Quality Management System Audits: Navigating 21 CFR 1271 and AATB
In today’s rapidly evolving regenerative medicine landscape, the assurance of safety, efficacy, and reliability in tissue banking is not just a regulatory requirement, it’s a moral imperative. Auditing a Quality Management System (QMS)/Quality Program for compliance to the Food and Drug Administration’s (FDA) requirements (21 CFR 1271) and other applicable standards such as the American Association of Tissue Banks (AATB) is a rigorous and an essential task to ensure patient safety. Let’s dive into some best practices and focus on some key areas for insights into a successful QMS audit (a.k.a. internal audit) for your establishment!
Understanding the Requirement Framework
A quality audit as defined by the FDA is a “documented, independent inspection and review of an establishment’s activities related to core Current Good Tissue Practice (CGTP) requirements. The purpose of a quality audit is to verify, by examination and evaluation of objective evidence, the degree of compliance with those aspects of the quality program under review” [1] . 21 CFR 1271 issued by the FDA lays down the comprehensive regulations for Human Cells, Tissues, and Cellular and Tissue-Based Products (HCT/Ps). The intent is to prevent the transmission of communicable diseases and ensure only safe and effective tissues are made available for clinical use. The scope of this framework covers establishment registration, donor eligibility and screening, processing and process controls, tracking and traceability, complaint handling and adverse reaction reporting, labeling and packaging controls, pre-distribution and distribution, and record-keeping which equates to a robust QMS.
The AATB Standards are widely recognized as the gold standard for tissue banking operations, including detailed requirements that provide more clarity and detail then the federal regulations. AATB emphasizes risk-based approaches, robust process validation, staff competency, and continuous improvement, while aligning closely with national requirements and international best practices.
Strategizing and Planning: Preparing for a QMS Audit
Scope and Objectives: Understanding the scope and objectives will define whether the audit is focused on compliance, certification, or internal improvement.
Documents: Prepare procedures, policies, validations reports, donor records, trending reports, continuous improvement items such as deviation/nonconformance/corrective and preventive action and complaint handling reports, previous audit findings, and training records (all QMS records).
Audit Team: Ensure auditors have proper training in all regulations and standards as appropriate and are independent of the areas being audited. When internal resources are limited, some establishments also hire Third Party consultants, such as those at Solaris.
Audit Checklists: Building comprehensive checklists based on the regulations and standards will help organize the areas audited, also allowing establishments to prioritize high-risk processes and prior audit findings.
QMS audits should be conducted at a minimal frequency of once per calendar year. How an establishment defines the audit of major tissue banking operations systems to identify trends or recurring problems including focused audits of critical areas is set by the establishment through their procedures. Audits are performed by those trained staff members who do not have direct responsibility for the process that is being audited [2] or where there are limited resources, using a Third Party to perform this function.
Conducting the Audit
Begin with systematic document and record review, cross-reference procedures and records with the requirements.
Observe actual operations paying attention to staff following written procedures, use of qualified equipment, and adhering to aseptic technique (where applicable).
Interview staff at all levels to gauge their understanding of the requirements and procedures, ask about recent changes, deviations, or corrective actions.
Inspect the facilities for cleanliness, environmental monitoring, equipment qualification and calibration, and documentation controls in minimizing contamination risk.
Verify that tracking from donor to product and vice versa is robust and records are readily retrievable.
Evaluate how deviations, nonconformances, complaints, and adverse events are captured, investigated, reported where applicable, and resolved. Are root cause analysis techniques used as well as effectiveness checks?
Verify where appropriate that processes are validated and revalidated periodically to ensure process and processing controls are effective and safe.
Ensure training records are up to date with staff evaluated for ongoing competency and retraining occur after any major procedure change or deviation.
Ensure records are legible, secure, and retrievable throughout the required retention period and where electronic records and/or electronic signatures are used, compliance to FDA’s 21 CFR Part 11 [3] .
Verify for ongoing quality continuous improvement beyond the requirements, such as use of metrics, management review, internal audits, and customer feedback loops.
Handling Audit Findings
Prepare to open corrective and preventive actions, performing root cause analysis especially for major events, using effectiveness checks, and being receptive to observations found. Perform re-training and enhance current training where needed. Fostering a culture of transparency and encouraging reporting of deviations and nonconformances without punishment or retaliation will help an establishment grow together and commit to continuous improvement, driving excellence.
Best Practices
Stay current: Are you up to date on the most current regulations and standards? Regulations and standards evolve, and regularly reviewing this information will help keep you aware of any change implementation and risk that will impact your QMS.
Engage leadership: Senior leadership should participate in QMS reviews and audits to reinforce a quality-focused culture.
Risk-based Approaches: Prioritize audits and corrective actions based on risk to product quality and patient safety.
Document! Document! Document!: Did I mention document? The golden phrase across any regulated industry is, “If it is not documented, it did not happen”. Meticulous record-keeping is not negotiable, this is how a company builds history and leaves a legacy!
Follow-up: Track corrective actions through completion and verify effectiveness during subsequent audits. If a corrective action has an annual birthday arriving because it hasn’t been resolved, this poses a significant challenge to the establishment’s continuous improvement efforts, a new systematic approach focusing on root cause is necessary.
In the industry of tissue banking, compliance with 21 CFR 1271 and applicable standards is vital for protecting patients, securing accreditation (where applicable), and maintaining public trust. By conducting thorough, risk-based audits and embracing a culture of continuous improvement, establishments can ensure their QMS not only meets regulatory and industry benchmarks, but also truly drive their commitment to continuous improvement and excellence.
Need help or have questions about performing internal audits? Contact us here!
Check back later for an upcoming blog on performing external audits as part of supplier qualification!
References
[1] https://www.ecfr.gov/current/title-21/chapter-I/subchapter-L/part-1271
[2] American Association of Tissue Banks, Standards for Tissue Banking, 15th Edition (April 2025), https://www.aatb.org/
[3] https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11