The short answer
Rank every process and area by risk, then audit the highest risks most often. Score areas on product and patient impact, recent deviations and complaints, previous findings, the level of change and time since the last audit, and use the scores to set audit frequency.
"Our internal audits only find what we already know." It is a common complaint, and it usually means the programme is built on a calendar rather than on risk. When every area is audited once a year in the same way, the high-risk areas get too little attention and the low-risk ones get too much.
Start by listing every process, department and system in scope. Include the quality system processes, such as change control and CAPA, as well as physical areas such as manufacturing, packaging, laboratories and warehousing. Don't forget computerised systems and outsourced activities.
Use a simple scoring model, for example one to five on each factor:
Add the scores to get a risk rating for each area.
Use the rating to set how often each area is audited. A typical approach is quarterly or six-monthly for high-risk areas, annually for medium risk and every two to three years for low risk. Make sure every area in scope is covered over a defined cycle.
“A good internal audit programme finds the issues before the inspector does.”
Craig Jacobs, Founder and Chief Momentum Officer, Affirm8
Brief auditors to follow the data. Before each audit, review the area's deviations, complaints and open actions. Ask where things might be going wrong, then test it. Checking that a procedure exists is the start of an audit, not the end.
Nobody should audit their own work. In small teams, swap auditors across departments or sites, or bring in independent auditors for the highest-risk areas. Train auditors properly, and coach them to make audits constructive conversations rather than fault-finding exercises.
Review the risk ranking at least once a year and after any significant event, such as a major deviation, an inspection finding or a major change. Track programme adherence as a metric. A programme that slips tells an inspector that self-inspection is not a priority.
Suppose your packaging hall scores 5 for impact, 4 for performance after several labelling deviations, 3 for history, 4 for change following a new line, and 3 for time since its last audit. Its total of 19 out of 25 puts it firmly in the high-risk group, so it moves to a quarterly audit with a focus on line clearance and label control. Meanwhile, a stable warehouse area scoring 9 might move to a two-year cycle, freeing auditor time for where it matters. Scoring like this also gives you a clear, defensible rationale to show an inspector.
It depends on risk. High-risk areas are commonly audited every three to six months and low-risk areas less often, as long as the full scope is covered over a planned cycle.
No. Auditors should be independent of the area they audit. ISO 9001 clause 9.2 requires objectivity and impartiality in the audit process.
Affirm8 helps quality leaders across pharmaceuticals, supplements, medical devices and cosmetics design risk-based audit programmes, train internal auditors and provide independent audits when your team can't. Start with the free Always Audit-Ready Diagnostic at affirm8.co.uk.