Audits are systematic, independent examinations of manufacturing and quality systems to verify compliance with GMP requirements. They are divided into internal audits (self-inspections conducted by the organization) and external audits (conducted by customers, regulators, or third-party certification bodies).

What Are Internal and External Audits?

Internal audits are planned self-inspections that assess a facility’s own compliance with GMP and internal procedures. External audits include supplier audits (evaluating raw material or contract service providers), customer audits (where pharmaceutical companies audit their contract manufacturers), and regulatory inspections (discussed separately in Regulatory Inspections). Both types follow a similar cycle: planning, preparation, execution, reporting, and follow-up.

Regulatory Framework

EU GMP Chapter 9 (Self-Inspection) requires manufacturers to conduct regular self-inspections. ICH Q10 includes internal audit as a key element of the Pharmaceutical Quality System. 21 CFR Part 211.22 requires the Quality Unit to have the authority to conduct audits. ICH Q7 Section 2.4 requires internal audits for API manufacturers. PIC/S PI 009 provides guidance on auditing quality systems.

Key Requirements

Internal audits must be scheduled based on risk — high-risk processes (sterile manufacturing, potent compounds) may be audited annually, while lower-risk areas may be every two to three years. Each audit requires qualified auditors who are independent of the area being audited. An audit checklist ensures coverage of all applicable GMP elements. Audit findings are classified as critical, major, or minor, and each finding must be linked to a CAPA. An audit report is issued within a defined timeframe, and CAPA effectiveness is verified at closure.

Practical Implementation

An annual audit schedule is developed based on risk assessment and approved by quality management. Auditors use questioning, document review, and facility walk-throughs to gather evidence. Opening and closing meetings establish scope and communicate findings. For supplier audits, audit outcomes feed into the approved supplier list and may affect procurement decisions.

Common Pitfalls

A common weakness is internal audits that are too superficial — focusing on documentation review without adequate facility observation or operator interviews. Another is failing to verify CAPA effectiveness during follow-up audits, which allows recurring issues to persist undetected.

Conclusion

A robust audit program — combining rigorous internal self-inspections with thorough external supplier audits — is essential for maintaining GMP compliance. Audits provide an objective window into the true state of quality systems and drive continuous improvement.