes your product safer and your next inspection a lot less interesting. I know which one I would rather pay for.
Next time you plan an internal audit, leave the clipboard in the conference room for an hour. Walk the floor, pull a thread, and see where it goes.
If your internal audit program still stops at subsystem checklists, or you want an outside set of eyes before your next inspection, get in touch at brian@gsdmeddevice.com or book a 30-minute call.
Comments