How to Conduct an Internal Audit
Run a self-inspection that finds problems before an inspector does.
What a how-to is not
A how-to is SPEQ’s practitioner method, not a procedure. It does not replace your own SOP, it is not a validated approach, and the judgement calls in it belong to your quality unit.
An internal audit (self-inspection) is how a quality system checks itself — objectively assessing whether processes meet requirements and actually work, so gaps are found and fixed before an external inspection. The value is in independence and honesty: an audit that only confirms everything is fine is theatre.
- 1
Plan the audit programme risk-based
Build the programme from risk rather than from a rotation, so that the areas with the most consequence and the weakest recent evidence are audited most often. A calendar-driven programme audits everything equally and therefore audits the important things too rarely; the programme should be able to explain why each area appears when it does.
- 2
Define scope and criteria, assign independent auditors
Define the scope and the criteria for each audit — which processes, against which requirements and procedures — and assign auditors who are independent of the work being audited. Independence is the mechanism, not a formality: an auditor examining an area they support will find what a colleague finds, which is not what an audit is for.
- 3
Prepare and audit against evidence
Prepare by reading the area’s own records first — deviations, changes, previous findings, trends — then audit against evidence rather than against description. The interview establishes what people believe happens; the records establish what happened, and the gap between the two is usually where the audit’s value is.
- 4
Classify and report findings
Classify findings by consequence with a defined scheme, and write each one so that it states the requirement, the evidence observed and the gap between them. A finding written as an instruction skips the argument and invites negotiation about the fix rather than agreement about the fact.
- 5
Drive CAPA and verify closure
Drive corrective action through the normal CAPA process rather than through an audit-specific side channel, and verify closure on evidence. Findings closed on the auditee’s assurance accumulate into the classic pattern where the same observation recurs in the next audit and is recorded as new.
- 6
Feed the results upward
Feed results upward to management review as a picture rather than a list: what the findings say collectively about the quality system, which areas are improving, and which findings recur. An audit programme that reports only counts and closure rates has withheld the one thing management review needs from it.
- !Auditors auditing their own area, so objectivity is compromised.
- !A rubber-stamp audit that finds nothing because it was designed to.
- !Findings recorded without objective evidence or severity.
- !No follow-through — findings raised but CAPA never verified.
How to Conduct an Internal Audit: frequently asked questions
Common questions on conduct an internal audit.
What is the difference between an internal audit and a self-inspection?
They are essentially the same concept — an organisation objectively evaluating its own compliance and effectiveness. GMP regulations use "self-inspection"; ISO and general quality practice use "internal audit". Both require independence from the area being assessed.
Can I audit my own department?
Not the parts you are responsible for. Auditor independence is fundamental — you cannot objectively assess your own work. Many organisations cross-train auditors from other functions or use a dedicated audit team for this reason.
How often should internal audits happen?
On a risk-based schedule that ensures the whole quality system is covered over a defined cycle, with higher-risk or previously-deficient areas audited more frequently. A documented audit programme, not a single annual sweep, is the expectation.
What makes an internal audit finding credible?
Objective evidence — specific records, observations, or gaps against a stated requirement — plus a clear severity classification. Findings tied to evidence drive real CAPA; vague findings get argued away.