Devine Guidance

MHLW MO 169 – Chapter 3 – Internal Audit

By Dr. Christopher Joseph Devine

The performance of internal audits is one of the viable tools that should reside in any respectable organization’s quality management system tool chest.

Happy 2013!  For those of you believing that the world would end on 12/21/12, surprise, surprise, surprise (thank you Gomer Pyle, USMC), it’s back to work with the lot of you. I hope each of you had a great holiday and no lasting ill effects (i.e., hangovers) from the celebration.
Ohayou Gozaimasu. This week the term/phrase specific to Japan, the doctor would like to introduce to the readers is: “Wakarimasen.” For those of you moderately fluent in Japanese, the phrase is: “わかりません。” The literal translation is “I have no idea” or simply stated when hanging in the hood, “huh?” If someone from PMDA employs this phrase, followed by “what you are talking about” the doctor thinks that trouble just might be on the horizon.
The performance of internal audits is one of the viable tools that should reside in any respectable organization’s quality management system (QMS) tool chest. Executing audits are a quick and easy way of ascertaining ongoing compliance to an organization’s policies, procedures, recognized standards, and the topic of this Devine Guidance (DG) series, Ministerial Ordinance 169 (MO 169), a.k.a., a regulation. The internal audit requirement is another salient element that is present in just about every regulatory system known to man, so it puzzles the doctor when I visit device manufacturers and their suppliers and find that internal audits are not being actively pursued. When Dr. D asks the inevitable question of why, the answer is always the same; “lack of resources or management support.” People, what part of internal audits being mandated by regulation (a.k.a., LAW) is not being understood? Now if an organization fails to perform internal audits during the holidays, blaming the lapse on the consumption of too much “glogg and wassail” (look-them-up) may be a viable excuse. However, unless you are F. Scott Fitzgerald, this excuse will not work for the remaining 50-weeks of the year. Enjoy!
Ministerial Ordinance Number 169 (2004)
Chapter 3 Manufacturing Control and Quality Control in Manufacturing Sites of Labeling, etc. – Category Medical Device Manufacturers, etc.
(Internal Audit)
Article 70. The labeling, etc. – category medical device manufacturer, etc. shall have the person designated beforehand conduct the following duties in accordance with the documented procedure.
(1) To conduct periodic internal audits on the manufacturing control and quality control of the products in the manufacturing site,
(2) To report in writing the results of the internal audits to the responsible engineering manager, and
(3) To establish and maintain records on the results of the internal audits.
2. The labeling, etc. –  category medical device manufacturer, etc. shall take necessary actions in case where any improvement is needed for the manufacturing control and quality control in accordance with the results of the internal audits specified in preceding Paragraph 1, and establish and maintain records of the actions taken.
What device manufacturers need to know
Article 70 is nothing more than a re-enforcement of Article 56, appropriately named “Internal Audit.” You see, MO 169 requires more than just a procedure for compliance. The good folks at MHLW and PMDA actually expect device manufacturers to perform internal audits. Dr. D can also tell you that it becomes readily apparent early on in the inspection process, organizations performing effective internal audits versus those that are not. Similar to FDA and the notified bodies, if multiple observations and non-conformances are being noted during an inspection, PMDA will quickly come to the conclusion that internal audits are either ineffectual or not being performed. Either way, the Chief Impalable Officer (CIO) is being placed in a precarious position, sword in hand.
From a MO 169 perspective, the internal audit process is straight forward and contains five salient components:
  1. Organizations must establish a “written” procedure for internal audits;
  2. Organizations must actually perform internal audits;
  3. Organizations must report the results of internal audits (in writing);
  4. Organizations must maintain records of internal audits performed; and
  5. Organizations must actually pursue corrective action if the results of an internal audit warrant such action must be taken.
What device manufacturers need to do
Simply stated; “performed the darn audits!” If an organization is resource challenged, it is perfectly acceptable to hire a third-party auditor to perform internal audits. Heck, you can even give Dr. D a call and he would be happy to execute your internal audits for you (for a price of course). Folks, the bestest (the doctor’s word) short and sweet advice that Dr. D can offer is that not performing internal audits because of resource constraints is not going to score many points with PMDA. In fact, not performing internal audits places an organization in an extremely precarious position not only with PMDA, but all regulatory bodies. Can you say; “Stop shipping product and address your compliance issues ASAP?”
From a procedural standpoint, an SOP for internal audits is a simple document to script. The procedure, as a minimum must: 
  • Contain a requirement to ensure audits, assessing all aspects of the QMS, are performed;
  • Define audit frequency;
  • Define the publishing of an audit schedule;
  • Define audit scope and methods employed for auditing;
  • Contain requirements and skills for auditors (recommend reading ISO 19011);
  • Contain a requirement that auditors cannot audit their own work or functional organization;
  • Ensure audit results, including non-conformances noted, are recorded and retained as a quality record;
  • Ensure re-audits and increased frequency of audits are performed for problem areas; and
  • Ensure that corrective action is pursued when non-conformances are identified during the execution of an internal audit.
An extremely important concept to grasp, regardless of who is performing the audits (internal resource or contracted resource) is that a written procedure and evidence of training is required. A second point to remember is that audit frequency is up to the organization. Best practice would be to schedule and conduct audits on a monthly basis. The typical practice the doctor sees are audits being performed on a quarterly basis. While sometimes Dr. D sees organizations performing all of the internal audits annually, during one extremely intense week. Regardless of the approach, it is important to remember an audit is just a snapshot of the QMS element being audited at a specific point in time. Not wanting to state the obvious but obliged to do so, “Performing audits more frequently will enhance the effectiveness of the QMS.” This is real rocket science right?
As you can see from Table 1.0, the internal audit requirement easily maps to 21 CFR, Part 820 and EN ISO 13485:2012. This is no coincidence as the performance of internal audits is a universally accepted QMS requirement.

