Your Ongoing Audit Program — Internal, Mock Regulatory, and Supplier Audits
An effective audit program is a fundamental component of a functioning quality management system (QMS). For organisations operating in the therapeutic goods, biotechnology and laboratory sectors, audits provide a structured means of evaluating whether processes are controlled, procedures are followed, risks are managed and regulatory requirements are being met.
However, an audit program should do considerably more than prepare an organisation for its next regulatory inspection. It should provide continuous insight into the effectiveness of the quality system, identify weaknesses before they become significant compliance issues and verify that external suppliers and service providers are maintaining appropriate standards.
Three types of audits are particularly important: internal audits, mock regulatory inspections and supplier audits. Each serves a different purpose, examines different aspects of the organisation's operations and provides distinct evidence of control. When coordinated through an ongoing, risk-based audit program, they create a more comprehensive view of quality and compliance.
Why an Ongoing Audit Program Matters
A quality system can appear complete on paper while important processes are not being implemented consistently. Procedures may be approved, responsibilities assigned and training records maintained, yet operational practices may differ from documented requirements. Equipment records may be incomplete, deviations may not be investigated thoroughly, or supplier controls may not reflect the actual risks associated with outsourced activities.
Auditing provides a mechanism for testing whether the system works in practice.
An ongoing audit program allows management to evaluate the implementation and effectiveness of quality controls over time. It also provides evidence that the organisation is actively monitoring its compliance obligations rather than relying solely on external regulatory inspections to identify problems.
For GMP manufacturers, the audit program should support compliance with applicable Good Manufacturing Practice requirements. For testing laboratories, it should assess relevant technical and management system requirements, including those associated with ISO/IEC 17025 where applicable. Biotechnology companies operating across development, manufacturing and clinical activities may need to address several overlapping frameworks.
The program should be proportionate to the organisation's activities, complexity and risk profile. A small organisation may not require the same audit frequency or resources as a large manufacturer with multiple facilities and complex supply chains. Nevertheless, the principles remain consistent: audits should be planned, objective, documented and followed by effective corrective action.
Internal Audits: Evaluating Your Own Quality System
Internal audits are conducted by or on behalf of the organisation to determine whether its processes comply with established requirements and are operating effectively.
They provide an independent examination of the organisation's activities, although independence must be considered carefully. An auditor should not assess work for which they have direct responsibility where this would compromise objectivity. Smaller organisations may need to use suitably qualified personnel from another department or an external auditor to achieve appropriate independence.
An internal audit should not simply compare a procedure against a checklist. It should examine how the process operates, whether personnel understand their responsibilities, whether records provide sufficient evidence and whether controls achieve their intended outcomes.
For example, an audit of deviation management should examine more than whether a deviation procedure exists. It should assess how events are reported, classified, investigated, evaluated for impact and closed. The auditor should consider whether root causes are appropriately identified, whether CAPA is proportionate to the risk and whether effectiveness checks demonstrate that corrective actions have worked.
Similarly, an audit of training should examine whether personnel are qualified and competent for their assigned tasks. Training records alone may not demonstrate practical competence, particularly for critical manufacturing, laboratory or quality activities.
What Should Your Internal Audit Program Cover?
The audit schedule should cover the quality system as a whole, with individual audits addressing specific processes or operational areas.
Typical areas include:
Document and record control.
Personnel training and competency.
Deviation, incident and nonconformance management.
Corrective and preventive action.
Change control.
Risk management.
Supplier qualification and monitoring.
Equipment qualification, calibration and maintenance.
Facility and utility management.
Cleaning and contamination control.
Manufacturing and packaging operations.
Laboratory testing and analytical methods.
Validation and qualification.
Data integrity and computerised systems.
Batch documentation and product release.
Storage, distribution and traceability.
Management review and quality oversight.
Not every organisation will require an audit of every topic as a separate exercise. Some processes may be combined where this is practical and technically justified. Others may require more frequent or detailed assessment because of their criticality.
For example, a manufacturer with extensive outsourced testing may place particular emphasis on laboratory oversight and supplier controls. A biotechnology organisation operating a small-scale manufacturing process may prioritise contamination control, process validation, material traceability and batch documentation.
The audit schedule should reflect the organisation's actual operations rather than relying on a generic annual checklist.
Developing a Risk-Based Audit Schedule
An effective audit program is risk-based. This means audit frequency, scope and depth are determined according to the potential consequences of process failure and the available evidence about process performance.
