PROTOCOLREFERENCE OUTLINE

Internal Audit Program & Checklist

Risk-based self-inspection program with an annual schedule, area-by-area checklists, and finding-to-CAPA tracking. Maps to ICH Q10 self-inspection and 21 CFR 820.22.

What a template is not

A template is a document baseline to adapt inside your own quality system. SPEQ does not approve, validate, or take responsibility for what you issue from it, and using one is not evidence of compliance.

CHECKING ACCESS

Checking your Professional access…

REGULATIONS MAPPED
ICH Q1021 CFR Part 820
DOCUMENT TYPE
Protocol
LAST UPDATED
January 2025
PURPOSE

A risk-based self-inspection programme and the checklists that structure each audit — the schedule that decides what is audited and when, the evidence captured during each audit, and the route from finding to closure. An audit programme that always audits the same areas at the same depth is a calendar, not a risk-based programme, and the schedule is where that distinction is made visible.

What's Inside

Programme scope and objectives, including which sites, functions, and outsourced activities are covered
Risk-based annual schedule derived from area risk, prior findings, and change since the last audit
Auditor assignment and the independence rule that keeps an auditor out of their own area
Area checklists covering the GMP chapters and systems relevant to each area
Objective evidence capture — what was examined, sampled, or witnessed for each observation
Finding classification with defined criteria, and CAPA linkage with owners and due dates
Audit report and the management summary that carries the programme's results to leadership

How to Use It

1Build the schedule from area risk, prior findings, and what has changed — not from last year's schedule
2Assign auditors who are independent of the area, and record the independence check rather than assuming it
3Use the area checklist to structure the audit, but record what you examined rather than ticking what you asked
4Capture objective evidence for every observation; an unevidenced finding cannot survive challenge and should not be raised
5Classify findings against defined criteria, and route each to CAPA with a named owner and a due date
6Summarise for management review, including overdue actions and any area the schedule did not reach
DOCUMENT CONTENTS

The full section structure of this template — every section and sub-section, so you can use it as a baseline for your own site document.

Document Control
Document InformationApproval SignaturesRevision HistoryDistribution List
1Audit Program Scope and Objectives
2Risk-Based Annual Schedule
3Auditor Assignment and Independence
4Area Audit Checklist
5Findings Log and Classification
6CAPA Linkage and Tracking
7Audit Report
8Management Review Summary
REGULATORY CONTEXT

EU GMP Chapter 9 requires self-inspections to be conducted to monitor compliance and propose corrective measures, with records of the inspections and subsequent actions. For devices, 21 CFR 820.22 requires quality audits by individuals without direct responsibility for the matters audited, and 21 CFR 820.20 requires management to be made aware of the results. ICH Q10 places internal audit among the monitoring activities feeding management review. The risk-based scheduling model here is SPEQ synthesis; the classification criteria you adopt are your determination.

MAPPED STANDARDS
ICH Q1021 CFR Part 820
Browse the standards catalog →