Table 1.0 – Sample Requirements Matrix

 Procedure (s)

  Procedure Name(s)


  21 CFR, Part 820

 EN ISO 13485:2012 

 MHLW MO 169

 1266-1 Rev B 

 Internal Quality Audits 

 Internal Audit



 Article 56

 Article 70

For this edition of DG, the doctor will leave the readers with just one takeaway. “Do the darned audits.” It is a regulatory requirement to perform internal audits and not having adequate resources is not an acceptable excuse. In fact, not performing internal audits because of insufficient resources can result in an additional inspection observation (non-conformance for the ISO folks) for management responsibility. Why? Just in case an organization has not figured it out, it is management’s responsibility to ensure the availability of adequate resources (Article 10).

Until the next edition of DG, when the doctor provides guidance on: MO 169 – Chapter 3 “Manufacturing Control and Quality Control in Manufacturing Sites of Labeling, etc. Category Medical Device Manufacturers, etc.” (Article 71 – Training), sayonara from Dr. D and best wishes for continued professional success.

  1. Code of Federal Regulation. (2011, April). Title 21 Part 820: Quality system regulation. Washington, D.C.: U. S. Government Printing Office.
  2. Device master file. (2012). Emergo Group Website. Retrieved November 29, 2012, from
  3. EN ISO 13485:2012. (2012, February). Medical devices – quality management systems – requirements for regulatory purposes (EN ISO 13485:2012).
  4. Linguanaut the Japanese phrases and expressions. (2012). Retrieved September 8, 2012, from
  5. Ministerial Ordinance 169. (2004). MHLW ministerial ordinance 169 on standards for manufacturing control and quality control for medical devices and in-vitro   diagnostic reagents. Retrieved June 1, 2012, from
  6. Quality management system inspection of medical devices and in-vitro diagnostics in Japan (2012). PMDA Website. Retrieved November 30, 2012, from

About The Author

Dr. Christopher Joseph Devine, President, Devine Guidance International