Factors to consider include the criticality of the activity, its impact on product quality or patient safety, regulatory significance, process complexity, previous audit findings, deviation trends and the effectiveness of existing controls.
A process with repeated nonconformances or overdue CAPAs may require more frequent auditing. A recently introduced process may also warrant an early review to determine whether new controls have been implemented effectively.
Conversely, a stable process with a strong compliance history may be audited less frequently, provided the decision is justified and ongoing monitoring remains adequate.
Risk assessment should not be used to exclude important areas indefinitely. The overall program must still provide suitable coverage of the quality system and applicable requirements. A documented rationale for audit frequency and scope helps demonstrate that scheduling decisions are deliberate and proportionate.
The audit schedule should also be flexible. Significant changes to equipment, facilities, products, suppliers or processes may justify an additional audit outside the planned cycle. Serious deviations, adverse trends or regulatory concerns should similarly trigger consideration of targeted audits.
Mock Regulatory Audits: Testing Inspection Readiness
Internal audits assess the quality system, while mock regulatory audits are designed to evaluate how effectively the organisation can demonstrate compliance during an external inspection.
A mock inspection should simulate relevant aspects of a regulatory inspection as realistically as practicable. It should test the availability and accuracy of records, the ability of personnel to explain their activities and the organisation's capacity to respond to questions and requests for evidence.
The exercise may involve a review of the site quality system, facility operations, production records, laboratory controls, validation documentation, supplier oversight and other areas relevant to the regulatory scope.
A mock audit is particularly valuable because inspection readiness involves more than having documentation available. Personnel must be able to explain what they do, identify the procedures governing their work and demonstrate that activities have been performed correctly.
For example, an inspector may ask an operator to explain how a manufacturing deviation is reported. The operator should understand the reporting process and be able to describe the immediate actions required. A laboratory analyst may be asked to explain how an out-of-specification result is investigated. Quality personnel may need to demonstrate how a change was assessed, approved and implemented.
A mock inspection can reveal gaps in these practical capabilities that a conventional document review may not identify.
How to Conduct a Meaningful Mock Inspection
The exercise should be planned around the regulatory framework and activities relevant to the organisation. A GMP manufacturer should be assessed against applicable GMP requirements, while a laboratory may need an exercise based on its accreditation scope and relevant technical requirements.
The mock inspection team should have sufficient regulatory and technical knowledge to evaluate the activities being examined. Auditors should ask questions, follow records through connected processes and assess whether responses are supported by objective evidence.
The exercise should also test inspection management arrangements. These include the process for receiving inspectors, coordinating document requests, assigning subject matter experts, managing copies of records and communicating questions to relevant personnel.
Particular attention should be given to the consistency of information provided by different departments. Contradictory explanations, incomplete records or uncertainty about responsibilities can undermine confidence in the quality system.
Mock inspection findings should be documented and classified according to their significance. A critical weakness affecting product quality or patient safety requires a different response from a minor administrative issue. The organisation should develop CAPA plans, assign responsibilities and verify that actions have been effective.
Mock audits should not be treated as theatrical exercises designed to rehearse answers. Their purpose is to identify genuine weaknesses and improve the organisation's ability to demonstrate effective control.
Supplier Audits: Extending Quality Oversight Beyond Your Organisation
Manufacturers and laboratories depend on external suppliers for materials, components, equipment, calibration, maintenance, testing, transport, storage and specialist services.
These relationships can introduce significant quality risks. An organisation may have a well-controlled internal quality system but still experience problems because a supplier fails to meet agreed specifications, changes a process without notification or does not maintain appropriate records.
Supplier audits provide a mechanism for assessing the controls operated by external organisations. They are particularly important where a supplier provides a critical material or service that can directly affect product quality, data reliability or regulatory compliance.
The extent of supplier auditing should be determined through risk assessment. A supplier providing a critical starting material may require a detailed audit, while a supplier providing a low-risk general service may be adequately assessed through other qualification and monitoring activities.
Supplier audits may be conducted on site or remotely, depending on the risks, scope and practical circumstances. However, the audit method must provide sufficient evidence to evaluate the relevant controls. A remote document review may not be adequate where direct observation of operations, facilities or technical practices is necessary.
What Should a Supplier Audit Examine?
The audit scope should be tailored to the products or services supplied and the associated quality risks.
For a supplier of pharmaceutical starting materials, relevant areas may include quality management, manufacturing controls, specifications, testing, traceability, contamination prevention, change notification and deviation management.
