PROTOCOLREFERENCE OUTLINE

Internal Audit Program & Checklist

Risk-based self-inspection program with an annual schedule, area-by-area checklists, and finding-to-CAPA tracking. Maps to ICH Q10 self-inspection and ISO 13485 clause 8.2.4 under FDA’s QMSR (formerly 21 CFR 820.22).

What a template is not

A template is a document baseline to adapt inside your own quality system. SPEQ does not approve, validate, or take responsibility for what you issue from it, and using one is not evidence of compliance.

CHECKING ACCESS

Checking your access…

HOW TO FILL THIS IN
How to Conduct an Internal Audit, step by step →
REGULATIONS MAPPED
ICH Q1021 CFR Part 820
DOCUMENT TYPE
Protocol
LAST UPDATED
January 2025
PURPOSE

A risk-based self-inspection programme and the checklists that structure each audit — the schedule that decides what is audited and when, the evidence captured during each audit, and the route from finding to closure. An audit programme that always audits the same areas at the same depth is a calendar, not a risk-based programme, and the schedule is where that distinction is made visible.

What's Inside

✓Programme scope and objectives, including which sites, functions, and outsourced activities are covered
✓Risk-based annual schedule derived from area risk, prior findings, and change since the last audit
✓Auditor assignment and the independence rule that keeps an auditor out of their own area
✓Area checklists covering the GMP chapters and systems relevant to each area
✓Objective evidence capture — what was examined, sampled, or witnessed for each observation
✓Finding classification with defined criteria, and CAPA linkage with owners and due dates
✓Audit report and the management summary that carries the programme's results to leadership

How to Use It

1Build the schedule from area risk, prior findings, and what has changed — not from last year's schedule
2Assign auditors who are independent of the area, and record the independence check rather than assuming it
3Use the area checklist to structure the audit, but record what you examined rather than ticking what you asked
4Capture objective evidence for every observation; an unevidenced finding cannot survive challenge and should not be raised
5Classify findings against defined criteria, and route each to CAPA with a named owner and a due date
6Summarise for management review, including overdue actions and any area the schedule did not reach
DOCUMENT CONTENTS

The full section structure of this template — every section and sub-section, so you can use it as a baseline for your own site document.

—Document Control
› Document Information› Approval Signatures› Revision History› Distribution List
1Audit Program Scope and Objectives
2Risk-Based Annual Schedule
3Auditor Assignment and Independence
4Area Audit Checklist
5Findings Log and Classification
6CAPA Linkage and Tracking
7Audit Report
8Management Review Summary
REGULATORY CONTEXT

EU GMP Chapter 9 requires self-inspections to be conducted to monitor compliance and propose corrective measures, with records of the inspections and subsequent actions. For devices, the QMSR (ISO 13485:2016 clause 8.2.4; formerly 21 CFR 820.22) requires internal audits by individuals without direct responsibility for the matters audited, and management review (ISO 13485 clause 5.6; formerly 21 CFR 820.20) takes the results as an input. ICH Q10 places internal audit among the monitoring activities feeding management review. The risk-based scheduling model here is SPEQ synthesis; the classification criteria you adopt are your determination.

MAPPED STANDARDS
ICH Q1021 CFR Part 820
Browse the standards catalog →

Where to next

All 122 SPEQ templates →Filter the library by document type, product area, and format.

WHERE NEXT

  1. FILL IT INHow to Conduct an Internal Audit →The procedure this template records, one step at a time.
  2. ALL TEMPLATESBrowse all 122 templates →

A free account keeps what you save, remembers where you are across devices, and can send you the weekly regulatory briefing. Create a free account