GMP audits: internal and supplier

Internal audit is included among the processes described in the quality management system overview. It supports a company’s understanding of its own system. That role differs from an FDA inspection, which is a regulatory activity. An internal report does not determine regulatory status, and an audit cannot assure that an investigator will make no observations.

The purpose should guide the scope. A review of laboratory records may examine how results reach a batch decision. A supplier review may focus on the controls relevant to a particular material. A broad system review may examine the connections between investigation, change control and training. Without a clear purpose, an audit can drift toward whatever is easiest to inspect.

A useful scope identifies the activities, expectations and evidence needed to answer the audit question. It should also state practical limits. Looking at a selection of records does not establish that every record has been examined. Making the limits visible helps readers use the conclusion responsibly.

Preparation starts with understanding what the process is intended to do. The reviewer needs current procedures, relevant standards and enough background to recognise significant departures. Previous concerns can suggest useful questions, but they should not predetermine the findings. A past issue might have been resolved, or a different weakness may now deserve attention.

A checklist can support consistency. It becomes less useful when it replaces thought. The reviewer should be able to follow a material, result or decision across related steps and ask whether the evidence remains connected. If a record points to another system, the review may need to follow that link rather than marking the first record as complete.

The ICH Q10 guidance page frames the pharmaceutical quality system as a model. In an audit, that systems view encourages attention to handoffs. Responsibilities, instructions and information need to work together. Preparation should therefore include the connections between departments, not just a collection of separate departmental forms.

During an audit, observation, discussion and record review answer different questions. Observation shows how a task is performed. Discussion helps explain the reasons behind a step or an unusual condition. Records provide evidence of earlier activities and decisions. Agreement between these sources builds confidence; disagreement identifies something that needs explanation.

Questions work best when they invite a description of the process. Asking how an operator identifies the current instruction is more informative than asking whether the instruction is current. Following a released material back to its incoming information can show whether identity and status remain connected. An audit is not improved by turning these discussions into a memory examination.

An observation should be recorded accurately enough to support the later finding. The reviewer needs to distinguish a direct observation, a statement made during discussion and an inference. Those are different forms of evidence. A conclusion becomes harder to assess when they are blended together without explanation.

A supplier audit is one part of understanding the source and reliability of an incoming material or service. Other parts include specifications, receipt controls, testing, quality information and examination of performance over time. A reassuring visit cannot substitute for the applicable controls at the receiving manufacturer.

Part 211 material controls describes written procedures for receipt, identification, storage, handling, sampling, testing and approval or rejection. Its provisions on component testing also set conditions for relying on a supplier’s analysis, including establishing the reliability of that analysis. Those requirements help explain why a supplier assessment needs more than a general impression of the facility.

The audit scope can follow the particular risk and activity. Relevant questions may concern how a material is identified, how changes are communicated, how test information is produced and how an unexpected result is investigated. Qualification needs to reflect the actual supply relationship. A supplier that performs several activities may not perform all of them for the material under consideration.

A finding should connect an expectation with evidence of the observed condition. It needs enough context for the responsible team to understand what was examined and why the gap matters. Describing only that a process is poor is not helpful. Listing a requirement without the evidence is equally incomplete.

For example, a review may find that the current procedure requires a check but the examined records do not show whether it occurred. The finding should explain the relevant procedure and the evidence examined. It should not assume that the activity definitely did not happen unless the evidence supports that conclusion. The distinction matters to the subsequent investigation.

Clear findings also help prioritisation. Related observations may point to a shared control weakness. The report should preserve that connection rather than leaving each observation isolated.

The value of an audit depends on what follows. Responsible teams need to examine the cause, decide what action is appropriate and provide evidence of completion. The reviewer then needs to assess whether that evidence addresses the finding. A revised procedure may help, but only if the revision resolves the identified weakness and reaches the people who use it.

Follow-up can include further record review, observation of the relevant work or examination of related performance information. The method should fit the issue. Confirming that a document exists does not show that a weak handoff now works. Equally, demanding a broad investigation for an isolated clerical correction may not be proportionate.

Recurring findings deserve examination of the earlier explanation and action. Repeating the same finding without learning from the response is a sign that the improvement loop itself needs attention.