GMP audits that find what an inspector would find
Internal audits, self-inspection programmes and supplier or contract manufacturer audits, run at the depth the risk actually justifies rather than the depth the calendar allows.
Structured the way we scope the work: what is wrong, what it risks, what waiting costs, and what we would actually do.
- 01The problem
- 02What it puts at risk
- 03What waiting costs
- 04How we assess it
- 05What we do
What is actually going wrong
Audit programmes rarely fail loudly. They fail by deferral. An internal audit slips a quarter because the auditor is the same person handling the current deviation. A supplier re-qualification rolls forward because nothing has gone wrong with them yet. A self-inspection is performed by someone too close to the area to see it. Each decision is defensible on the day it is taken, and together they produce a programme that exists on paper and not in fact.
The second failure mode is subtler: audits that happen on schedule but find nothing. An audit that never produces an uncomfortable finding is not evidence of a healthy system. It is usually evidence of an auditor who is too familiar with the area, too junior to challenge it, or too aware of who will have to fix whatever they raise.
- Self-inspection is an explicit expectation under EU GMP, and a programme visibly behind schedule invites scrutiny of everything else.
- An unqualified or overdue supplier is a finding in its own right, and their deviation becomes your recall.
- Audits that never find anything remove your best early-warning system, so problems surface during an inspection instead.
- Client audits of your own site become harder each time, because nobody maintains one consistent account of how the site works.
The cost of deferring this
The cost of a deferred audit is not the audit. It is the months during which a problem that an audit would have caught continues, unmeasured, and gets more expensive to unwind. A supplier issue found at qualification is a sourcing conversation. The same issue found at goods-in is a deviation, and found after release it is a recall assessment.
Put a figure on itWe start by reading the last two years of your audit plan against what was actually executed, the findings raised, and how many were still open at the next audit. That comparison alone usually tells us whether the constraint is capacity, independence or authority, and those three problems have different fixes.
The work itself
- Internal and self-inspection auditsperformed independently, so findings are not filtered by proximity to the area.
- Supplier, API, excipient and CMO auditson site or remote, including quality agreement review and follow-up verification.
- Risk-based programme designthat tiers suppliers by what they can actually do to your product, so scrutiny goes where it matters and the rest stop consuming days they do not deserve.
- Auditor coachingwhere you would rather build the capability in-house than keep buying it.
The state you are left in
A programme that runs to schedule without heroics, findings that are ranked rather than listed, and a supplier file that would survive someone else reading it. The measure we care about is whether your next inspection finds anything your own audits had not already found first.
Fifteen minutes, no proposal attached
Bring the specific version of this problem that you have, and we will tell you what we would do about it, or that you do not need us.