Isolating the Quality Plan's unreviewed sections turned up a gap that had nothing to do with the sections themselves: the internal audit program's own training records hadn't kept pace with the sites and countries the audit scope had grown to include.
Scope grows faster than training, if nobody watches it
Adding a new country or site to audit scope is usually treated as a scheduling decision. It's also a training decision. An auditor can only credibly audit a site if their training record shows they're current on what that site actually does, and that record doesn't update itself when scope changes.
- Applying a clause-by-clause internal audit checklist against ISO 13485:2016
- Collecting objective evidence for each section
- Logging findings/observations through the internal audit SOP
- Updating training certificates for the newly added sites/countries
What an unaudited section actually risks
An unaudited section or site carrying an undetected nonconformance into an external MDSAP or notified body audit is the direct cost of letting training records lag behind audit scope. The gap is invisible internally right up until an external reviewer finds it first.
Closing the gap with a documented trail
Updating the internal audit SOP and training certificates extended audit scope to the newly added sites and countries with a documented, auditable trail, so the program's own records could stand up to the same scrutiny it applies to everything else.
The Real Takeaway
An internal audit program is only as strong as its training records.
Adding a new country or site to scope means the auditors need documented, current training before they audit it, not sometime after.