How to plan an internal audit programme for ISO 13485 and GMP

Most internal audit programmes start life as a spreadsheet with every QMS process down the side and twelve months across the top, one tick per process per year. It looks complete, and it satisfies nobody who reads it closely. A notified body auditor or an MHRA inspector will ask why the programme looks the way it does, who audited what, what was found, and whether the fixes worked. This article gives you a method for building a programme that answers those questions: how to schedule by risk, how to keep auditors independent in a small team, how to write checklists that test evidence, how to grade findings, and what the programme record should show when someone external opens it.

What ISO 13485 and EU GMP actually require of an internal audit programme

The two frameworks say similar things in different words, and it pays to know both if you make combination products or supply into pharma.

ISO 13485:2016 clause 8.2.4 requires a documented procedure for planning and conducting audits and for recording and reporting results. The audit programme has to be planned "taking into consideration the status and importance of the processes and area to be audited, as well as the results of previous audits". Criteria, scope, interval and methods must be defined and recorded. Auditor selection and conduct must ensure objectivity and impartiality, and auditors shall not audit their own work. The management responsible for the audited area must make sure corrections and corrective actions happen without undue delay, and follow-up must verify the actions taken and report the result. The full text is in the standard itself, available from ISO.

EU GMP calls the same activity self-inspection. Chapter 9 of EudraLex Volume 4 is short: personnel, premises, equipment, documentation, production, quality control, distribution, complaints and recalls, and self-inspection itself should be examined "at intervals following a pre-arranged programme". Self-inspections should be independent and detailed, carried out by designated competent people. Every self-inspection is recorded, with all observations, proposals for corrective measures, and statements on the actions subsequently taken.

Two things follow. First, the programme needs a written rationale behind every interval. Second, both texts care as much about what happens after the audit as about the audit. Self-inspection appears in its own list of areas to examine, so your audit process gets audited too.

Scheduling internal audits by risk

"Status and importance" gives you permission, and an obligation, to audit some areas more often than others. A workable approach is to score each process or area against a handful of factors and let the score set the interval.

Set three bands. High-scoring areas get audited at least twice a year, the middle band annually, and the low band across a two or three year cycle, provided nothing in the quality system triggers an earlier look. Most auditors will want every applicable clause or chapter covered within a defined cycle, so state the cycle length in the procedure and show coverage against it.

Then build in triggers. A labelling deviation that sent a mislabelled batch to a distributor is a reason to bring the packaging audit forward, whatever the plan said in January. Record the reason when you do. A programme that changes in response to evidence and explains each change shows the risk-based approach working, which is exactly what clause 8.2.4 asks for.

One practical warning: plan only what your auditors can deliver. An ambitious programme with half the audits overdue in October is a finding in itself. Fewer, deeper audits that happen on time are better than a full grid that slips.

Auditor independence when the quality team is small

"Auditors shall not audit their own work" is easy for a large site and awkward for a company of forty people where the quality manager wrote half the procedures. Independence here means distance from the work itself; the auditor can still be an employee. Chapter 9 says as much: designated competent people from the company, with external experts as a useful addition.

Three arrangements hold up well. Cross-auditing between departments works for most areas: a production supervisor audits the warehouse, a QC analyst audits complaint handling, a regulatory specialist audits document control. A sister site, or a peer company under a confidentiality agreement, can swap auditors with you. For the processes the quality team owns, typically CAPA, management review, document control and the audit process itself, contract an external auditor for a day or two a year.

Whoever audits needs evidence of competence: auditor training, a few audits shadowed or co-led, and knowledge of the area. Keep that in their training record and list the qualified auditors in the programme. When an inspector sees that the quality manager audited CAPA, the next question will be who audits the quality manager.

Writing an internal audit checklist that tests evidence

The most common weakness in internal audits is a checklist made of clause text turned into questions. "Is there a procedure for supplier evaluation?" gets a yes, and the audit learns nothing. Questions should force the auditor to go and look at records and at the work.

