How to Conduct a GMP Internal Audit: Checklist, Interviews, Evidence and Closing Meeting
A “strong” GMP internal audit can be recognised by one key element: it does not simply check whether documents exist, but demonstrates that processes are under control and that what happens on the shop floor is consistent with SOPs, GMP requirements and data integrity principles.
Here you will find a practical guide to conducting an audit as an inspector would — but with the objective of improving the system before inspectors arrive.
Content derived from the complete guide.
1) Before entering the department: prepare the audit, or you are wasting time
1.1 Define objective, criteria and boundaries
An audit without clear boundaries quickly becomes:
- too superficial;
- or unmanageable.
Example of a well-written scope
“GMP audit of the packaging department: line clearance, material status, reconciliations, line logbook, deviation handling.”
1.2 Build a “one-page” Audit Plan
It should include:
- objective;
- area/process;
- criteria: EU GMP, internal SOPs, applicable Annexes;
- audit team;
- agenda: opening meeting, tour, document review, interviews, closing meeting.
Template – One-page Audit Plan
| Audit title | Date | Area |
|---|---|---|
| Objective | Scope | Criteria |
| Audit team (Lead/Co) | Audited department | Key contacts |
| Agenda (timing) | Sample documents requested | PPE/logistics |
2) Checklist: an essential tool, but do not become its slave
A checklist helps you to:
- avoid forgetting critical points;
- standardise the approach;
- make audit coverage defensible.
However, an experienced auditor also applies the principle of follow the evidence:
- if you notice an anomaly → investigate further, even if it is not included in the checklist.
“Core” checklist, almost always applicable
- Training and qualification of operators
- GDP: records, corrections, timing of entries
- Status and identification: materials, equipment, areas
- Deviation / change / CAPA: existence, quality, timelines
- Cleaning and maintenance, with an evidence-based approach
- Data integrity, especially in QC/CSV
3) Opening meeting: 10 minutes that set the tone of the audit
A well-conducted opening meeting:
- reduces defensiveness;
- clarifies objectives;
- prevents later misunderstandings.
Practical script to use
- “The purpose is to verify compliance and system robustness.”
- “This is not a witch hunt: we are looking for process gaps, not someone to blame.”
- “We will work on two levels: observation in the department and document review.”
- “We will close with a summary and next steps: report and CAPA.”
4) On the shop floor: the “dual-track” approach that makes the audit credible
A serious GMP audit combines:
- Gemba / operational tour
- Document review
- Interviews
4.1 Operational tour, or Gemba: what to really look at
During the operational tour, observe actively:
- condition of premises: corners, “hidden” points, less frequented areas;
- equipment status: clean, dirty, in use, out of service;
- material and personnel flows: risks of mix-up or contamination;
- operator behaviour: gowning, hygiene, aseptic behaviour, attention to GDP;
- weak signals: damaged labels, containers without ID, logbooks with “time gaps”.
If you operate in a sterile environment, remember that Annex 1, 2022 revision, entered into application on 25 August 2023, with a specific time-based exception for one point indicated by the Commission.
This affects what inspectors expect today in terms of contamination control and operational discipline.
4.2 Document review: intelligent sampling
Do not try to “read everything”.
Perform targeted sampling on:
- recent batches;
- batches with deviations;
- post-change batches;
- batches linked to complaints or rework.
5) Interviews: questions that reveal real gaps
Questions that work: open and evidence-based
- “Show me where you find the SOP and which version is currently in force.”
- “What do you do if a result is out of limit?”
- “How do you manage an error in a batch record?”
- “Who verifies what, and when?”
Questions that do not work, because they suggest the answer
- “You always do it this way, right?”
- “You are compliant, correct?”
The most important rule: “trust but verify”
Every statement must be capable of becoming:
- a document;
- a record;
- observable evidence.
If the answer is only “I know” or “I did it”, but there is no evidence, in GMP this is a risk.
6) Evidence and notes: write as if you had to defend yourself in 12 months
During an inspection, or in the event of an internal escalation, the question is not:
“Was it clear verbally?”
The question is:
“Where is the written evidence? Is it specific? Is it reproducible?”
What you should always record
- date and time;
- who: role, not necessarily name;
- what you observed;
- which documents you reviewed: ID, revision, date;
- how many examples you sampled;
- how many examples were non-compliant.
7) Closing meeting: how to communicate without negotiating reality
The objective of the closing meeting is to:
- align on the facts;
- provide an initial prioritisation;
- define the next steps.
Recommended structure
- Thank you and summary of the scope covered
- List of findings: facts, not opinions
- Preliminary severity classification, if used
- Containment actions, if required
- Timelines: report and CAPA response
8) Mini-checklist ready to copy and customise
Personnel
- Is training on critical SOPs up to date?
- Is there evidence of signature and understanding?
- Do personnel have access to current SOPs in the area?
Documentation, GDP
- Are records complete and timely?
- Are corrections managed correctly?
- Are correction fluid, post-its or non-traceable corrections absent?
Process
- Is line clearance actually performed and documented?
- Is material status clear?
- Is segregation correct: quarantine, released, rejected?
Equipment
- Are logbooks up to date?
- Are calibrations and qualifications valid?
- Is equipment status clearly identified?
Quality System
- Do deviations show good-quality root cause analysis?
- Are CAPA defined, assigned and closed on time?
- Do change controls include adequate impact assessments and consistent approvals?
Do you want to turn this checklist into a complete system?
If you want to turn this checklist into a complete system — with examples of questions for specific departments, audit plan templates, report models and classification criteria “like inspectors use” — the complete guide was created for this purpose.
👉 Access the main guide available on GuideGxP.com: Get the complete guide on GMP Internal Audits
