What is a GMP internal audit (self-inspection), and how often should one be done?

1What a self-inspection is.

In the EU, self-inspection is a legal duty. Article 14 of Directive (EU) 2017/1572 requires the manufacturer “to conduct repeated self-inspections as part of the pharmaceutical quality system” to monitor the implementation of GMP and propose any corrective or preventive actions, and to keep records of the self-inspections and of the actions taken.¹ Chapter 9 of the EU GMP Guide explains how: self-inspections monitor compliance with GMP and propose necessary corrective measures, and they cover personnel, premises, equipment, documentation, production, quality control, distribution, complaints and recalls, and self-inspection itself.² Chapter 1 makes a process for self-inspection or quality audit, “which regularly appraises the effectiveness and applicability” of the quality system, one of the things a pharmaceutical quality system should ensure.³

ICH Q7 section 2.4, for active substances, uses both names: “Internal Audits (Self Inspection)”.⁴ WHO distinguishes the two. Its self-inspection evaluates GMP compliance across production and QC; a quality audit examines all or part of the quality system “with the specific purpose of improving it”, is usually done by outside or independent specialists, and can supplement self-inspections.⁵

The US drug CGMP regulations are different. FDA says 21 CFR parts 210 and 211 “do not specifically address the requirement to conduct, or to keep records of, internal quality assurance audits”.⁶ FDA’s 2006 quality systems guidance still calls for audits at planned intervals as part of a quality system.⁷ Medical device makers have a binding requirement: the Quality Management System Regulation, in force since 2 February 2026, requires a quality management system that complies with ISO 13485:2016, and FDA’s Compliance Program 7382.850 for device inspections lists internal audits, ISO 13485 clause 8.2.4, as an element investigators can examine.⁸⁹

2How often to audit.

No GMP text fixes one interval for every area. What they ask for is a planned programme. EU GMP wants areas examined “at intervals following a pre-arranged programme”.² ICH Q7 wants regular internal audits “in accordance with an approved schedule”.⁴ WHO says the frequency “may depend on company requirements but should preferably be at least once a year”, and that the procedure should state it.⁵

FDA’s guidance explains how to set the schedule: audit procedures should ensure “the planned audit schedule takes into account the relative risks of the various quality system activities, the results of previous audits and corrective actions, and the need to audit the complete system”. It adds that trending of quality data can help focus internal audits.⁷ The regulators’ MDSAP audit approach for device makers describes internal audits as performed “at defined intervals and at sufficient frequency” to show whether the quality system complies with its procedures and is effective.¹⁰

Routine audits are not the only trigger. WHO says self-inspections may also be done on special occasions, such as product recalls, repeated rejections or an announced health authority inspection.⁵

3Who should audit, and what to cover.

EU GMP asks for self-inspections “in an independent and detailed way by designated competent person(s) from the company”, and says independent audits by external experts may also be useful.² WHO says management should appoint a team of experts in their fields who are familiar with GMP, from inside or outside the company.⁵ For device makers, the MDSAP approach expects internal audits to be done by appropriately trained people who have no direct responsibility for the matters audited.¹⁰

FDA’s guidance lists what audit procedures should define: how auditors are trained in gathering objective evidence, their responsibilities, the scope and method of the audit, how auditors are selected, and how the audit is conducted, from the plan and opening meeting through interviews to the closing meeting and report.⁷ WHO suggests written instructions, which may include GMP questionnaires, covering at least personnel, premises, maintenance, storage, equipment, production and in-process controls, QC, documentation, sanitation and hygiene, validation, calibration, recalls, complaints, labels control, and the results of previous self-inspections and their corrective steps.⁵

4Reports, corrective actions and management review.

EU GMP says “All self inspections should be recorded”, with reports containing all observations and, where applicable, proposals for corrective measures, and statements of the actions taken afterwards.² ICH Q7 asks for findings and corrective actions to be documented and brought to responsible management, and for agreed actions to be completed “in a timely and effective manner”.⁴ FDA’s guidance calls for the managers responsible for the audited areas to act on findings in good time and to make sure follow-up actions are completed, verified and recorded.⁷

Audits feed the rest of the quality system. ICH Q10 includes actions from audits in the CAPA system, and makes the results of audits and other assessments an input to management review of process performance and product quality.¹¹

5Whether inspectors can read your audit reports.

For drugs, FDA’s Compliance Policy Guide 130.300 says that during routine inspections FDA will not review or copy reports and records that result from audits of a firm’s written quality assurance programme. It may seek written certification that the audits were performed and documented and that required corrective action was taken, and it still reviews audit records in for-cause inspections of clinical sponsors or monitors, in litigation and under warrant.¹² FDA has also said a firm may discard a routine internal audit report once all corrections are verified, but the documentation of corrective actions, and investigations such as those under 21 CFR 211.192, must be kept.⁶

Device makers lost that protection on 2 February 2026. FDA’s QMSR FAQ says the regulation “gives the FDA the authority to inspect management review, quality audits, and supplier audit reports”, because the exceptions in the old § 820.180(c) were not kept.¹³

6How it runs in Seal.

In Seal’s audit management workflow, the programme records what is audited, when and by whom, with the reason for each choice and any deferral. Each engagement keeps its focus, window, lead and scope, and the assigned auditor’s role, qualification and independence are recorded with its approval. An evidence package references each source record at the version selected for it, and a finding links its assessment, the change it leads to and the verification as separate records, each with its own owner and state.

Neil can assemble the evidence for an audit request: it reads the question, the procedures and the linked records, drafts an indexed evidence brief and makes missing evidence explicit, and your audit owner checks scope and completeness before anything is shared. For inspections by authorities or clients, inspection readiness keeps each request, the package delivered and the observations that follow linked.