Write each checklist line as an evidence test. Compare these for supplier control:

Good evidence questions share a pattern. They sample real records from a defined period. They follow one thread across process boundaries, for example from a complaint to its investigation, to the CAPA, to the changed SOP, to the training on that SOP. And they include observation: watch a line clearance, a gowning sequence or a sample receipt, then compare what you saw with the procedure.

Treat the checklist as a guide the auditor can depart from when the evidence leads somewhere else, and leave space for the auditor to record what they sampled, by reference (batch numbers, document numbers, record IDs), so a reviewer can retrace the audit later. An audit report that says "records reviewed, satisfactory" with no sample references is very hard to defend.

Grading findings consistently

A grading scheme does two jobs: it sets how fast a finding must be fixed, and it makes trends readable across years. Many pharmaceutical manufacturers borrow the MHRA's three levels, defined on gov.uk under grading of inspection findings. A critical deficiency has produced, or significantly risks producing, a product harmful to patients. A major deficiency is non-critical but, for example, could produce product outside its marketing authorisation or indicates a major deviation from GMP; a combination of several "other" deficiencies can together amount to a major. "Other" covers departures from GMP that are neither.

Medical device manufacturers often use major and minor nonconformities plus observations, mirroring certification audits. Either works. What matters is that the definitions are written down, that each grade carries a response time (for example a plan within a set number of working days for majors and immediate escalation for criticals), and that auditors apply them the same way. Calibrate by having two auditors grade the same set of past findings once a year and discuss where they differ.

Write each finding as a statement of fact with its requirement and its evidence: what was required, what was seen, where. "SOP-PRD-014 rev 6 requires line clearance to be second-checked; batch records for lots 24-118 and 24-121 show no second signature" can be acted on. "Line clearance needs improvement" cannot.

Follow-up and closure that would satisfy an external auditor

ISO 13485 requires verification of the actions taken and reporting of that verification. Chapter 9 asks for statements on the actions subsequently taken. In practice, closure has three parts, and each needs its own record.

The response comes from the auditee: correction, root cause and corrective action, with owners and dates. Anything systemic goes into the CAPA process rather than being handled inside the audit record, so it gets the same root cause discipline and effectiveness check as any other CAPA.

Verification comes from the auditor or quality: was the action done as described? Look at the revised SOP, the retraining records, the changed setting on the machine.

Effectiveness is checked later: did the problem stop? Sample the same type of record a few months on. If the second-signature gap was the finding, pull a fresh set of batch records and count.

Closing a finding when the action is merely planned, or when the evidence is a single email saying "done", is one of the patterns external auditors probe first. Overdue findings should be visible to management review, with the reasons.

What the programme record should show

When a notified body auditor or an inspector opens your internal audit programme, they should be able to see, without a guided tour:

• The programme for the period with the rationale for each interval, and any changes made in-year with the reason.
• Coverage of every applicable clause, chapter or process across the defined cycle.
• For each audit: scope, criteria, auditor, the auditor's independence from the area, the plan, the sample references and the report.
• Findings with grade, requirement, evidence, owner, due date and status.
• Verification and effectiveness records for closed findings, and links to CAPAs.
• Audits performed against plan, overdue findings and trends, as reported to management review.

If the programme lives across spreadsheets, shared folders and email, assembling that view takes days, and gaps between the sources tend to surface during the inspection. Internal audit software that holds the programme, checklists, findings and closure in one system with an audit trail makes the record readable as it happens, which is the main reason to move off spreadsheets once the programme grows past a handful of audits a year.

The takeaway: plan by risk and write the reason down, keep auditors away from their own work, make every checklist line test a real record, grade findings the same way each time, and close only what you have verified. A programme built like that will usually stand up well when an inspector reads it.

If you want the programme, checklists, findings and closure in one place with an append-only audit trail, see how InnoQualis handles internal audits.