Auditors increasingly look for proof of “continuous improvement.” Depending on the type of audit—financial, regulatory and so forth—improvement varies in the eye of the beholder. Given all the other demands of business, how do you show progress across the board?
In my work helping executives and organizations with lean FDA compliance, I’ve identified three crucial components that prove to any auditor your commitment to continuously improve your controls, your product quality and the safety and well-being of your employees and consumers.
Risk Management
Simply put, you need some type of documented—and followed—risk assessment and mitigation process.
Firms in the software and the medical device industries often use Failure Mode and Effects Analysis (FMEA). The FMEA process identifies the failure, its effect and then probes for either solutions to fix the problem or mitigations to contain the risk. FMEA, however, is not for everyone and certainly not for every risk.
An internet search will give you plenty of additional risk assessment tools to choose from; select something appropriate to your company, its product and your industry’s litigation environment. In my work with small to midsize firms, I often suggest a simplified version of the Hazards Analysis and Critical Control Points (HACCP) risk method.
For most small to midsized firms (and for sake of argument, let’s consider a separate division of a large multi-national company as a midsized firm), a single risk assessment and management tool in use by everyone is far more cost-efficient and effective than multiple techniques targeted at varying specific types of risk.
Corrective Action
Now that you have a process in place to identify problem areas and potential risks, you need to document the actions taken to resolve or mitigate the issues, plus independent verification that the action worked. It is important to remember that risk mitigation is not risk elimination. Risk mitigation is simply reducing a risk to a level wherein you have confidence in your ability to control any situation that might arise as a result of the risk (thus the need for independent verification). Risk elimination is one type of risk mitigation, but do not let yourself become stuck on “elimination” as the ideal state for any given risk.
Use of corrective action and preventative actions (CAPA) to achieve continuous improvement in a risk-based decision-making environment requires documenting three items:
· How the action will prevent or mitigate similar issues in the future;
· Why you chose that particular action over others that might also have resolved future problems; and
· What monitoring you have put in place to verify the positive long-term impact.
Preventative Checks & Balances
When I conduct a mock FDA audit or Part 11 inspection, one of the first document sets I like to look at is the firm’s history of preventative checks and balances. Incomplete reporting – even at the dashboard level – typically indicates problems with continuous improvement.
When looking at such records, there are two questions I frequently get asked:
1. Preventative checks and balances seem like a Gordian knot – where and how do we start? Isn’t easier to just let “sleeping dogs lie”?
2. How do we put proactive checks and balances in place without using a heavy hand or being “big brother”?
Rather than getting tied into knots over questions of how much, where, how often, and so on (what one of my clients referred to as “analysis paralysis”), focus first on the checks and balances you can put in place without negatively impacting your business or the morale of your staff.
Ideally, you already have a holistic view of your organization and its compliance infrastructure (processes, control points, weaknesses, and so on), and thus can identify two or three possible areas to target for preventative controls. Chances are though, if you’re struggling to demonstrate continuous improvement, a mature holistic view isn’t in place yet. In that case, go back to a recent CAPA.
Assess the effort it took you to identify and then resolve the issue. Measure that against the anticipated effort a proposed preventative check and balance will take. Example: If it took 14 hours to resolve a mistaken purchase order and shipment, how much time would an independent review and approval of purchase orders take?
Final Thoughts
Demonstrating continuous improvement is also demonstrating awareness of your firm’s limitations. Your creativity is called for to find ways to continuously improve year after year. One attendee of my seminar on quality systems management review best practices has her team make a “Top 10” list of continuous improvement ideas at the end of every review session. Over the course of the next year, one by one, they either complete the ten items or document (with a memo to the file) why that could not undertake the improvement.
When you target – and document – the improvements you can make, you show the auditor that when it comes to compliance and quality, you do “get it.”
Do you have tips on how to demonstrate continual improvement? Add them in!