**Purpose of Module for Internal Auditing**:  This module provides an example template for use in internal auditing that your organization might use as part of your organization’s quality management practices relevant to APHIS regulations at 7 CFR Part 340 for certain genetically engineered (GE) organisms. 

**Biotechnology Quality Management Support**:  APHIS Biotechnology Regulatory Services has developed this module as one of a series of modules. Biotechnology Quality Management Support is useful for any organization that wishes to develop or improve quality management practices related to the APHIS regulations cited above. 

**Approach**:  The module includes a template (below) that your organization can customize specific to your needs and operational practices for the design and implementation of internal auditing.  Each section of the template has examples of what might be included in a standardized form for internal auditing.  The template is not a standard, but should be considered as a tool to modify to meet your organization’s needs.  

The example template is found on the APHIS BRS website at https://www.aphis.usda.gov/aphis/ourfocus/biotechnology/bqms.  Note that the template text in blue font serves as a prompt for describing your organization’s approach.

**Module:  Internal Auditing**

**Disclaimer:** This module provides a generalized guide for your organization’s quality practices relevant to your obligations under APHIS regulation found at 7 CFR Part 340.  Use of these modules and its content does not guarantee that the user’s activities are in compliance with 7 CFR part 340, and it does not eliminate the user’s obligations under any other statute or regulation.  If your organization wishes to use formal quality management systems, it is best to rely on qualified quality management professionals.  

Page 1 of 4

****

**1.0	PURPOSE:**This procedure describes the controls your organization uses for internal auditing for activities with regulated genetically engineered (GE) organisms; identification of those organisms; the way in which the process is monitored; and whether the monitoring and verification, as well as any changes in those activities, are effective. The procedure also explains the way in which planned activities are achieved and regulated activities are conducted. For example, species of regulated GE organism addressed in this procedure is [species name].  

**2.0	DEFINITIONS:**Insert any terms, acronyms or reference to a glossary here that may apply to this procedure.  For the sake of clarity, indicate any deviations in your terminology from the definitions and terms used in 7 CFR Part 340.  For example, the following might be some of the definitions used:

****

Audit Criteria – the set of policies, procedures or requirements.  Typically, audit criteria are used as a reference against which audit evidence is compared. 

Audit Scope – the extent and boundaries of an audit.  Typically, the audit scope might include a description of the physical locations, organizational units, species of regulated GE organisms, activities and processes as well as the time period covered.

Audit Frequency – Your organization’s entire quality management system might be audited annually, but the audit might be broken up into sections or categories depending on time availability and the season in which an activity takes place.   For example, your organization might want to audit planting or harvesting when those activities take place.  

Planned Arrangements – the activities planned well in advance to ensure that the outcome meets expectations. Typically this refers primarily to the section more specific to the APHIS regulation, but it could also relate to the quality objectives or specific areas being monitored or measured.

**3.0	RESPONSIBILITIES**

**3.1**Identify and record the relevant personnel involved in the internal auditing.  For example, this could be accomplished with an organizational chart or defined directly in the procedure. The level of specificity might identify any quality management representatives, corporate staff, field supervisors, or someone else engaged in the procedure for internal auditing. In some cases this procedure might require your organization to obtain information from multiple departments according to your organization’s structure (i.e.; legal, regulatory) — each of which could be described in this section.**

**

4.0 **INTERNAL AUDIT PROCEDURE**

Describe how your organization plans internal audits.  For example, planning the internal audit might consider the following:

**

Status and importance of the process and areas to be audited;Results of previous audits	Time availability	Time of year	Notice of when the audit plan will be sent (two weeks prior)	Whether some areas need to be audited more frequently than others

**4.2**Describe your organization’s audit criteria, scope, frequency and methods.  For example, the criteria of your internal audit might be your organization’s quality manual with associated documentation.**

The scope might describe the location of the audit(s), the regulated GE species, and the element or elements that you will cover on the audit. 

The frequency might be annually for the entire BQMS, but your organization might audit areas more than once if problems arise to warrant more frequent audits. The method to be used to conduct the audit also helps determine the frequency of the audit. 

The method of the audit is typically at the discretion of the auditor or the assigning organization. Different methods include but are not limited to: process audit, system audit, checklist audit, etc. 

**4.3**Describe how your organization will select internal auditors to ensure objectivity and impartiality. For example, an auditor might not audit their own work.  Auditors might be selected on their knowledge of your organization’s operations and the APHIS regulations.  Outside consultants or other qualified persons might be selected to conduct internal audits for your organization.****

**4.4**Describe who will take the responsibility for planning and conducting the audits.  For example, it might be your organization’s Quality Management Representative (QMR) or a designee.  Typically, a person in an organization has overall responsibility for an internal audit even if your organization uses the services of someone from outside the organization.**

**4.5****Describe who will report the results of the audit, as well as the manner for storage and retention of the audit results and any records related to the audit.

****

**4.6**Describe who has responsibility for the follow-up activities of the internal audits including verification that follow-up actions have taken place and that verification results have been reported*.*

A follow up activity might be assigned to the person managing the area where correction or corrective action must be taken.  For example, if the internal audit found that documentation associated with harvest equipment cleaning was obsolete and the field coordinator was in charge, the field coordinator might be assigned the relevant corrective activity.

· As part of additional follow up activities to an internal audit, an organization’s management typically ensures that corrective actions are taken without undue delay to eliminate detected nonconformities and their causes.**

· Describe how your organization reviews the results of internal audits as part of your organization’s management review meetings or other similar meetings.**

**5.0	REFERENCES**

**5.1**List here any references that your organization uses in its procedures for internal auditing.

****Examples might include:**

**Control of Documents

**Control of Records

**

List here any records or forms that apply to your organization uses in its procedures for internal auditing.

**Examples might include:

Audit Checklist	CPAR Form   

# image1.gif