Internal Audit (Self-Inspection) Workflow

📋

Internal Audit - The Quality System Checking Itself

Internal audit, referred to as self-inspection under EU GMP Chapter 9, is the mechanism by which a site verifies its own compliance with GMP requirements and its own procedures, independent of any regulatory inspection. A well-run self-inspection programme identifies gaps, drift, and emerging risks before they become findings in an external inspection or, worse, contribute to a quality event. The programme depends on genuine auditor independence, a risk-based schedule, and a closed-loop CAPA process that treats every finding as an opportunity for the quality system to improve.

EU GMP Chapter 9 · ICH Q10 · 21 CFR 211.22 · 21 CFR 211.180

EU GMP Chapter 9

ICH Q10

21 CFR 211.22

21 CFR 211.180

Internal Self-Inspection

Comprehensive site GMP audit covering all quality system elements, scheduled on a risk-based annual programme.

Scope: Full quality system

Frequency: Annual programme

Supplier / Vendor Audit

Audit of a raw material, component, or contract service supplier's quality system, assessing their capability to reliably meet GMP requirements.

Scope: Supplier quality system

Frequency: Risk-based interval

Mock Regulatory Inspection

Simulated regulatory inspection conducted internally to test inspection readiness and identify gaps before an actual agency visit.

Scope: Inspection simulation

Frequency: Pre-inspection or periodic

For-Cause / Targeted Audit

Focused audit triggered by a specific concern, such as a repeated deviation pattern, complaint trend, or prior audit finding follow-up.

Scope: Specific area or issue

Frequency: Trigger-based

Phase 1

Audit Planning and Scheduling

1Develop the risk-based annual audit schedule

Areas and systems prioritized for audit based on risk factors such as complexity, complaint history, deviation frequency, and time since last audit.

EU GMP Chapter 9

↓

2Define audit scope and checklist

Scope and reference checklist prepared for each scheduled audit, tailored to the specific area or system while grounded in a standardized site template.

ICH Q10

↓

3Assign qualified, independent auditors

Auditors assigned who are trained in audit technique and independent of the area being audited, avoiding any reporting relationship that could compromise objectivity.

EU GMP Chapter 9

↓

4Notify the audited area and confirm logistics

Audited area notified with sufficient lead time, and logistics such as document access and personnel availability confirmed ahead of the audit date.

EU GMP Chapter 9

Phase 2

Audit Execution

5Conduct the opening meeting

Opening meeting held to confirm scope, introduce the audit team, and align expectations with the audited area before examination begins.

EU GMP Chapter 9

↓

6Perform document and record review

SOPs, batch records, training records, and other relevant documentation reviewed against the audit checklist and applicable GMP requirements.

21 CFR 211.180

↓

7Conduct area walkthrough and interviews

Physical area walkthrough performed alongside personnel interviews to verify that actual practice matches documented procedure.

EU GMP Chapter 9

↓

Are potential findings identified during execution?

YES → Document objective evidence NO → Proceed to closing meeting

Phase 3

Findings Documentation and Classification

8Classify findings by severity

Each finding classified as critical, major, or minor per pre-defined criteria, with the classification driving the urgency of the required response.

EU GMP Chapter 9

↓

9Conduct the closing meeting

Findings presented to the audited area's management at a closing meeting, allowing immediate clarification of facts before the formal report is issued.

EU GMP Chapter 9

↓

10Issue the formal audit report

Written report issued documenting each finding with objective evidence, classification, and reference to the specific requirement or procedure involved.

21 CFR 211.180

Phase 4

CAPA and Follow-Up Verification

11Audited area develops CAPA response

Audited area develops a corrective and preventive action plan with a defined timeline, addressing both the immediate finding and its underlying cause.

ICH Q10

↓

12QA reviews and approves the CAPA plan

Quality unit reviews the proposed CAPA plan for adequacy before approval, confirming it genuinely addresses the finding rather than only its symptom.

21 CFR 211.22

↓

13Verify effectiveness and close the finding

CAPA effectiveness verified through follow-up review or a subsequent audit before the finding is formally closed in the tracking system.

ICH Q10

Finding Severity Classification

Critical Finding

A gap with direct potential to affect patient safety, product quality, or data integrity, or that reflects a systemic breakdown in a quality system element.

Immediate escalation required

Major Finding

A significant deviation from GMP requirements or internal procedure that does not present an immediate critical risk but requires prompt correction.

Formal CAPA required

Minor Finding

A localized or isolated gap with limited quality system impact, often procedural or documentation-related in nature.

Documented correction required

Critical Finding Escalation Steps

Step 1 - Notify site quality leadership immediately Critical findings communicated to quality leadership without waiting for the formal audit report to be issued.

Step 2 - Assess immediate product or patient risk Determine whether the finding has implications for product already released or in the distribution chain.

Step 3 - Implement interim containment if warranted Apply an interim control or containment measure while the full CAPA is developed, if the finding presents an ongoing risk.

Step 4 - Expedite CAPA development and approval Prioritize CAPA development for critical findings ahead of the standard timeline applied to major and minor findings.

Step 5 - Schedule a dedicated follow-up verification Verify critical finding CAPA effectiveness through a dedicated follow-up review rather than waiting for the next scheduled audit cycle.

Audit Programme Requirements

Genuine auditor independence Auditors free from any reporting relationship or direct responsibility for the area under audit, preserving objectivity in findings and classification.

Risk-based scheduling Audit frequency and depth scaled to the risk profile of each area, rather than applying a uniform schedule regardless of complexity or history.

Standardized checklist foundation Core checklist elements standardized across audits of similar scope, supporting consistency while still allowing area-specific tailoring.

Defined follow-up verification timing Timeline for verifying CAPA effectiveness defined in advance, scaled to the severity of the finding being addressed.

Common Internal Audit Scope Areas

Quality System Audit Broad review of the site's overall pharmaceutical quality system, including document control, training, and change control effectiveness.

Manufacturing Operations Audit Focused review of batch production, equipment qualification status, and adherence to approved manufacturing procedures.

Laboratory Systems Audit Review of analytical method compliance, equipment calibration, and laboratory data handling practices.

Data Integrity Audit Targeted review of electronic and paper record practices against ALCOA+ principles, including audit trail review and access control.

Facilities and Utilities Audit Review of HVAC, water system, and cleanroom qualification and maintenance status against documented requirements.

Supplier Quality Audit On-site or remote evaluation of a supplier's quality system, assessing their ongoing capability to reliably meet material or service specifications.

Cross-Site Audit Audit of a sister site within the same company, verifying consistent application of corporate quality standards across the network.

Regulatory Readiness Audit Mock inspection focused specifically on simulating the experience and rigor of an actual regulatory agency inspection.

Never do this

Assign an auditor to review their own area of responsibility. Schedule audits on a fixed calendar without regard to actual risk. Close a critical finding without dedicated follow-up verification. Allow a CAPA plan to address only the immediate symptom without evaluating the underlying systemic cause.

Self-inspection vs external inspection

A self-inspection is conducted by the site's own trained personnel under its own programme, giving the organization the chance to identify and correct gaps proactively, well before an external regulatory inspection would encounter the same issue.

Finding vs observation

A finding represents a documented, objective-evidence-supported gap against a specific requirement. An observation may note a lower-risk opportunity for improvement without necessarily representing a requirement failure, and the two should be tracked and classified distinctly.

Key regulations

EU GMP Chapter 9 - self inspection requirements and expectations. ICH Q10 - internal audit as a management review and continual improvement input. 21 CFR 211.22 - quality control unit responsibilities. 21 CFR 211.180 - records and reports retention requirements.