Internal Audit and Self-Inspection
Self-inspection is the practice of a site or organisation auditing its own operations against GMP requirements and its own quality system, independent of external customer or regulatory audits. Done well, it is the mechanism that surfaces problems before an inspector or a customer does; done as a formality, it becomes a compliance-theatre exercise that finds nothing because it was never designed to.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 20 LINKSSelf-inspection is worth exactly as much as its independence: an audit performed by people who report to the area being audited will find the findings that area can comfortably afford.
06 · QUALITY MATURITY — INTERNAL AUDIT AND SELF-INSPECTION, REACTIVE TO ADAPTIVE
Self-inspection happens before an expected regulatory visit. Coverage follows whoever is available.
An annual programme covers every area on a rota, performed by trained auditors who nonetheless sit inside the areas they audit.
Auditor independence is structural, the programme is scheduled by risk rather than by rota, and findings are graded on a defined scale.
Audit output is analysed across areas for systemic patterns, and repeat findings trigger a different response from first-time ones.
The programme deliberately looks where nobody wants it to, and a serious internal finding is treated as the system working rather than as a failure to explain.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 3
Derived from the 3 standards SPEQ maps to this subject, across 3 regulatory bodies: ICH, PIC/S, ISO.
RECORDS & OBJECTIVE EVIDENCE
- The audit programme with its risk basis and the coverage achieved against plan
- Auditor qualification records and their reporting line relative to the audited area
- Audit reports with graded findings and the evidence each rests on
- Corrective action records, with effectiveness verification
- Trending of findings across areas and across cycles
COMMON INSPECTION FINDINGS
- Auditors auditing areas they work in or report into
- A programme that never covered an area, or covered it only after a regulatory visit was scheduled
- Findings closed on a promise to act rather than on evidence of action
- The same finding recurring across cycles with no escalation
- Audit reports that grade nothing, so severity is left to the reader
Purpose and Independence
Self-inspection exists to detect deficiencies in GMP implementation and to propose necessary corrective measures — the point is not to confirm that everything is fine, but to actively look for evidence that it is not. Auditor independence from the area being audited is the structural requirement that makes this credible: someone reviewing their own daily work is a self-check, not an audit.
ISO 19011 provides the generic methodology for auditing management systems — planning, competence of auditors, conducting the audit, and reporting — that most internal-audit programmes in regulated industries adopt or adapt, regardless of whether the audited system is a pharmaceutical, device, or laboratory quality system.
Programme Structure
A mature self-inspection programme runs on a documented schedule that covers all GMP-relevant areas over a defined cycle (commonly annual), scopes each audit against specific regulatory and procedural requirements, and produces a written report with findings, criticality, and required corrective actions.
Risk-based scheduling — auditing higher-risk or historically problematic areas more frequently — is widely accepted practice and is consistent with the quality-risk-management principles in ICH Q9(R1), though the base expectation of covering the whole facility over a defined cycle still applies.
Where the Requirement Comes From
In the EU GMP framework, self-inspection is an explicit, standing obligation: EU GMP Chapter 9 requires manufacturers to conduct self-inspections to monitor implementation of and compliance with GMP principles and to propose necessary corrective measures, and PIC/S PE 009 carries the same expectation for its participating authorities. The programme, its records, and the follow-up on findings are all inspectable.
US drug cGMP does not use the phrase “self-inspection,” but the same accountability lands through the quality unit’s responsibilities and the expectation of ongoing quality-system oversight, reinforced by ICH Q10’s management-review and continual-improvement expectations. For medical devices the obligation is explicit under the quality audit requirement of the device quality system. However it is codified, the regulator’s interest is the same: does the organisation genuinely look for its own problems, and act on what it finds?
From Finding to Closure
A self-inspection finding is only as good as what happens after it is written. Findings route into the same CAPA system that handles deviations and external audit findings — with root-cause analysis, corrective action, and an effectiveness check — rather than living in a standalone audit report that never reconnects to the quality system.
SPEQ interpretation: the single most reliable predictor of a self-inspection programme’s honesty is whether its finding rate over time resembles the finding rate of external audits and inspections at the same site. A self-inspection programme that consistently finds far less than customer audits or regulatory inspections do is not detecting less risk — it is looking less hard.
FREQUENTLY ASKED
How is self-inspection different from a supplier audit?
Self-inspection looks inward at the organisation’s own operations against GMP and its own procedures; a supplier audit looks outward at a third party’s operations to qualify or maintain qualification of that supplier. The methodology overlaps heavily, but the accountable relationship is different.
Who can perform a self-inspection?
Trained, competent personnel who are independent of the area being audited — internal auditors from a different department, a dedicated internal-audit function, or in some cases external consultants engaged specifically for independence, provided the arrangement still meets the sponsoring authority’s expectations.
Does a clean self-inspection report satisfy a regulatory inspection?
No. Self-inspection is evidence the organisation is actively monitoring itself, which regulators view favourably, but it does not substitute for or pre-clear a regulatory inspection, and inspectors routinely review the self-inspection programme’s own rigor as part of their assessment.