For a contract testing laboratory, the audit may examine personnel competence, method validation or verification, equipment calibration, data integrity, sample handling, results review and management of nonconforming work.
For a calibration or maintenance provider, the organisation may need to assess technical competence, equipment traceability, procedures, personnel authorisation and the quality of records supplied after each service.
Supplier audits should also evaluate how the organisation manages changes and communicates problems. A supplier that performs well during initial qualification may become a significant risk if it changes manufacturing processes, relocates facilities or experiences repeated quality failures without appropriate notification.
The audit report should distinguish between deficiencies that require corrective action and observations that may represent opportunities for improvement. Significant findings should be addressed through documented CAPA, with effectiveness assessed according to the risk.
Connecting Audit Findings to CAPA and Risk Management
An audit has limited value if findings are recorded but not resolved effectively. The organisation must have a reliable process for evaluating findings, investigating underlying causes and implementing corrective actions.
CAPA should address the cause of the problem rather than merely correcting the immediate observation. For example, if several employees use obsolete procedures, replacing the documents may not be sufficient. The investigation should examine why obsolete versions remained accessible, whether document distribution controls are effective and whether personnel understand the current document approval process.
The level of investigation should be proportionate to the significance and recurrence of the issue. Not every minor observation requires an extensive root cause investigation, but significant or repeated failures should receive appropriate scrutiny.
Corrective actions should have clear owners, defined completion dates and objective evidence of implementation. Where effectiveness checks are required, the organisation should determine in advance what evidence will demonstrate that the problem has been resolved.
Audit trends should also feed into the organisation's broader quality risk management process. Repeated findings across different departments may indicate a systemic weakness, such as inadequate training, poor change control or insufficient management oversight.
Reviewing trends across internal, mock regulatory and supplier audits can reveal relationships that are not apparent when individual reports are considered in isolation.
Auditor Competence and Independence
The effectiveness of an audit program depends heavily on the competence of the auditors.
Auditors need to understand the applicable standards and regulatory requirements, but technical knowledge alone is not sufficient. They must also be able to plan audits, interview personnel, examine records, follow evidence, assess risk and communicate findings clearly.
Training should include audit principles, evidence gathering, objective reporting and the organisation's audit procedures. Practical experience under supervision can help develop the judgement needed to distinguish between isolated errors and systemic failures.
Technical audits may require specialist knowledge. For example, assessing a microbiology laboratory, a sterile manufacturing process or a complex computerised system requires an understanding of the relevant technical risks and controls.
Independence is equally important. Auditors must be able to report findings objectively without pressure to minimise issues or protect departmental performance. Management should support this independence and ensure that audit findings receive appropriate attention.
Measuring Whether the Audit Program Is Effective
An audit program should be evaluated periodically to determine whether it is achieving its objectives.
Useful indicators may include audit schedule completion, overdue audit actions, repeat findings, CAPA closure performance, effectiveness check results and the recurrence of significant nonconformances.
However, the number of audits completed is not a reliable measure of quality system effectiveness by itself. An organisation can complete every scheduled audit while failing to identify important weaknesses or implement meaningful improvements.
Management should consider the significance of findings and whether the audit program is detecting problems early. A reduction in repeat findings may indicate that CAPA is becoming more effective, while recurring observations across multiple audits may indicate that deeper systemic action is required.
The program should also be reviewed when the organisation changes its products, processes, facilities, suppliers or regulatory obligations. Audit resources must remain aligned with the organisation's current risk profile.
Building an Audit Program That Supports Continuous Compliance
Internal audits, mock regulatory inspections and supplier audits should operate as connected components of one coordinated assurance program.
Internal audits evaluate the effectiveness of the organisation's own processes. Mock inspections test its ability to demonstrate compliance under regulatory scrutiny. Supplier audits assess the quality controls of external organisations on which the business depends.
Together, they provide a more complete understanding of quality system performance and help management make informed decisions about compliance risks.
Quality Systems Now supports manufacturers, biotechnology organisations and testing laboratories in developing practical audit programs, conducting internal and mock regulatory audits, assessing suppliers and strengthening CAPA processes. The focus is on building internal capability so that organisations can maintain effective oversight rather than relying on occasional external reviews.
A mature audit program is not defined by the volume of reports it produces. Its value lies in the quality of the evidence it generates, the weaknesses it identifies and the improvements it drives. When audits are planned according to risk, performed by competent personnel and followed through to verified corrective action, they become an essential part of maintaining a reliable and sustainable quality system.
