A Complete Step-by-Step Guide with Real-Life Examples
Internal audit is one of the most important responsibilities of the Pharmaceutical Quality Assurance (QA) department.
If internal audits are strong, inspections go smoothly.
If internal audits are weak, regulatory inspections will find problems.
In simple words:
Internal audit is a self-check system where QA audits its own departments to find gaps before regulators do.
This article explains everything about internal audit in pharma QA — from basic meaning to practical execution, so that students, working professionals, and inspectors’ expectations are all covered.
1. What is Internal Audit in Pharma QA?
An internal audit is a planned, systematic, and documented examination conducted by QA to verify whether:
- GMP systems are implemented correctly
- SOPs are followed as written
- Regulatory requirements are complied with
- Gaps are identified and corrected in time
Unlike external audits, internal audits are conducted by the company itself, not by regulators.
Simple definition:
Internal audit is a QA tool to evaluate compliance, identify weaknesses, and improve the pharmaceutical quality system.
2. Why is Internal Audit Mandatory in Pharmaceuticals
Internal audit is not optional. It is expected by:
- WHO GMP
- US FDA
- EU GMP
- Schedule M (India)
Why regulators care so much about internal audits:
- It shows management control
- It proves continuous improvement
- It prevents repeat GMP failures
- It identifies issues before inspection
- It ensures patient safety
👉 During inspections, one of the first documents inspectors ask for is:
Internal Audit Schedule + Reports + CAPA
Regulatory agencies expect companies to conduct regular internal audits as part of compliance with WHO GMP guidelines.
3. Objectives of Internal Audit
Internal audit is not done to blame people.
It is done to improve systems.
Main objectives:
- Verify GMP compliance
- Evaluate SOP implementation
- Identify deviations and risks
- Check documentation accuracy
- Ensure data integrity
- Improve the overall quality culture
A good internal audit answers this question:
“If an inspector comes tomorrow, are we ready?”
Similar expectations for internal audits are also defined under EU GMP audit requirements.
4. Types of Internal Audits in Pharma
Internal audits are not all the same. QA performs different types based on need.
1️⃣ System Audit
Audits overall systems such as:
- Deviation system
- Change control
- CAPA
- Training system
2️⃣ Department Audit
Audits specific departments:
- Production
- Warehouse
- QC Laboratory
- Engineering
- QA
3️⃣ Process Audit
Audits specific processes:
- Granulation
- Compression
- RM dispensing
- Cleaning process
4️⃣ Product / Batch Audit
- Review of selected batches
- Focus on BMR, BPR, deviations, IPC
5️⃣ Follow-up Audit
- Conducted to verify CAPA effectiveness
5. Internal Audit Frequency (How Often?)
There is no single fixed rule, but common industry practice is:
| Area | Frequency |
|---|---|
| Critical GMP Areas | Every 6 months |
| Non-critical Areas | Once a year |
| After Major Deviation | Immediate |
| Before Regulatory Inspection | Mandatory |
👉 High-risk areas are audited more frequently.
6. Who Conducts Internal Audit?
Auditor Requirements:
- Should be trained in GMP
- Should be independent of the area being audited
- Should understand process + documentation
- Should have QA authority
❌ A person should never audit their own work.
Example:
- Production staff cannot audit production
- QC analyst cannot audit their own lab activities
7. Internal Audit Team Structure
A typical pharma internal audit team includes:
- Lead Auditor (QA) – plans and controls audit
- Co-Auditor(s) – technical support
- Auditee – department being audited
QA always has final authority.
8. Internal Audit Planning (Very Important)
A strong audit starts before entering the area.
Step 1: Annual Audit Schedule
QA prepares an annual internal audit plan, covering:
- Departments
- Audit frequency
- Tentative timelines
Step 2: Audit Scope & Objective
Clearly define:
- What will be audited
- Which SOPs apply
- What standards will be checked
Step 3: Audit Checklist Preparation
The checklist is prepared based on:
- SOPs
- GMP guidelines
- Previous audit findings
9. Internal Audit Procedure – Step by Step
This is the heart of the process.
Step 1: Opening Meeting
- Introduce the audit team
- Explain the audit scope
- Confirm the availability of documents
- Create a cooperative environment
Step 2: Area Walkthrough
- Observe cleanliness
- Check status labels
- Look for GMP violations
- Verify segregation and flow
Step 3: Document Review
- SOPs
- Logbooks
- BMR / BPR
- Training records
- Calibration records
Step 4: Interview of Personnel
Auditors ask:
- “Which SOP do you follow?”
- “What do you do if deviation occurs?”
- “How do you correct mistakes?”
👉 This checks training effectiveness.
Step 5: Observation Recording
All findings are:
- Written clearly
- Supported by evidence
- Referenced to SOP/GMP clause
10. Classification of Audit Observations
Observations are classified to assess risk.
🔴 Critical Observation
- Direct impact on patient safety or data integrity
- Example: Data falsification, mix-up risk
🟠 Major Observation
- GMP system failure
- Example: SOP not followed
🟡 Minor Observation
- Documentation gaps
- Example: Incomplete entries
11. Closing Meeting
At the end of audit:
- Findings are discussed
- No arguments or blame
- Clarifications allowed
- Timeline for CAPA is agreed
👉 Surprises in the final report are a sign of poor auditing.
12. Internal Audit Report
The audit report must include:
- Audit date & area
- Auditors & auditees
- Observations with classification
- References (SOP/GMP)
- Conclusion
QA signs and controls the report.
All internal audit observations must be investigated and closed through a structured deviations and CAPA management in pharma system to prevent recurrence.
During inspections, inspectors review internal audit records to assess compliance with US FDA quality system requirements.
13. CAPA Management After Audit
Audit without CAPA is useless.
CAPA steps:
- Root cause analysis
- Corrective action
- Preventive action
- Target dates
- Responsible person
- Effectiveness check
QA tracks CAPA until proper closure.
If an audit finding requires modification of any SOP, format, or process, it must be implemented through the change control system in pharmaceutical QA.
14. Effectiveness Check (Most Missed Step)
QA must verify:
- Has the problem really stopped?
- Is SOP revised if required?
- Are people trained again?
Inspectors heavily focus on this step.
15. Common Internal Audit Mistakes (Real Life)
- Audits are done only on paper
- Same observations repeated every year
- No root cause analysis
- CAPA closed without evidence
- Friendly audits to “save departments.”
👉 These are red flags during inspections.
16. Benefits of Strong Internal Audits
- Fewer inspection observations
- Strong GMP culture
- Better inter-department coordination
- Early risk detection
- Management confidence
A plant with strong internal audits is inspection-ready every day.
17. Real-Life Example
During an internal audit, QA noticed:
- RM dispensing balance verification skipped
Corrective action:
- Immediate training
- SOP revision
- Additional checklist added
Result:
- No observation during the WHO inspection
This is the real power of internal audit.
18. Final Conclusion
Internal audit is not a formality.
It is a protective shield for pharmaceutical companies.
Strong internal audits = Smooth regulatory inspections = Patient safety
Every QA professional must respect, understand, and properly execute internal audits.
📌 FAQ (For SEO & Schema)
Q1. Is an internal audit mandatory in pharma?
Yes, it is required by all GMP guidelines.
Q2. Who conducts an internal audit in pharma?
Trained and independent QA personnel.
Q3. How often should internal audits be done?
At least once a year, more frequently for critical areas.
Q4. What happens after an internal audit?
CAPA is initiated, implemented, and effectiveness checked.